Network layers, addressing, firewalls, wireless and devices

Follow data through network layers

Layering separates responsibilities so a failure can be located. In the OSI model, physical transmission sits below data-link framing, network addressing and routing, transport delivery, session coordination, presentation representation and application services. The TCP/IP model commonly groups these into link, internet, transport and application layers. The models are teaching abstractions; real protocols and products do not always fit perfectly into one box.

IPv4 uses 32-bit addresses and IPv6 uses 128-bit addresses. Addresses identify network interfaces or locations in a routing context, not a trustworthy human identity. A subnet separates address space; routing connects networks. TCP provides a connection-oriented transport with delivery mechanisms, while UDP provides datagrams without the same transport-level guarantees. Applications can build additional reliability on top of either.

Distinguish ports, encryption and access control

A port identifies a transport endpoint. A familiar port does not guarantee the application behind it is safe or even the expected service. DNS resolves names; TLS can protect an application connection when identity and certificate validation are correct; a VPN protects an approved path but does not make a compromised endpoint trustworthy. A firewall enforces configured traffic policy at its inspection level, while an intrusion-detection system alerts on observations and an intrusion-prevention system can block according to its design.

Packet filtering, stateful inspection and application-aware controls examine different context. Read source, destination, direction, protocol and purpose together. A rule allowing a service’s port is not the same as authorizing every application action. Encrypted content can limit inspection at devices that do not have approved decryption access.

Account for wireless and constrained devices

Wi-Fi and Bluetooth use radio and require appropriate authentication, encryption, configuration and device handling. A visible network name is not proof of a trusted access point. Avoid outdated protections and unmanaged sharing. Embedded, IoT and industrial systems may have limited update capability or physical safety consequences. Inventory them, assign owners, separate management paths and coordinate maintenance.

AI-based network detection can identify unusual patterns but can also produce false positives or miss new behavior. Review the evidence and escalation process. Do not treat an anomaly score as proof of a particular attacker or assume that device isolation is safe for every operational process.

Understand each OSI layer

The physical layer concerns the transmission medium and signaling. The data-link layer handles local frames and link addressing. The network layer handles logical addressing and routing across networks. The transport layer provides endpoints and transport behavior, such as TCP or UDP. The session layer concerns coordination of a conversation, the presentation layer concerns representation, and the application layer concerns services used by applications.

A switch commonly forwards local frames using link information; a router forwards between networks using network information. Modern products can inspect and enforce at several layers, so a product label alone does not identify every capability. The TCP/IP application grouping includes functions represented by several upper OSI layers. TLS, proxies and encapsulated protocols show why practical troubleshooting is more nuanced than assigning every technology to one exact teaching-model box.

Addresses, subnets and transport in a concrete example

In IPv4, a prefix such as /24 describes how many leading address bits identify the network portion in that context. A 192.0.2.0/24 documentation network contains 256 address values; conventional subnet use reserves particular values for network and broadcast purposes. That does not make the subnet a security boundary by itself. IPv6 uses longer addresses and different addressing behavior; do not assume IPv4 broadcast rules apply unchanged.

TCP establishes and manages a connection with mechanisms for ordered delivery and retransmission. UDP sends datagrams without the same transport-level connection and delivery behavior. DNS often uses UDP but also uses TCP where required, and modern application protocols may use other combinations. Blocking one transport without understanding the application can cause unexpected failures. NAT changes address representation; it is not a substitute for a firewall policy or application authorization.

Common services and port conventions

Port numbers are useful recognition aids, not proof of what is running. Common conventions include DNS on 53, HTTP on 80, HTTPS on 443, SSH on 22, SMTP on 25, NTP on 123, LDAP on 389 and SMB on 445. Services can run on different ports, and encryption, authentication or modern secure variants require their own configuration and protocol understanding.

For an entry-level investigation, ask which device initiated the communication, which service it expected, whether the path was permitted and what identity and application logs show. Do not conclude that traffic is safe because it uses 443 or malicious merely because it uses an uncommon port. A port-level rule cannot determine whether a customer is authorized to read another customer’s invoice.

Check your understanding

A firewall permits TCP 443. Does this prove that every request to the application is authorized?