Learn how data moves between computers: layers, IP addresses and subnets, ports, DNS, DHCP, HTTPS, and the tools to troubleshoot it.

Networking Fundamentals

## Why it matters

When a web page will not load, the cause could be a loose cable, a Wi-Fi password, a wrong IP address, a blocked port, a DNS failure, an expired certificate or a bug in the application. Network models give you a map so you can check these one layer at a time instead of guessing. They also give engineers a shared vocabulary: "it's a layer 3 problem" means "look at IP addressing and routing", and everyone on the call knows where to start.

## The core idea: layers

Sending data across a network is split into layers. Each layer does one job and relies on the layer below it. When you send something, every layer wraps the data in its own **header** (this is called **encapsulation**). The receiver unwraps the headers in reverse order.

## The OSI model (7 layers)

The OSI model is a teaching and troubleshooting model. Real networks do not implement it exactly, but its layer numbers are used everywhere.

| # | Layer | Job | Examples |
|---|---|---|---|
| 7 | Application | Services programs use | HTTP, DNS, SMTP, SSH |
| 6 | Presentation | Data format, encryption | TLS (often placed here), JPEG, UTF-8 |
| 5 | Session | Opening and closing conversations | session setup in some protocols |
| 4 | Transport | Delivery between programs | TCP, UDP (ports) |
| 3 | Network | Delivery between networks | IP, ICMP, routers |
| 2 | Data link | Delivery on one local network | Ethernet, Wi-Fi (802.11), MAC addresses, switches |
| 1 | Physical | Bits on a medium | cables, radio signals, fibre |

A common memory aid, from layer 1 up: "Please Do Not Throw Sausage Pizza Away".

## The TCP/IP model (4 layers)

The TCP/IP model describes how the internet is actually built. It merges some OSI layers:

| TCP/IP layer | Matches OSI layers | Examples |
|---|---|---|
| Application | 5, 6, 7 | HTTP, DNS, TLS, SSH |
| Transport | 4 | TCP, UDP |
| Internet | 3 | IP, ICMP |
| Link (network access) | 1, 2 | Ethernet, Wi-Fi |

You will hear both. People usually use OSI numbers ("layer 2 switch", "layer 7 load balancer") while describing the TCP/IP stack.

## Worked example: loading a web page

You type `https://example.com` and press Enter. Following the data down the stack on your laptop:

1. **Application:** the browser builds an HTTP request (`GET /`). TLS encrypts it.
2. **Transport:** TCP adds a header with the source port (a random high number such as 52814) and destination port 443.
3. **Internet:** IP adds a header with your IP address and the server's IP address.
4. **Link:** Wi-Fi adds a frame header with your laptop's MAC address and your router's MAC address, then sends it as radio signals.

Your router strips the link header, reads the IP header, decides where to send the packet next, and wraps it in a new link header for the next hop. Routers work at layer 3, so the IP addresses stay the same end to end (apart from NAT, covered later), while MAC addresses change at every hop.

## Units at each layer

- Layer 2: a **frame**
- Layer 3: a **packet**
- Layer 4: a **segment** (TCP) or **datagram** (UDP)

## Using the model to troubleshoot

Work bottom-up when the problem is "nothing works", and top-down when only one application fails:

- Layer 1: is the cable plugged in, is Wi-Fi connected?
- Layer 2: does the device see the local network (link lights, connected SSID)?
- Layer 3: does it have a valid IP address, can it `ping` the router?
- Layer 4: is the port open, is a firewall blocking it?
- Layer 7: does the name resolve in DNS, does the application return an error?

## Common mistakes

- **Treating the models as competing standards.** They describe the same thing at different levels of detail.
- **Putting DNS at the transport layer** because it uses UDP port 53. DNS is an application-layer protocol that *uses* the transport layer.
- **Forgetting that a switch and a router work at different layers.** A switch forwards frames by MAC address inside one network; a router forwards packets by IP address between networks.
- **Memorising without mapping.** The value is in placing a real protocol or fault on a layer, not reciting the list.

## Quick recap

- OSI has 7 layers; TCP/IP has 4 and is what the internet actually runs.
- Each layer adds a header on the way down and removes it on the way up.
- Ethernet and Wi-Fi are layer 2, IP is layer 3, TCP and UDP are layer 4, HTTP and DNS are layer 7.
- Use the layers as a checklist when something breaks.


Map common protocols such as Ethernet, IP, TCP, DNS and HTTP to the layers of the OSI and TCP/IP models.

The OSI and TCP/IP models

Understanding the OSI Model - N10-008 CompTIA Network+ : 1.1

TCP/IP Model Explained | Cisco CCNA 200-301

## Why it matters

Every device on an IP network needs an address, and every address belongs to a **subnet**. Cloud engineers carve virtual networks into subnets, security engineers write firewall rules for address ranges, and database administrators decide which networks may connect to a database. If you cannot read `10.0.4.0/22`, you cannot do any of these safely.

## An IPv4 address is 32 bits

`192.168.1.10` is four **octets** (8 bits each) written in decimal, separated by dots. Each octet ranges from 0 to 255. Underneath, it is one 32-bit number:

```text
192      .168      .1        .10
11000000 .10101000 .00000001 .00001010
```

An address has two parts: the **network part** (which network the device is on) and the **host part** (which device on that network).

## The subnet mask and CIDR prefix

The **subnet mask** says where the network part ends. Its 1-bits cover the network part:

```text
255.255.255.0  =  11111111.11111111.11111111.00000000
```

That mask has 24 one-bits, so it is written as the **CIDR prefix** `/24`. `192.168.1.10/24` means "the first 24 bits are the network".

| Prefix | Mask | Addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /24 | 255.255.255.0 | 256 | 254 |
| /26 | 255.255.255.192 | 64 | 62 |
| /30 | 255.255.255.252 | 4 | 2 |

Each extra prefix bit halves the subnet.

## Network, broadcast and usable addresses

In each subnet, the first address (host bits all 0) is the **network address** and the last (host bits all 1) is the **broadcast address**. Neither is given to a device, so usable hosts = 2^(32 - prefix) - 2. (Cloud providers often reserve a few more; AWS reserves five per subnet.)

## Worked example 1: a /24

`192.168.1.10/24`: the network is `192.168.1.0`, the broadcast is `192.168.1.255`, and hosts run from `192.168.1.1` to `192.168.1.254`. A device at `192.168.2.5` is on a different network, so traffic to it must go through a router (your **default gateway**).

## Worked example 2: a /26

`192.168.1.130/26`. A /26 mask is `255.255.255.192`, so the last octet's block size is 256 - 192 = 64. The subnets start at .0, .64, .128 and .192. 130 falls in the block starting at 128, so:

- network: `192.168.1.128`
- broadcast: `192.168.1.191` (the next block starts at .192)
- usable: `192.168.1.129` to `192.168.1.190`, 62 hosts

The same answer comes from a bitwise AND of the address and the mask, which is what computers do and what you will code in the activity:

```text
130 = 10000010
192 = 11000000
AND = 10000000 = 128
```

## Worked example 3: same subnet or not?

A server is at `10.0.4.20/22` and a database at `10.0.7.200`. Are they on the same subnet? A /22 has 22 network bits, so the third octet's block size is 256 - 252 = 4: blocks start at 4, 8, 12 and so on. 4 and 7 both fall in the block 4 to 7, so the subnet is `10.0.4.0` to `10.0.7.255` and they can talk directly without a router. A host at `10.0.8.1` would be in the next block and would need the gateway.

## Private and special ranges

RFC 1918 reserves three ranges for private networks. They are not routed on the public internet:

- `10.0.0.0/8`
- `172.16.0.0/12` (172.16.0.0 to 172.31.255.255)
- `192.168.0.0/16`

Also worth knowing: `127.0.0.1` is **loopback** (this computer), and `169.254.x.x` is a self-assigned address that usually means DHCP failed.

## IPv6 in one paragraph

IPv4 has only about 4.3 billion addresses, so IPv6 uses 128 bits, written in hexadecimal groups such as `2001:db8::1` (`::` replaces a run of zero groups). Subnets are usually `/64`. The same network/host idea applies.

## Common mistakes

- **Giving a device the network or broadcast address.**
- **Overlapping subnets.** `10.0.0.0/16` already contains `10.0.5.0/24`; using both in one design causes routing confusion. This matters when you connect two cloud networks.
- **Thinking /24 always means the last octet.** A /22 such as `10.0.4.0/22` spans `10.0.4.0` to `10.0.7.255`.
- **Mixing up mask and prefix.** `255.255.255.192` is /26, not /192.

## Quick recap

- IPv4 = 32 bits, four octets; the prefix says how many bits are network.
- Network address = address AND mask; usable hosts = 2^(32 - prefix) - 2.
- Know the RFC 1918 private ranges, loopback and 169.254.

## Try it

Open the **Do** tab and finish a small JavaScript subnet calculator.


Read an IPv4 address, subnet mask and CIDR prefix, and work out a subnet's network address and host count.

IP addresses and subnets

Basics of IP Addressing

Subnetting Explained: Networking Basics

## Why it matters

An IP address gets data to the right computer, but a server runs many programs at once: a web server, an SSH server, maybe a database. **Ports** get data to the right program. Choosing between **TCP** and **UDP** decides whether that data arrives reliably or quickly. Firewall rules, cloud security groups and "connection refused" errors are all about ports.

## Ports

A port is a 16-bit number (0 to 65535) at the transport layer. A connection is identified by five things: protocol, source IP, source port, destination IP, destination port.

- **Well-known ports (0 to 1023)** are used by standard services.
- **Registered ports (1024 to 49151)** are used by many applications, such as databases.
- **Ephemeral ports (usually 49152 to 65535)** are picked at random by your computer for the client side of a connection.

Ports worth memorising:

| Port | Protocol | Service |
|---|---|---|
| 22 | TCP | SSH |
| 25 | TCP | SMTP (mail between servers) |
| 53 | UDP and TCP | DNS |
| 67/68 | UDP | DHCP |
| 80 | TCP | HTTP |
| 123 | UDP | NTP (time) |
| 443 | TCP (and UDP for HTTP/3) | HTTPS |
| 3306 | TCP | MySQL |
| 5432 | TCP | PostgreSQL |
| 3389 | TCP | Remote Desktop |

IANA keeps the official registry, but a port number is only a convention: you can run a web server on 8080. What matters is that client and server agree.

## TCP: reliable, ordered, connection-based

TCP sets up a connection before sending data, with a **three-way handshake**:

1. Client sends **SYN** ("I want to connect, my sequence number starts at x").
2. Server replies **SYN-ACK**.
3. Client sends **ACK**. The connection is open.

After that, TCP numbers every byte, the receiver acknowledges what it got, and anything lost is resent. TCP also puts data back in order and slows down when the network is congested (**flow and congestion control**). The cost is extra round trips and waiting: one lost packet holds up everything behind it.

Use TCP when every byte must arrive: web pages, file transfers, email, SSH, database queries.

## UDP: fast, simple, connectionless

UDP just sends **datagrams**. There is no handshake, no acknowledgement, no resending and no ordering. Its header is 8 bytes versus TCP's 20 or more.

UDP beats TCP when:

- **Late data is useless.** In a video call or online game, a resent packet from half a second ago is worse than a small glitch.
- **Messages are tiny.** A DNS question fits in one packet; a handshake would triple the time.
- **The application handles reliability itself.** QUIC, the protocol under HTTP/3, runs on UDP and adds its own faster reliability.

## Worked example: two connections at once

You open two browser tabs to the same site. Your laptop (192.168.1.20) creates two TCP connections:

```text
192.168.1.20:52814  ->  93.184.215.14:443
192.168.1.20:52815  ->  93.184.215.14:443
```

The server tells them apart by the source port. Meanwhile your laptop asks DNS a question over UDP:

```text
192.168.1.20:61002  ->  192.168.1.1:53   (UDP)
```

## Listening, open and closed

A server program **listens** on a port. If you connect to a port where nothing listens, the computer answers TCP with a reset and you see "connection refused". If a firewall silently drops the traffic, you see a **timeout** instead. That difference is a useful clue: refused means you reached the machine; timeout often means a firewall or routing problem.

## Common mistakes

- **Opening more ports than needed.** Every listening port is attack surface. Expose only what a service needs, and only to the networks that need it (for example, a database port only to the app servers, never to the whole internet).
- **Assuming DNS is UDP only.** Large responses and zone transfers use TCP 53.
- **Calling UDP "unreliable" as if it were broken.** It is simply best-effort; for real-time traffic that is the right trade.
- **Confusing the port with the protocol.** HTTPS is usually on 443, but a port number does not guarantee what is running there.

## Quick recap

- Ports (0 to 65535) deliver data to the right program; clients use random ephemeral ports.
- TCP: handshake, acknowledgements, retransmission, ordering. Reliable but slower.
- UDP: no handshake or retransmission. Fast and light, good for DNS, voice, video and games.
- "Refused" vs "timed out" tells you whether you reached the host.


Explain what ports are, how TCP gives reliable delivery, and when UDP is the better choice.

Ports, TCP, and UDP

Network Ports Explained

TCP vs UDP Comparison

The layer models, IPv4 addresses and subnets, and how ports, TCP and UDP deliver data to the right program.