←Back to Subject
Notes
Notes
Study material and explanations
Diagrams
Diagrams
Visualize concepts easily
Mnemonics
Mnemonics
Tricks to remember faster
One Night Prep
One Night Prep
Short and focused revision
Revision
Revision
Quick summary and key points
Important Questions
Important Questions
Practice most relevant questions
Notes

Brief Introduction to TCP/IP & Layer-Wise Network Security

Study material and explanations for Unit 3

Brief Introduction to TCP/IP and Network Defense

What is TCP/IP? (In Simple Words)

TCP/IP stands for Transmission Control Protocol / Internet Protocol.
It is the foundational set of communication rules (protocols) that powers the entire Internet. Whenever you open a website, watch YouTube, or send a WhatsApp message, your device uses TCP/IP to break your data into small packets, address them, route them across the world, and reassemble them at the destination.

Why Do We Study TCP/IP in Cyber Security?

When TCP/IP was originally designed in the 1970s (for ARPANET), it was built for a small group of trusted university researchers—security was NOT built into it by default!
To secure a network using Firewalls, VPNs, and SSL, you must first understand the 4 layers of TCP/IP and how hackers attack each layer.

1. The 4 Layers of the TCP/IP Protocol Suite

The TCP/IP model organizes networking tasks into 4 stacked layers:

The 4-Layer TCP/IP Architecture & Its Security Protocols
LAYER 4Application Layer
Protocols: HTTP, FTP, SMTP, DNS | Security: HTTPS, S-HTTP, PGP, S/MIME, SET
LAYER 3Transport Layer (Host-to-Host)
Protocols: TCP, UDP | Security: SSL (Secure Socket Layer), TLS
LAYER 2Internet Layer (Network Layer)
Protocols: IP, ICMP, ARP | Security: IPSec, VPNs, Packet Firewalls
LAYER 1Network Access Layer (Link Layer)
Protocols: Ethernet, Wi-Fi | Security: WPA2/WPA3, MAC Filtering

Layer 1: Network Access Layer (Physical + Data Link)

  • Role: Handles the physical transmission of raw bits over LAN cables (Ethernet) or wireless signals (Wi-Fi) between two directly connected devices using MAC Addresses (48-bit hardware addresses).

Layer 2: Internet Layer (Network Layer)

  • Role: Responsible for logical addressing (IP Addresses like 192.168.1.1) and Routing packets across different networks from the source computer to the destination computer.
  • Key Protocols:
    • IP (Internet Protocol): Addresses and routes packets (connectionless).
    • ICMP (Internet Control Message Protocol): Used by ping to report network errors.
    • ARP (Address Resolution Protocol): Maps an IP address to a physical MAC address.

Layer 3: Transport Layer

  • Role: Provides end-to-end communication between software applications using Port Numbers (e.g., Port 80 for HTTP, Port 443 for HTTPS).
  • Two Main Protocols:
    1. TCP (Transmission Control Protocol): Connection-oriented and reliable. Uses a 3-Way Handshake (SYN → SYN-ACK → ACK), guarantees delivery, and re-sends lost packets (used for Web, Email, File Transfer).
    2. UDP (User Datagram Protocol): Connectionless and fast, with no error recovery (used for live video streaming, online gaming, DNS).

Layer 4: Application Layer

  • Role: Directly interacts with the user’s software (web browsers, email apps).
  • Key Protocols: HTTP (Web browsing), FTP (File transfer), SMTP (Email sending), DNS (converts domain names like google.com into IP addresses).

2. Common Security Attacks on TCP/IP Layers

Because standard TCP/IP trusts whatever is written in a packet header, attackers exploit each layer:

TCP/IP Layer Common Cyber Attack How the Attack Works Defense Mechanism
Application Layer Phishing, SQL Injection, DNS Spoofing Redirecting users to fake websites or injecting malicious database commands HTTPS, S-HTTP, PGP, WAF (Web Application Firewall)
Transport Layer TCP SYN Flood Attack, Session Hijacking Attacker sends thousands of half-open SYN requests without completing the ACK, crashing the server SSL / TLS, Stateful Firewalls, SYN Cookies
Internet Layer IP Spoofing, Ping of Death (ICMP Flood) Attacker puts a fake Source IP address inside the IP packet header to hide identity IPSec, VPNs, Ingress Packet Filtering
Network Access Layer ARP Poisoning, MAC Spoofing, Wi-Fi Sniffing Attacker sends fake ARP replies on a local LAN/Wi-Fi to intercept traffic WPA3 Encryption, Dynamic ARP Inspection

3. Understanding the TCP 3-Way Handshake & SYN Flood Attack

In exams, explaining the TCP 3-Way Handshake shows how Transport Layer attacks work:

  1. Step 1 (SYN): Client sends a Synchronize packet to the Server: “Hello, I want to connect.”
  2. Step 2 (SYN-ACK): Server reserves memory and replies: “OK, I am ready. Confirm?”
  3. Step 3 (ACK): Client replies: “Confirmed!” — Connection is established!
  • How a TCP SYN Flood Attack Works:
    A hacker sends millions of SYN packets with fake IP addresses (Step 1), but never replies with the final ACK (Step 3)! The server’s memory fills up waiting for replies that never come, causing the server to freeze for real users.

💡 DAVV Exam Preparation Tips

5-Mark Question: “Give a brief introduction to TCP/IP and explain how security is implemented across its layers.”

  • Define TCP (reliable, connection-oriented transport) and IP (logical addressing and routing).
  • Draw the 4-Layer TCP/IP diagram and list the security protocols at each layer: IPSec/VPN at the Internet Layer, SSL/TLS at the Transport Layer, and S-HTTP/PGP/SET at the Application Layer.