Learn how to secure networks, applications, and systems against digital threats.
Networks carry almost everything a computer does, so understanding how data moves across them is essential for security. Attackers exploit weak protocols, and defenders inspect traffic to find those attacks. This lesson introduces the core networking concepts — IP and MAC addresses, packets, TCP and UDP, ports, ARP, and DNS — and explains where each becomes a security concern. The focus is practical: you will learn what a packet looks like, how a connection is established, and how common attacks such as ARP spoofing and DNS poisoning work, so you can recognize them in traffic.
If you cannot read traffic, you cannot see what an attacker is doing. Network security is the ability to understand, and therefore monitor and defend, the data flowing between systems.
| TCP | UDP | |
|---|---|---|
| Connection | Connection-oriented (handshake) | Connectionless |
| Reliability | Reliable, ordered | Best-effort |
| Use | Web, email, file transfer | DNS, streaming, voice |
A port identifies a service on a host (for example, 80 for HTTP, 443 for HTTPS). TCP establishes a connection with a three-way handshake.
ARP maps IP addresses to MAC addresses on a local network. DNS maps human-readable names to IP addresses. Both are trusted protocols with no built-in verification, which makes them attack targets.
In ARP spoofing, an attacker answers ARP requests with their own MAC address, redirecting traffic. In DNS poisoning, an attacker injects a false DNS answer so a name resolves to the wrong IP. Both are man-in-the-middle techniques.
Tools such as Wireshark capture and display packets. Analysts look for anomalies: unexpected hosts, plaintext credentials, unusual ports, or repeated failed connections.
| Protocol | Security concern |
|---|---|
| ARP | Spoofing / man-in-the-middle |
| DNS | Poisoning / domain hijacking |
| HTTP | Plaintext — use HTTPS |
| FTP/Telnet | Plaintext credentials |
| SSH/HTTPS | Encrypted — preferred |
Trace what happens when a browser loads a page over HTTPS.
(each layer has a security role)