// networking basics — module 02

Module 2 — Networking I: The Models, Addressing, and the Stack

Soren Brumbach · 2026-07-19 · 12 min read

Thesis: Networking is the single most important pre-split skill, because every attack and every defense moves over the network. We spend four modules on it. This one gives you the mental models — how a packet is actually built, and how machines are addressed and grouped — so that every later "which layer is this?" question has an answer.

Prerequisite: Module 1 — Build Your Lab (Virtualization & Safe Practice). You'll run these commands inside your lab. This module also builds directly on Linux Foundations Module 8 — where that module taught you the tools, this one teaches the theory beneath them.

2.1 Why models exist

"Get data from a program on this machine to a program on that machine, correctly, over unreliable wires shared by millions of others" is an impossibly complex job to solve all at once. So networking is built as a stack of layers, each with exactly one responsibility, each talking only to the layers directly above and below it.

The payoff of layering is substitution: because each layer only cares about its own job, you can swap Wi-Fi for Ethernet at the bottom without changing anything about how the web works at the top. The layer above doesn't know or care what's beneath it. This is the same "abstraction" idea you met with the kernel — hide a mess behind a clean interface — applied to networks.

Two models describe these layers. One is for teaching; one is what actually runs.

2.2 The OSI model — the 7-layer teaching model

The OSI model breaks networking into seven layers. Nobody implements it exactly, but everyone talks in its numbers — "that's a Layer 2 attack," "a Layer 7 firewall" — so you must know it cold. From the bottom up:

Physical — the actual signals: cables, radio waves, voltages, light in fiber. Raw bits on a medium.
Data Link — delivery across one local link (one Ethernet segment, one Wi-Fi network). Uses MAC addresses. Its unit is the frame. Switches live here.
Network — delivery between different networks, across the world. Uses IP addresses. Its unit is the packet. Routers live here.
Transport — end-to-end delivery to the right program on the destination, with (for TCP) reliability. Uses ports. Its unit is the segment (TCP) or datagram (UDP). This is Module 3's whole subject.
Session — setting up, maintaining, and tearing down conversations between applications.
Presentation — data formatting, character encoding, compression, encryption.
Application — what the user's program actually speaks: HTTP, DNS, SSH, SMTP.

A memory hook, bottom to top: Please Do Not Throw Sausage Pizza Away.

The three layers you'll spend almost all your time on are 2 (MAC), 3 (IP), and 4 (ports). Layers 5–7 are often collapsed together in practice, which is exactly what the next model does.

2.3 The TCP/IP model — the 4-layer model the internet actually uses

The real internet runs on a simpler, older model with four layers. It maps cleanly onto OSI:

   OSI (7)                      TCP/IP (4)         Unit          Address
 ┌────────────────┐
 │ 7 Application  │
 │ 6 Presentation │──────────►  Application        data          (names, e.g. host)
 │ 5 Session      │
 ├────────────────┤
 │ 4 Transport    │──────────►  Transport          segment       port
 ├────────────────┤
 │ 3 Network      │──────────►  Internet           packet        IP address
 ├────────────────┤
 │ 2 Data Link    │──────────►  Link               frame         MAC address
 │ 1 Physical     │
 └────────────────┘

Use OSI when you want to name a layer precisely (it has the numbers everyone cites); use TCP/IP when you want to reason about what's really happening. They're two rulers measuring the same thing.

2.4 Encapsulation — the core "aha"

Here is the single most important idea in this module. As your data travels down the stack on the sending machine, each layer wraps it in that layer's own header (and sometimes a trailer). As it arrives and travels up the stack on the receiving machine, each layer unwraps and removes its own header before handing the rest upward.

Concretely, sending an HTTP request:

 Application:  [ HTTP request ]                                  ← your data
 Transport:    [ TCP header | HTTP request ]                     ← add ports, seq #
 Internet:     [ IP header | TCP header | HTTP request ]         ← add src/dst IP
 Link:         [ Eth header | IP header | TCP header | HTTP request | Eth trailer ]
                                                                  ← add src/dst MAC
 Physical:      0101110100101...                                 ← bits on the wire

A packet is an onion. Each layer added its own wrapper on the way out; each layer peels its own wrapper on the way in, and never looks inside the deeper layers — the router reads the IP header and ignores the TCP header; the destination's TCP reads the TCP header and ignores the IP header. This is exactly what you will see with your own eyes in Wireshark in Module 5: the "packet details" pane is these nested headers, drawn as an expandable tree. When that clicks, networking stops being abstract.

The names are worth locking in: the same chunk of data is called a segment at Layer 4, a packet at Layer 3, and a frame at Layer 2. People say "packet" loosely for all of them, but the precise words tell you which header you're talking about.

2.5 IP addressing (IPv4)

An IP address is Layer 3's identifier — the address that gets a packet across the internet to the right machine (a port, Layer 4, then gets it to the right program). IPv4 addresses are 32 bits, written as four decimal numbers 0–255 separated by dots — a "dotted quad":

   192   .   168   .    1    .   10
 11000000.10101000.00000001.00001010     ← the same address in binary (32 bits)

Each of the four numbers ("octets") is 8 bits, so its range is 0–255. There are about 4.3 billion IPv4 addresses total, which — famously — is not enough for the modern world. Two mechanisms cope with that shortage: private addressing and NAT (below).

Some ranges are special and you must recognize them on sight:

Private ranges — reserved for internal networks, never routed on the public internet. Any home or office LAN uses these:
- 10.0.0.0 – 10.255.255.255 (a /8)
- 172.16.0.0 – 172.31.255.255 (a /12)
- 192.168.0.0 – 192.168.255.255 (a /16)
Loopback — 127.0.0.0/8, almost always 127.0.0.1, meaning "this very machine." A packet to loopback never leaves the host.
Public addresses — everything else; globally unique and routable.

IPv6 exists because IPv4 ran out. It uses 128-bit addresses written in hex (e.g. 2001:db8::1), giving a practically infinite supply. You don't need it in depth yet — just know it's the same job as IPv4 (Layer 3 addressing) with vastly more addresses, and that you'll occasionally see its long colon-separated form.

2.6 Subnetting and CIDR — carving a network into pieces

A single IP address secretly has two parts: a network part (which network you're on) and a host part (which specific machine on that network). A subnet mask is what draws the line between them.

The mask is 32 bits: a run of 1s marking the network part, then 0s marking the host part. CIDR notation writes how many leading 1s there are with a slash:

 Address:  192.168.1.10
 Mask /24: 255.255.255.0   =  11111111.11111111.11111111.00000000
                                └──── network (24 bits) ────┘└host (8)┘

   Network part: 192.168.1     Host part: .10

/24 means the first 24 bits are the network, leaving 8 bits (256 combinations) for hosts. From any network you can compute three key values:

Network address — host part all 0s. Names the network itself (192.168.1.0 for a /24). Not assignable to a machine.
Broadcast address — host part all 1s. "Everyone on this network" (192.168.1.255 for a /24). Not assignable to a machine.
Usable host range — everything in between. For a /24: .1 through .254, which is 2^8 − 2 = 254 usable hosts (subtract the network and broadcast addresses).

The general rule: with h host bits, you get 2^h − 2 usable hosts. A /24 has 8 host bits → 254 hosts. A /26 has 6 host bits (32 − 26) → 2^6 − 2 = 62 hosts. A smaller number after the slash = a bigger network; a larger number = a smaller network.

Why any of this matters for security: subnets are how networks are segmented, and segmentation is a core defense. "This subnet is the servers, that subnet is the workstations, and a firewall sits between them" is a Layer 3 boundary you'll design (blue) or try to cross (red). Reading a target's subnet also tells an attacker how many hosts could be on it — a /24 is 254 possible neighbors to scan.

2.7 MAC addresses and ARP — the Layer 2 / Layer 3 bridge

Down at Layer 2, machines on the same local network don't find each other by IP — they use MAC addresses: 48-bit hardware identifiers burned into (or assigned to) each network card, written as six hex pairs like 00:1A:2B:3C:4D:5E. A MAC address is local and flat; it has no structure that says "which network," because at Layer 2 there's only one network — the local link.

This creates a gap. Your machine knows the IP it wants to reach on the local network, but to actually put a frame on the wire it needs that machine's MAC. ARP (Address Resolution Protocol) fills the gap. It is Layer 2's question:

  Host A broadcasts:  "Who has 192.168.1.10? Tell 192.168.1.5"
  Host B replies:     "192.168.1.10 is at 00:1A:2B:3C:4D:5E"
  Host A caches that mapping and sends its frame to that MAC.

ARP is literally the bridge between Layer 3 (IP) and Layer 2 (MAC). The cached answers live in your ARP table (ip neigh on Linux, arp -a on Windows). ARP is also a classic attack surface: because a host believes any ARP reply, an attacker on the same network can lie — "I have that IP" — and quietly become a man-in-the-middle. That's ARP spoofing, a Layer 2 attack you'll understand fully once you can see ARP in Wireshark (Module 5).

2.8 Routing basics — getting off the local network

ARP only works within one local network. To reach a machine anywhere else, your packet must be handed to a router — a device that connects networks and forwards packets between them.

The specific router your machine sends "everything not local" to is the default gateway — your network's exit door. The logic your machine runs for every packet:

  Is the destination IP on my own subnet (same network part)?
    ├─ Yes → ARP for its MAC, deliver directly on the local link.
    └─ No  → send it to the default gateway; let the router figure out the next hop.

From there, routers pass the packet hop by hop — each router looks at the destination IP, consults its routing table, and forwards to the next router closer to the destination, until it arrives. No single router knows the whole path; each just knows the next best step. (You'll watch this hop-by-hop journey with traceroute in Module 4.)

Your machine's own routing table (ip route on Linux, route print on Windows) shows this logic: which subnets are "directly connected" (local) and where the default route (0.0.0.0/0 — "everything else") points.

2.9 NAT — why the whole office shares one public IP

Recall §2.5: private addresses can't be routed on the public internet, and there aren't enough public addresses for every device. NAT (Network Address Translation) resolves both at once. Your router holds one public IP. When a device with a private IP (192.168.1.10) reaches out to the internet, the router rewrites the packet's source address to its own public IP, remembers the mapping, and rewrites the replies back on the way in.

  You:      192.168.1.10  →  [router does NAT]  →  203.0.113.7 (public)  →  website
  Reply:    website  →  203.0.113.7  →  [router reverses NAT]  →  192.168.1.10

The consequence you must internalize: the IP a website sees is your router's public IP, not your device's private one. An entire household or office appears to the outside world as a single address. This is also exactly the mechanism behind the NAT networking mode you used in Module 1 — the hypervisor is being a little NAT router for your VM.

2.10 → Red/Blue

Every layer is a battleground, and knowing which layer a thing lives on tells you which tools and which attacks apply. Attackers pick a layer: ARP spoofing at Layer 2, IP spoofing and scanning at Layer 3, application attacks at Layer 7. Defenders segment and monitor at those same layers: VLANs and port security at Layer 2, firewalls and subnet segmentation at Layer 3/4, application firewalls at Layer 7. Encapsulation (§2.4) is literally the thing you'll be reading, layer by nested layer, in Module 5's packet captures. "Is this a Layer 2 problem or a Layer 3 problem?" is a triage question you'll ask for the rest of your career.

Lab 2

Run these inside your lab VM (and on your host for comparison). They make every abstract term above concrete.

Find your own address, mask, and MAC. Run ip addr (Linux) or ipconfig /all (Windows). Identify your IP address, your subnet mask in CIDR (the /24 etc.), and your MAC address. Which private range are you in?
Find your exit door. Run ip route (Linux) or route print (Windows). Find the default gateway — the router "everything else" is sent to. Note which networks are listed as directly connected.
Watch ARP bridge the layers. Inspect your ARP table with ip neigh (Linux) or arp -a (Windows). Pick one entry and state the IP → MAC mapping it holds. ping a machine on your local network you haven't talked to, then re-check the table — a new mapping should appear.
Subnet by hand — /24. For 192.168.1.0/24, write down: the network address, the broadcast address, and the number of usable hosts. State the usable range.
Subnet by hand — /26. Now do 192.168.1.0/26. How many host bits? How many usable hosts? What are the network and broadcast addresses of that first /26 block? (Answer: 6 host bits, 62 hosts, network .0, broadcast .63.) Explain to yourself why a bigger CIDR number means a smaller network.
See encapsulation named. Draw the five nested headers of §2.4 from memory for an HTTP request, labeling which address each layer adds (MAC, IP, port). You'll match this drawing against a real packet in Module 5.

✅ Mastery Check — do not proceed until true

Answer out loud, without notes:

Why do layered network models exist at all? What does layering buy you?
Name the OSI layers in order, and say which address or unit lives at layers 2, 3, and 4.
Explain encapsulation. What is added at each layer on the way out, and what happens on the way in? Why is "a packet is an onion" accurate?
What are the three private IPv4 ranges, and what does loopback mean?
Given 10.0.0.0/24: network address, broadcast address, number of usable hosts. Then do the same for a /26.
What problem does ARP solve, and why does that make it the bridge between Layer 2 and Layer 3?
What is the default gateway, and what decision does your machine make to decide whether to use it?
After NAT, what source IP does a public website see when you visit it, and why?

And perform cold:

On any machine, report its IP, CIDR mask, MAC, and default gateway using two commands, and match one ARP-table entry to a live host.

When all of that is effortless: Module 3 — Networking II: Transport, Ports, and the Three-Way Handshake