13.1 Understand and Apply Fundamental Concepts of Networking
Key Takeaways
- The Open Systems Interconnection (OSI) model has seven layers; the TCP/IP model has four (Application, Transport, Internet, Link/Network Access). Map the symptom to a layer before you pick a control.
- ARP spoofing and IEEE 802.1X sit at the data-link layer; IP spoofing at the network layer; TCP SYN floods at the transport layer; DNS and HTTP abuse at the application layer.
- Campus Ethernet is almost always a star of stars. Peer-to-peer (P2P) on that star is a relationship change — every laptop becomes a server — not a new cable plant.
- Software-defined networking (SDN) and SD-WAN decouple the control plane from the data plane so a controller and automation program forwarding; they do not replace encryption or change management.
- Memorize the operations port catalog: 22/SSH, 23/Telnet, 80/HTTP, 443/HTTPS, 53/DNS, 25/SMTP, 389/LDAP, 636/LDAPS, 161/SNMP, 3389/RDP, 1812/RADIUS, 49/TACACS+, 123/NTP.
Understand and apply fundamental concepts of networking
Domain 6 of the ISC2 Systems Security Certified Practitioner (SSCP) exam — Network and Communications Security — is weighted at 16% under the outline effective 1 October 2025. Knowledge Area 6.1 is understand and apply fundamental concepts of networking. The outline names six piles: the Open Systems Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models; network topologies; network relationships (peer-to-peer and client-server); transmission media (wired and wireless); software-defined networking (SDN) including Software-Defined Wide Area Network (SD-WAN), network virtualization, and automation; and commonly used ports and protocols. This is not a CCNA switching lab. It is the vocabulary a security administrator uses when a scanner, a packet capture, or a ticket names a layer, a port, or a topology.
OSI and TCP/IP models
The OSI model is a seven-layer teaching map. The TCP/IP model is the four-layer stack that actually forwards internet traffic. SSCP items ask you to map a protocol, an attack, or a control onto a layer — not to recite a mnemonic.
| OSI layer | Name | Unit | TCP/IP mapping | Operations examples |
|---|---|---|---|---|
| 7 | Application | Data | Application | HTTP, DNS, SMTP, LDAP, SSH as the service the user wanted |
| 6 | Presentation | Data | Application | Encoding and compression; Transport Layer Security (TLS) is often taught here even though it wraps the application |
| 5 | Session | Data | Application | Session setup (Remote Procedure Call (RPC), NetBIOS); rarely a separate box in a capture |
| 4 | Transport | Segment (TCP) / datagram (UDP) | Transport | TCP, User Datagram Protocol (UDP), port numbers, SYN floods |
| 3 | Network | Packet | Internet | Internet Protocol (IP), Internet Control Message Protocol (ICMP), routers, IP spoofing |
| 2 | Data link | Frame | Link / Network Access | Ethernet, Media Access Control (MAC), switches, Address Resolution Protocol (ARP), IEEE 802.1X |
| 1 | Physical | Bits | Link / Network Access | Copper, fiber, radio, hubs, jamming, a tap in a closet |
TCP is connection-oriented, sequenced, and acknowledged — the transport under SSH, HTTPS, and Remote Desktop. UDP is connectionless — DNS queries, Network Time Protocol, SNMP traps, RADIUS. The transport you name tells you which spoofing and amplification stories are plausible. UDP plus a spoofable source is how amplification denial-of-service works; TCP SYN state is how a protocol flood fills a firewall table.
OSI layer mapping for attacks and controls
A standing SSCP trick is to offer a control from the wrong layer. Match the symptom to the layer first.
| Symptom | Layer | Why | Control that actually fits |
|---|---|---|---|
| Cable tap, hub, RF jamming | 1 Physical | Bits on a shared medium | Physical path protection, fiber instead of copper in hostile plant, Faraday/cage for sensitive rooms |
| ARP spoofing, MAC flooding, rogue switch | 2 Data link | Frames and MAC-to-IP bindings | Port security, Dynamic ARP Inspection, 802.1X, DHCP snooping |
| IP spoofing, ICMP floods, rogue router advertisements | 3 Network | Packets and routing | Router access control lists (ACLs), unicast reverse-path forwarding, anti-spoof filters |
| TCP SYN flood, UDP flood, port scan | 4 Transport | Flags, ports, connection state | Stateful firewall, SYN cookies, rate limits |
| Session hijack of an application session | 5–7 | Session tokens live with the app | TLS, secure cookies, re-authentication |
| DNS cache poisoning, HTTP credential theft, cleartext LDAP bind | 7 Application | The name, the page, the directory | DNSSEC, HTTPS, LDAPS, application firewalls |
IEEE 802.1X authenticates at the data-link edge even though the backend is RADIUS (Knowledge Area 6.3). A stateful firewall that tracks TCP flags is a layer-3/4 control. A web application firewall (WAF) is layer 7. If the stem is a SYN flood and the options include "enable 802.1X on the access port," that is a real control for a different problem.
Network topologies
Topology is how nodes are wired or associated — which is also how failures, sniffing, and SPAN ports behave.
| Topology | Shape | Failure behavior | Security note |
|---|---|---|---|
| Bus | Shared backbone (legacy coax, some industrial buses) | A backbone break splits or kills the segment | Anyone on the bus can see frames |
| Star | Endpoints to a central switch or access point | One link fail is local; the switch fail is a closet outage | The switch is the choke point for port security, SPAN, and 802.1X |
| Ring | Closed loop (token ring, some metro rings) | One break may survive if dual-ring; two breaks isolate | Predictable path; uncommon on the LAN you will operate |
| Mesh (full or partial) | Many-to-many | High path resilience | More paths to encrypt and to monitor; typical of SD-WAN overlays |
| Tree / hierarchical | Stars stacked as access, distribution, core | Core failure is campus-wide | Matches how you place firewalls and intrusion detection and prevention (IDPS) |
| Hybrid | Mix (hub-and-spoke WAN plus mesh backup) | Depends on the mix | Document the actual forwarding path, not the architecture slide |
Campus Ethernet is almost always a star of stars. The wide-area network may be hub-and-spoke, partial mesh, or an SD-WAN overlay that looks like a mesh even when the underlay is two inexpensive circuits. Topology questions on the SSCP are about blast radius: if the core switch dies, who is offline; if an attacker owns the access switch, whose frames they can span.
Network relationships: peer-to-peer and client-server
Client-server concentrates data and policy on a server — file share, directory, mail, web application. The client initiates; the server authenticates and authorizes. That is the default for corporate identity, logging, and backup. Compromise of the server is high impact, which is why you patch it, monitor it, and back it up.
Peer-to-peer (P2P) treats nodes as equals: each can request and serve. File-sharing overlays, some collaboration tools, and printer discovery are P2P-shaped. P2P is harder to inventory because every laptop is now a server, and easier to abuse for data exfiltration and worm spread. A policy that says "no unauthorized P2P" is an access-control and data-loss problem, not a new topology drawing.
Scenario. Finance still maps \\FILESERVER01\payroll. That is client-server on a star. A help-desk technician enables a personal LAN-sync tool that advertises folders to the subnet. That is unauthorized P2P on the same star. The switch did not fail; the relationship model did. Domain 6.4 will ask you to segment that; 6.1 asks you to name it.
Transmission media types
| Media | Typical use | Strengths | Operations risk |
|---|---|---|---|
| Unshielded twisted pair (UTP) copper (Cat5e / Cat6 / Cat6a) | Access switch to desktop, 1–10 Gb/s | Cheap, easy to punch down | Tap-able in a closet; electromagnetic interference; roughly 100 m copper limit |
| Shielded copper / coaxial | Legacy, some industrial, cable plant | Shielding | Still copper: tap and ground loops |
| Multimode fiber (MMF) | In-building backbone | No EMI; harder to tap casually | Distance and modal limits; the path still needs physical protection |
| Single-mode fiber (SMF) | Campus and metro | Long haul | A splice in an unmonitored manhole is a confidentiality failure |
| Wireless (Wi-Fi, cellular, microwave, Bluetooth, near-field) | Access and WAN backup | Mobility | Radio is a shared medium: eavesdrop, jam, rogue access point — Domain 6.6 owns the protocols |
Wired versus wireless is a broadcast-domain decision. Copper in a locked closet is not encrypted. Fiber is not magically confidential. Wireless without current Wi-Fi Protected Access and Extensible Authentication Protocol is a data-link problem you will treat in 6.6; here, remember that media choice changes who can sit on the path.
Software-defined networking, SD-WAN, virtualization, and automation
Software-defined networking (SDN) separates the control plane (what the path should be) from the data plane (forward this frame or packet). A controller — or a cluster of controllers — programs forwarding devices through an application programming interface (API). Network virtualization builds overlay networks (Virtual Extensible LAN (VXLAN), Geneve, vendor overlays) on a shared underlay so tenants and applications get isolated segments without recabling. Automation is how you push those intents: templates, APIs, and orchestration so a change is a ticketed playbook, not a unique SSH session on forty routers.
SD-WAN applies the same split to the wide-area network. An overlay (often IPsec or a vendor tunnel) chooses among underlay transports — MPLS, broadband, LTE — per application. The security win is centralized policy: guest software-as-a-service can take a local internet breakout while payroll prefixes stay on the encrypted overlay. The security miss is an SD-WAN box that split-tunnels payroll to the coffee-shop internet because someone tagged the application "general web." SDN does not excuse you from Domain 1.6 change management; a controller push is still a change.
Scenario. You inherit twelve branches. Each has a unique ACL "that has always worked." SDN/SD-WAN is how you replace tribal configs with a controller policy: identity-aware overlay, consistent encryption, and an audit trail of who pushed the change. It is not a license to skip a security impact analysis.
Commonly used ports and protocols
Memorize the well-known ports the outline expects you to recognize in a scan, a firewall rule, or a change ticket. Domain 5 already used several as cryptography wrappers; Domain 6 asks whether you know what is listening.
| Port | Protocol | Transport | What it is | Operations default |
|---|---|---|---|---|
| 22 | Secure Shell (SSH) | TCP | Encrypted remote administration and SFTP | Prefer keys; this replaces Telnet |
| 23 | Telnet | TCP | Cleartext remote administration | A finding, not a management plan |
| 80 | Hypertext Transfer Protocol (HTTP) | TCP | Web in the clear | Redirect to 443; never for credentials or card data |
| 443 | HTTP over TLS (HTTPS) | TCP | Web with TLS | Default for web, many TLS VPNs, and APIs |
| 53 | Domain Name System (DNS) | UDP and TCP | Name resolution | UDP for typical queries; TCP for zone transfers and large answers |
| 25 | Simple Mail Transfer Protocol (SMTP) | TCP | Mail between mail transfer agents | Require TLS; do not leave an open relay |
| 389 | Lightweight Directory Access Protocol (LDAP) | TCP | Directory binds | Passwords in the clear unless StartTLS |
| 636 | LDAP over TLS (LDAPS) | TCP | Directory with TLS | Preferred for binds |
| 161 | Simple Network Management Protocol (SNMP) | UDP | Device management (162 is traps) | SNMPv1/v2c community strings are passwords in the clear; use SNMPv3 |
| 3389 | Remote Desktop Protocol (RDP) | TCP | Windows remote desktop | Never expose to the internet; jump host and multi-factor authentication |
| 1812 | Remote Authentication Dial-In User Service (RADIUS) | UDP | Authentication (1813 is accounting; some gear still uses 1645/1646) | 802.1X and VPN AAA |
| 49 | Terminal Access Controller Access-Control System Plus (TACACS+) | TCP | Device-administration AAA | Network-device command authorization |
| 123 | Network Time Protocol (NTP) | UDP | Time synchronization | Authenticate if you can; bad time breaks Kerberos, logs, and certificates |
If a stem shows "TCP/23 open on the core switch," the answer is not "the OSI model has seven layers." Replace Telnet with SSH on 22. If "UDP/161 with public/private community strings," upgrade to SNMPv3. If "TCP/389 binds from the wireless controller," move to 636 or StartTLS. Port 3389 on the public internet is an incident waiting for a password-spray; put RDP behind a jump host.
When you sit the item, ask: which layer is the symptom on, which topology concentrates the failure, is the relationship client-server or P2P, what media can an attacker sit on, is the path programmed by SDN or by a snowflake ACL, and which port is actually open? Knowledge Area 6.2 hangs attacks on this map; 6.3 hangs 802.1X, RADIUS, and TACACS+ on the same ports.
Section takeaways
Map every protocol and attack to an OSI/TCP-IP layer before you pick a control. Treat campus Ethernet as a star whose switch is the enforcement point, name unauthorized P2P as a relationship problem, and treat SDN/SD-WAN as a control-plane split plus automation — not as a substitute for encryption. Know the port table cold, especially 22 versus 23, 389 versus 636, 1812 versus 49.
A security operations analyst sees a TCP SYN flood aimed at port 443 on the customer portal. At which OSI layer is the flood operating, and which TCP/IP layer does that map to?
Twelve branch offices will move from per-router access-control lists to a Software-Defined Wide Area Network overlay. What does software-defined networking actually change for SSCP Knowledge Area 6.1?
A scanner reports TCP 23 on a core switch, UDP 161 with a default community string on the same switch, and TCP 389 on a domain controller used for wireless binds. What is the operations meaning of those ports?