1. The OSI Model
Launch OSI VisualizerThe OSI (Open Systems Interconnection) model is a 7-layer framework used to describe how data moves from one device to another.
Mnemonic Tool
Remember it from bottom (L1) to top (L7): Please Do Not Throw Sausage Pizza Away.
2. Data Encapsulation
As data travels down the layers, each layer adds a "Header" (like an envelope). This process is called Encapsulation. When the receiver gets it, they De-encapsulate it.
^--- The "Frame" that actually hits the wire ---^
🛡️ Deep Packet Inspection (DPI)
Basic firewalls only look at L3 (IP) and L4 (Ports). Modern security tools use DPI to look inside the L7 "Data Payload" to find malware.
3. TCP vs UDP
The Transport Layer (L4) decides how to send data. It's a choice between Reliability and Speed.
| Feature | TCP (Transmission Control) | UDP (User Datagram) |
|---|---|---|
| Connection | Connection-Oriented | Connectionless |
| Speed | Slower (Reliability overhead) | Faster (Fire and forget) |
| Reliability | Guaranteed Delivery | No Guarantee |
| Examples | HTTP, SSH, FTP | DNS, VoIP, Gaming |
4. The 3-Way Handshake
Launch Handshake SimBefore TCP sends any real data, it performs a 3-step greeting to ensure both sides are ready.
2. Server -> [SYN/ACK] -> Client (Yes, Synchronize & Acknowledge)
3. Client -> [ACK] -> Server (Understood, Acknowledged)
💀 SYN Flood Attack
Hackers send thousands of [SYN] packets but never send the final [ACK]. This leaves the server's memory full of "half-open" connections, causing a Denial of Service (DoS).
5. Layer-Based Attacks
Hackers target specific layers depending on their goal. Knowing where an attack lives helps you defend against it.
| OSI Layer | Attack Examples |
|---|---|
| Layer 7 (App) | SQL Injection, Cross-Site Scripting (XSS) |
| Layer 4 (Transport) | Port Scanning, SYN Flooding |
| Layer 3 (Network) | IP Spoofing, ICMP Smurfing |
| Layer 2 (Data Link) | ARP Spoofing, MAC Flooding |
🧪 Mini Exercise
Run a "Stealth Scan" using Nmap: sudo nmap -sS [target-ip].
This performs a "Half-Open" handshake (SYN, then RST) to see if a port is open without completing the connection.
📌 Module Recap
- OSI Model has 7 layers; TCP/IP has 4 layers.
- Encapsulation wraps data in headers as it moves down the stack.
- TCP is reliable (Handshake); UDP is fast (No Handshake).
- Security issues exist at every layer of the stack.