Section 1: Networks through a security lens
TCP, UDP and the handshake, briefly
You do not need to be a network engineer for security work, but a few protocol details explain how firewalls, scans and many attacks work.
TCP: connections with a handshake
TCP sets up a connection with a three way handshake:
- The client sends SYN: "I want to connect."
- The server replies SYN-ACK: "OK, I am listening."
- The client sends ACK: "Connection established."
After that, data flows in both directions with sequence numbers, acknowledgements and retransmission of lost packets. The connection ends with FIN or is aborted with RST.
Security relevance:
- A port scan often sends SYN packets and looks at the reply. SYN-ACK means open, RST means closed, no reply means filtered.
- Stateful firewalls track connections: once an outgoing connection is established, they allow the replies automatically.
- SYN floods try to exhaust a server's resources with half open connections. Modern kernels defend with SYN cookies.
UDP: no connection
UDP sends individual datagrams with no handshake and no delivery guarantee. DNS, NTP, many VPNs such as WireGuard, and QUIC, the transport behind HTTP/3, use UDP.
Security relevance:
- Without a handshake, the source address of a UDP packet is easy to fake, which enables reflection and amplification attacks: an attacker sends small spoofed requests to open servers, which send much larger responses to the victim.
- Scanning UDP is slower and less certain, because a closed port may simply not answer.
Addresses and private ranges
IPv4 reserves private ranges that are not routed on the internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Networks using them reach the internet through NAT. NAT hides internal addresses but is not a security control on its own; it is a side effect of address translation, and outbound connections or misconfigured port forwarding still expose hosts.
IPv6
IPv6 hosts often have globally routable addresses without NAT. If your network has IPv6 enabled but your firewall rules only cover IPv4, services may be exposed without anyone noticing. Always write and test rules for both.
Watch it yourself
sudo tcpdump -n -i any 'tcp port 443 and tcp[tcpflags] & (tcp-syn) != 0'Open a website and watch the SYN packets go out. Seeing the protocol makes it real.