Networking is easier to reason about when you separate the problem into layers: application behavior, transport sessions, IP addressing and routing, local-link delivery, and the physical or virtual medium.
These notes condense Beej’s Guide to Network Concepts into a smaller reference set for security engineering, cloud networking, and troubleshooting.
Reading Order
- Networking Foundations and Layering
- Sockets, HTTP, and Application Protocols
- IP Addressing, Subnetting, and Routing
- TCP, UDP, and Packet Analysis
- Ethernet, ARP, and Link-Layer Delivery
- DNS, DHCP, and NAT
- Network Security and Troubleshooting
Big Picture
flowchart TD User["User or application"] App["Application protocol<br/>HTTP, DNS, SSH, SMTP"] Transport["Transport<br/>TCP or UDP ports"] Network["Internet layer<br/>IPv4 or IPv6 routing"] Link["Link layer<br/>Ethernet, Wi-Fi, ARP, MAC addresses"] Medium["Physical or virtual medium<br/>copper, fiber, radio, hypervisor network"] User --> App --> Transport --> Network --> Link --> Medium Medium --> Link --> Network --> Transport --> App --> User
Security Engineer’s Mental Model
- A service is reachable only when addressing, routing, local-link delivery, and filtering all allow the path.
- A port identifies a process-facing endpoint; an IP address identifies a host or interface-facing endpoint.
- DNS names are not routing. DNS answers provide addresses that still need reachable network paths.
- NAT changes packet addresses or ports, but it does not replace routing or firewall policy.
- Packet captures, flow logs, DNS logs, and application logs answer different parts of the same question.
- Most incidents become easier when you can explain the packet path in both directions.
Source Coverage
These notes combine the guide’s chapters on clients and servers, protocols, sockets, HTTP, number representation, IP, subnetting, ports, byte order, packet inspection, routing, Ethernet, ARP, DNS, NAT, DHCP, firewalls, port scanning, and input validation.