Networking for Cyber Security

Outcome: Use OSI and TCP/IP models, encapsulation, headers, and protocol states to reason about network behavior and evidence.

Case: A browser connection fails. Different teams blame DNS, routing, TLS, and the application, but no one can separate the layers or state the evidence that would confirm each hypothesis.

Tools: Layered evidence trace, Encapsulation worksheet, Protocol dependency map

Outcome: Explain Ethernet switching, MAC learning, broadcast domains, VLANs, trunks, loops, and Layer 2 segmentation risks.

Case: A new VLAN rollout creates intermittent access, excessive broadcasts, and unexpected reachability between laboratory and administration devices.

Tools: MAC-table analysis, VLAN and trunk plan, Layer 2 evidence worksheet

Outcome: Plan IPv4 and IPv6 addressing, interpret prefixes, calculate subnets, and identify address-related exposure or misconfiguration.

Case: A merger combines overlapping IPv4 space, an incomplete IPv6 rollout, inconsistent prefix documentation, and security rules that cover only part of the actual address plan.

Tools: Prefix and subnet worksheet, Dual-stack address plan, Address-exposure matrix

Outcome: Interpret routing tables, path selection, gateways, NAT/PAT, asymmetry, and path-enforcement points during troubleshooting.

Case: A cloud application works from one branch but not another. The failing path includes a default route, overlapping prefixes, PAT, an asymmetric return, and a firewall state table.

Tools: Routing-table analysis, End-to-end path map, NAT and state worksheet

Outcome: Analyze ARP, ICMP, DHCP, DNS, and NTP dependencies and distinguish normal service flow from suspicious or failed behavior.

Case: Users report intermittent access after a network change. Evidence includes duplicate address warnings, expired leases, delayed DNS answers, blocked ICMP errors, and time-skewed logs.

Tools: Service-sequence map, DNS and DHCP trace worksheet, Dependency-failure lab

Outcome: Reconstruct TCP and UDP conversations using states, flags, ports, sockets, timing, and encrypted-session metadata.

Case: Monitoring reports thousands of short connections, UDP timeouts, retransmissions, and unexpected high ports. Analysts must distinguish normal application behavior from failure or suspicious activity.

Tools: TCP state worksheet, IANA registry lab, Session reconstruction exercise

Outcome: Evaluate wireless, VPN, remote-access, and cloud-network designs using authentication, encryption, segmentation, and least privilege.

Case: Remote staff use Wi-Fi, full and split-tunnel VPNs, cloud applications, and administrator access. Overlapping policies and unmanaged endpoints create inconsistent visibility and access.

Tools: Synthetic wireless review, VPN and remote-access decision matrix, Cloud network flow map

Outcome: Review firewalls, proxies, IDS/IPS, segmentation, and zero-trust controls and translate policy intent into testable network rules.

Case: A rulebase has years of exceptions, broad address groups, disabled logging, shadowed rules, and unclear ownership. A new segmentation project must preserve critical services without recreating the flat network.

Tools: Firewall-rule review, Segmentation architecture, Control-placement matrix

Outcome: Collect and interpret authorized network evidence, use Wireshark safely, troubleshoot systematically, and triage a synthetic incident.

Case: A synthetic incident combines DNS anomalies, a new outbound destination, repeated TCP resets, configuration drift, and time-skewed logs. The analyst must establish facts without capturing private production traffic.

Tools: Packet-analysis worksheet, Network triage runbook, Capstone evidence pack