🛡️
Network Security — Protocols, Packet Analysis & Firewalls
Secure communication protocols (TLS/SSH/IPsec), packet-level analysis
with Wireshark, every firewall type from packet-filter to WAF,
and the golden rules of defence-in-depth.
Secure Protocols
Packet Analysis
Firewalls
Defence in Depth
Press Next → or use ← → arrow keys
Section 01
Network Security Basics
🎯 CORE MISSION
Protect the network's Confidentiality, Integrity and Availability
Network security is the practice of preventing, detecting and responding
to unauthorised access, misuse, modification or denial of service on any device or data
moving across the network. Every control you deploy targets one or more of the
CIA triad:
Confidentiality — only the right eyes. Integrity — nothing silently altered. Availability — up when needed.
Confidentiality — only the right eyes. Integrity — nothing silently altered. Availability — up when needed.
82%Breaches involve humans
$4.88MAvg breach cost 2024
11sA cyberattack every…
45%Global IPv6 adoption
Section 01 · Threats
Common Network Threats You're Defending Against
🕵️
Man-in-the-Middle (MITM)
Attacker sits between two parties, silently reads or modifies traffic — especially on public Wi-Fi.
🌊
DoS / DDoS
Floods target with traffic until legitimate users can't reach it. DDoS uses thousands of compromised devices.
📡
Sniffing / Eavesdropping
Capturing unencrypted traffic to steal credentials, session cookies or sensitive data.
🎭
Spoofing
IP, MAC, ARP or DNS spoofing tricks devices into trusting an attacker as a legitimate host.
🚪
Port Scanning + Recon
Attackers probe open ports to fingerprint services and find exploitable weaknesses.
🎯
Malware & Lateral Movement
One infected host becomes the springboard for spreading across the LAN via SMB, RDP or credentials.
Section 01 · Model
Defence in Depth — Layered Rings
🛡️
Every Ring Buys Time
An attacker has to defeat every layer to reach the data. Perimeter (firewalls) → Network (segmentation, IDS/IPS) → Endpoint (EDR/AV) → Application (WAF, auth) → Data (encryption, DLP). Assume every layer will fail eventually — the next ring is there when it does.
Section 02
Secure Communication Protocols — the Map
| Protocol | OSI Layer | Protects | Typical use |
|---|---|---|---|
| TLS / SSL | 6 · Presentation | Web, email, APIs | Wraps HTTP → HTTPS, SMTP → SMTPS |
| HTTPS | 7 · Application (over TLS) | Web traffic | Every modern website |
| SSH | 7 · Application | Remote shell + tunnels | Admin access to servers |
| IPsec | 3 · Network | Site-to-site & remote VPNs | Encrypts entire IP payload |
| OpenVPN · WireGuard | App-level VPN | Remote access | Encrypted tunnel to corp network |
| WPA2 · WPA3 | 2 · Data Link | Wi-Fi | Home + enterprise Wi-Fi |
| SFTP · SCP | 7 (over SSH) | File transfer | Replace legacy FTP |
| DoH · DoT | 7 (DNS over TLS/HTTPS) | DNS queries | Encrypt DNS from ISP snooping |
| Kerberos | 5–7 | Authentication | Windows Active Directory |
| SPF · DKIM · DMARC | 7 (email) | Email spoofing | Anti-phishing |
Section 02 · TLS
TLS / SSL — the Backbone of HTTPS
🔐 CORE CONCEPT
Encryption + Authentication + Integrity — in one protocol
TLS (Transport Layer Security) is the modern successor to SSL. It sits at
OSI Layer 6 and wraps any application-layer protocol with:
🔒 Confidentiality — symmetric encryption (AES-GCM, ChaCha20)
🪪 Authentication — X.509 certificate signed by a trusted CA
✅ Integrity — MACs verify nothing was tampered with in transit
🔒 Confidentiality — symmetric encryption (AES-GCM, ChaCha20)
🪪 Authentication — X.509 certificate signed by a trusted CA
✅ Integrity — MACs verify nothing was tampered with in transit
TLS 1.3Current standard (2018)
1 RTTHandshake in TLS 1.3
SSL 3.0Deprecated / insecure
FreeCerts via Let's Encrypt
Section 02 · Handshake
The TLS Handshake — Step by Step
🎬
Watch the Loop
Hello ➜ Certificate ➜ verify + key ➜ change cipher ➜ Finished. From then on every byte — HTTP, email, whatever — is encrypted with the shared symmetric key. TLS 1.3 collapses this into 1 round trip.
Section 02 · Apps
HTTPS & SSH — TLS in Action
🌐
HTTPS
HTTP over TLS · port 443
Every modern web browser uses HTTPS. TLS wraps the HTTP request so no MITM can read login credentials or cookies.
💻
SSH
port 22
Secure Shell — encrypted remote terminal into servers. Also carries SFTP, SCP and port-forwarded tunnels.
📁
SFTP · SCP
file transfer over SSH
Modern replacements for insecure FTP. All data + credentials tunneled through SSH's encryption.
📬
SMTPS · IMAPS
port 465 / 993
Email transfer wrapped in TLS. Blocks passive sniffing of message bodies and passwords.
🌐
DoH / DoT
encrypted DNS
DNS over HTTPS (port 443) / DNS over TLS (port 853). Hides your lookups from ISPs and Wi-Fi snoops.
🚪
Key Exchange
SSH-keygen
Prefer public-key auth over passwords.
ssh-keygen -t ed25519 generates a modern keypair.Section 02 · VPN
IPsec & VPN — Encrypting the Network Layer
🔗 CONCEPT
Every packet in the tunnel is encrypted at Layer 3
A VPN creates an encrypted tunnel across an untrusted network (the internet)
so two endpoints can talk as if they were on the same LAN. IPsec is the
classic protocol suite — it encrypts (ESP) and authenticates (AH) the entire IP payload
at Layer 3, invisible to the applications above.
| Protocol | Where | Notes |
|---|---|---|
| IPsec (ESP) | L3 tunnel | Classic site-to-site VPN · encryption + integrity |
| IPsec (AH) | L3 tunnel | Authentication only (rarely used alone) |
| IKEv2 | L3 control plane | Sets up IPsec keys and policies |
| OpenVPN | App-level (TLS-based) | Popular open-source SSL VPN · TCP/UDP |
| WireGuard | L3 · modern | Small codebase · very fast · ChaCha20 crypto |
| L2TP / PPTP | Legacy | PPTP is broken — don't use |
Section 02 · Wi-Fi
Wi-Fi Security — WEP → WPA → WPA2 → WPA3
| Standard | Year | Encryption | Status |
|---|---|---|---|
| WEP | 1997 | RC4 (40/104-bit key) | ❌ Broken — crackable in minutes |
| WPA | 2003 | TKIP + RC4 | ❌ Deprecated |
| WPA2 | 2004 | AES-CCMP (128-bit) | ⚠ Still common but KRACK-vulnerable |
| WPA3 | 2018 | AES-GCMP + SAE handshake | ✅ Current standard |
📶
Enterprise vs Personal
WPA2/3-Personal (PSK) — shared password. Fine for home. WPA2/3-Enterprise (802.1X) — each user has their own credentials via a RADIUS server. Standard in offices and universities.
🔐
Practical Rules
Turn off WPS (weak). Change the default admin password on the router. Prefer WPA3 if all your devices support it. Hide/disable "guest" networks that aren't isolated.
Section 02 · Email
Email Security — SPF · DKIM · DMARC
📃
SPF
Sender Policy Framework
A DNS TXT record listing which mail servers are allowed to send email for your domain. Blocks basic spoofing.
🖋️
DKIM
DomainKeys Identified Mail
Sender's mail server digitally signs each outgoing message. Receivers verify the signature against a public key in DNS.
🛡️
DMARC
policy layer
Tells receivers what to do if SPF/DKIM fail —
none, quarantine, or reject — and sends you reports.📄 EXAMPLE DNS RECORDS FOR example.com
example.com TXT "v=spf1 include:_spf.google.com ~all" # SPF
selector1._domainkey.example.com TXT "v=DKIM1; p=MIGfMA0GCSqGSIb3DQE..." # DKIM
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" # DMARC
Section 03
Packet Analysis — the Doctor's Stethoscope
🔍 CORE IDEA
Read the actual bytes flowing across your network
Packet analysis (sniffing / deep packet inspection) captures raw frames
off a network interface and decodes each one, layer by layer.
It's how you diagnose weird performance issues, prove that TLS is actually being used,
detect malware call-outs, and answer "what really happened at 14:03:22?".
The industry-standard tool is Wireshark (GUI) —
The industry-standard tool is Wireshark (GUI) —
tcpdump (CLI) is the terminal cousin.
WiresharkIndustry standard tool
tcpdumpCLI packet capture
.pcapStandard capture format
BPFBerkeley Packet Filter
Section 03 · Structure
Anatomy of a Captured Packet
🧩
Every Wireshark Row Is Peeled Like This
Wireshark takes each frame and decodes it top-down: Ethernet → IP → TCP → TLS → HTTP. When TLS is used, the last two layers are encrypted — you can see the headers but not the message body.
Section 03 · Filters
Wireshark Filters — the 10 You'll Use Daily
🔍 DISPLAY FILTERS (in the search bar)
# By protocol
http # only HTTP traffic
tls or ssl # only TLS handshakes
dns # only DNS queries/answers
# By IP / port
ip.addr == 192.168.1.10 # any packet involving this IP
ip.src == 10.0.0.5 and ip.dst == 8.8.8.8
tcp.port == 443 # HTTPS
udp.port == 53 # DNS
# TCP flags & errors
tcp.flags.syn == 1 and tcp.flags.ack == 0 # SYN scans (recon!)
tcp.analysis.retransmission # dropped packets
tcp.stream eq 3 # follow one TCP conversation
# HTTP specific
http.request.method == "POST" # credential submissions
http contains "password" # unencrypted secrets
💻 tcpdump — SAME IDEA, CLI
$ sudo tcpdump -i eth0 port 80 -w capture.pcap
$ sudo tcpdump -i any -n host 8.8.8.8
$ sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0' # SYN flood detection
Section 03 · Attacks
Attacks You Can Spot in a Packet Capture
| Attack | Tell-tale signature in the capture |
|---|---|
| Port scanning | Many SYN packets to different ports from one IP · very few ACKs |
| SYN flood (DoS) | Huge burst of half-open SYNs from many IPs · no completions |
| ARP spoofing | Sudden ARP replies changing an IP → MAC mapping |
| DNS tunneling | Unusually long or high-frequency DNS TXT queries |
| Cleartext credentials | HTTP POSTs to /login, FTP PASS, Telnet payloads |
| C2 beaconing | Regular-interval HTTPS connections to unusual domains — same size, same timing |
| Data exfiltration | Large upload/outbound bytes on non-business hours or to strange geos |
⚠️
The Golden Question
"Is this traffic normal for this host at this time?" — the answer tells you if you have an incident. Baselining normal traffic patterns is what turns a packet capture into a security signal.
Section 04
Firewalls — What They Actually Do
🔥 CORE JOB
Allow good traffic, block bad — based on a rule set
A firewall is a network security device (hardware, software or cloud service)
that sits between two zones and enforces a policy on every packet:
allow, deny, or log-and-alert. Modern firewalls do far more than
just check IPs and ports — but that's always the starting point.
🚦
Filter
match & act
Compare each packet against ordered rules; the first match wins (allow / deny).
📊
Log
audit trail
Record allowed & denied connections for forensics, compliance and SIEM correlation.
🚫
NAT
rewrite addresses
Translate between private and public IPs (Layer-3 firewalls also perform NAT).
Section 04 · Types
Five Major Firewall Types by Depth of Inspection
🎯
The Trade-Off
Deeper inspection = more security but more CPU and higher latency. Modern networks typically layer several types together (perimeter NGFW + host firewall + WAF for web apps).
Section 04 · Type 1 & 2
Packet-Filtering & Stateful Firewalls
🚦
Packet-Filtering
stateless · L3/L4
Examines each packet in isolation — src/dst IP, port, protocol.
Doesn't remember previous packets. Fast but easy to bypass by forging responses.
Examples: classic Cisco ACLs, iptables in stateless mode.
Examples: classic Cisco ACLs, iptables in stateless mode.
🧠
Stateful Inspection
tracks sessions
Maintains a connection table. A response is only allowed if
it matches an outgoing request already in the table. Blocks unsolicited replies.
Examples: Linux
Examples: Linux
iptables/nftables with conntrack, pfSense, Windows Defender FW.📞
Circuit-Level (Proxy)
L5
Verifies TCP handshake is legitimate, then relays traffic without inspecting content.
Cheaper than full application proxy but hides internal IPs.
Example: SOCKS proxy.
Example: SOCKS proxy.
⚠️
Why Stateful Wins
Almost every modern firewall is stateful by default. Stateless filtering is still used on router ACLs where CPU is limited or where session state doesn't matter (e.g. blocking RFC1918 spoofing at the ISP edge).
Section 04 · Type 3 & 4
NGFW · UTM · WAF — Deep Inspection
🧬
NGFW
Next-Generation Firewall
Stateful + deep packet inspection (DPI), integrated IPS, application awareness (identifies YouTube vs a random HTTP tunnel), user identity, TLS decryption.
Vendors: Palo Alto, Fortinet FortiGate, Cisco Firepower, Check Point.
Vendors: Palo Alto, Fortinet FortiGate, Cisco Firepower, Check Point.
🎁
UTM
Unified Threat Mgmt
One appliance that bundles firewall + AV + IPS + web filter + VPN + spam filter.
Great for SMBs — one box, one dashboard.
Vendors: Sophos XG, WatchGuard, SonicWall.
Vendors: Sophos XG, WatchGuard, SonicWall.
🌐
WAF
Web Application Firewall
Sits in front of a website. Understands HTTP, defends against
OWASP Top 10: SQLi, XSS, path traversal, bots, DDoS.
Vendors: Cloudflare, AWS WAF, F5, Akamai, ModSecurity.
Vendors: Cloudflare, AWS WAF, F5, Akamai, ModSecurity.
💻
Host-Based Firewall
runs on the endpoint
Filters traffic in/out of a single device. Last line of defence when perimeter fails.
Examples: Windows Defender FW,
Examples: Windows Defender FW,
iptables/ufw, macOS PF firewall.☁️
Cloud FWaaS
firewall as a service
Delivered from the cloud. Protects branches, SaaS, mobile users without a hardware box.
Examples: Zscaler, Cloudflare Magic Firewall, Prisma Access.
Examples: Zscaler, Cloudflare Magic Firewall, Prisma Access.
🔬
DPI Firewall
Deep Packet Inspection
Peers inside the payload — not just headers. Used for content filtering, IDS/IPS signatures, DLP. Often part of an NGFW.
Section 04 · Rules
Firewall Rules — Real Syntax Examples
🐧 LINUX · iptables (stateful, INPUT chain)
# Default deny — the golden starting point
$ iptables -P INPUT DROP
$ iptables -P FORWARD DROP
# Allow already-established sessions (stateful magic)
$ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Allow SSH only from your admin IP
$ iptables -A INPUT -p tcp -s 203.0.113.5 --dport 22 -j ACCEPT
# Allow HTTP/HTTPS from anywhere
$ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$ iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# Log & drop everything else
$ iptables -A INPUT -j LOG --log-prefix "FW-DROP: "
$ iptables -A INPUT -j DROP
🔴 CISCO ACL EXAMPLE
! Permit HTTPS from any host to web server 10.0.0.10
access-list 101 permit tcp any host 10.0.0.10 eq 443
! Deny Telnet inbound (obsolete/insecure)
access-list 101 deny tcp any any eq 23 log
! Deny known-bad IP
access-list 101 deny ip host 192.0.2.66 any log
! Implicit deny at the end — apply to interface
interface GigabitEthernet0/0
ip access-group 101 in
🏆
Golden Rule of Rule Ordering
Most specific first, broad deny last. Every firewall matches top-down and stops at the first hit. A wide "allow all" rule above your specific denies will silently break your whole policy.
Section 04 · Topology
Where Firewalls Sit — Perimeter, DMZ & Internal
🏛️
The 3-Zone Model
Untrusted (internet) → DMZ (public-facing servers like web/mail — reachable but isolated) → Trusted (internal LAN). Two firewalls sandwich the DMZ so a compromised web server cannot pivot to the internal database.
Section 04 · Best Practices
Firewall Rule Design — Best Practices
🏆 RULES-OF-RULES
1
Default deny. The last rule is always "deny everything else" — explicit allow-lists only.
2
Least privilege. Allow only the ports and IPs that are strictly needed for the business function.
3
Most specific rules first. Order matters — first match wins. Narrow denies before broad allows.
4
Log denies. Log every dropped connection so you can spot scans, reconnaissance and misconfigurations.
5
Segment the network. Separate DMZ from internal, DB VLAN from user VLAN. Every zone boundary needs a rule.
6
Review quarterly. Firewall rules rot. Old "temporary" rules for a project 4 years ago become attack paths.
7
Change control. Every rule change goes through a ticket + peer review. Undocumented changes are a compliance red flag.
Section 05 · Part 1
Network Security Golden Rules — 1 to 4
🏆 CORE RULES · 1–4
1
Encrypt everything in transit.
TLS for web, SSH for remote access, IPsec/WireGuard for VPN, WPA3 for Wi-Fi.
Cleartext is a modern crime scene.
2
Defence in depth.
Perimeter → network → endpoint → app → data. Every ring buys time for the next one to catch the attacker.
3
Default deny + least privilege.
Firewall rules, IAM, everything. Explicitly allow only what business needs — deny the rest.
4
Watch the wire.
Regular packet captures & NetFlow. If you can't see traffic, you can't detect an intrusion.
Section 05 · Part 2
Network Security Golden Rules — 5 to 8
🏆 CORE RULES · 5–8
5
Segment aggressively.
Guest ≠ production, dev ≠ prod, IoT ≠ HR. A compromise in one segment shouldn't touch the others.
6
Patch fast, measure MTTP.
Most breaches ride known vulnerabilities. Critical patches within 72 hours is the modern baseline.
7
Review firewall rules quarterly.
Rules that made sense in 2019 are attack paths today. Kill orphaned rules and shrink over-broad allows.
8
Log everything — and actually look at it.
Firewall + IDS + endpoint logs into a SIEM. Baselines make anomalies obvious. Untested detection = no detection.
FINAL
You Now Have the Network Security Toolkit
TLSEncrypts everything
WiresharkSee the wire
5+Firewall types
DenyDefault rule
5Defence rings
72hPatch SLA target
🎯
You Can Now…
Choose the right secure protocol for the job, read a packet capture and spot common attacks, design a firewall rule set that's default-deny + least-privilege, and place firewalls in a proper 3-zone topology with a DMZ. That's the working vocabulary of a network defender.
📚
Where To Practise
Fire up Wireshark on your own laptop and analyse real traffic. Build a pfSense / OPNsense home lab and write your own rules. Practise TryHackMe and HackTheBox network rooms. Study NIST SP 800-41 for firewall guidelines.
🛡️ End of tutorial · Press ← to review, or click Restart
Author: Dr. Mohit
1 / 25