Concept of Computer Network and Network Security System

1

The OSI model has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application.

2

The TCP/IP model has 4 layers: Network Interface/Link, Internet, Transport, Application — it combines OSI's Application, Presentation, and Session layers into one Application layer.

3

OSI's Physical layer (layer 1) corresponds to TCP/IP's Network Interface/Link layer; OSI's Network layer (layer 3) corresponds to TCP/IP's Internet layer.

4

A protocol is a set of rules governing how data is formatted, transmitted, and received between devices.

5

A standard may be de facto (established by common/widespread use) or de jure (formally approved by a standards body).

6

Hub: operates at the physical layer; broadcasts incoming data to all connected ports; has no intelligence.

7

Bridge: operates at the data link layer; connects two LAN segments and filters traffic based on MAC address.

8

Switch: operates at the data link layer; a multi-port bridge that forwards frames using a MAC address table, sending data only to the intended port (unlike a hub).

9

Router: operates at the network layer; forwards packets between different networks based on IP address and determines the best path.

10

Guided (wired) media include twisted pair cable (UTP/STP — cheap, used in LANs) and coaxial cable (better shielding, used in cable TV/older LANs).

11

Fiber optic cable uses light signals, giving the highest bandwidth and longest transmission distance among guided media, and is immune to electromagnetic interference (EMI).

12

Unguided (wireless) media include radio waves, microwave (line-of-sight, used for point-to-point links), and infrared (short range, line-of-sight, used for remote controls).

13

Guided media (twisted pair, coaxial, fiber) require a physical cable, while unguided media (radio, microwave, infrared) transmit signals through free space.

1

The data link layer provides reliable node-to-node delivery of frames over a physical link, handling framing, error control, flow control, and medium access.

2

DLL services: framing (dividing bits into manageable frames), error control, flow control, and access control (medium sharing).

3

Parity check adds one bit to make the count of 1s even or odd, for basic error detection.

4

Checksum is a sum of data segments, verified at the receiver, used for error detection.

5

CRC (Cyclic Redundancy Check) uses polynomial division and is the most powerful of the error detection methods (parity, checksum, CRC).

6

Hamming code adds redundant bits that allow both detection and correction of single-bit errors — unlike parity, checksum, or CRC, which only detect errors.

7

Flow control prevents a fast sender from overwhelming a slow receiver: stop-and-wait (send one frame, wait for acknowledgement) vs sliding window (send multiple frames before requiring acknowledgement, more efficient).

8

Random access protocols: ALOHA, CSMA (Carrier Sense Multiple Access), CSMA/CD (Collision Detection — used in wired Ethernet), CSMA/CA (Collision Avoidance — used in wireless LANs).

9

Controlled access protocols: Polling (a controller invites stations to send in turn) and Token passing (a special token frame grants the right to transmit).

10

Channelization protocols: FDMA (Frequency Division), TDMA (Time Division), CDMA (Code Division) — divide the shared channel's bandwidth among stations.

11

A MAC address is a 48-bit hardware address burned into the network interface card, used for addressing within a LAN.

12

ARP (Address Resolution Protocol) maps a known IP address to its corresponding MAC address on the local network.

13

IEEE 802.3 (Ethernet) uses CSMA/CD over a bus/star topology; IEEE 802.4 (Token Bus) uses token-based access on a bus topology; IEEE 802.5 (Token Ring) circulates a token around a ring, and a station can transmit only when it holds the token.

14

Wireless LAN (IEEE 802.11) uses CSMA/CA since collisions cannot be reliably detected over radio; PPP (Point-to-Point Protocol) provides a direct link between two nodes, commonly used for WAN and dial-up/broadband connections.

1

The network layer is responsible for logical addressing and routing packets across multiple networks from source to destination.

2

IP address Class A (first octet 1–126) is used for very large networks (few networks, many hosts).

3

Class B (128–191) is used for medium to large networks; Class C (192–223) is used for small networks (many networks, few hosts each).

4

Class D (224–239) is reserved for multicast addresses; Class E (240–255) is reserved for experimental/research use.

5

Subnetting divides a large network into smaller sub-networks by borrowing bits from the host portion of an address, using a subnet mask to distinguish the network/subnet part from the host part.

6

Flooding: every incoming packet is sent out on every outgoing link except the one it arrived on — simple but generates heavy traffic.

7

Distance vector routing: each router shares its routing table (distance to each destination) with neighbors; e.g. RIP (Routing Information Protocol) uses hop count, max 15 hops.

8

Link state routing: each router builds a complete map of the network topology and computes the shortest path using Dijkstra's algorithm; e.g. OSPF (Open Shortest Path First).

9

Path vector routing: used between autonomous systems, tracks the full path (list of AS) a route has traversed; e.g. BGP (Border Gateway Protocol).

10

Unicast routing delivers a packet to a single specific destination; multicast routing delivers a packet to a group of interested destinations.

11

ARP resolves an IP address to a MAC address; RARP resolves a MAC address to an IP address (the reverse of ARP).

12

IP provides logical (network layer) addressing and best-effort packet delivery; ICMP reports errors and diagnostic information (e.g., ping and traceroute use ICMP).

13

IPv6 uses 128-bit addresses (vs IPv4's 32-bit), offering a vastly larger address space, with a simplified fixed header plus optional extension headers.

14

Transition from IPv4 to IPv6 uses dual stack (running both protocols simultaneously), tunneling (encapsulating IPv6 packets inside IPv4 packets), and header translation; IPv6 has native built-in multicast support and eliminates broadcast.

1

The transport layer provides end-to-end (process-to-process) communication between applications, handling connection management, reliability, and congestion control.

2

A port number identifies a specific process/application on a host; a socket is the combination of an IP address and a port number, uniquely identifying an endpoint of communication.

3

TCP is connection-oriented, reliable (acknowledgement & retransmission), guarantees ordered delivery, and has flow control and congestion control.

4

UDP is connectionless, unreliable (best-effort, no acknowledgement), gives no delivery order guarantee, and has no flow or congestion control — but is faster (lower overhead), used for streaming, DNS, VoIP.

5

TCP connection establishment uses the three-way handshake: SYN (client requests connection) → SYN-ACK (server acknowledges and responds) → ACK (client confirms).

6

TCP connection release typically uses a four-way handshake: FIN → ACK → FIN → ACK, allowing both sides to close their part of the connection independently.

7

Flow control at the transport layer (as in TCP) uses a sliding window mechanism so the sender does not overwhelm the receiver's buffer.

8

Multiplexing combines data from multiple application processes (using different port numbers) into a single stream for transmission; demultiplexing separates the incoming stream back to the correct application at the receiver.

9

Slow start exponentially increases the sending rate initially; congestion avoidance increases the rate linearly once a threshold is reached.

10

AIMD (Additive Increase, Multiplicative Decrease) increases the sending rate slowly but cuts it sharply upon detecting loss.

11

Leaky bucket and token bucket algorithms are used to shape/police traffic rate.

1

The application layer provides network services directly to end-user applications, including the web, file transfer, email, name resolution, and network monitoring tools.

2

HTTP is a stateless request-response protocol used to transfer web pages; HTTPS is HTTP secured with SSL/TLS encryption for confidential, authenticated web communication.

3

FTP (File Transfer Protocol) uses separate control and data connections to transfer files.

4

PuTTY is a terminal/SSH client used for secure remote command-line access; WinSCP is a GUI client for secure file transfer (using SFTP/SCP over SSH).

5

SMTP (Simple Mail Transfer Protocol) is used to send email between mail servers; POP3/IMAP are protocols used by a mail client to retrieve/download email from a mail server.

6

DNS (Domain Name System) translates human-readable domain names (e.g., example.com) into IP addresses, using a hierarchical, distributed database.

7

P2P (peer-to-peer) applications have no dedicated central server; peers share resources directly with each other (e.g., BitTorrent).

8

Socket programming provides an API (e.g., in C/C++, Java, Python) that lets applications create sockets to send/receive data over a network using TCP or UDP.

9

An application server hosts and executes application logic, processing requests from client programs and returning responses.

10

SNMP (Simple Network Management Protocol) is used to monitor and manage network devices remotely.

11

MRTG/PRTG are tools that monitor and graph network traffic load over time (often using SNMP).

12

Wireshark is a packet capture and protocol analysis tool used to inspect network traffic in detail.

13

Packet Tracer is a Cisco network simulation tool used to design, configure, and test network topologies.

1

Computer security is generally defined by the CIA triad: Confidentiality (data is accessible only to authorized parties), Integrity (data is not altered without authorization), and Availability (data/services are accessible when needed).

2

Passive attacks (eavesdropping, traffic analysis) — the attacker only observes without altering data, making them hard to detect.

3

Active attacks (masquerade/impersonation, replay, message modification, Denial of Service) — the attacker alters system behavior or data.

4

Symmetric-key cryptography uses the same key for both encryption and decryption (e.g., DES, AES) — fast, but the key must be shared securely.

5

Asymmetric (public-key) cryptography uses a key pair: a public key (shared openly, used to encrypt) and a private key (kept secret, used to decrypt).

6

The RSA algorithm is a widely used public-key algorithm whose security is based on the difficulty of factoring the product of two large prime numbers.

7

A digital signature is created by encrypting a message digest with the sender's private key; the receiver verifies it using the sender's public key, confirming both authenticity and integrity of the message.

8

PGP (Pretty Good Privacy) secures email using a combination of symmetric encryption (for speed), asymmetric encryption (for key exchange), and digital signatures (for authentication).

9

SSL/TLS secures TCP connections (the basis of HTTPS), providing encryption, authentication, and data integrity.

10

IPsec secures IP-layer communication; operates in transport mode (encrypts only the payload) or tunnel mode (encrypts the entire IP packet) — commonly used to build VPNs.

11

A VPN (Virtual Private Network) creates a secure, encrypted tunnel over a public network (e.g., the Internet) to connect remote users/sites privately.

12

WEP (Wired Equivalent Privacy) is an early, now-weak wireless LAN security protocol, largely superseded by WPA/WPA2 due to known vulnerabilities.

13

A firewall filters incoming/outgoing network traffic based on defined security rules; types include packet-filtering, stateful inspection, and application-level (proxy) firewalls.