> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/soc-operations/soc-fundamentals/network-security.md).

# Network Security

## Network Layer Protocols

### 1- **Internet Protocol (IP)**

IP operates at the **Network Layer (Layer 3 – OSI)**\
Its job is **logical addressing and packet delivery across networks**.

* IP addressing
  * An **IP address** uniquely identifies a device on a network.
  * Two main versions:
    * **IPv4** → 32-bit (e.g. `192.168.1.1`)
    * **IPv6** → 128-bit (e.g. `2001:db8::1`)
* IP routing
  * Decides **how packets move from source to destination**
  * Uses **routing tables**

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FVdhqO1NNBgyyAaAlM736%2Fimage.png?alt=media&amp;token=94e968d0-cd30-44fc-a39f-0232cdf64335" alt=""><figcaption></figcaption></figure>

### 2- **Transmission Control Protocol**

* it operates at transport layer
* connection-oriented -reliable
  * A session is established before data transfer.
  * No data loss
  * Correct order
  * No duplication
* Three-way handshake
  * Confirm both sides are ready
* Steps
  * **SYN** → Client requests connection
  * **SYN-ACK** → Server acknowledges
  * **ACK** → Client confirms
* Flow and congestion control
* Where TCP is Used
  * HTTP / HTTPS
  * SMTP
  * FTP
  * SSH
  * Database connections

### **3- User Datagram Protocol**

UDP also operates at the **Transport Layer (Layer 4)**\
Its job is **fast, best-effort data delivery**.

* Connectionless
  * No handshake
  * No session tracking
  * No acknowledgment
* Lightweight, low-overhead - speed over reliability
  * No retransmissions
  * No ordering
  * No congestion control
  * Smaller header (8 bytes vs TCP’s 20+)
* Where UDP is Used
  * VoIP (Zoom, Teams, SIP)
  * Video streaming
  * Online gaming
  * DNS
  * DHCP
  * NTP