Networking Fundamentals: Protocols, Hardware & Security

Your firewall rules are perfect. Your VPN uses AES-256. Your SIEM correlates logs in real time. None of it matters if you don't understand how a packet actually moves from host A to host B. In 2026, the network is no longer a perimeter—it's the attack surface. Mastering the fundamentals of TCP/IP, routing, switching, and name resolution isn't entry-level trivia; it's the prerequisite for every effective defense decision you'll make.

TCP/IP isn't a single protocol; it's a suite. At Layer 3, IP handles addressing and routing. At Layer 4, TCP guarantees delivery while UDP trades reliability for speed. Everything above—HTTP, TLS, DNS, DHCP—rides on this foundation. If you can't trace a SYN packet through a three-way handshake, you can't diagnose a reset attack. If you don't know how fragmentation works, you'll miss evasion techniques that split malicious payloads across multiple frames.

Switches operate at Layer 2, forwarding frames based on MAC addresses. VLANs carve a single physical switch into multiple broadcast domains. Trunk links (802.1Q) carry tagged frames between switches. The security implication is direct: a misconfigured trunk or a missing native VLAN mismatch lets traffic hop segments without touching a firewall. Port security, BPDU guard, and DHCP snooping aren't checkboxes—they're the controls that keep Layer 2 from becoming a flat, sniffable network.

Routers make forwarding decisions based on Layer 3 addresses. Static routes work for stub networks; dynamic protocols—OSPF, BGP, EIGRP—scale to enterprise and internet edge. Route redistribution between protocols is where logic errors become outages. From a security lens, control-plane policing (CoPP) protects the route processor from DoS. Unicast Reverse Path Forwarding (uRPF) drops packets with spoofed source addresses. BGP prefix filtering and RPKI validation prevent hijacks that reroute your traffic through adversary infrastructure.

Every connection starts with a query. DNSSEC signs records so resolvers can verify authenticity. DoH (DNS over HTTPS) and DoT (DNS over TLS) encrypt queries, blinding passive monitors but also your own inspection tools. Split-horizon DNS serves internal zones to trusted clients only. Monitor for excessive NXDOMAIN responses—they signal domain generation algorithms (DGAs) used by malware. Block known malicious domains at the recursive resolver; it's the cheapest, highest-ROI control in your stack.

Modern firewalls are stateful: they track connection state (SYN, SYN-ACK, ESTABLISHED) and allow return traffic automatically. Next-gen adds application identification (App-ID), SSL decryption, IPS, and sandboxing. Rule order matters—first match wins. Place specific denies before broad allows. Log denied traffic, not just allowed. Review rule hit counts quarterly; stale rules are shadow IT waiting to be exploited. Micro-segmentation extends firewall logic east-west inside the data center, enforcing zero-trust between workloads.

Don't read another certification guide passively. Build a lab. Spin up GNS3 or EVE-NG. Configure OSPF between three routers. Create VLANs, trunk them, apply port security. Capture a DNS query with Wireshark; verify DNSSEC validation. Write a firewall rule set that permits only necessary traffic and logs everything else. Break it on purpose—then fix it. The muscle memory you build now is what keeps the network standing when the alerts fire at 2 AM.