Hello, all! I am currently learning cybersecurity from the beginning, as I aim to become a SOC analyst. I am using TryHackMe to learn everything that I need to know from the ground-up, and I would like to cover what I had been learning in the past week thanks to TryHackMe.

I took notes and learned the first module, Networking Fundamentals (before that was changed to be the fifth module recently). I would like to summarize all that I have learned to help other beginners entering the field.

When connecting with the internet, you need an IP address and a MAC address. Your IP address is used to identify you over the internet and changes, and the MAC address is your “fingerprint” that can’t change (but it can be spoofed!).

A router is behind moving data from one network to another, just like a GPS. A switch can send traffic to multiple different devices. We can split a network to smaller ones through the use of subnetting, to make things more manageable and secure!

There’s also what’s called Address Resolution Protocol (or, ARP for short) to find the MAC address that belongs to an IP address. There’s ARP Request and ARP Reply.

  • ARP Request has one device ask all the other devices in the network “Which MAC address has this IP address here?”
  • ARP Reply will then have one device that has that IP address say “Hey, I have that IP address! Here is my MAC.”

And then, there is Dynamic Host Configuration Protocol (DHCP), a protocol that assigns a new device in the network an IP address automatically, and that new device will hang onto that IP address for a limited amount of time. This happens in four steps: Discover, Offer, Request, ACK(nowledge). I use D.O.R.A to help remember the order.

  1. Discover: A client will look for any DHCP servers in the network.
  2. Offer: After finding one, the DHCP server will reply with an IP address so that the client could use it.
  3. Request: The client will then accept the offer made to the server.
  4. ACK(nowledge): The server then acknowledge the acceptance, and then provides the lease—the amount of time the server has to own that new address.

I was also able to understand the OSI model, something I’m really happy about because it felt like there was all so much to learn with one system, but I had a fun time learning exactly what each layer and how it works.

  1. The physical layer handles raw bits of data through physical cables, wires, plugs, and so on.
  2. The data link layer receives an IP packet and builds a frame around it.
  3. The network layer handles the best routing path for packets to take.
  4. The transport layer deals with transmitting data between devices, either through TCP or UDP, which I will cover in just a bit!
  5. The session layer manages the communication between two devices, controlling how communication between the two devices works.
  6. The presentation layer translates and encrypts data so other systems can understand each other.
  7. The application layer is the layer that everyone deals with, it has a graphical user interface for the user to send and receive data.

I’ll also cover exactly what TCP and UDP are after mentioning them. As mentioned, these two protocols handle sending data from one device to the other, but they handle it very differently.

  • TCP (Transmission Control Protocol) is slow but very reliable, as there is a constant connection between the two devices. This comes with error-checking as well, as inside of the header, it has a checksum. It uses a three-way handshake:
    1. SYN: The client wants to initiate a conversation with the server.
    2. SYN/ACK: The server also initiates a conversation and acknowledges the client’s initiation.
    3. ACK: The client acknowledges the server’s initiation. The two are now ready to send information to one another.
  • UDP (User Datagram Protocol) is fast but unreliable. Unlike TCP, it doesn’t have a constant connection between the two devices. The client makes a request to the server, and then the server would send multiple responses. The server doesn’t care if the data isn’t successfully received by the client, unlike TCP.

Thanks to TryHackMe, I learned the difference between what a packet and a frame is. When I first heard of the two, I thought they were the exact same thing with two different names you can refer to them as. And while the two are similar at first—they’re both just small pieces of data—where the function is different.

  • Packets are used in the third layer of the OSI model, the Network Layer, as the unit of data.
  • Frames are used in the second layer of the OSI model, the Data Link layer, as the unit of data.

This means that packets hold and handle IP addresses, and frames hold and handle MAC addresses. Furthermore, I learned about the headers I should know in the IP, TCP/IP, and UDP/IP packet headers. As of now, I’m learning them in theory, so I will be seeing the headers more like the checksum and the different flags with TCP/IP in action when I begin using tools like Wireshark (which, I am really excited for!).

I also learned about firewalls, and two types out of the many I’m sure that are out there and exist. Firewalls, which operate in the network and transport layers of the OSI model, is placed in a network to determine what traffic could and couldn’t enter. The two that I’ve learned about are stateful and stateless firewalls.

  • Stateful Firewalls inspects the entire device’s connection, which would use a lot of resources as you could assume. If that device is determined to be bad, it is blocked entirely.
  • Stateless Firewalls on the other hand focuses on the rules you place as it inspects individual packets instead of the entire device. If one packet is determined to be bad, the whole device might not be blocked. This firewall is about as good as the rules you set.

One part I was interested in was learning about VPNs because I see a lot of VPN services being advertised out there on the internet, and I am a fan of Proton. I’ve always had a base understanding of VPNs (I know it creates a “tunnel” to securely talk to another device), but learning about how the technologies that goes into a VPN was very neat. Here are the three I learned:

  • PPP (Point-to-Point Protocol): Allows for authentication and encrypts data, through a public and private key pair. It’s non-routable so it can’t leave the network on its own.
  • PPTP (Point-To-Point Tunneling Protocol): This allows PPP data to become routable, but it’s not as well-encrypted as PPP.
  • IPSec (Internet Protocol Security): Uses IP to encrypt data.

And while there is some extra stuff I learned, I would like to conclude things here as I would like to go into more of the topics I learned in greater detail for another post in the future. I have learned a lot, and I had a fun time doing it. I understood a lot of the topics in TryHackMe more easily than I thought, and I can’t wait to get an even stronger understanding of a lot of these existing topics later in the future.

And above all, I can’t wait to share my future projects with the world. Thank you so much for taking the time to read this. Let me know if I got anything wrong, or have something that could use better explanation down in the comments. I’d love to chat!