Network Foundations

Every piece of digital evidence that travels over a network — an email, a login, a malware download — follows a strict set of rules. Understanding those rules tells you where to look for evidence and what you are looking at when you find it.

7.1The OSI Model — Seven Layers

The OSI (Open Systems Interconnection) model defines seven layers that describe how data is packaged and transmitted between devices. Each layer adds its own header to the data before passing it down — a process called encapsulation. Think of it like sending a letter: you write the content (Layer 7), address the envelope (Layer 3), hand it to the post office (Layer 2), and it travels on the physical road (Layer 1). At the destination, each layer unwraps its header in reverse until the original message reaches the application.

The mnemonic "All People Seem To Need Data Processing" gives the layers from top to bottom: Application, Presentation, Session, Transport, Network, Data Link, Physical.

Layer 7 — Application is what the user sees: HTTP, HTTPS, FTP, SMTP, DNS, and DHCP all live here. Application logs — web server logs, mail server logs, DNS query logs — are your richest evidence source at this layer.

Layer 6 — Presentation handles data format conversion, compression, and encryption/decryption. SSL/TLS is negotiated here. When traffic is encrypted, this layer makes content unreadable to a passive sniffer.

Layer 5 — Session establishes, manages, and terminates communication sessions between applications. Session tokens and login state belong conceptually here.

Layer 4 — Transport adds port numbers and manages end-to-end communication. TCP (Transmission Control Protocol) is reliable, ordered, and error-checked — it guarantees delivery. UDP (User Datagram Protocol) is faster but offers no delivery guarantee. Firewall logs record Layer 4 information: source IP, destination IP, source port, destination port, and protocol.

Layer 3 — Network handles IP addressing and routing. Each packet carries an IP header with source and destination IP addresses. Routers operate at this layer, consulting routing tables to forward packets. Raw packet captures (pcap files) expose Layer 3 headers directly.

Layer 2 — Data Link uses MAC addresses to deliver frames within a single network segment. Ethernet (IEEE 802.3) and Wi-Fi (IEEE 802.11) are Layer 2 technologies. Switches operate here, maintaining a MAC address table to send frames only to the correct port.

Layer 1 — Physical carries raw bits over copper cable, optical fibre, or radio. Hubs, modems, and physical cables live here. There is no addressing at this layer — just electrical signals or light pulses.

7.2TCP/IP Model

The TCP/IP model is the practical four-layer framework that actually governs internet communication. OSI is the conceptual reference; TCP/IP is what engineers implement. The layers map onto OSI as follows:

TCP three-way handshake establishes a reliable connection before any data transfers. The sequence is:

1. SYN — client sends a synchronise segment to the server.
2. SYN-ACK — server acknowledges the SYN and sends its own synchronise.
3. ACK — client acknowledges the server's SYN. Connection is open.

Forensic value: in a packet capture (pcap), a SYN with no SYN-ACK means the port is closed or filtered. Repeated SYNs to many different ports is the signature of a port scan. A flood of SYNs that never complete the handshake is a SYN flood denial-of-service attack.

TCP flags you must know for the exam:

• SYN — initiate connection
• ACK — acknowledge received data
• FIN — graceful close (waits for FIN-ACK before teardown)
• RST — abrupt reset (immediate teardown, no waiting)
• PSH — push data to application immediately without buffering
• URG — urgent data, process ahead of normal stream

UDP skips the handshake entirely. No acknowledgement, no ordering guarantee. DNS queries, VoIP calls, and video streams use UDP because speed matters more than delivery guarantee. Forensic note: because there is no handshake, an attacker can forge the source IP in a UDP packet — the server cannot verify the claimed sender.

7.3IP Addressing

IPv4 addresses are 32-bit numbers written as four decimal octets separated by dots — for example, 192.168.1.100. With 32 bits there are approximately 4.3 billion possible addresses. That pool is now exhausted globally.

IPv6 addresses are 128 bits written as eight groups of four hexadecimal digits separated by colons — for example, 2001:0db8:85a3::8a2e:0370:7334. The :: shorthand compresses one or more consecutive all-zero groups. The IPv6 address space is so vast that exhaustion is not a concern for the foreseeable future.

Private (RFC 1918) IPv4 ranges are reserved for internal networks and are not routable on the public internet:

Loopback addresses refer to the local machine itself — 127.0.0.1 in IPv4 and ::1 in IPv6. Traffic to loopback never leaves the host.

NAT (Network Address Translation) lets multiple private-IP devices share one public IP. The router rewrites source IPs on outgoing packets and keeps a translation table to route replies back to the correct internal device. Forensic implication: the IP address in a server's access log is the NAT gateway, shared by everyone behind it. To identify the specific device, investigators need DHCP lease records or router logs showing which private IP was assigned to which device at the exact time of the event.

Port numbers identify services on a host. They are 16-bit values (0–65535). Well-known ports (0–1023) are assigned to standard services:

7.4Subnetting & CIDR

CIDR (Classless Inter-Domain Routing) replaced the old fixed-class system. A CIDR address like 192.168.1.0/24 means the first 24 bits identify the network and the remaining 8 bits identify hosts within it. The slash number is called the prefix length.

Common prefix lengths and their host counts:

A /24 is the most common subnet in small and medium networks. A /30 is used for point-to-point links between routers (only 2 usable addresses needed).

DHCP (Dynamic Host Configuration Protocol) automatically gives a joining device its IP address, subnet mask, default gateway, and DNS server. The DHCP server maintains lease records — a log of which MAC address received which IP at which time. In an investigation, DHCP logs are often the only path from a dynamic IP address back to a specific physical device. Always request DHCP logs together with router and firewall logs when pursuing a logged IP address.

7.5LAN, MAN, WAN & Network Devices

Networks are classified by geographic scale:

LAN (Local Area Network) covers a single building or campus. Most LANs use Ethernet (IEEE 802.3) for wired connections and Wi-Fi (IEEE 802.11) for wireless, with speeds from 100 Mbps to 10 Gbps. Evidence from a LAN investigation comes from switch logs, ARP tables, DHCP records, and wireless access point association logs.

MAN (Metropolitan Area Network) spans a city. ISPs build MANs using fibre backbone to connect multiple LANs. A university spread across a city or a bank's branch offices in one city would use MAN infrastructure.

WAN (Wide Area Network) connects geographically separated locations across cities, countries, or continents. The internet is the largest WAN. Corporate WANs use leased lines, MPLS circuits, or VPN tunnels. Evidence at the WAN level typically requires ISP records obtained by court order.

Network devices and their forensic significance:

A hub operates at Layer 1 and broadcasts every frame to every connected port. All devices on a hub segment see all traffic — passive sniffing requires nothing more than a laptop in promiscuous mode. Hubs are obsolete in real networks but appear frequently in exam questions.

A switch operates at Layer 2 and maintains a MAC address table. When a frame arrives, the switch looks up the destination MAC and delivers the frame only to the correct port. A device on a switched network sees only its own traffic and broadcasts. To sniff on a switched network, an attacker must first poison the ARP cache to redirect traffic through their machine.

A router operates at Layer 3 and connects different networks, forwarding IP packets based on a routing table. Routers log connection attempts, DHCP leases, and NAT translations. Firewall functionality is often built into edge routers.

A firewall filters traffic using ACLs (Access Control Lists) based on IP address, port, protocol, and connection state. Stateful firewalls track TCP state — they know whether a packet belongs to an established, permitted connection. Firewall logs are primary evidence in intrusion investigations, recording allowed and blocked traffic with source/destination IP, port, protocol, and timestamp.

A proxy server sits between internal clients and the internet, intercepting HTTP/HTTPS requests on behalf of clients. Corporate proxies log every URL accessed per internal IP address. These logs are a rich evidence source when investigating employee misconduct or malware command-and-control traffic.