What you'll learn
- OSI, TCP/IP and common ports
- Segmentation and firewalls
- IDS/IPS and network monitoring
- Secure remote access
Lessons
1OSI, TCP/IP and common ports
Know the layers so you can say where a control works. Ports to memorize: 22 SSH, 25 SMTP, 53 DNS, 80/443 HTTP(S), 88 Kerberos, 389/636 LDAP(S), 445 SMB, 3389 RDP, 502 Modbus.
TCP three-way handshake: SYN → SYN/ACK → ACK. Unexpected resets or half-open floods show up in this exchange.
2Segmentation and firewalls
- Put servers, users, management and OT in separate zones; allow only needed flows (default deny).
- Stateful firewalls track sessions; NGFWs add app-ID, user-ID and TLS inspection.
- Microsegmentation enforces policy per workload, which limits lateral movement.
- Management interfaces (SD-WAN managers, VPN admin portals) should never face the internet.
3IDS/IPS and network monitoring
Signature engines (Suricata, Snort) match known patterns; anomaly detection flags deviations. NetFlow/IPFIX gives who-talked-to-whom; full packet capture gives content. Zeek turns traffic into structured logs (conn, dns, http, ssl) that feed a SIEM.
4Secure remote access
VPN concentrators and edge devices are among the most exploited assets of the last few years. Patch them first, enforce MFA, restrict admin access by source IP, and forward their logs to your SIEM. ZTNA brokers per-app access instead of whole-network tunnels.
Hands-on lab: Read a packet capture with Wireshark
- Install Wireshark on your own machine.
- Capture 2 minutes of your own browsing traffic.
- Apply filter
dnsand list the domains your machine resolved. - Apply
tcp.flags.syn==1 && tcp.flags.ack==0to see new connections. - Use Statistics → Conversations to find the top talkers.
- Write 3 lines: what is normal here, and what would look suspicious?
Outcome: You can spot baselines and new connections in traffic.
Practice questions
Which port is SMB?
Answer: 445. Modern SMB runs directly over TCP 445.
Main benefit of network segmentation?
Answer: Limits lateral movement. Zones with default-deny contain a compromise.
Which tool turns traffic into structured protocol logs?
Answer: Zeek. Zeek produces conn/dns/http/ssl logs.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- Three-way handshake
- TCP connection setup: SYN, SYN-ACK, ACK.
- DMZ
- A network segment exposing public services while isolating the internal network.
- NGFW
- Next-generation firewall: adds application awareness, user identity and IPS to stateful filtering.
- IDS
- Intrusion Detection System: alerts on suspicious traffic.
- IPS
- Intrusion Prevention System: inline, can block malicious traffic.
- NetFlow
- Metadata about network flows (who talked to whom, when, how much).
- VLAN
- Virtual LAN separating broadcast domains on shared switches.
- DNS sinkhole
- Redirecting malicious domains to a controlled address to block and detect infections.
- ARP spoofing
- Sending forged ARP replies to intercept traffic on a local network.
- ZTNA
- Zero Trust Network Access: per-application access brokered after identity and device checks.
See the full cyber security glossary →
Official references
Related courses
Identity & Access Management
Authentication, MFA, SSO, privileged access and the identity attacks defenders see most.
Cloud Security
Shared responsibility, cloud identity, misconfigurations, CSPM and workload protection on Azure, AWS and GCP.
Cryptography & PKI
Symmetric vs asymmetric crypto, hashing, TLS, certificates and the move to post-quantum.