🎯 Goal

Build a solid mental model of networking using the OSI framework in preparation for CompTIA Network+ concepts and future SOC analysis work.

The focus was understanding:

  • why network models exist
  • how data moves through network layers
  • how protocols cooperate to deliver traffic
  • how this knowledge applies to security investigations

🛠️ What I Did

Studied Chapter 1 of the CompTIA Network+ All-in-One Exam Guide.

Topics covered included:

  • purpose of networking models
  • OSI seven-layer architecture
  • encapsulation and decapsulation
  • frames, packets, and segments
  • NIC functionality
  • MAC vs IP addressing
  • hub vs switch vs router behavior

I also practiced recalling the OSI layers from memory and mapping responsibilities to each layer.

🌐 OSI Model Overview

Layer Function
7 Application Network services used by applications
6 Presentation Data formatting, encryption, compression
5 Session Session management between systems
4 Transport Segmentation, ports, reliable delivery
3 Network Routing using IP addresses
2 Data Link Frames and MAC addressing
1 Physical Bits transmitted over physical media

Understanding these layers provides a structured way to reason about how network communication works.

📦 Encapsulation Concept

Network communication occurs through encapsulation, where each layer adds its own header information.

Example flow:

Application Data
→ Transport Segment
→ Network Packet
→ Data Link Frame
→ Physical Bits

At the receiving end, the process reverses through decapsulation, where each layer removes its header and passes the data upward.

🔐 Protocols Studied

ICMP

Internet Control Message Protocol is used for network diagnostics.

Examples:

ping
traceroute

ICMP operates at Layer 3 (Network layer).

ARP

Address Resolution Protocol maps IP addresses to MAC addresses on a local network.

Example use case:

When a host knows the destination IP but needs the MAC address to deliver the frame on the local network.

ARP operates between Layer 2 and Layer 3.

SNMP

Simple Network Management Protocol allows monitoring and management of network devices.

Typical use cases:

  • collecting device telemetry
  • monitoring routers, switches, and servers
  • centralized infrastructure management

From a security perspective, SNMP can also be abused for network reconnaissance.

🔐 Key Cybersecurity Connections

Understanding network fundamentals enables analysts to interpret network telemetry.

Security investigations often rely on recognizing:

  • abnormal network traffic patterns
  • unexpected protocols or ports
  • unusual routing behavior
  • suspicious network scanning activity

A key concept learned today:

  • MAC addresses change at every hop
  • IP addresses remain constant end-to-end

This distinction is critical when analyzing packet movement across networks.

⚠️ Challenges

The main difficulty was reconciling:

  • the OSI model (theoretical framework)
  • the TCP/IP model (real-world implementation)

These models do not map perfectly to each other.

The solution was to separate:

  • exam-oriented understanding
  • operational networking reality

🧠 What I Learned

Networking communication follows layered abstraction.

Each layer solves a different delivery problem:

Question Layer
Which application? Application layer
Which port/service? Transport layer
Which host? Network layer
Which local device? Data link layer
How is data physically transmitted? Physical layer

Understanding these responsibilities makes network behavior easier to analyze.

⏭️ Next Steps

  • continue Network+ study
  • deepen understanding of TCP vs UDP behavior
  • connect packet flow concepts to real network traffic analysis
  • start using tools that reveal network activity

Examples to explore:

tcpdump
wireshark
netstat
ss

💭 Reflection

This session helped transform networking concepts from memorized definitions into a clearer mental model of how packets move through networks.

Instead of isolated facts, the OSI layers now feel like a structured explanation of how communication is actually delivered.

🧩 Lessons Learned

What worked

  • active recall of OSI layers
  • mapping protocols to their operational role

What broke

  • confusion between Session and Transport responsibilities

Why it broke

  • theoretical models sometimes simplify real implementations

Fix / takeaway

Understand both:

  • the model used for learning and certification
  • the real-world networking behavior systems actually follow.