Networking Primer — From Scratch

Who this is for: You — assuming zero networking knowledge. Prior certifications don't matter here; this primer teaches from absolute scratch exactly the networking foundation Security+ assumes, no more, no less. Nothing in the study packs requires anything beyond what's on this page.

How to work through it: Not in one sitting. Take it in 3 short sessions of about an hour (sections 1–3, then 4–5, then 6–8), re-doing the previous session's part of the self-check each time.

Ports (section 5) are pure memorisation — put them straight into daily flashcard rotation from the first session.

Finish, and pass the full self-check, before starting Domain 3.

1. The OSI Model — the exam's favourite way to organise everything

Seven layers; data moves down the stack when sending, up when receiving. Security+ mostly cares about which layer a device or attack operates at.

Memory hook: Please Do Not Throw Sausage Pizza Away (L1→L7). The three layers that matter most for the exam: L2 = MAC/switch, L3 = IP/router, L4 = port/TCP-UDP.

2. TCP vs UDP — the two transport protocols

3. IP Addressing — who you are on the network

IPv4: four numbers 0-255 separated by dots — 192.168.1.50. 32 bits total.

Private IPv4 ranges (never routed on the internet — memorise all three):

• 10.0.0.0 – 10.255.255.255
• 172.16.0.0 – 172.31.255.255
• 192.168.0.0 – 192.168.255.255

CIDR notation: /24 after an address says how many leading bits are the network part. 192.168.1.0/24 = one network of 254 usable hosts (192.168.1.1–254). Smaller number after the slash = bigger network.

The exam rarely makes you subnet by hand — it wants you to recognise that /24 describes a network segment's size.

NAT (Network Address Translation): your router rewrites private internal addresses to its one public address for outbound traffic. Why it matters for security: internal addresses are invisible from outside — a mild layer of obscurity, not a real security control.

4. Switches, Routers, VLANs — moving traffic

• Switch (Layer 2): connects devices within one network, forwards frames by MAC address (the burned-in hardware address, e.g. AA:BB:CC:11:22:33).
• Router (Layer 3): connects different networks, forwards packets by IP address. Your default gateway is a router.
• VLAN: slices one physical switch into multiple isolated logical networks. Finance on VLAN 10 can't reach IT on VLAN 20 unless traffic passes a router/firewall — which is where you enforce policy. This is what "logical segmentation" means throughout Security+.
• ARP: the protocol that translates "who has IP 192.168.1.1?" into a MAC address. ARP poisoning (Domain 2) forges those answers so traffic flows through the attacker — the classic on-path attack inside a LAN.

5. Common Ports — memorise this table cold

Port numbers identify which service on a machine traffic is for. These come up constantly in exam questions and PBQs:

Exam pattern: "Which port should be blocked/allowed?" — the answer is nearly always about replacing an insecure service with its secure twin (23→22, 80→443, 389→636, 21→22).

6. Core network services

• DNS — the internet's phonebook: translates claude.ai → an IP address. Attacked via poisoning/hijacking (Domain 2); defended via DNS filtering (Domain 4) which blocks lookups of known-bad domains.
• DHCP — automatically hands devices an IP address, gateway, and DNS server when they join a network. A rogue DHCP server can silently hand out a malicious DNS/gateway.
• NTP — synchronises clocks. Security relevance: if clocks drift, log timestamps can't be correlated across systems and Kerberos authentication starts failing.

7. Wireless essentials

• WPA3 — current Wi-Fi encryption standard (WPA2 is the still-common predecessor; WEP is ancient and broken — instant wrong answer unless the question asks for the insecure option).
• Enterprise vs Personal mode: Personal = one shared passphrase; Enterprise = each user authenticates individually via 802.1X → RADIUS server (this trio appears throughout Domains 3-4).
• Rogue AP — an unauthorised access point on your network; an evil twin is a rogue AP impersonating your legitimate SSID to harvest credentials.

8. Putting it together — one mental picture

Internet (untrusted)
   │
[Firewall/NGFW]  ← perimeter: filters by IP/port (L3/L4) and content (L7)
   │
 DMZ / screened subnet  ← public-facing servers live here
   │
[Firewall]
   │
Internal LAN ── switch ── VLAN 10 (staff PCs)
                   │        ← 802.1X: no port access until authenticated
                   └────── VLAN 20 (servers)
                              ← jump server = only admin path in

Every Domain 3 architecture question is some variation of this picture. Every Domain 1 "zero trust" question says: stop assuming the Internal LAN is trustworthy just because it's inside.