Network Security
482 words
2 min read
Visual companion
Python
Type and operator map
Python Week 1: the first filter for runtime behavior
View
Revision summary
What this note is really saying
Short form
# Network Security ## 🎯 Learning Objectives - Explain how firewalls filter traffic at different layers - Trace the TLS 1.3 handshake - Identify common network attacks and defenses - Configure VPN tunneling concepts * * * ## 1. Firewalls Type Layer How it Works Example Packet filter 3-4 Inspect headers only iptables...
Network Security
🎯 Learning Objectives
- Explain how firewalls filter traffic at different layers
- Trace the TLS 1.3 handshake
- Identify common network attacks and defenses
- Configure VPN tunneling concepts
1. Firewalls
| Type | Layer | How it Works | Example |
|---|---|---|---|
| Packet filter | 3-4 | Inspect headers only | iptables |
| Stateful | 3-4 | Track connection state | pfSense |
| Application (Proxy) | 7 | Inspect payload | Squid |
| Next-Gen (NGFW) | 3-7 | Deep packet inspection | Palo Alto |
2. TLS Handshake (1.3)
(Diagram)
Key improvements over TLS 1.2:
- 1-RTT vs. 2-RTT handshake
- Removed insecure ciphers (RC4, 3DES)
- 0-RTT resumption for returning clients
- Perfect Forward Secrecy by default
3. Common Network Attacks
| Attack | Target | Mechanism | Defense |
|---|---|---|---|
| DDoS | Availability | Botnet floods traffic | Rate limiting, CDN |
| MITM | Confidentiality | Intercept communication | TLS certificate pinning |
| ARP spoofing | LAN | Fake ARP replies | Dynamic ARP inspection |
| DNS poisoning | DNS cache | Corrupt resolver cache | DNSSEC |
| SYN flood | TCP | Half-open connections | SYN cookies |
| IP spoofing | Source auth | Fake source address | Ingress filtering |
4. VPNs
| Protocol | Port | Encryption | Speed |
|---|---|---|---|
| IPsec | 500/4500 | AES, 3DES | Moderate |
| OpenVPN | 1194/UDP | TLS-based | Good |
| WireGuard | 51820/UDP | ChaCha20 | Excellent |
| PPTP | 1723 | MPPE (broken) | Fast (insecure) |
Tunneling: Original packet → encapsulate in VPN header + encrypt → outer IP header → send over internet.
5. Common Pitfalls
Pitfall: Assuming Encryption Solves All Security
The mistake: Thinking TLS/HTTPS protects against all attacks.
Correct approach: TLS protects confidentiality and integrity in transit. But endpoints can still be compromised, metadata leaks, and application bugs bypass encryption.
6. Key Concepts Reference
| Concept | Layer | Purpose |
|---|---|---|
| TLS | 5-6 (Session/Presentation) | Encrypts TCP connections |
| IPsec | 3 (Network) | Encrypts IP packets |
| WireGuard | 3 (Network) | Modern VPN protocol |
| DDoS mitigation | 3-7 | Absorb attack traffic |
| IDS/IPS | 3-7 | Detect/prevent intrusions |
| NAT | 3 (Network) | Hide internal addresses |
7. 📝 Practice Questions
Q1: How many round trips does TLS 1.3 take for a new connection?Answer: 1-RTT for the full handshake (ClientHello → ServerHello + Finished). 0-RTT for resumption (Client sends data immediately with pre-shared key). Compare: TLS 1.2 takes 2-RTT (plus TCP's 1-RTT = 3 total for TCP+TLS 1.2 vs 2 total for TCP+TLS 1.3). Q2: A SYN flood sends many SYN packets without completing the handshake. How does SYN cookie defense work?Answer: Server encodes connection info in the SYN-ACK sequence number (using a hash of src/dst IP/port + secret). When ACK returns, server recomputes the hash to verify without allocating state. This prevents memory exhaustion from half-open connections. Only works if TCP timestamps are available. Q3: Why does OpenVPN use UDP by default?Answer: UDP avoids TCP-over-TCP performance issues (TCP retransmissions inside TCP tunnels cause exponential backoff collapse). OpenVPN implements its own reliable delivery on top of UDP. WireGuard also uses UDP for the same reason. Q4: What is DNSSEC and why isn't it widely deployed?Answer: DNSSEC adds digital signatures to DNS records, allowing resolvers to verify authenticity. Limited adoption due to: (1) Operational complexity (key management, re-signing). (2) Performance overhead (larger responses). (3) Zone walking (enumerating all records). (4) Cost/complexity for domain owners.
8. 🔗 Cross-References
- Week 2 - TCP: TCP handshake vulnerabilities
- Week 5 - Application Layer: HTTPS, DNSSEC
- BSCS4003 (Privacy & Security): Cryptography, TLS Join Discord PreviousApplication LayerNextWireless Networks