OSI model layers

Physical, Data Link, Network, Transport, Session, Presentation, Application, from bottom (Layer 1) to top (Layer 7). Know which layer common devices and attacks operate at: a bridge or Layer 2 switch operates at the data link layer, and a router at Layer 3. A useful habit is to identify the layer of any attack or control in a scenario.[3][4][5]

TCP three-way handshake

SYN, then SYN-ACK, then ACK: the procedure TCP uses to establish a connection. Understanding this is essential for grasping SYN flood attacks (a stream of SYNs from phony source addresses forces the target to hold state for connections that never complete) and stateful firewall inspection (a session is marked established once the handshake completes).[6][7][8]

Firewall generations

Packet filtering (stateless, looks at headers, not content), then stateful inspection (tracks each connection in a state table), then application firewalls (stateful protocol analysis, also called deep packet inspection, which adds basic intrusion detection) and application-proxy gateways (a proxy agent that inspects the actual content). Unified threat management devices bundle a firewall with functions such as malware detection and probe blocking.[8][9][10][11][12]

VPN protocols

IPsec (network layer, tunnel or transport mode) vs. TLS-based VPNs (still usually called SSL VPNs; a transport layer VPN that is much harder to block because it can run on any port, typically 443). Know that IPsec tunnel mode encrypts the whole original packet including headers, while transport mode keeps the original IP header and encrypts only the payload.[13][14][15]

Network segmentation and Zero Trust

DMZs (subnetworks separated from internal networks) and micro-segmentation (placing resources on their own segment behind a gateway) limit lateral movement, which perimeter-only security leaves unhindered. Zero Trust extends this: no implicit trust is granted based solely on network location or asset ownership, and authentication and authorization happen before every session to a resource.[17][18][19][20]

IPSec tunnel mode vs. transport mode

Tunnel mode encrypts the entire original IP packet, header included, inside a new packet (used for site-to-site gateway VPNs and remote access, and required to cross NAT); transport mode reuses the original IP header and encrypts only the payload, leaving that header exposed (typically used between a pair of hosts for end-to-end protection).[15][16]

Stateful vs. stateless firewall

Stateless evaluates each packet independently against its ruleset and cannot associate multiple requests within a session; stateful tracks the state of active connections in a state table and can make decisions based on context, such as automatically allowing all subsequent traffic for a session once its TCP handshake has completed.[8][9]