Network Basics · Topic 1 of 2
Network Reference Models
Learn the OSI and TCP/IP models, encapsulation and PDUs, TCP versus UDP, the three-way handshake and common protocol ports for HCIA-Security H12-711.
- 5 min
- OSI has seven layers; TCP/IP merges the top three into one application layer.
- PDUs: data, segment, packet, frame, bits. Ports live in layer 4, IP addresses in layer 3, MAC addresses in layer 2.
- IP protocol numbers: ICMP 1, TCP 6, UDP 17. Ethernet Type: IPv4 0x0800, ARP 0x0806.
What it is
A network reference model splits communication into layers. Each layer has one job, uses the service of the layer below and serves the layer above, so protocols and devices from different vendors can work together.
The OSI model from ISO has seven layers and is the reference for teaching. The TCP/IP model is the one the internet actually runs on. Security devices are often described by the highest layer they can inspect.
How it works
OSI and TCP/IP layers
| OSI layer | Job | TCP/IP layer | Example protocols |
|---|---|---|---|
| 7 Application | Services for applications | Application | HTTP, FTP, DNS, SMTP, Telnet, SSH |
| 6 Presentation | Data format, encryption, compression | Application | Coding and encryption formats |
| 5 Session | Set up and end sessions | Application | Session control |
| 4 Transport | End to end delivery between ports | Transport | TCP, UDP |
| 3 Network | Logical addressing and routing | Internet (network) | IP, ICMP, IPsec |
| 2 Data link | Framing and MAC addressing on one link | Network access (link) | Ethernet, PPP |
| 1 Physical | Bits on the medium | Network access (link) | Cables, signals |
The TCP/IP model merges OSI layers 5 to 7 into one application layer. A common teaching version keeps five layers: application, transport, network, data link and physical.
Encapsulation and PDUs
On the way down, each layer adds its own header, and the data link layer also adds a trailer (the FCS). This is encapsulation. The receiver removes the headers layer by layer, which is decapsulation.
| Layer | PDU name | Key address or identifier |
|---|---|---|
| Application | Data (message) | Application content |
| Transport | Segment (TCP) or datagram (UDP) | Port number |
| Network | Packet | IP address |
| Data link | Frame | MAC address |
| Physical | Bits | None |
Each header also says what it carries next. The Ethernet Type field shows 0x0800 for IPv4 and 0x0806 for ARP. The IP Protocol field shows 1 for ICMP, 6 for TCP and 17 for UDP, and the transport header gives the destination port.
TCP and UDP
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection oriented | Connectionless |
| Reliability | Sequence numbers, acknowledgments, retransmission | None |
| Flow control | Sliding window | None |
| Header | 20 bytes minimum | 8 bytes |
| Typical use | Web, file transfer, remote login, email | DNS queries, DHCP, SNMP, voice and video |
TCP opens a connection with a three-way handshake: SYN, then SYN+ACK, then ACK. It closes with a four-way exchange of FIN and ACK in each direction. A firewall uses these flags to judge the state of a TCP session.
Common protocols and ports
| Protocol | Transport and port | Purpose |
|---|---|---|
| FTP | TCP 20 (data), 21 (control) | File transfer |
| SSH | TCP 22 | Secure remote login, SFTP |
| Telnet | TCP 23 | Plain text remote login |
| SMTP | TCP 25 | Sending email |
| DNS | UDP 53, and TCP 53 | Name resolution |
| DHCP | UDP 67 (server), 68 (client) | Address assignment |
| TFTP | UDP 69 | Simple file transfer |
| HTTP | TCP 80 | Web |
| POP3 | TCP 110 | Receiving email |
| SNMP | UDP 161, 162 (traps) | Network management |
| HTTPS | TCP 443 | Web over TLS |
ARP resolves a known IP address to a MAC address on the local link. ICMP carries error and test messages such as ping (echo request and echo reply).
Threats by layer
Attacks also map onto layers, which is why defenses are layered too.
| Layer | Example attack |
|---|---|
| Data link | MAC flooding, ARP spoofing |
| Network | IP spoofing, ICMP floods |
| Transport | SYN flood, port scanning |
| Application | SQL injection, malicious web pages, email phishing |
A worked example
A user browses to a web server. The browser creates an HTTP request. TCP adds a header with destination port 80, IP adds the server's address and protocol number 6, and Ethernet adds the MAC address of the next hop and Type 0x0800.
A firewall on the path reads the IP addresses, the protocol and the ports. That gives it the 5-tuple that identifies the flow, which the firewall chapter uses for its session table.
How the exam asks about this
- "At which OSI layer does a router forward packets based on IP address?" → Layer 3, the network layer.
- "Which value in the IP Protocol field identifies UDP?" → 17.
- "Which protocols use UDP?" → DNS queries, DHCP, TFTP and SNMP.
What to remember for the exam
- OSI has seven layers; TCP/IP merges the top three into one application layer.
- PDUs: data, segment, packet, frame, bits. Ports live in layer 4, IP addresses in layer 3, MAC addresses in layer 2.
- IP protocol numbers: ICMP 1, TCP 6, UDP 17. Ethernet Type: IPv4 0x0800, ARP 0x0806.
- TCP is connection oriented and reliable with a three-way handshake; UDP is connectionless with an 8-byte header.
- Learn the port table: FTP 20 and 21, SSH 22, Telnet 23, SMTP 25, DNS 53, HTTP 80, HTTPS 443.
DNS is not UDP only. Normal queries use UDP 53, but zone transfers and large responses use TCP 53.
Common mistakes
Thinking ARP crosses routers. ARP resolves IP to MAC only on the local link, with a broadcast request. To reach a remote host, a PC resolves the MAC of its gateway instead.
Mixing up FTP ports. Port 21 carries the commands and port 20 carries the data in active mode. In passive mode the data port is negotiated.
Thinking encapsulation adds only headers. The data link layer adds a trailer too, the frame check sequence that detects errors.
Check yourself
Which PDU name is used at the transport layer for TCP?
A segment. UDP's unit is usually called a datagram, the network layer's a packet, and the data link layer's a frame.
What are the three messages of the TCP three-way handshake, in order?
SYN from the client, SYN+ACK from the server, then ACK from the client.
Which fields make up the 5-tuple that identifies a flow?
Source IP address, destination IP address, source port, destination port and protocol.
Topic 1 of 2 in Network Basics
Test yourself on Network Basics
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.