Networking — How Computers Talk

What you'll learn

• What an IP address and a port really are
• How data travels in packets
• The everyday protocols: HTTP, DNS, TCP
• TCP vs UDP — reliable delivery vs raw speed
• A real DNS-attack case study that took down half the internet
• Why networking is the #1 skill for security

If you can't read a network, you can't defend it.

The postal system 📮

The internet is a giant postal service for data.

• IP address = a building's street address, like 142.250.185.78. Every device online has one so mail can find it.
• Port = the apartment number inside the building. One computer runs many services; the port says which one. Web = port 80/443, email = 25, SSH = 22.
• Packet = one envelope. Big data (a video) is chopped into thousands of small envelopes, each stamped with source + destination, sent separately, and reassembled at the other end.
• Protocol = the language/rules both sides agree on. HTTP for web pages, DNS for looking up names, TCP for reliable delivery.

DNS is the internet's phone book. You type google.com (easy for humans); DNS translates it to 142.250.185.78 (what machines need). Attackers love DNS because if they poison that translation, they can send you to a fake site.

A web request, start to finish:

1. You type google.com
2. DNS turns it into an IP address
3. Your computer opens a TCP connection to that IP on port 443
4. It sends an HTTP request: "GET me the homepage"
5. Google's server replies with packets of HTML
6. Your browser reassembles and renders them

TCP vs UDP — careful courier or shouting into the wind 📢

Packets travel using one of two delivery styles, and picking the right one matters:

TCP (Transmission Control Protocol) — the careful courier. Before sending anything, it shakes hands with the other side, numbers every packet, waits for confirmation each arrived, and re-sends anything lost. Slower, but nothing goes missing and nothing arrives out of order. Used for web pages (HTTP), email, file transfers — anywhere a missing or scrambled piece would break things.

UDP (User Datagram Protocol) — shouting into the wind. No handshake, no confirmation, no re-sending. Just fire packets and hope. Much faster and lower overhead, but packets can arrive late, out of order, or not at all. Used for video calls, live streaming, and online games — where a dropped frame is fine, but waiting for a resend would make the call laggy and useless.

The one-line test: if losing a piece of data would break the whole thing (a bank transfer, a webpage), use TCP. If a missing piece just means one blip and moving on (a video call), UDP is faster and good enough.

Real-world case study: the 2016 Dyn DNS attack 🔍

In October 2016, attackers used the Mirai botnet — hundreds of thousands of hacked security cameras and routers — to flood Dyn, a company providing DNS service for major websites, with junk traffic (a DDoS attack). Because so many sites relied on Dyn's DNS, when Dyn went down, the translation service itself stopped working — even though Twitter, Netflix, Reddit, PayPal, and Spotify's actual servers were perfectly fine, users worldwide couldn't reach them, because their browsers couldn't turn the domain names into IP addresses anymore.

This is exactly why the earlier lesson called DNS "a favorite attacker target": it's a single point of failure that, if broken, takes down services that never actually failed themselves. It's also why large sites now use multiple DNS providers as backup.

Summary

• IP = address, Port = service, Packet = envelope, Protocol = shared language
• TCP = reliable but slower (web, email); UDP = fast but no guarantees (calls, gaming)
• DNS maps names → IPs (a favorite attacker target — as the 2016 Dyn attack proved at scale)
• You wrote a real IP validator and a port-service identifier in Python

Practice: open a terminal and try ping google.com and nslookup google.com to watch DNS and packets in action. Next: Linux, the operating system of servers and security tools.