The ultimate goal of networking knowledge is building defensible systems. In this final module, we integrate all prior layers to analyze enterprise perimeter defenses, intrusion detection systems, Zero Trust segmentation, and traffic capture analysis.
1. Firewalls: Stateless vs. Stateful vs. Next-Gen (NGFW)
| Firewall Generation | Operating Layers | Inspection Mechanism | Limitations |
|---|---|---|---|
| Stateless Packet Filters (ACLs) | Layer 3 / 4 | Inspects each packet in isolation against static rules (Src/Dst IP, Port, Protocol). | No awareness of connection state. Vulnerable to ACK spoofing; requires wide ephemeral port ranges open for return traffic. |
| Stateful Inspection (SPI) | Layer 3 / 4 / 5 | Maintains a dynamic State Table tracking TCP handshakes and UDP sessions. Automatically allows legitimate return traffic. | Blind to Layer 7 encrypted payloads. Vulnerable to state-table exhaustion attacks. |
| Next-Generation Firewall (NGFW) | Layers 3 through 7 | Performs Deep Packet Inspection (DPI), TLS decryption, application identification (App-ID), user identity integration, and integrated IPS. | Requires high computational throughput and managed SSL/TLS decryption certificates. |
2. IDS vs. IPS (Intrusion Detection & Prevention)
Network security monitoring tools inspect packet streams to identify known exploit patterns and suspicious behaviors:
- NIDS (Network Intrusion Detection System): Deployed out-of-band via switch SPAN (Port Mirroring) or Test Access Points (TAPs). Passively monitors packet copies; alerts security operations without impacting traffic latency.
- NIPS (Network Intrusion Prevention System): Placed directly in-line with network traffic. Actively drops malicious packets, resets connections (TCP RST), or updates firewall rules dynamically.
- Signature-Based: Matches byte sequences against databases of known attack signatures (e.g. Snort/Suricata rules). Fast and low false-positive rate, but blind to zero-day exploits and obfuscated payloads.
- Anomaly / Heuristic-Based: Establishes a baseline of normal network behavior (bandwidth, packet rates, typical protocol distributions) and triggers alerts on statistical outliers. Capable of catching novel attacks, but prone to higher false-positive rates.
3. Network Segmentation & Zero Trust Architecture
Traditional network security relied on a "castle-and-moat" perimeter model (assuming everything inside the LAN was trusted). Modern security employs Zero Trust Architecture (NIST SP 800-207) under the core principle: "Never Trust, Always Verify."
Demilitarized Zone (DMZ)
An isolated physical or logical subnet separating public-facing servers (Web, Reverse Proxy, Mail) from the private internal corporate network. If a web server is breached, the attacker cannot pivot directly into internal databases.
Microsegmentation
Enforces granular security policies between individual workloads and servers, preventing lateral movement within the same VLAN or datacenter cluster.
Least Privilege Access
Every request—whether originating inside or outside the network—must be explicitly authenticated, authorized, and encrypted before access is granted.
4. Packet Analysis & Investigation (Wireshark / tcpdump)
Security analysts must be proficient at analyzing raw packet captures (PCAP). Below are standard Wireshark display filters used in SOC investigations:
# Detect SYN-only packets (SYN Scan or SYN Flood):
tcp.flags.syn == 1 && tcp.flags.ack == 0
# Detect potential ARP spoofing / duplicate IP claims:
arp.duplicate-address-frame || arp.opcode == 2
# Filter cleartext HTTP POST requests (credential harvesting):
http.request.method == "POST"
# Filter anomalous high-volume DNS requests (DNS Tunneling):
dns.flags.response == 0 && dns.qry.name.len > 40
# Isolate traffic to/from a specific suspicious host on non-standard ports:
ip.addr == 192.168.1.105 && !(tcp.port in {80, 443, 53, 22})
# Capture packets directly on Linux using tcpdump:
tcpdump -i eth0 -nn -w capture.pcap "tcp and port 443"