Chapter 11 — Networks and protocols
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Layers"]
N2["11.2 Addressing plan"]
N3["Lab — Subnet plan"]
N4["11.3 Reading the plan"]
N5["11.4 Protocols in use"]
N6["Name resolution and time"]
N7["Transport choices"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Layers"]
N2["11.2 Addressing plan"]
N3["Lab — Subnet plan"]
N4["11.3 Reading the plan"]
N5["11.4 Protocols in use"]
N6["Name resolution and time"]
N7["Transport choices"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Layers]
|
v
[11.2 Addressing plan]
|
v
[Lab — Subnet plan]
|
v
[11.3 Reading the plan]
|
v
[11.4 Protocols in use]
|
v
[Name resolution and time]
|
v
[Transport choices]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) explain addressing, routing and transport; (2) plan subnets; (3) identify protocols in use.
11.1 Layers
Networks are built in layers: physical links, Ethernet switching, IP routing, transport protocols such as TCP and UDP, and applications. Security controls work at different layers: switch port security at Ethernet, firewalls at IP and transport, TLS at application.
Layered models separate network functions: physical transmission, local delivery, routing between networks, end-to-end transport and applications. Each layer relies on the one below. Security controls also sit at particular layers, such as port security at the link layer, filtering at the network layer, and authentication at the application layer. Knowing which layer a control works at shows which threats it can and cannot address.
11.2 Addressing plan
Segmentation needs a clean addressing plan. Each zone gets its own subnet sized for its devices with growth room. Kofi uses a private block from RFC 1918 space.
An addressing plan assigns each zone its own subnet with room to grow, using a consistent pattern so that an address reveals its zone. When subnets map neatly to zones, firewall rules can refer to whole subnets rather than individual hosts, which keeps rules short and makes errors easier to spot. Documenting the plan in one place prevents accidental overlaps.
Lab — Subnet plan
"""Split a synthetic 10.40.0.0/16 site block into zone subnets (stdlib only)."""
import ipaddress as ip
need = {"staff": 600, "servers": 120, "voice": 300, "cctv": 80, "guest": 400, "mgmt": 30}
pool = list(ip.ip_network("10.40.0.0/16").subnets(new_prefix=22))
plan = {}; nxt = 0
for z, n in sorted(need.items(), key=lambda x: -x[1]):
bits = (n + 2 - 1).bit_length(); pref = 32 - bits
net = list(pool[nxt].subnets(new_prefix=pref))[0]; nxt += 1
plan[z] = net; print(f"{z:8} hosts {n:4d} -> {net} ({net.num_addresses - 2} usable)")
print("overlaps:", any(a.overlaps(b) for i, a in enumerate(plan.values()) for b in list(plan.values())[i+1:]))
Run with python3 lab_subnet.py. Verified output:
staff hosts 600 -> 10.40.0.0/22 (1022 usable)
guest hosts 400 -> 10.40.4.0/23 (510 usable)
voice hosts 300 -> 10.40.8.0/23 (510 usable)
servers hosts 120 -> 10.40.12.0/25 (126 usable)
cctv hosts 80 -> 10.40.16.0/25 (126 usable)
mgmt hosts 30 -> 10.40.20.0/27 (30 usable)
overlaps: False
11.3 Reading the plan
The script assigns staff a /22 with 1022 usable addresses, guest and voice /23s, servers and CCTV /25s and management a /27. No subnets overlap. Each zone starts on its own /22 boundary, leaving room to grow and making firewall rules simple to write.
Reading an addressing plan, an engineer checks that subnets do not overlap, that each is large enough for expected devices, and that related zones are grouped so they can be summarised. Gaps left between blocks allow future expansion without renumbering. A plan that fails these checks will cause problems once routing and rules are built on it.
11.4 Protocols in use
Kofi lists protocols each zone needs: HTTPS and SMB for staff to servers, SIP over TLS for voice, RTSP for CCTV and SSH for management. This list becomes the basis of the policy.
Before designing rules, engineers list the protocols the organisation actually relies on, such as DNS, DHCP, web traffic, file sharing, printing and voice. Each has known ports and behaviours. Writing this list from evidence, such as synthetic flow summaries in a lab, rather than from assumptions, prevents rules that block a forgotten but essential service.
Name resolution and time
Two supporting services underpin everything else: DNS, which turns names into addresses, and time synchronisation, which keeps logs consistent. Every zone needs access to the council's DNS resolvers and time servers, so these flows appear in the protocol list even though nobody thinks of them as applications. NIST SP 800-81-2 gives guidance on secure DNS deployment, including restricting which hosts can query internal resolvers. Kofi places the resolvers in the server zone and allows DNS from each zone only to them, not to arbitrary external servers.
Transport choices
TCP provides reliable, ordered delivery with connection set-up; UDP sends independent datagrams without set-up. Voice traffic often uses UDP for media because late packets are useless, while file access uses TCP. These differences affect firewall design: stateful firewalls track TCP connections clearly, while UDP flows are tracked with timeouts. Kofi notes which protocols each zone uses on which transport, because rules must specify both, and because short UDP timeouts can break long phone calls if set too aggressively. He records the timeout chosen for each UDP service and the reason, so later engineers can tune it safely.
Worked example
The management /27 has exactly 30 usable addresses; Kofi notes it should grow to /26 if devices increase.
Synthetic case. Addresses are synthetic.
Errors and limits
Tight subnets leave no growth room; renumbering later is disruptive.
Exercises
- EX031 — Usable hosts. How many usable addresses in a /25? Rubric: 3 = 126;; 2 = value;; 1 = vague;; 0 = none.
- EX032 — Boundary choice. Why start each zone on a /22 boundary? Rubric: 3 = growth and simple rules;; 2 = growth;; 1 = vague;; 0 = none.
- EX033 — Layer mapping. Match TLS and firewall rules to layers. Rubric: 3 = application vs network/transport;; 2 = one;; 1 = vague;; 0 = none.
Synthesis
A clean addressing plan and protocol list are the foundation of segmentation.
Continue studying — chapter 11 of 50
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →