OSI & TCP/IP Models

Every attack or defense operates at some layer. Naming the layer tells you which tools apply.

OSI (7): Application, Presentation, Session, Transport (ports, TCP/UDP), Network (IP), Data Link (ARP), Physical.

TCP vs UDP — TCP is reliable and performs the 3-way handshake (SYN → SYN/ACK → ACK); scanners rely on how a host answers it. UDP is fire-and-forget.

Encapsulation: [ Ethernet [ IP [ TCP [ HTTP ] ] ] ]. Reading traffic means peeling these back one layer at a time.