The TCP/IP Model for Security

Why the Model Matters for Security

The TCP/IP model groups network communication into four layers. Understanding which layer a protocol operates at is not academic — it determines which security controls can protect against which attacks. A firewall that filters at the network layer cannot inspect application-layer content. An intrusion detection system that monitors the transport layer cannot detect DNS tunneling.

Layer 1: Link Layer (Network Interface)

The link layer handles communication between devices on the same physical network segment. It deals with MAC addresses, Ethernet frames, and ARP (Address Resolution Protocol).

Protocols: Ethernet, Wi-Fi (802.11), ARP, PPP

Security concerns:

• ARP spoofing: ARP is stateless and unauthenticated. Any device on the local network can send an ARP reply claiming to be any other device. An attacker sends gratuitous ARP replies associating their MAC address with the gateway's IP, causing all traffic to flow through the attacker's machine (man-in-the-middle).

# Detect ARP spoofing: check for duplicate MAC addresses in the ARP cache
arp -a
# Look for multiple IP addresses mapped to the same MAC address

• MAC flooding: An attacker sends frames with thousands of different source MAC addresses, filling the switch's MAC address table. When the table is full, the switch falls back to broadcasting all traffic, allowing the attacker to capture everything.

• VLAN hopping: An attacker sends frames with double 802.1Q tags to jump from one VLAN to another, bypassing network segmentation.

Defenses: Dynamic ARP inspection (DAI), port security (limiting MAC addresses per port), static ARP entries for critical systems, 802.1X network access control.

Layer 2: Internet Layer

The internet layer handles routing and addressing across networks. It deals with IP addresses and determines how packets travel from source to destination.

Protocols: IP (IPv4, IPv6), ICMP, IPsec

Security concerns:

• IP spoofing: The source IP address in a packet header is trivially forgeable. An attacker sends packets with a spoofed source IP to evade IP-based access controls, hide their identity, or amplify DDoS attacks (reflection attacks).

# Detect IP spoofing: check for packets with internal source IPs arriving on external interfaces
# On a router or firewall:
# deny ip 10.0.0.0/8 any in outside

• ICMP abuse: ICMP echo requests (ping) can be used for network reconnaissance, and ICMP redirect messages can manipulate routing tables. ICMP tunneling can exfiltrate data bypassing firewall rules that allow ICMP.

• IP fragmentation attacks: Attackers craft fragmented packets that overlap or exceed the maximum packet size, causing the target's reassembly buffer to overflow (Ping of Death, Teardrop).

Defenses: Ingress/egress filtering (BCP 38) to block spoofed source addresses, ICMP rate limiting, IP fragmentation reassembly validation, IPsec for authentication and encryption.

Layer 3: Transport Layer

The transport layer provides end-to-end communication services. It deals with ports, connections, and reliability.

Protocols: TCP, UDP

Security concerns:

• TCP SYN flood: An attacker sends TCP SYN requests without completing the three-way handshake, exhausting the server's connection table. Each half-open connection consumes memory until the server cannot accept legitimate connections.

# Detect SYN flood: count half-open connections
netstat -n -p tcp | grep SYN_RECV | wc -l
# Or on Linux:
ss -n state syn-recv | wc -l

• TCP session hijacking: An attacker predicts or captures a TCP sequence number and injects packets into an established session. If the attacker can sniff the traffic, they can take over the session.

• Port scanning: An attacker probes for open ports to discover running services. SYN scans, FIN scans, and NULL scans each exploit different TCP behaviors to evade detection.

• UDP flood: UDP is connectionless, so an attacker can flood a target with UDP packets to random ports, forcing the target to send ICMP port unreachable responses, consuming bandwidth and CPU.

Defenses: SYN cookies (allow the server to handle SYN floods without storing state), TCP sequence number randomization, stateful firewalls that track connection state, rate limiting.

Layer 4: Application Layer

The application layer provides services directly to user applications. It deals with data formats, sessions, and application-specific protocols.

Protocols: HTTP, HTTPS, DNS, SSH, FTP, SMTP, TLS/SSL

Security concerns:

This is where the majority of attacks occur because this is where the data is most valuable and the attack surface is largest:

• HTTP attacks: SQL injection, cross-site scripting, request smuggling, HTTP response splitting
• DNS attacks: DNS poisoning, DNS tunneling, DNS amplification
• TLS attacks: Downgrade attacks, certificate spoofing, heartbleed (OpenSSL vulnerability)
• Application-layer DDoS: HTTP floods that mimic legitimate traffic, making them harder to distinguish from real users

Defenses: Web application firewalls (WAF), input validation, TLS 1.3, DNSSEC, application-layer rate limiting, API gateways.

Why Layer Matters for Security Controls

The critical insight: a control at one layer cannot protect against attacks at another layer.

• A network-layer firewall (Layer 3) can block traffic to a specific IP and port, but it cannot detect SQL injection in an HTTP request (Layer 4).
• A WAF (Layer 4) can detect and block SQL injection, but it cannot prevent ARP spoofing on the local network (Layer 1).
• TLS (Layer 4) encrypts application data, but it does not prevent IP spoofing of the underlying packets (Layer 2).
• A host-based intrusion detection system that monitors system calls cannot detect a SYN flood at the network interface (Layer 3).

This is why defense in depth requires controls at multiple layers. No single control is sufficient because no single layer is the only attack surface.

From Attack Description to Layer to Defense

The practical skill is taking a described attack, identifying which layer it targets, and selecting the appropriate defensive control. Let's work through real scenarios.

Scenario 1: The Man-in-the-Middle on the Coffee Shop Wi-Fi

An attacker at a coffee shop sets up a rogue access point with the same SSID as the shop's Wi-Fi. Victims connect to the attacker's AP, and the attacker intercepts all traffic.

Layer: Link (Layer 1) — the attack exploits the wireless association process and ARP.

Why a higher-layer control does not help: TLS encrypts the application data, but the attacker can still see which sites you visit (through DNS queries and SNI), and if any traffic is unencrypted, the attacker reads it directly. TLS does not prevent the interception — it only limits what the attacker can read from intercepted traffic.

Appropriate defenses:

• VPN (creates an encrypted tunnel at Layer 3, protecting all traffic regardless of the wireless network)
• Certificate pinning (prevents the attacker from presenting a fake TLS certificate)
• HSTS (prevents SSL stripping downgrade attacks)
• 802.1X authentication (prevents unauthorized APs from joining the network)

Scenario 2: The DDoS Attack on the DNS Server

An attacker uses a botnet to flood a company's DNS server with queries, preventing domain resolution.

Layer: Application (Layer 4) — the attack targets the DNS protocol specifically, not the network connectivity.

Why a network-layer control is insufficient: A network-layer firewall can rate-limit traffic to the DNS server's IP, but it cannot distinguish legitimate DNS queries from malicious ones. Rate-limiting all DNS traffic blocks legitimate users along with the attack.

Appropriate defenses:

• DNS rate limiting (RRL — Response Rate Limiting) at the DNS server
• Anycast DNS (distributes queries across multiple geographically dispersed servers)
• DNS filtering (blocks queries to known malicious domains)
• Upstream DDoS mitigation (absorbs the flood before it reaches your network)

Scenario 3: The IP Spoofing Attack on the Firewall

An attacker sends packets with a spoofed source IP matching an allowed internal address, bypassing the firewall's IP-based access rules.

Layer: Internet (Layer 2) — the attack exploits the forgeable source IP address in the packet header.

Why an application-layer control does not help: The firewall makes its allow/deny decision based on the source IP before the application layer is even involved. By the time the application sees the request, the firewall has already allowed it through.

Appropriate defenses:

• Ingress filtering (BCP 38): block packets with internal source IPs arriving on external interfaces
• Stateful inspection: track connection state rather than just source IP
• IPsec authentication: cryptographically verify the source of each packet
• Unicast Reverse Path Forwarding (uRPF): verify that the source IP is reachable via the interface the packet arrived on

Scenario 4: The TCP Session Hijacking Attack

An attacker on the same network segment sniffs TCP traffic, predicts the sequence number, and injects a malicious packet into an established session.

Layer: Transport (Layer 3) — the attack exploits the predictability of TCP sequence numbers.

Why a link-layer control does not help: The attacker is on the same network segment, so link-layer controls (port security, 802.1X) have already been satisfied — the attacker is an authorized device on the network.

Appropriate defenses:

• TCP sequence number randomization (modern operating systems implement this)
• TLS encryption (the attacker can read the sequence numbers but cannot inject valid encrypted packets)
• Network segmentation (limits the attacker's ability to sniff traffic on other segments)
• Intrusion detection systems that detect anomalous sequence numbers

The Layer-Appropriate Defense Matrix

The pattern is clear: match the defense to the layer of the attack. A mismatched defense wastes resources and creates a false sense of security.

Practice: Analyze Your Network

For each service in your environment, ask:

1. Which layer does this service operate at?
2. Which layers are exposed to potential attackers?
3. What controls exist at each exposed layer?
4. Where are the gaps — layers with no controls?

The gaps are your highest-risk areas because they are the layers where an attacker can operate without detection.