Hack the Route Start free Open app Reference
255 networking concepts
Each one explained plainly, layer by layer, with the labs where you see it happen on real machines.
Link
One network: frames, hardware addresses and switches.
Ethernet and ARP
Frames, hardware addresses and finding them.
- OSI model Seven layers that split networking into jobs, from signals on a cable to the program, each wrapping the one above.
- MAC address The 48-bit address of a network card, used to deliver frames within one network.
- Network interface A card a machine sends and receives through, switched on or off, with or without a live link.
- Interface counters What a card has counted since it started: packets and bytes each way, and every frame it dropped or found damaged.
- Duplex and speed Whether a link's two ends may send at the same time, and how fast: agreed by auto-negotiation, or set by hand.
- Ethernet frame The envelope a packet travels in across one link: destination MAC, source MAC, type, payload.
- ARP How a device finds the MAC address behind an IP address on its own network.
- MTU The largest IP packet a link carries in one frame: 1500 bytes on ordinary Ethernet.
Switches and VLANs
One network, or several on one switch.
- Switch Joins devices into one network, forwarding each frame toward the port its destination MAC was seen on.
- Hub The switch's ancestor: it repeats every frame out of every port, so everyone hears everything.
- MAC address table A switch's record of which port each MAC address was last seen on, learned from source addresses.
- MAC flooding Filling a switch's MAC table with made-up addresses so that it floods everyone's frames to every port.
- Port security A limit on how many MAC addresses one switch port accepts; one more is a violation that drops the frame or shuts the port.
- Port mirroring (SPAN) A switch copying every frame of some ports out of another port, where a sensor or capture box listens.
- Spanning tree The protocol that lets switches be cabled in loops by electing a root and blocking the ports that close a loop.
- Edge port A spanning-tree port that faces a single host, so it forwards the instant the link is up — plus the guards that protect it.
- Link aggregation Several cables between the same two devices joined into one logical link, with one MAC and one address.
- LACP The protocol both ends of a bond speak to agree which cables belong to it, and to notice one failing.
- Broadcast storm A broadcast copied round a loop of switches for ever, because Ethernet frames have no hop limit.
- Broadcast domain The set of devices a broadcast reaches: one network at the link layer.
- VLAN Several separate networks on one switch, kept apart by a tag in each frame.
- VXLAN Ethernet frames carried inside UDP across a routed network, so one segment can span racks or sites.
- Underlay and overlay The physical routed network (underlay) and the virtual networks built on top of it with tunnels (overlay).
- Spine-leaf A data center design where every leaf (rack) switch connects to every spine, so any two racks are two hops apart.
- LLDP Devices announcing their name, port and addresses to whoever is at the other end of each cable.
- CDP Cisco's own discovery protocol, on by default on every Cisco device.
- Trunk One link that carries several VLANs, each frame tagged with its VLAN, usually between switches.
- Voice VLAN A second VLAN on a desk port, tagged, for the IP phone in front of the computer.
- Switched virtual interface A switch's own address inside a VLAN: the VLAN's gateway when the switch routes.
- IGMP snooping A switch reading its devices' IGMP to send each multicast group only out of the ports that joined it.
Wireless and network types
Wi-Fi standards, access points, how a wireless network is locked, and networks named by their reach.
- Wi-Fi standards The 802.11 family: how fast a wireless link goes, on which band, and why the air is shared.
- Access point and controller The bridge between the air and the wired network, and the box that manages many of them.
- Wi-Fi security: WEP, WPA, WPA2, WPA3 How a wireless network keeps strangers off and its frames private, from broken WEP to WPA3.
- Evil twin and rogue access point An access point that copies a trusted network's name to lure clients onto an attacker's radio.
- Deauthentication attack and 802.11w A forged frame that kicks a client off Wi-Fi, and the standard that makes management frames unforgeable.
- WPS A shortcut for joining a WPA network by button or PIN, whose PIN mode is easily guessed.
- MAC filtering Letting in only listed MAC addresses at an access point or switch port: easy to set up, and easy to get past.
- Network types: LAN, WAN, MAN, PAN, SAN Networks named by their reach: a room, a building, a city, the world, or a storage fabric.
Network
Addresses and routes: getting a packet across many networks.
Addressing
IPv4 addresses, subnets and groups.
- IP address A device's address across networks: 32 bits, written as four numbers like 10.0.1.10.
- Subnet and prefix length A block of addresses on one network, written as address/length: 10.0.1.0/24 holds 256 addresses.
- VLSM Cutting one block of addresses into subnets of different sizes, each as big as its network needs.
- Wildcard mask A mask turned inside out, as Cisco ACLs and OSPF use it: 0 bits must match, 1 bits are free.
- Network configuration A machine's four network settings: the card up, an address and subnet, a default route, a DNS server.
- Private addresses Address ranges any organisation may use inside, never routed on the internet: 10/8, 172.16/12, 192.168/16.
- Multicast One packet to a group of listeners, like all OSPF routers on a link (224.0.0.5).
- IGMP How a device tells its network which multicast groups it wants: reports to join, leaves to go, queries to check.
Forwarding
How routers pass packets on, hop by hop.
- Default gateway The router a device sends everything to that is not on its own network.
- First-hop redundancy Two or more routers sharing one virtual gateway address, so hosts keep their gateway when a router fails.
- Router A device on several networks that forwards packets between them, by destination address.
- Routing table The list a device uses to decide where each packet goes next.
- Static route A route typed in by hand: a prefix and the next hop to send it to.
- Floating static route A backup static route with a higher administrative distance, used only when the main route is gone.
- Route summarisation One route standing for many: a shorter prefix that covers several networks behind the same next hop.
- Null route A route that drops what matches it: for addresses a router announces but does not have.
- TTL A counter in every IP packet, lowered by each router; at zero the packet is dropped.
- MPLS Forwarding by a short label put in front of the IP header, instead of by the destination address.
- GRE tunnel A virtual link between two routers: each packet is wrapped in a new IP header between their public addresses.
- VRF One router split into several virtual routers, each with its own routing table and its own interfaces.
- Asymmetric routing Traffic there and back taking different paths, because each router picks its own way out.
Errors and packet size
ICMP, traceroute, fragmentation and path MTU.
- ICMP The network's messages about packets: echo for ping, unreachable, time exceeded, too big.
- Traceroute Lists the routers on the way to a destination, by sending packets with TTL 1, then 2, then 3.
- Fragmentation Cutting a packet that is too big for the next link into pieces, reassembled at the destination.
- Path MTU discovery Learning the largest packet a whole path carries, from the routers' ICMP messages.
Address translation
NAT and port forwarding.
- NAT A router rewriting addresses as packets pass, usually to hide many private devices behind one address.
- Static NAT, dynamic NAT and PAT One address for one device (static), addresses from a pool as devices go out (dynamic), or one address shared by port (PAT).
- Port forward One port on the router's public address passed to one device and port inside.
- STUN A server that tells a device behind NAT the public address and port its packets arrive from.
- UDP hole punching Two peers behind NAT sending to each other at once, so each router takes the other's packets for replies.
- NAT mapping and filtering Whether a NAT keeps one public port per inside port (friendly to peer-to-peer) or picks one per destination.
IPv6
Addresses that build themselves, and neighbour discovery.
- IPv6 The 128-bit Internet Protocol: a /64 prefix for the network, 64 bits for the card.
- Link-local address The fe80:: address every IPv6 card gives itself, valid only on its own link.
- Neighbour discovery IPv6's replacement for ARP, and more: ICMPv6 messages to find neighbours and routers.
- SLAAC Devices build their own IPv6 address from the prefix a router advertises.
- DHCPv6 IPv6's DHCP: addresses (stateful) or only settings (stateless), as the router advertisement's M and O flags say.
- Temporary address A random IPv6 address a device makes beside its stable one and uses for connections it opens.
- Anycast address One address held by several devices; a packet to it reaches the nearest one.
- Dual stack Running IPv4 and IPv6 side by side; each connection picks one.
- NAT64 and DNS64 How an IPv6-only device reaches an IPv4-only server: DNS64 makes up the address, NAT64 translates the packets.
Dynamic routing
Routers that find their routes: RIP, OSPF and BGP, and LDP for labels.
- RIP A distance-vector routing protocol: each router tells its neighbours how many hops away every network is.
- Split horizon Never announce a route back on the card it was learned on; poisoned reverse announces it at infinity instead.
- Counting to infinity Routers in a loop each believe the next about a lost route, raising its metric one step at a time.
- OSPF A routing protocol inside one organisation: routers share a map and compute shortest paths.
- Router ID The 32-bit name an OSPF (or BGP) router goes by, written like an IPv4 address and unique in the domain.
- Designated router The OSPF router a shared segment elects to sync with everyone, so routers need not all sync with each other.
- OSPF network type How OSPF treats a link: broadcast with a DR election, or point-to-point between two routers with none.
- OSPF areas and LSA types OSPF splits a big network into areas around area 0, with border routers summing one area up for another.
- EIGRP Cisco's advanced distance-vector protocol: neighbours share distances, with a backup path worked out in advance.
- LDP Hands out MPLS labels: each router picks a label for every route it has and tells its neighbours.
- Administrative distance How much a router trusts a source of routes, when several offer the same network.
- Autonomous system A network run by one organisation, with a number of its own, as seen by the rest of the internet.
- BGP The protocol between autonomous systems: how the networks of the internet find each other.
- AS path The list of autonomous systems a BGP route crossed: used to choose paths and to prevent loops.
- Local preference A BGP value an AS sets on routes it receives to choose its own way out, checked before the AS path.
- MED (multi-exit discriminator) A BGP value a neighbour attaches to ask which of several links into it you should use.
- BGP community A tag that travels with a BGP route, written AS:value, which does nothing until a policy reads it.
- Route leak Routes announced past where they should go: a customer passing on a transit's routes, or a mistyped more-specific.
- RPKI (route origin validation) Signed records saying which AS may originate a prefix, so a router can drop routes from anyone else.
Containers and cloud networking
Networks built from software: containers on one host, and VPCs, their gateways and firewalls at a provider.
- Network namespace A separate copy of the kernel's network: its own cards, addresses, routes and firewall, which is what a container's network is.
- veth pair Two virtual cards joined like the ends of a cable: what goes in one comes out the other, even across namespaces.
- Published port A host port forwarded to a container's port with a DNAT rule, so others reach a container through its host.
- VPC (virtual private cloud) A private network of your own inside a cloud provider, split into subnets whose route tables decide their way out.
- Internet gateway and NAT gateway The VPC's doors: one-to-one public IPs both ways through the internet gateway, and outbound-only overload through a NAT gateway.
- Security groups and network ACLs The cloud's two firewalls: stateful allow rules on each instance, and stateless numbered rules on each subnet.
- NFV (network functions virtualization) Routers, firewalls, NAT and load balancers run as software on ordinary servers instead of as dedicated boxes.
- Cloud service and deployment models How much the provider runs for you (IaaS, PaaS, SaaS), and whose cloud it is (public, private, hybrid, community).
- SD-WAN A WAN built as encrypted tunnels over several links at once, run from one controller that steers each application onto the best path.
- SASE and SSE SD-WAN joined with security run as a cloud service, so every user gets the same policy wherever they connect from.
Transport
Ports and connections: from one program to another.
Ports, sockets and UDP
Reaching one program on a device.
- Port A 16-bit number that picks the program on a device: web 80 and 443, DNS 53, SSH 22.
- Socket An address plus a port; a connection is named by both ends' sockets.
- Ephemeral port The temporary port a client's kernel picks for each outgoing connection.
- UDP Independent datagrams with ports and nothing else: no connection, no acknowledgement, no retries.
TCP connections
Opening, numbering and closing a connection.
- TCP Reliable, ordered byte streams between programs: handshake, acknowledgements, retransmission.
- Three-way handshake SYN, SYN-ACK, ACK: how TCP opens a connection, each side agreeing on starting sequence numbers.
- Sequence and acknowledgement numbers TCP's byte counters: what this segment carries, and the next byte expected from the other side.
- TCP reset A TCP packet that aborts a connection; the answer to a SYN for a port with no listener.
- TIME-WAIT The state the side that closes first keeps for a while, so stray packets cannot join a new connection.
TCP performance
How fast a connection goes, and what slows it.
- Window and bandwidth-delay product How much data may be unacknowledged at once; to fill a path it must reach bandwidth × round trip.
- Congestion window The sender's own limit on data in flight, grown while all goes well and cut on loss.
- Bufferbloat Delay added by an oversized queue that TCP fills before any packet is dropped.
- AIMD TCP's rule for sharing a link: add a little each round trip, halve on loss.
- Packet loss Packets that never arrive: TCP resends them and halves its window, so a small loss rate caps its speed.
- Quality of service Deciding which traffic waits when a link is full: classify it, then schedule the queue, voice first.
- DSCP Six bits in the IP header that mark a packet's traffic class, such as EF (46) for voice.
- Shaping and policing Two ways to hold traffic to a rate: a shaper queues the excess, a policer drops it.
- MSS The most TCP data per packet, announced in the SYN: the link's MTU minus 40 bytes of headers.
- MSS clamping A router lowering the MSS in TCP SYNs to what its small link carries.
Services
What runs on top: names, addresses handed out, the web.
Names and DNS
Turning names into addresses.
- DNS The distributed directory that turns names like bank.lab into addresses.
- Recursive resolver The DNS server a device asks: it does the whole search and caches the answers.
- Forwarding resolver A resolver that keeps a cache but sends every other question, whole, to one upstream resolver.
- Filtering resolver A resolver that refuses names on a blocklist: it answers NXDOMAIN or a block page without looking them up.
- Authoritative server A DNS server that holds a zone's records and answers for them with the aa flag.
- DNS records The typed entries of a zone: A for an address, CNAME for an alias, NS for delegation, and more.
- Zone transfer How a secondary name server copies a zone from its primary: whole (AXFR) or just the changes (IXFR), prompted by NOTIFY.
- Encrypted DNS DNS questions sent inside TLS (DoT, port 853) or HTTPS (DoH, port 443), so the path cannot read or change them.
- Hosts file A local list of names and addresses, consulted before DNS on most systems.
Network services
Addresses handed out, the web, remote shells.
- DHCP How a device gets its address, gateway and DNS server when it joins a network.
- DHCP relay A router that passes DHCP broadcasts on to a server on another network, so one server can serve many.
- HTTP The web's request and response protocol: plain text over TCP unless wrapped in TLS.
- FTP File transfer over two kinds of connection: commands on port 21, and a separate data connection per transfer.
- TFTP The simplest file transfer: UDP port 69, no login, no listing, no encryption. Network devices load images and configs with it.
- SMTP How mail moves: from a client to its own mail server, then from server to server, found by the domain's MX record.
- IMAP How a reader gets mail from their own server: it stays on the server, in folders, seen alike from every device.
- SMB/CIFS Windows-style file and printer sharing on TCP 445: a client logs in, connects to a named share, and reads or writes its files.
- RDP Remote graphical login on TCP 3389: the client negotiates a security layer, then runs the desktop inside TLS.
- SIP The signaling that sets up a VoIP call on port 5060: INVITE, ringing, 200 OK, ACK — then the audio flows separately over RTP.
- NTP Keeping clocks right by asking other clocks, in a hierarchy of strata from a reference clock down.
- PTP Sub-microsecond time sync on a LAN, timestamping packets as they cross the wire rather than when software reads them.
- NTS Authenticating an NTP server over TLS so a spoofed or man-in-the-middle time source is refused.
- Virtual host Many sites on one address and port, told apart by the Host header in each request.
- HTTP keep-alive Several HTTP requests over one TCP connection instead of a new handshake for each.
- HTTP/2 HTTP's meaning in binary frames: many requests as streams over one TCP connection, headers compressed.
- HTTP/3 and QUIC HTTP over QUIC: a transport on UDP port 443 with TLS 1.3 built in and streams that do not block each other.
- ALPN The TLS extension in which client and server agree on the protocol to speak inside, such as h2 or http/1.1.
- SSH Encrypted remote login and commands, on TCP port 22, with passwords or keys.
Load balancing
Many servers behind one address.
- Load balancer One address in front of many servers, spreading connections between them and skipping the unhealthy.
- Health check A regular probe a load balancer sends each backend, to stop using those that fail.
- Least connections A balancing policy that sends each new request to the backend with the fewest connections still open.
Monitoring
Watching a running network: counters, flows and logs.
- Network monitoring Knowing what a running network does: counters that say how busy, flows that say who, logs that say what happened.
- SNMP A protocol for reading counters and settings from network devices, on UDP port 161.
- MIB and OID The tree of numbered names every SNMP value lives at, and the files that put words on the numbers.
- SNMP trap A message an agent sends on its own, to UDP port 162, when something changes, such as a link going down.
- NetFlow Flow records a router exports to a collector: who talked to whom, on which ports, how much and when.
- Syslog The standard way devices send log lines to a collector: one message each, on port 514.
- SIEM and log correlation Gathering every device's log in one place, parsing each line into fields, and running rules across all of them to raise alerts.
- Facility and severity The two numbers that sort a syslog message: what kind of program sent it, and how bad it is.
Automation and APIs
Running the network from programs: APIs, data formats and configuration as code.
- REST API An HTTP interface where every thing is a URL and the methods are the verbs: GET reads, POST creates, PUT and PATCH change, DELETE removes.
- JSON The text format APIs exchange data in: objects of key: value pairs, arrays, strings, numbers, true, false and null.
- Network controller A central system that holds the network's intended state and configures the devices for you, behind an API.
- Control plane and data plane Deciding where traffic should go (control plane) against moving each packet by those decisions (data plane).
- OpenFlow The protocol an SDN controller uses to write match-and-action rules (flows) into a switch's flow table.
- Configuration management Writing the wanted configuration down as files and letting a tool make every device match it.
- Running and startup config What a device does now against what it loads when it starts: unsaved changes vanish at the next reload.
- Idempotence Doing it again changes nothing: a run that describes a state leaves a device already in that state alone.
- Configuration drift A device's running config moving away from its intended one, usually through changes made by hand.
Protection
Deciding what may cross, and keeping traffic private.
Firewalls
Deciding what may cross.
- Firewall Rules deciding, packet by packet, what may reach or cross a device.
- Access control list An ordered list of permit and deny lines a router checks each packet against, applied to a card in or out.
- Forward proxy A server that makes web requests on its users' behalf, and so can allow or refuse them by name and URL.
- SOCKS proxy A circuit-level gateway: it opens any TCP connection a client asks for and relays the bytes unread.
- Web application firewall A reverse proxy in front of a web application that refuses requests matching its rules before they reach it.
- Next-generation firewall A stateful firewall that also identifies the application in each flow and applies proxy and IPS rules to it.
- Stateful firewall A firewall that remembers connections, so it can allow replies while refusing new connections in.
- Firewall types From packet filters to next-generation firewalls: how much of the traffic each kind understands.
- DMZ A network apart for the servers the internet may reach, so breaking into one opens nothing behind it.
- Drop or reject Two ways to refuse a packet: silence, or an explicit answer.
Remote access
Reaching in safely.
- Bastion host One hardened machine that is the only way into a private network.
- In-band and out-of-band management Managing devices over the networks they carry (in band), or over a separate management network that survives them (out of band).
- Console port A serial line straight into a device's operating system, working with every network down and even during boot.
- Password strength and rate limiting Why guessable passwords fall to repeated tries, and the defences that stop them.
Encryption and trust
Keeping traffic private and answers genuine.
- Hashing, salting and key exchange The building blocks under TLS and passwords: one-way hashes, salts, key pairs and agreeing a key in public.
- TLS and certificates Encryption plus proof of identity: the server shows a certificate for the name, signed by a trusted authority.
- Certificate chain A server's certificate, signed by an issuing CA, whose certificate a root signed: the path a client follows to someone it trusts.
- Trust store The list of root certificates a device trusts; every certificate it accepts chains to one of them.
- Self-signed certificate A certificate whose issuer is its own subject: nobody vouches for it but itself.
- Certificate signing request What a server sends a CA to get a certificate: its public key and names, signed with its private key.
- SNI The site name sent in the clear at the start of a TLS handshake, so the server can pick a certificate.
- VPN Packets wrapped, encrypted, in UDP to a VPN server, which unwraps them on the far side.
- IPsec Encryption at the IP layer: IKE agrees keys between two gateways, ESP carries their traffic encrypted.
- Remote access vs site-to-site A VPN joins one device to a network (remote access) or two networks through their gateways (site-to-site).
- Clientless VPN Remote access through a web portal in the browser, over HTTPS, with nothing installed and no route into the network.
- NAT traversal Getting traffic through NAT: wrapping protocols in UDP, whose ports NAT can map, and punching holes between peers.
- DNS leak Lookups leaving outside a VPN tunnel, telling the local network every name you visit.
- DNSSEC and encrypted DNS Signed DNS answers, and DNS carried over an encrypted connection to a resolver you chose.
- SPF, DKIM and DMARC Three DNS-published policies that let a receiving mail server check that a message really comes from the domain it claims.
- DNSSEC chain of trust The run of signed links from the root's key, which a resolver trusts, down to the answer it checks.
Identity and access
Proving who is asking, and deciding what they may do.
- Authentication and authorization Authentication proves who is asking; authorization decides what that identity may do.
- API authentication How a program proves who it is to an API: a password on every request (Basic), a token it got once (Bearer), or a key.
- 802.1X and EAP Port login: a switch port (or Wi-Fi association) passes only login frames until the device proves who is using it.
- RADIUS The protocol switches, access points and VPN gateways use to ask one central server whether to let a user in.
- AAA for device logins (RADIUS and TACACS+) Routers and switches asking a central server who may log in, at what privilege, and recording each session.
- LDAP and directories One central tree of people and groups, which every server asks at login instead of keeping its own accounts.
- Kerberos A ticket system that lets one password login open many services, each proven with a ticket, never the password again.
- Single sign-on Signing in once to an identity provider, then reaching many services without logging in to each.
- Multi-factor authentication Requiring more than one kind of proof to log in, such as a password plus a time-based code from a device.
- Mutual TLS TLS in which the server also asks for the client's certificate and checks it, so both ends prove who they are.
- Zero trust Granting nothing for being on the network: every request to every service is authenticated and authorized.
Interception
Getting between two machines, and stopping it.
- Man in the middle A machine placed on the path between two parties, able to read and alter what is not protected end to end.
- ARP spoofing Forged ARP messages that tie someone else's IP address, usually the gateway's, to the attacker's MAC address.
- DNS spoofing A forged DNS answer that sends a name to the attacker's address, believed by a client or cached by a resolver.
- Downgrade attack An attacker in the path makes two sides settle for a weaker protocol, version or cipher than both support, then breaks that.
- DHCP snooping and ARP inspection Switch features that learn which device holds which address, and drop answers that do not match.
- Rogue DHCP server An attacker's own DHCP server answering devices on the LAN, handing out a poisoned gateway and DNS.
Denial of service
Exhausting a pool, a server or a link so real users cannot get through, and spoofing to hide the source.
- DHCP starvation Claiming every address in a DHCP pool under forged MAC addresses so no real device can get one.
- SYN flood and SYN cookies Forged SYNs that fill a server's half-open connection queue, and the stateless trick that defeats them.
- DNS amplification Bouncing small spoofed queries off open resolvers so large answers flood a victim.
- IP source spoofing Putting a false source address on a packet, the basis of floods and reflection attacks.
Reconnaissance and exfiltration
Finding what a network exposes, smuggling data out, and detecting both.
- Port scanning Probing an address's ports to learn which services it exposes, and whether a firewall sits in the way.
- Host discovery Finding which addresses on a network belong to a machine that is up, before looking at any port.
- Half-open scan Probing a TCP port with a SYN and hanging up after the reply, so no connection is ever made.
- Banner grabbing Reading the greeting a service sends on connect, to learn the real software and version behind a port.
- OS fingerprinting Guessing a machine's operating system from how its network code answers a few odd probes.
- DNS tunneling and exfiltration Smuggling data in and out of a network by encoding it inside DNS queries, which firewalls usually let through.
Detection and response
Noticing an attack, reading the evidence, and working the incident.
- Honeypot A decoy host or service nobody legitimate uses, so any touch of it is a high-confidence alert.
- Canary token A planted file, credential or URL that is never used legitimately, so any use of it signals an intruder.
- True and false positives An alert's worth is how often it is a real attack versus noise, which decides whether anyone acts on it.
- DNS sinkhole A resolver that answers known-bad domains with a harmless address or NXDOMAIN, blocking them for every client.
- Response policy zone (RPZ) A zone of DNS policy rules a resolver loads, overriding answers for listed names in bulk.
- Packet forensics Reconstructing an incident after the fact from a saved packet capture of the traffic.
- Indicators of compromise (IOC) Concrete artifacts of an attack — an address, a file path, a hash — that you block and hunt for everywhere.
- Beaconing A compromised host repeatedly contacting an outside controller to fetch commands, on a regular rhythm.
- Persistence Whatever an implant installs so it survives a reboot or a kill, like a cron entry that relaunches it.
- Incident response phases The ordered runbook for handling a compromise: prepare, identify, contain, eradicate, recover, learn.
- Kill chain and MITRE ATT&CK Models that break an intrusion into ordered stages, giving defenders shared language for what happened.
- Defense in depth Overlapping controls so that when one fails, another still catches or contains the attack.
- Network intrusion detection (NIDS/NIPS) A sensor on the wire that flags (IDS) or blocks inline (IPS) traffic matching attack signatures or anomalies.
- IDS signatures and alerts A rule describing a known attack in the traffic's content; the IDS alerts (or, inline, drops) whatever matches.
- Fail open and fail closed What an inline security device does to traffic when it stops: let it all through, or let none through.
- Endpoint detection and response (EDR) An agent on each host that records process, file and network activity to detect and help respond to threats.
- Host intrusion prevention (HIDS/HIPS) Host-based monitoring that detects or blocks suspicious local activity, such as changes to critical files.
- Data loss prevention (DLP) Controls that watch for sensitive data leaving the network and block or flag the attempt.
- Sandboxing Running untrusted code or attackers in an isolated environment to observe behaviour without real risk.
Hardening and auditing
Keeping a host you run safe: scanning it against a baseline, prioritising findings, remediating, and catching a file being tampered with.
- Vulnerability management The ongoing loop of scanning a host for weaknesses, prioritising them, fixing them, and rescanning to confirm.
- CVSS and CVE A CVE names a specific known vulnerability; its CVSS score rates how severe it is, so findings can be prioritised.
- SCAP and security benchmarks A standard format for writing a security baseline as machine-checkable rules, and the tool that evaluates a host against it.
- Secure baseline and hardening The known-good configuration a host should hold, and the work of bringing it there and keeping it there.
- File integrity monitoring Recording a fingerprint of trusted files while a host is known-good, then checking later which ones have changed.