How the Internet Works

Why Security People Study Networks

Almost every attack travels over a network. Phishing links, stolen passwords, ransomware and data breaches all move as small chunks of data between machines. If you understand how that data is addressed, sent and delivered, you can spot where it can be watched, changed or blocked.

When you open www.accessbankplc.com on your phone, a chain of events happens in under a second. Let's follow it.

Step 1: DNS Turns Names into Addresses

Computers talk using IP addresses such as 41.216.170.12, not names. The Domain Name System (DNS) is the internet's phone book. Your device asks a resolver (your ISP's, or a public one such as 1.1.1.1 or 8.8.8.8) for the IP address behind a name, then caches the answer for a short time (the TTL).

Security link: classic DNS is unencrypted and unauthenticated. An attacker who can forge the answer can send you to a fake bank site. You will see this attack in the next lesson.

Step 2: The TCP/IP Model

Networks are built in layers, and each layer has one job:

Each layer wraps the data from the layer above with its own header. This is called encapsulation. The receiver unwraps it in reverse.

Step 3: TCP Opens a Connection

TCP gives reliable, ordered delivery. Before any web data moves, the two sides perform the three-way handshake:

Client  -> Server : SYN        "Can we talk?"
Server  -> Client : SYN-ACK    "Yes, I am ready"
Client  -> Server : ACK        "Great, let's go"

Then TLS (HTTPS) agrees on encryption keys. UDP, by contrast, just sends data with no handshake. It is faster but unreliable, so it is used for video calls, gaming and DNS.

Step 4: Packets and Routing

Your request is cut into small packets. Each packet carries the source IP, destination IP and a TTL (time to live). Every router that forwards the packet subtracts 1 from the TTL. If it reaches 0 the packet is dropped, which stops packets looping forever (and is how the traceroute tool works).

Routers look at the destination IP and pick the next hop. Packets from one request may take different paths and arrive out of order, so TCP numbers them and the receiver puts them back in order. If a packet is lost, no acknowledgement comes back and TCP retransmits it.

A Nigerian and Global View

When you use a mobile-data plan from MTN or Airtel, your request goes from your phone to the operator's network, across national and undersea cable links (such as Equiano, 2Africa and SAT-3 landing in Lagos), and on to servers that may sit in Europe or the US. Every hop is a place where traffic could be monitored if it is not encrypted. That is why HTTPS everywhere matters, whether you are logging into a bank in Lagos or a webmail account in London.

Try It: Packet Visualizer

Use the lab on the right. Send a request, watch DNS, the handshake and the numbered packets travel, then tick Simulate packet loss and watch TCP retransmit packet 3.

Things to notice

1. DNS happens before any connection to the site.
2. The handshake needs three messages, so every new connection costs time.
3. Without HTTPS, every packet along the path is readable.