Core Concepts: DNS, IP, UDP, TCP and HTTP

DNS — the Domain Name System

DNS is the phonebook of the internet. Humans use names such as example.com; machines route packets to IP addresses such as 93.184.216.34 or 2606:2800:220:1:248:1893:25c8:1946. DNS translates one into the other, and it must do so in tens of milliseconds, billions of times per second, worldwide.

The four servers in a full resolution

1. DNS recursor (recursive resolver) — the librarian. It receives the query from the client stub resolver (your OS), and takes responsibility for chasing the answer. Operated by your ISP, your enterprise, or a public resolver. It caches aggressively.
2. Root nameserver — the index. There are 13 logical root server addresses (a.root-servers.net through m), served by hundreds of physical anycast instances. The root does not know example.com; it knows who runs .com.
3. TLD nameserver — the shelf. The .com TLD servers know which authoritative nameservers are delegated for example.com (the NS records).
4. Authoritative nameserver — the book. It holds the actual zone file: A, AAAA, CNAME, MX, TXT, SRV, CAA records. Its answer is final. Akamai Edge DNS is an authoritative nameserver service.

An 8-step uncached lookup

1  Browser  -> Recursor      : "A record for example.com?"
2  Recursor -> Root          : "Who handles .com?"
3  Root     -> Recursor      : "Ask the .com TLD servers" (referral, NS + glue)
4  Recursor -> TLD (.com)    : "Who is authoritative for example.com?"
5  TLD      -> Recursor      : "ns1.example.com / ns2.example.com" (referral)
6  Recursor -> Authoritative : "A record for example.com?"
7  Auth     -> Recursor      : "93.184.216.34, TTL 300"
8  Recursor -> Browser       : "93.184.216.34"  (and caches it for 300s)
   Browser then opens TCP/QUIC to 93.184.216.34 and sends the HTTP request.

Recursive vs iterative queries

The client-to-recursor query is recursive: "give me the final answer or an error". The recursor-to-root/TLD/authoritative queries are iterative: "give me the answer or a referral to someone closer". This split is why a single recursor outage feels like the whole internet is down for its users, and why recursors are a prime DDoS target.

Caching layers and TTL

TTL is a security lever. Short TTLs (30–60s) allow rapid failover and rapid revocation of a compromised record, but multiply query volume and therefore your exposure to DNS flooding. Long TTLs (3600s+) reduce load but slow down incident response and cutovers. A common compromise: 300s for A/AAAA records fronting production, 3600s+ for stable infrastructure records.

Other server roles you will meet

• Forwarding resolver — a resolver that does not iterate itself but forwards to an upstream recursor. Common in enterprise branch offices and home routers, and the natural enforcement point for protective DNS.
• Secondary/slave authoritative — holds a zone transferred (AXFR/IXFR) from a primary. Provides redundancy; Akamai Edge DNS can act as primary or secondary.
• Stub resolver — the minimal client-side library in the OS.

DNSSEC in one paragraph

Plain DNS answers are unauthenticated UDP datagrams, which is why cache poisoning works. DNSSEC signs records with the zone's private key (ZSK), signs the ZSK with a key-signing key (KSK), and publishes a DS record in the parent zone to build a chain of trust from the root down. Validating resolvers verify the RRSIG on every answer. DNSSEC provides integrity and authenticity, not confidentiality — the answers are still in cleartext. DNS-over-TLS (DoT, port 853) and DNS-over-HTTPS (DoH, port 443) address confidentiality instead.

IP addresses

An IP address is the numeric identifier assigned to a device on a network — the destination on the packet envelope. IPv4 uses 32 bits written as four dotted octets (203.0.113.7), giving roughly 4.3 billion addresses. IPv6 uses 128 bits written as eight hex groups (2001:db8::1), giving an effectively inexhaustible space.

Public vs private

Private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routable on the public internet; a NAT gateway rewrites them to a single public address on egress. Consequence for security teams: hundreds or thousands of distinct users can share one public IP, which is exactly why IP-only rate limiting causes collateral damage on corporate and mobile-carrier networks, and why behavioural systems combine IP with TLS fingerprint.

Static vs dynamic, and what an IP reveals

Consumer IPs are typically dynamic (DHCP-leased, rotating); servers are static. A reverse lookup and WHOIS/ASN lookup on a responding IP tells you a great deal: whether it belongs to an on-premise allocation, a CDN/WAF provider range, or a hyperscaler (AWS, Azure, GCP). During reconnaissance this reveals what protection sits in front of a target; during incident response it tells you whether an attack originates from residential proxies, hosting providers or a specific cloud region.

UDP — User Datagram Protocol

UDP is a connectionless transport: no handshake, no acknowledgements, no retransmission, no ordering guarantees. A datagram carries source port, destination port, length and checksum, then payload. It is fast and stateless, which makes it ideal for DNS, NTP, VoIP, gaming, video streaming and QUIC — and equally ideal for attackers.

Why UDP is the attacker's favourite transport

• No handshake means the source address is never validated, so spoofing is trivial.
• Small query, large answer in protocols such as DNS, NTP monlist, memcached, SSDP and CLDAP produces amplification factors from ~4x to over 50,000x.
• Stateless servers will happily answer every datagram, so a reflector can be abused indefinitely.

A reflection/amplification attack therefore spoofs the victim's IP as the source, sends small queries to thousands of open reflectors, and each reflector mails a large response to the victim. The victim sees traffic from legitimate-looking servers, never from the attacker.

TCP/IP

TCP is a connection-oriented transport that provides reliability, ordering and flow control on top of the unreliable IP layer. The TCP/IP model has four layers: Application (HTTP, DNS, SMTP), Transport (TCP, UDP), Internet (IP, ICMP), and Link (Ethernet, Wi-Fi).

The three-way handshake

Client                                Server
  |  SYN  (seq=x)                       |   -> server allocates a TCB, half-open
  |------------------------------------>|
  |  SYN-ACK (seq=y, ack=x+1)           |
  |<------------------------------------|
  |  ACK (ack=y+1)                      |   -> connection ESTABLISHED
  |------------------------------------>|

The security-relevant detail is step 1–2: the server commits memory (a transmission control block) after the SYN and waits for the final ACK. A flood of SYNs from spoofed sources exhausts the backlog queue — the classic SYN flood. Mitigations include SYN cookies (encode the state in the sequence number instead of allocating memory), shortened SYN-RECV timeouts, and upstream scrubbing.

Teardown, resets and state

Graceful teardown is FIN/ACK in both directions; an abrupt teardown is RST. Stateful middleboxes (firewalls, load balancers) track this state machine, and their state tables are themselves a finite resource that ACK floods and connection floods target.

Windows, congestion control and head-of-line blocking

TCP's receive window plus congestion control (Reno, CUBIC, BBR) determine throughput. Because TCP guarantees in-order delivery to the application, one lost segment stalls everything behind it — head-of-line blocking. This single property is the reason HTTP/3 abandoned TCP for QUIC over UDP.

HTTP — HyperText Transfer Protocol

HTTP is the request/response application protocol of the web. A request carries a method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS), a path, a version, and headers; a response carries a status code, headers and a body.

GET /api/v2/orders?limit=50 HTTP/1.1
Host: api.example.com
User-Agent: Mozilla/5.0 (...)
Authorization: Bearer eyJhbGciOi...
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: private, max-age=0
Set-Cookie: session=...; Secure; HttpOnly; SameSite=Lax

Status classes

1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. In behavioural baselining these matter enormously: error and redirect responses are typically excluded from baselines because they do not represent successful legitimate interaction, and a rising 401/403 ratio on an endpoint is a leading indicator of credential stuffing or authorisation probing.

Why plain HTTP is not secure

HTTP messages travel in cleartext. Anyone on the path — a compromised Wi-Fi access point, an ISP, a transit provider — can read cookies, tokens and form submissions, and can modify the response: inject ads, inject malicious JavaScript, or downgrade links. There is also no server authentication, so the client cannot know it reached the real origin. HTTPS solves all three: confidentiality, integrity and authentication.

HTTPS and TLS

HTTPS is HTTP inside a TLS tunnel. The TLS handshake authenticates the server via an X.509 certificate signed by a trusted CA, negotiates a cipher suite, and derives symmetric session keys (TLS 1.3 does this in one round trip, or zero with 0-RTT resumption). Beyond privacy, HTTPS is a prerequisite for HTTP/2, HTTP/3, service workers, geolocation and most modern browser APIs, and it is a ranking and trust signal.

Mixed content

Mixed content occurs when an HTTPS page loads sub-resources over plain HTTP. Passive mixed content (images, video, audio) cannot alter the DOM but leaks browsing details and can be swapped by an attacker. Active mixed content (scripts, stylesheets, iframes, XHR/fetch) executes in the page's origin, so a network attacker who replaces it owns the entire page — the padlock becomes meaningless. Modern browsers block active mixed content outright and auto-upgrade many passive requests. Fix it at source by serving all sub-resources over HTTPS, and enforce with a Content-Security-Policy: upgrade-insecure-requests header plus HSTS.

HTTP/1.1 vs HTTP/2

Security consequence: with HTTP/2 a single connection can carry thousands of requests, so “connections per second” is a useless attack metric and request-rate accounting must be done at the stream level. The HTTP/2 Rapid Reset class of attacks abused exactly this by opening and immediately cancelling streams.

HTTP/3 and QUIC

HTTP/3 runs over QUIC, a transport built on UDP that integrates TLS 1.3. Key properties:

• No TCP head-of-line blocking — streams are independent, so a lost packet stalls only its own stream.
• Faster handshakes — transport and crypto handshakes are combined; 1-RTT, or 0-RTT on resumption.
• Connection migration — a connection ID rather than the 4-tuple identifies the session, so switching from Wi-Fi to cellular does not break it.
• Encrypted transport metadata — most of the QUIC header is encrypted, which improves privacy but reduces what passive middleboxes and some DDoS appliances can inspect.

Because QUIC is UDP, it inherits UDP's spoofing exposure; QUIC counters this with address validation via retry tokens and an anti-amplification limit (a server must not send more than three times the bytes it received before validating the client's address). QUIC floods, described in the DDoS section, target the cryptographic cost of handshakes rather than raw bandwidth.