Part 1: The TCP Header (20 to 60 Bytes)

TCP is a complex, stateful protocol. Its header contains the “control plane” information required to guarantee delivery. Because it is stateful, it is highly inspectable by firewalls, but its complexity also provides a massive attack surface.

The Core Fields:

1. Source & Destination Port (16 bits each): Identifies the sending and receiving applications (e.g., Port 443 for HTTPS).
2. Sequence Number (32 bits): Assigns a unique number to every byte of data sent. Ensures data is reassembled in the exact correct order.
3. Acknowledgment Number (32 bits): Tells the sender which byte the receiver is expecting next. Confirms successful receipt of data.
4. Data Offset (4 bits): Indicates where the actual data begins (the size of the header).
5. Control Flags (9 bits): The most critical field for security. These are the “switches” that control the TCP state machine:
   • SYN (Synchronize): Initiates a connection.
   • ACK (Acknowledgment): Confirms receipt.
   • FIN (Finish): Gracefully terminates a connection.
   • RST (Reset): Abruptly tears down a connection (often used by firewalls to block traffic).
   • PSH (Push): Forces immediate delivery of data to the application.
   • URG (Urgent): Marks data as high priority.
6. Window Size (16 bits): Dictates how much data the receiver can accept before requiring an acknowledgment (Flow Control).
7. Checksum (16 bits): Ensures the header (and data) hasn’t been corrupted in transit.
8. Options (Variable): Used for advanced features like Maximum Segment Size (MSS) or SACK (Selective Acknowledgment).

The Security & Architectural Lens for TCP:

• Stateful Inspection: Because of the SYN, ACK, and Sequence numbers, a Next-Generation Firewall (NGFW) can track the exact state of a connection. If a packet arrives with an ACK flag but the firewall has no record of a prior SYN, the firewall drops it. This is the foundation of Stateful Firewalls.
• TCP Sequence Prediction (Session Hijacking): If an attacker can guess or intercept the Sequence Number, they can inject malicious data into an established TCP session without having the password.
• Flag Manipulation Attacks: Attackers use abnormal flag combinations to bypass firewalls or scan networks. For example, an “XMAS scan” sets the FIN, PSH, and URG flags simultaneously (lighting the packet up like a Christmas tree) to see how the target OS responds.
• SYN Floods (DDoS): By sending thousands of packets with only the SYN flag set, and never sending the final ACK, the attacker fills up the server’s connection state table, causing a Denial of Service.

---

Part 2: The UDP Header (Exactly 8 Bytes)

UDP is intentionally simple. It strips away all the reliability and state-tracking mechanisms of TCP to maximize speed.

The Core Fields:

1. Source Port (16 bits): Identifies the sending application. (Note: This is optional in UDP and is often set to 0 to hide the sender).
2. Destination Port (16 bits): Identifies the receiving application (e.g., Port 53 for DNS).
3. Length (16 bits): Specifies the total length of the UDP header and the data payload.
4. Checksum (16 bits): A basic error-checking mechanism for the header and data.

The Security & Architectural Lens for UDP:

• The “Stateless” Problem: Because there are no Sequence Numbers, no Acknowledgments, and no Flags (no SYN/ACK), a firewall cannot track a UDP “session.” Firewalls must use heuristic rules (e.g., “If internal host A sends a UDP packet to external IP B, allow return traffic from B to A for the next 30 seconds”).
• Trivial IP Spoofing: Because there is no 3-way handshake, an attacker does not need to receive a response to send a UDP packet. They can easily forge (spoof) the Source IP address.
• Amplification / Reflection DDoS: Attackers exploit UDP spoofing by sending small UDP requests (like a DNS query) to public servers, but spoof the Source IP to be the victim’s IP. The server sends a massive UDP response to the victim. Because the response is often much larger than the request, the attacker “amplifies” their attack power by 50x to 100x.

---

Part 3: Introduction to IP Addresses (Layer 3)

While TCP/UDP handle how data is delivered (Transport), IP handles where the data is going (Network). IP addresses are logical, hierarchical addresses used by routers to move packets across the globe.

1. IPv4 (32-bit Architecture)

• Format: 32 bits, represented in dotted-decimal notation (e.g., 192.168.1.10). Each octet is 8 bits (0-255).
• Structure: An IP address is divided into two parts: the Network ID (identifies the specific network/subnet) and the Host ID (identifies the specific device on that network).
• CIDR (Classless Inter-Domain Routing) & Subnetting:
  • Represented by a slash and a number (e.g., /24). This tells the router how many bits belong to the Network ID.
  • Architectural Context: In AWS/Azure, you design VPCs using CIDR blocks (e.g., 10.0.0.0/16). You then slice that VPC into smaller subnets (e.g., 10.0.1.0/24 for Web Servers, 10.0.2.0/24 for Databases). This is the foundation of Network Micro-segmentation.
• Public vs. Private (RFC 1918):
  • Private IPs: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. These are not routable on the public internet.
  • Security Context: We use NAT (Network Address Translation) to map private IPs to a single public IP. This hides our internal network topology from the outside world, providing a basic layer of “security through obscurity.”

2. IPv6 (128-bit Architecture)

• Format: 128 bits, represented in hexadecimal, separated by colons (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334).
• Why it exists: We ran out of IPv4 addresses. IPv6 provides roughly 340 undecillion addresses (enough to assign an IP to every atom on Earth).
• Security & Architectural Implications:
  • The Death of Network Scanning: In IPv4, an attacker can easily “ping sweep” a /24 subnet (254 IPs) to find active hosts. In IPv6, the address space is so astronomically vast that scanning for live hosts is mathematically impossible.
  • Shift to Identity: Because you can no longer rely on network scanning to find assets, IPv6 forces organizations to adopt Identity-Aware security and strict Zero Trust architectures. You cannot secure what you cannot find via IP sweeps.
  • No NAT Required: Every device can have a globally routable public IP. While this simplifies routing (great for P2P and IoT), it removes the “obscurity” of NAT, meaning every endpoint must have a robust local firewall (Host-based firewall/EDR).

---

Part 4: The Executive Synthesis (Tying it to Platform Security)

When you are designing a Fintech platform or interviewing for a Head of Platform Security role, you don’t discuss packet headers in a vacuum. You discuss how they dictate your security architecture:

1. Firewall Design: “Because TCP is stateful, we deploy Next-Gen Firewalls to inspect the TCP handshake and track session states. Because UDP is stateless, we must restrict UDP traffic aggressively and rely on application-layer gateways (like DNS proxies) to prevent amplification attacks.”
2. Cloud Micro-segmentation: “We use IPv4 CIDR blocks to logically separate our AWS VPCs. We then use Security Groups (Stateful) and NACLs (Stateless) at the subnet level to ensure that even if an attacker breaches the web tier (Layer 7), they cannot pivot laterally to the database tier (Layer 4) because the IP routing and port permissions are explicitly denied.”
3. DDoS Mitigation: “We understand that volumetric attacks target Layer 3/4 (IP and TCP/UDP headers). Therefore, we route all public-facing Fintech traffic through cloud-based scrubbing centers (like AWS Shield or Cloudflare) that can analyze millions of packets per second, drop malformed TCP flags, and filter spoofed UDP source IPs before the traffic ever reaches our data center.”