Network & Security for Developers

You do not need to be a network engineer.
But understanding how data moves and how it can be attacked makes you a better developer.

This short guide covers:

The OSI Model
TCP vs UDP
Essential networking concepts
Basic security concerns

1. The OSI Model

The OSI Model splits network communication into 7 layers.
Each layer has a clear job.

Mnemonic (bottom to top):
Please Do Not Throw Sausage Pizza Away

7. Application     ← HTTP, DNS, SMTP (what the app uses)
6. Presentation    ← Encryption, compression, format
5. Session         ← Manages the conversation
4. Transport       ← TCP / UDP + ports
3. Network         ← IP addresses + routing
2. Data Link       ← MAC addresses + switches
1. Physical        ← Cables, Wi-Fi, signals

Simple view of how data travels

You click "Send Email"
        ↓
[Application]     SMTP
[Presentation]    Encrypt / format
[Session]         Keep connection alive
[Transport]       TCP + Port 587
[Network]         Source IP → Destination IP
[Data Link]       MAC address of next hop
[Physical]        Electrical / light signals
        ↓
     Across the internet
        ↓
Receiving computer peels the layers in reverse

Why developers care

Problem you hear	Likely Layer
Cable unplugged / no signal	1 Physical
Can't talk on same network	2 Data Link
Can't reach Google	3 Network
Port 443 blocked	4 Transport
App returns wrong data	7 Application

2. TCP vs UDP

Both live at Layer 4 (Transport).

TCP – Reliable Courier

Client                Server
  |---- SYN ---------->|
  |<--- SYN-ACK -------|
  |---- ACK ---------->|
  |                    |
  |  Data (ordered)    |
  |  Lost? → Resend    |

Guarantees delivery and order
Used for: Web, APIs, email, databases, file transfer

UDP – Speed Demon

Client                Server
  |---- Data --------->|   (no handshake)
  |---- Data --------->|
  |---- Data --------->|   (hope it arrives)

Fast, no guarantees
Used for: Live video, gaming, DNS, VoIP

Quick comparison

Feature	TCP	UDP
Connection	Yes (handshake)	No
Reliability	Guaranteed	Best effort
Ordering	Yes	No
Speed	Slower	Faster
Best for	APIs, files, web	Streaming, games

Rule of thumb
Use TCP when data must not be lost.
Use UDP when speed matters more than perfection.

3. Essential Networking Topics for Developers

HTTP / HTTPS

HTTP = request/response
HTTPS = HTTP + encryption (always use in production)
Common status codes: 200, 400, 401, 403, 404, 500

DNS

google.com  →  DNS  →  142.250.190.46

Translates names to IP addresses. Wrong DNS = site looks down.

Ports

IP address = building
Port       = apartment number

Common ports:
80 (HTTP), 443 (HTTPS), 22 (SSH), 5432 (Postgres), 6379 (Redis)

IP Basics

Private ranges: 10.x.x.x, 192.168.x.x, 172.16-31.x.x
Localhost: 127.0.0.1
Public IP = reachable from the internet

Other useful concepts

Concept	One-line meaning
Load Balancer	Spreads traffic across servers
Reverse Proxy	Sits in front of your app (SSL, cache)
CDN	Caches static files closer to users
WebSocket	Keeps connection open for real-time data
Latency	Time for a packet to travel
Bandwidth	How much data can be sent at once

4. Basic Security Concerns

Security is every developer's job. Focus on these.

OWASP Top risks (know these)

Broken Access Control
Injection (SQL, command, etc.)
Cryptographic failures
Security misconfiguration
Vulnerable libraries
Authentication failures
XSS / CSRF
SSRF

Core practices

Never trust user input
        ↓
Validate on the server
        ↓
Use parameterized queries
        ↓
Escape output (prevent XSS)

Encryption

In transit → HTTPS / TLS
At rest → Encrypt sensitive data
Passwords → Hash with bcrypt / Argon2 (never store plain text)

Secrets

Never hardcode keys or passwords
Never commit .env files
Use environment variables or a secrets manager

Auth basics

Authentication = Who are you?
Authorization = What can you do?
Prefer OAuth 2.0 / OpenID Connect + MFA

Common attacks & simple defenses

Attack	Simple defense
SQL Injection	Parameterized queries
XSS	Output encoding + CSP
CSRF	CSRF tokens
Brute force	Rate limiting + lockout
MITM	TLS everywhere

CORS
Only allow the origins you trust. Avoid * with credentials in production.

Logging
Log security events. Never log passwords, tokens, or full credit card numbers.

5. Quick Reference Cheat Sheet

OSI Layers (bottom → top)
1 Physical → 2 Data Link → 3 Network → 4 Transport
5 Session → 6 Presentation → 7 Application

TCP = reliable   |  UDP = fast
HTTPS = always   |  Ports identify the app
DNS = name → IP  |  Private IPs stay inside

Security rules
- Validate input
- Parameterize SQL
- Use HTTPS
- Hash passwords
- Don't commit secrets

6. Learning Path (Short)

Understand the 7 OSI layers and what each does
Know when to choose TCP vs UDP
Learn common ports and basic DNS
Practice reading HTTP status codes and headers
Memorize the main OWASP risks and their defenses
Always use HTTPS and never trust user input

Conclusion

You do not need deep network engineering knowledge.
You need enough understanding to:

Debug faster
Design cleaner systems
Write safer code

Remember the two core ideas:

Data travels through layers (OSI / TCP-IP).
Every input is a potential attack surface.