Difficulty: Beginner
Time: 20–30 minutes
Prerequisite: Lessons 1–5
Goal: Understand how computers actually move data across a network.

You already know that an IP address identifies a machine and a port identifies a service on that machine.

Now we need to answer the bigger question:

How the fuck does the data actually get there?

That’s where TCP/IP comes in.

1. TCP/IP ISN'T ONE THING

People say “TCP/IP” like it's a single protocol.

It isn't.

It's a collection of networking protocols that work together.

Two of the most important are:

IP — Internet Protocol

IP handles where data needs to go.

Think:

TCP — Transmission Control Protocol

TCP handles how data gets there reliably.

Think:

Put them together and you have the foundation for a huge amount of network communication.

2. THINK ABOUT MAIL

Imagine mailing somebody a 200-page book.

The destination address tells the postal system where the book needs to go.

That's similar to an IP address.

But instead of mailing the entire book as one gigantic object, imagine separating it into smaller numbered packages.

Package 1.

Package 2.

Package 3.

And so on.

The receiver gets them and puts everything back together.

If package 17 disappears?

They request package 17 again.

That's roughly the problem TCP solves.

Your network traffic gets broken into manageable pieces, transmitted across networks, and reconstructed at the destination.

3. IP GETS DATA TO THE MACHINE

Suppose your computer is:

192.168.1.50 

And you're communicating with:

192.168.1.100 

IP provides addressing information that allows network devices to determine where traffic needs to travel.

But remember Lesson 5.

One computer can run multiple services.

So knowing:

192.168.1.100 

isn't enough.

We might need:

192.168.1.100:22 

for SSH.

Or:

192.168.1.100:80 

for HTTP.

Or:

192.168.1.100:443 

for HTTPS.

Now you're combining concepts.

IP address = machine

Port = service

4. TCP CREATES A CONNECTION

TCP is connection-oriented.

Before two machines start exchanging application data over TCP, they establish a connection.

This happens using something you're going to see constantly in networking and cybersecurity:

THE TCP THREE-WAY HANDSHAKE

It looks like this:

CLIENT SERVER -------- SYN --------> <----- SYN-ACK ------- -------- ACK --------> CONNECTION ESTABLISHED 

Three messages.

SYN

“Yo, can we talk?”

SYN-ACK

“Yep. I hear you. Can you hear me?”

ACK

“Yep.”

Connection established.

Obviously the protocol is more technical than that, but conceptually that's what's happening.

5. WHY HACKERS CARE ABOUT THIS

Now something from later lessons starts making more sense.

When a scanner tells you:

22/tcp open 

that's not just random output.

The scanner interacted with that destination and gathered evidence about the state of that TCP port.

When you eventually start analyzing packet captures, you'll literally be able to observe things like:

SYN SYN-ACK ACK 

Instead of memorizing:

You'll understand why that signal matters.

That's the entire point of BASIX.

We're not memorizing tool output.

We're learning what the tool is actually seeing.

6. SEE TCP ON YOUR OWN COMPUTER

Open a terminal.

On Windows, run:

netstat -ano 

You'll see output resembling:

Proto Local Address Foreign Address State TCP 192.168.1.50:51432 142.250.x.x:443 ESTABLISHED TCP 192.168.1.50:51435 104.x.x.x:443 ESTABLISHED 

Don't worry about understanding every column yet.

Look at this:

192.168.1.50:51432 

That's your side.

And:

142.250.x.x:443 

is the remote side.

Notice something?

We're combining:

IP ADDRESS : PORT 

Exactly what the previous lessons taught you.

7. ESTABLISHED

You may see:

ESTABLISHED 

That means an active TCP connection exists.

You might also encounter states such as:

LISTENING TIME_WAIT CLOSE_WAIT SYN_SENT 

Those aren't meaningless words.

They're describing the state of a TCP connection.

And connection state becomes extremely important when you start analyzing networks.

8. TCP VS UDP

There's another major transport protocol:

UDP — User Datagram Protocol

TCP prioritizes reliability.

UDP removes much of that overhead.

Very simplified:

TCP Did you get it? Yes. Did you get the next one? Yes. Everything in order? Yes. 

UDP is closer to:

HERE YOU GO. HERE'S ANOTHER ONE. AND ANOTHER ONE. GOOD LUCK. 

😂

UDP doesn't establish connections using TCP's three-way handshake.

That makes UDP useful when speed matters more than guaranteed delivery.

You'll commonly encounter UDP with things like DNS, streaming, gaming, and real-time communication, although modern protocols can make the real picture more complicated.

9. PUTTING EVERYTHING TOGETHER

You're starting to build the mental model now.

You type:

example.com 

Eventually your computer determines an IP address.

It communicates with something like:

93.184.216.34:443 

You now recognize two pieces:

93.184.216.34 

IP address

and:

443 

Port

If the communication uses TCP, a connection can be established and application data can begin moving between the systems.

We're building this shit one layer at a time.

YOUR TURN

Run:

netstat -ano 

Find three TCP connections.

For each one, identify:

LOCAL IP: LOCAL PORT: REMOTE IP: REMOTE PORT: STATE: 

Don't worry about identifying the remote company or application yet.

Just learn to read the evidence in front of you.

Then answer this without Googling:

If you can explain that in your own words, you've got Lesson 6.