The Binary World: 0s and 1s

Have you ever wondered how data from your computer actually moves across the internet and ends up in the cloud? Let's start from the very basics.

Computers operate using the binary number system, which has only two digits: 0 and 1. This is different from the decimal system, which has ten digits (0–9).

Example: To convert 13 into binary:
13 = 8 + 4 + 1 = 2³ + 2² + 2⁰
Binary representation: 1101

How Are 0s and 1s Created?

At the lowest level, computers use transistors. A transistor can either be On (1) or Off (0).

Imagine memory as billions of tiny switches. Each switch is called a bit, and eight bits together form a byte.

How Does the Computer Understand Them?

• Hardware layer
• Kernel and device driver layer
• Operating system layer
• Application layer

When you save a file, the application informs the OS, which uses drivers to write data to the hard drive.

Encoding of Data

Every character is encoded for efficient storage and transmission using formats like ASCII or UTF (Unicode).

Example: The word network uses 7 characters → file size is 7 bytes.

MAC vs IP Address

At the software level, systems care about IP addresses. At the local network level, devices use MAC addresses.

MAC addresses are 48-bit (6 octets) identifiers defined by IEEE 802.3 and never leave the local network.

OSI Layers and Packet Formation

• Transport → Segment
• Network → Packet
• Data Link → Frame
• Physical → Bits

Each layer adds its own header. At the destination, headers are removed in reverse order. 1️⃣ Flow A flow is a unidirectional stream of packets that share the same five key attributes: Source IP Destination IP Source Port Destination Port Protocol This is commonly referred to as the 5-tuple. If traffic travels from a client to a server, that is one flow. The return traffic from server to client is technically a separate flow because the direction changes. Key Characteristics: Unidirectional Used heavily in monitoring systems (NetFlow, IPFIX, sFlow) Often used in cloud “flow logs” (AWS, Azure) Think of a flow as one direction of traffic. 2️⃣ Connection A connection represents bidirectional communication between two endpoints. For TCP: It begins with the SYN handshake. Both directions of traffic together form a single connection. Even though UDP is technically connectionless, most firewalls still treat UDP exchanges as connections for tracking purposes. Key Characteristics: Bidirectional Represents a conversation between two devices Often used in traditional firewall terminology Think of a connection as a full conversation. 3️⃣ Session A session is the firewall’s internal state entry that tracks a connection. When traffic first matches a firewall policy: The rule is evaluated. NAT is applied (if configured). Security inspection profiles are assigned. A session entry is created in the firewall’s session table. After that, subsequent packets do not go through full policy lookup — they simply match the existing session. A session typically stores: Original and translated IPs/ports Policy ID Timeout values Security profile information Byte and packet counters Most next-generation firewalls (Fortinet, Palo Alto, etc.) use the term session as the primary tracking object. Think of a session as the firewall’s memory of a conversation. How They Relate For a single TCP interaction: 2 flows (forward and reverse) 1 connection (the conversation) 1 session (the firewall’s state record)

Network Media

• Ethernet: electrical pulses over copper or fiber
• Fiber: light pulses over glass
• Wireless: radio waves (WiFi)
• PAN: Bluetooth

Network Topologies

• Bus
• Ring
• Star (most common)
• Mesh

Speed, Bandwidth, Latency & Throughput

Bandwidth: Maximum data capacity (bps).

Latency: Time taken for a packet to travel (ms).

Throughput: Actual successful data rate.

Speed: Physical signal rate of the medium.

Real-Life Example

A 1 Gbps connection = 1024 Mbps = 128 MB/s.
A 1 GB file can be downloaded in about 8 seconds.

The Journey Ends in the Cloud ☁️

The data you're reading travelled from a VS Code editor, across multiple networks, and reached you via the cloud.

What is a DDoS Attack?

A Distributed Denial of Service (DDoS) attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources.

Testing & Resilience Validation

The Goal of DDoS Protection

The objective is not just to block traffic, but to ensure legitimate users always get through while attacks are absorbed at the network edge.

Month Year · X min read

Flow, Connection, and SessionS in Firewall/LoadBalancer/WAF

In networking and firewall design, the terms flow, connection, and session are often used interchangeably. A flow is a unidirectional stream of packets that share the same five key attributes. A connection represents bidirectional communication between two endpoint A session is the firewall’s internal state entry that tracks a connection.