Overview
Most network communication follows the client–server model: one host requests a service and another provides it. This simple pattern underlies the web, email, databases, and most of what you do online. Understanding it clarifies how services are exposed — and attacked.
Learning objectives
- Define client and server roles.
- Explain the request–response pattern.
- Recognize that the roles are about behavior, not hardware.
Core concept
- A client is a host that requests a service or resource.
- A server is a host that listens for requests and provides the service or resource.
Communication follows a request–response cycle: the client sends a request, the server processes it and returns a response. Your browser (client) requests a web page; a web server responds with it.
Importantly, "client" and "server" are roles, not fixed device types. The same machine can be a server for one interaction and a client for another.
How it works
Servers listen on specific network ports (covered soon) for incoming requests, then respond. Because servers wait for connections from others, they are, by design, reachable — which makes them both useful and exposed. Clients typically initiate outbound connections and are not waiting to be contacted, so they are less directly exposed.
An alternative model, peer-to-peer (P2P), has hosts act as both client and server to each other, but client–server dominates typical services.
Practical example
You open an email app (client); it connects to a mail server that has been listening for connections, requests your new messages, and the server responds with them. Later, that same mail server acts as a client when it connects to another mail server to deliver an outgoing message. The role depends on who initiates and who serves in each exchange.
Cybersecurity relevance
Servers are prime targets precisely because they listen for connections and are reachable. Attackers scan for listening servers and probe their services; defenders minimize exposed servers and harden the ones that must listen. This model explains why "reducing exposed services" is such a common hardening step.
Common mistakes
- Thinking a "server" must be special hardware — it is a role any host can play.
- Forgetting that listening servers are inherently exposed, which is why they need hardening.
Key takeaways
- In the client–server model, clients request services and servers listen and respond.
- Client and server are roles defined by behavior, not fixed hardware; a host can be both.
- Servers listen for connections and are therefore reachable and attractive to attackers.
Check your understanding
- Describe the request–response cycle when you load a web page.
- Why are servers generally more exposed to attack than clients?