Networking basics for beginner cybersecurity analysts

Why networking basics matter for SOC work

Most security alerts are really network stories. A SIEM rule fires, because one IP talked to another IP on a specific port using a specific protocol. If you do not know what that means, every alert feels like noise. With core networking concepts you can answer simple but crucial questions. Who talked to whom. Over which path. Is this normal for this system. That is what turns raw data into a decision. You do not need deep CCNA level skills for a junior SOC role, but you do need to feel comfortable with addresses, ports, protocols and basic traffic patterns.

IPs and ports in plain language

An IP address is a numeric label that identifies a device on a network, similar to a street address. Ports are like apartment numbers inside that address. Port 80 usually means web traffic over HTTP, port 3389 usually means Remote Desktop. As an analyst, you read alerts that mention source IP, destination IP, source port and destination port. Your goal is to quickly guess what type of communication that probably is. Common mistake: treating all public IPs as malicious or assuming any high port is bad. In practice, many apps use dynamic or high ports in normal ways.

Protocols that appear in real alerts

A protocol is an agreed set of rules for how data is sent. In alerts and logs you will constantly see HTTP, HTTPS, DNS, RDP, SSH and SMB. For a junior role you do not have to explain every packet, but you should know what each protocol is used for and which port it usually uses. That way you can say things like: this workstation used RDP out to the internet, which is suspicious. Typical mistake: viewing protocol names as abstract tags instead of mental shortcuts for behaviour, like web browsing, file sharing or remote control.

Reading a simple traffic flow step by step

Traffic flow just means the direction and sequence of network communication. For example, an internal PC sends a DNS request to a DNS server, then sends an HTTPS request to a website. As an analyst you look at who started the connection, which ports and protocols were used, and whether that matches what that device normally does. Good practice: sketch flows on paper when a case feels confusing. Draw boxes for devices, arrows for traffic, and annotate with ports and protocols. This keeps your thinking structured and makes it easier to explain your findings.

Practical ways to learn networking from home

You can build useful networking intuition with simple home setups. Install Wireshark on your own machine and capture traffic while you browse, update apps or stream video. Watch how IPs and ports change. Use the built in netstat or ss command to see open connections and listening ports. Look at your router admin page and note private IP ranges. Keep a small notebook where you write down common ports and what they usually mean. You do not have to master everything before applying for jobs, but steady daily practice will make real alerts feel far less mysterious.

Useful links

• Wireshark official site — Free network protocol analyzer for hands on traffic inspection.
• Cisco Networking Academy — Entry level networking courses widely recognised in the industry.

Keep learning