Networking for defenders: read alerts, flows and IP connections

Why networking knowledge matters for defenders

As a junior analyst you spend your day inside tools that show IPs, ports, protocols and strange looking network paths. Without basic networking, all of that feels like random numbers. With it, you can quickly see what is normal and what is suspicious. You recognise internal addresses, internet ranges and risky services like exposed RDP. This reduces noise, guides your questions and makes your investigation notes clearer. Strong networking basics also give you confidence in interviews, because you can explain alerts in plain language. You do not need deep engineering skills. You need just enough to read the picture of how systems talk to each other.

Reading IP addresses and subnets in security alerts

Most alerts show at least a source IP, a destination IP and sometimes a subnet or CIDR value. You should quickly see if an address is internal, external or special use. For example, 10.x, 172.16 to 172.31 and 192.168.x are private ranges that stay inside a network. Public IPs are reachable over the internet and deserve more attention. Subnets like /24 or /16 tell you how large an internal segment is. This matters when an alert hits many hosts at once. Practice by taking random IPs from sample logs and deciding where they likely sit in a company network.

Using ports and protocols to judge how risky traffic is

Ports and protocols tell you what kind of conversation is happening. TCP 80 and 443 usually mean web traffic. TCP 3389 means remote desktop. UDP 53 is DNS. As a defender you map these details to risk. Unexpected RDP from internet to a server is worrying. DNS to random external IPs might hint at tunneling or malware. Start by learning a shortlist of common ports and what they are used for. When an alert pops up, ask which side started the connection, what service the port suggests and whether that story fits the asset. Over time you will spot odd patterns faster.

Understanding flows so you can see the bigger picture

Network flows summarise who talked to whom, on which port, how often and for how long. They do not always show full packet content, but they show patterns. As a defender this helps you answer fast questions. Is this a single failed login or thousands from one IP. Is data leaving the network over an unusual port. Did that internal host suddenly start talking to many countries. When you view flows, group them by source, destination or port and look for repeats. Short, one off connections to known services might be fine. Long lived or spreading flows often deserve a deeper look.

Typical beginner mistakes when reading network alerts

New analysts often chase every single alert without checking context, which leads to fatigue. A common mistake is to ignore direction. For example, blocked inbound scans from the internet matter less than successful outbound connections from a server to a rare country. Another mistake is to focus only on the IP reputation score and skip basic checks like asset owner or usual business use. Avoid guessing. If you do not understand a protocol, quickly look it up and note what you learned. Over time you will build a mental list of common benign patterns and free your attention for true threats.

Practical ways to build networking skills for defense

You can train with only a laptop and free tools. Install Wireshark and capture traffic from your own web browsing. Practice spotting your local IP, the external server IPs and the ports used. Use basic commands like ipconfig or ifconfig and netstat to see active connections. Many labs and Capture the Flag platforms give network logs or PCAPs to analyse. Focus on explaining in words what you see, for example, internal host connects to external IP over TCP 443 for 10 minutes. This translation skill is what hiring managers look for in junior defenders.

Useful links

• Wireshark — Free network protocol analyser for practicing packet and flow analysis.
• IANA Service Name and Port Number Registry — Official list of registered port numbers and common uses.

Keep learning