Networking Basics for Cyber Security: What Beginners Must Know

Almost every attack travels across a network, and almost every alert describes network activity. Networking is the foundation the rest of cybersecurity sits on. You do not need to be a network engineer, but you do need the concepts below to feel familiar.

The Models: OSI and TCP/IP

The OSI model describes networking in seven layers, from the physical cable up to the application. The TCP/IP model groups them into four practical layers: link, internet, transport and application. Security people use the layers as a shared vocabulary: "a layer 7 attack" means one at the application level, such as a web exploit.

IP Addresses and Subnets

Every device on a network has an IP address. Private ranges such as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are used inside organizations. The number after the slash says how big the network is: a /24 holds 256 addresses. You need this to scope a test, read a scan and understand a firewall rule.

TCP and UDP

TCP sets up a connection with a three-way handshake (SYN, SYN-ACK, ACK) and guarantees delivery; web, email and remote access use it. UDP sends without a connection and is used for DNS queries, streaming and some management protocols. Scanners such as Nmap rely on how hosts respond to these packets.

Ports Worth Knowing by Heart

• 22 SSH, 23 Telnet, 21 FTP
• 25 SMTP (email)
• 53 DNS
• 80 HTTP and 443 HTTPS
• 88 Kerberos and 389 LDAP (Active Directory)
• 445 SMB (Windows file sharing)
• 3389 RDP (Windows remote desktop)
• 3306 MySQL and 1433 Microsoft SQL Server

Protocols Attacks Often Abuse

• DNS turns names into addresses; attackers use it for reconnaissance and to hide traffic
• ARP links IP addresses to hardware addresses on a local network; spoofing it enables man-in-the-middle attacks
• DHCP hands out addresses; a rogue server can redirect traffic
• HTTP and HTTPS carry web traffic; most application attacks travel here
• SMB and LDAP are central to Windows networks and Active Directory attacks

Network Devices and Controls

Switches connect devices in a local network; routers connect networks; NAT lets many private addresses share one public address; VLANs split one physical network into separate segments; firewalls allow or block traffic by rules; intrusion detection systems raise alerts on suspicious traffic. Segmentation is one of the strongest defenses, because it limits how far an attacker can move.

Learn It Hands-on with Wireshark

Install Wireshark, capture your own traffic while you load a web page, and find the DNS query, the TCP handshake and the HTTP request. Then do the same in your home lab while running an Nmap scan. Seeing packets makes the theory stick. Our Wireshark guide shows the filters to use.

Networking in Our Program

Our SOC and DFIR course starts with networking and security fundamentals, and the Offensive Security Track builds on them in network and Active Directory testing and in log analysis in the SOC course. For a networking-focused credential, see EC-Council's CND.