Networking Fundamentals Every Security Professional Needs

You've just started as a Level 1 SOC analyst at Veyra Financial Group, a mid-sized bank with 40,000 retail customers and a growing digital lending arm. Your first week, your lead hands you a firewall log and asks: "What happened here?" You cannot answer that question without understanding what's actually happening at the packet level.

The handshake, and why it matters

Every TCP conversation starts with a three-way handshake: SYN, SYN-ACK, ACK. Attackers exploit this directly — a SYN flood sends thousands of SYN packets and never completes the handshake, exhausting the target's connection table. When you see a spike of half-open connections in Veyra's IDS dashboard, that's what you're looking at.

The model as a map, not trivia

The OSI/TCP-IP model isn't something you memorize for an exam — it tells you where controls actually sit. Veyra's WAF inspects HTTP requests at the application layer; it will never see a SYN flood, because that's a transport-layer problem the WAF isn't positioned to stop. Their perimeter firewall operates at the network/transport layer; it won't catch a malicious file upload hidden inside a legitimate-looking POST request. Knowing which layer a control operates at tells you which control to expect to catch which attack — and which gap nothing is currently covering.

DNS: the channel everyone forgets to watch

DNS resolution happens constantly and invisibly, which is exactly why it's a favorite for command-and-control and data exfiltration. A compromised host beaconing to a C2 server every 60 seconds looks like normal DNS traffic unless you're watching for the tells: high query volume to a single external domain, oddly long subdomain labels (a common DNS-tunneling exfiltration pattern encoding data into queries), or queries to domains registered days ago.

NAT, routing, and attacker reach

When Veyra's threat intel feed flags an external IP as malicious, your first question should be: what could that IP actually reach? NAT and routing define the blast radius from any given foothold. A workstation on the branch office VLAN reaching the core banking segment is a routing failure waiting to be exploited — and it's exactly the kind of finding a red team engagement (see the Advanced Red Teaming course) would go looking for.

On the job: Given a pcap or firewall log, you should be able to reconstruct the conversation — who initiated it, over what protocol, and whether that pattern is normal for that host. That single skill underlies almost everything else in this course, and in this job.