Networking Fundamentals for Cybersecurity: TCP/IP, DNS, HTTP, and Packet Analysis

Understanding networking for cybersecurity is the foundation of this guide. Below we break it down step by step so you can act with confidence.

You cannot secure what you do not understand. Networking is the foundation of cybersecurity — every attack travels across a network, every defense monitors network traffic, and every security tool speaks the language of packets, ports, and protocols.

This lesson teaches you the networking concepts that matter most for security work: how data moves between computers, how DNS translates names to addresses, how HTTP delivers web pages, and how to capture and analyze real network traffic.

Networking For Cybersecurity: The OSI model and TCP/IP stack

The OSI model has 7 layers, but in practice security professionals work primarily with the TCP/IP 4-layer model:

• Layer 4 — Application (HTTP, DNS, SMTP, FTP) — where users interact. Attacks: SQL injection, XSS, phishing.
• Layer 3 — Transport (TCP, UDP) — reliable delivery and ports. Attacks: SYN floods, port scanning.
• Layer 2 — Internet (IP, ICMP) — addressing and routing. Attacks: IP spoofing, ICMP floods.
• Layer 1 — Network Access (Ethernet, Wi-Fi, ARP) — physical connection. Attacks: ARP spoofing, MAC flooding.

# Ping sends an ICMP echo request (Layer 2 - Internet)
$ ping -c 3 google.com
PING google.com (142.250.80.46): 56 data bytes
64 bytes from 142.250.80.46: icmp_seq=0 ttl=117 time=12.4 ms
64 bytes from 142.250.80.46: icmp_seq=1 ttl=117 time=11.8 ms

# What happened:
# 1. DNS resolved google.com → 142.250.80.46 (Application layer)
# 2. ICMP packet created (Internet layer)
# 3. TCP/IP wrapped it with source/dest IPs (Transport layer)
# 4. Ethernet frame sent over your NIC (Network Access layer)

TCP vs UDP, ports, and the three-way handshake

TCP (Transmission Control Protocol) guarantees delivery through a three-way handshake. UDP (User Datagram Protocol) fires and forgets — faster but unreliable.

Every network service listens on a port — a number from 0 to 65535:

• Port 80 — HTTP (web)
• Port 443 — HTTPS (secure web)
• Port 22 — SSH (remote access)
• Port 53 — DNS
• Port 3306 — MySQL
• Port 3389 — RDP (Remote Desktop)

Client → Server:  SYN        ("I want to connect")
Server → Client:  SYN-ACK    ("OK, I acknowledge")
Client → Server:  ACK        ("Connection established")

--- Data flows both ways ---

Client → Server:  FIN        ("I'm done")
Server → Client:  FIN-ACK    ("OK, closing")

# SYN Flood Attack:
# Attacker sends thousands of SYN packets but never
# sends the final ACK — the server keeps half-open
# connections until it runs out of resources.

DNS: how domain names become IP addresses

DNS (Domain Name System) translates human-readable names like 'google.com' into IP addresses like '142.250.80.46'. It is one of the most attacked protocols because controlling DNS means controlling where users go.

# Look up the A record (IPv4 address) for a domain
$ dig google.com A +short
142.250.80.46

# Look up the MX records (mail servers)
$ dig google.com MX +short
10 smtp.google.com.

# Look up the name servers
$ dig google.com NS +short
ns1.google.com.
ns2.google.com.

# Trace the full DNS resolution path
$ dig google.com +trace
# Shows: root servers → .com TLD → google.com authoritative NS

# DNS Security issue: if an attacker poisons the DNS cache,
# 'bank.com' could resolve to the attacker's IP instead.

Packet analysis with tcpdump and Wireshark

Packet capture is the most fundamental skill in network security. Every network forensics investigation, every IDS alert, and every traffic analysis starts with captured packets.

# Capture packets on interface eth0, port 80 (HTTP)
$ sudo tcpdump -i eth0 port 80 -nn -X

# -i eth0  = capture on this interface
# port 80  = only HTTP traffic
# -nn      = don't resolve hostnames or ports
# -X       = show packet contents in hex and ASCII

# Output:
# 17:23:45.123456 IP 192.168.1.5.54321 > 93.184.216.34.80:
#   Flags [S], seq 12345, win 65535
#   GET /index.html HTTP/1.1
#   Host: example.com

# Save to file for Wireshark analysis:
$ sudo tcpdump -i eth0 -w capture.pcap

# Read back:
$ tcpdump -r capture.pcap | head -20

When evaluating networking for cybersecurity, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Frequently asked questions

Do I need to memorize all port numbers?

No, but you should know the most common 20-30 ports by heart (HTTP 80/443, SSH 22, DNS 53, FTP 21, SMTP 25, RDP 3389, MySQL 3306, etc.). During pentesting and CTFs these come up constantly. Use 'cat /etc/services' for a full reference.

Should I learn IPv6 for security?

Yes, increasingly. Many networks run dual-stack (IPv4 + IPv6), and attackers exploit IPv6 when defenders only monitor IPv4. Learn the basics — IPv6 addressing, NDP (replaces ARP), and how IPv6 tunneling can bypass firewalls.

What is the best tool for packet analysis?

Wireshark for GUI analysis with deep protocol dissection, tcpdump for quick command-line captures, and tshark (Wireshark's CLI) for scripted analysis. Learn all three — they complement each other.