Networking for SOC Analysts: Stop Memorizing Ports. Understand the Story.
A practical introduction to networking for future SOC analysts — focused on understanding suspicious conversations instead of memorizing every port.
Every cybersecurity beginner has heard this advice: “Learn networking first.”
Cool — but nobody tells you what to learn. Then you open YouTube and find a fourteen-hour CCNA course when you only wanted to know why port 443 keeps appearing in Microsoft Sentinel.
Let’s keep this simple. This is not networking for future Cisco engineers. It is networking for someone about to investigate their first security incident.
Imagine This
It’s your first week as a SOC Analyst. You get an alert:
Device connected to
185.199.xxx.xxxover port443.
Your manager asks: “Does this look suspicious?”
The important question is not whether the alert has numbers. It is what the connection means.
Networking Isn’t About Ports — It’s About Conversations
People think networking is all about remembering port 22, port 53, or port 443. Those are just addresses.
The real question is: who is talking to whom?
Attackers communicate too. Malware phones home. Ransomware contacts command-and-control servers. Employees upload files. Browsers download updates. Everything is devices talking — and your job is to identify conversations that do not belong.
IP Addresses
Think about ordering food. You do not tell the delivery person to bring it “somewhere near Hyderabad”; you provide your exact address.
Computers do the same thing. An IP address is simply where a device lives:
192.168.1.25
Nothing scary — it is just an address.
Ports
Do you need to memorize all 65,535 ports? Absolutely not.
Imagine an apartment building. The building is the IP address; apartment 301 is the port. Same building, different room.
Why Does Port 443 Keep Appearing?
Because almost everything uses HTTPS now:
- Google: 443
- GitHub: 443
- Microsoft: 443
- Your company portal: 443
- Attackers: also 443
The port alone does not tell you whether something is malicious. You need the whole story.
DNS
DNS is basically your phone contacts. You do not remember your friend’s number; you save “Rahul” and your phone finds the number.
Computers work the same way. You type google.com, DNS replies with an IP address, and the connection can begin.
Why SOC Analysts Love DNS Logs
Attackers know companies inspect web traffic, so they sometimes hide information inside DNS requests. The same system that helps you open websites can be abused — which is why DNS logs are valuable during investigations.
TCP vs UDP
Imagine ordering a laptop. You expect confirmation, tracking updates, and delivery notification. That is TCP: reliable delivery.
Now imagine shouting across a cricket ground: “Catch!” You do not stop to check that everyone heard you. That is UDP: fast, with no delivery guarantees.
Both are useful — just for different jobs.
Packets
A packet is a tiny piece of data.
When you send a large movie, the internet does not send one giant file. It breaks it into thousands of small packets, then assembles them again later — like LEGO.
Wireshark
The first time I opened Wireshark, I thought my laptop had been hacked. There were thousands of packets, random colors, and strange protocols.
Here is the secret: you do not need to understand everything. Even experienced analysts do not inspect every packet. They filter, ask questions, and follow the evidence — exactly like detectives.
What You’ll Actually See in a SOC
Real investigations look more like this:
- Why is this laptop connecting to Russia?
- Why did this server suddenly start talking to Dropbox?
- Why did the same user log in from India and Germany within five minutes?
Every investigation starts with networking.
Please Don’t Memorize Everything
Do not spend three days trying to memorize every port. Understand why ports exist. Do not memorize protocols; understand why they were created.
Cybersecurity rewards understanding, not memorization.
Final Thoughts
If networking feels confusing today, good — that means you are learning something new. Nobody wakes up knowing subnetting, routing, TCP handshakes, DNS, and packet analysis.
Take one concept at a time. Open Wireshark. Capture your own traffic. Look at the packets. Search for the terms you do not know. Repeat.
One day, you will look at a suspicious connection and immediately think: “Wait, that doesn’t look right.” That is the moment you stop studying networking and start thinking like a SOC Analyst.
YouTube: The Security Insider