Networking Basics for Cybersecurity

An AI security tool can flag a suspicious connection, but you still need to understand what connected to what. Networking basics give you the vocabulary to investigate that evidence instead of accepting a label.

Start with four ideas: IP identifies network interfaces, DNS resolves names, transport protocols carry communication, and HTTP defines application requests and responses. Follow one browser request and the layers become easier to distinguish.

Follow a request to a fictional learning site

Imagine opening https://learn.example/course. This is an illustrative address, not a service you should test. The browser needs a destination for the hostname learn.example. A DNS lookup may provide an address, although cached information and other resolution steps can affect what happens.

The browser establishes a suitable connection and, for HTTPS, negotiates encrypted communication. It then requests the resource /course. The service responds with a status and content. The page may make further requests for images, scripts, or an API.

This sequence is a simplified model. Browsers reuse connections and caches, and different HTTP versions use different transports. Its value is helping you locate a problem at the right layer.

IP addresses and ports answer different questions

An IP address helps route traffic to a network interface. A port helps identify an endpoint for a particular service on that interface. Many applications can communicate from the same computer.

Neither a familiar address nor a commonly used port proves that activity is safe. Shared infrastructure, proxies, and address translation can complicate attribution. Record what your evidence actually identifies rather than turning an address into a person's identity.

In a practice diagram, draw a laptop, a resolver, and a web service. Label the hostname separately from the address and service port. That distinction prevents a surprisingly common beginner mistake: treating every identifier as the same thing.

DNS is name resolution, not authorization

DNS lets applications use names instead of requiring users to remember addresses. An unfamiliar lookup may deserve investigation, but a lookup alone does not show that information was stolen.

Ask which application initiated it, when it happened, and what followed. If a browser fails to load a page, a name-resolution problem is one possible explanation. An application-level permission error is another kind of problem entirely.

Avoid changing network settings simply because an AI assistant suggests it. First identify which observation supports that change.

TCP and HTTP describe different layers

TCP provides a reliable, ordered byte stream between endpoints. HTTP describes application-level exchanges, such as requesting a resource and receiving a response. HTTPS adds encrypted transport using TLS.

HTTP/1.1 and HTTP/2 commonly use TCP. HTTP/3 uses QUIC, which operates over UDP. Therefore, a diagram that says every web request always uses TCP is too broad.