When I first became interested in cybersecurity, I naturally focused on the exciting part: tools.
Pentesting tools, network analyzers, security distributions, monitoring platforms...
But the more I learned, the more I realized something:
Security tools become much more useful when you understand what they're actually showing you.
And for me, networking has been one of the most important foundations.
From IP addresses to communication
At first, networking can feel like a collection of concepts to memorize:
IP addresses
MAC addresses
Ports
DNS
TCP and UDP
Routing
Subnets
Individually, these concepts aren't particularly difficult.
The interesting part comes when you start connecting them.
For example, opening a website might look simple from the user's perspective:
Browser
↓
DNS Resolution
↓
Destination IP
↓
TCP Connection
↓
TLS
↓
HTTP Request
↓
Server Response
Suddenly, one simple action involves several different technologies working together.
And each step gives us something that can be observed, analyzed and potentially secured.
Normal traffic comes first
One idea has become increasingly important to me:
Before looking for abnormal behavior, you need some understanding of normal behavior.
Imagine looking at network traffic and seeing connections to several IP addresses.
Are they malicious?
Maybe.
Or maybe they're completely normal connections generated by an application.
Without context, traffic is just data.
Understanding protocols and normal communication gives that data meaning.
DNS is a great example
DNS sounds simple:
A domain name is translated into an IP address.
But from a security perspective, DNS becomes much more interesting.
Questions start appearing:
Which domains is a device contacting?
How frequently?
Are the requests expected?
Are there unusual patterns?
What happens when DNS resolution fails?
The protocol hasn't changed.
What changed is the way I'm looking at it.
Tools make more sense afterward
This also changed the way I approach tools such as Wireshark.
Instead of opening a packet capture and thinking:
"There are thousands of packets. Now what?"
I can start asking questions.
What protocol am I interested in?
Which hosts are communicating?
Who initiated the connection?
What DNS queries occurred?
Which ports are being used?
That's a completely different way of working.
The tool isn't providing the understanding.
The fundamentals allow me to understand what the tool is showing me.
Cybersecurity is built on fundamentals
I'm still developing my cybersecurity skills, but one lesson keeps appearing:
There are no shortcuts around the fundamentals.
Linux matters.
Networking matters.
Operating systems matter.
Understanding services matters.
Learning security becomes much more interesting when those pieces start connecting.
That's why, instead of only asking:
"Which cybersecurity tool should I learn next?"
I'm increasingly asking:
"Which fundamental concept should I understand better?"
Tools change.
The fundamentals stay useful.
I'm documenting some of the things I'm learning as I continue studying systems, networking and cybersecurity.
If you're learning cybersecurity too: which networking concept made everything start clicking for you?
— Mateo Benjamín Italiano
