Networking Basics for Hacking

Every security role assumes you understand networking, and it is the fundamental beginners most often skip. You do not need a networking degree; you need to understand how data moves, what ports and protocols are, the TCP three way handshake, and how DNS works. Those, understood properly, carry you through the rest.

Why networking is the foundation

Every attack crosses a network. Scanning, exploitation, pivoting, exfiltration, all of it is network traffic. You cannot exploit what you cannot describe, and you cannot describe an attack without understanding the network it travels over. This is stage one for a reason.

The models, simplified

Two models describe how networking works in layers. You do not need to memorise every layer, you need the intuition: data is wrapped in layers as it goes down the stack and unwrapped as it goes up, and different attacks target different layers.

Ports and protocols

A port is a numbered door on a machine, and each service listens on one. Knowing the common ones lets you read a scan instantly.

When Nmap reports open ports, this is how you know what you are looking at.

The TCP three way handshake

The single most asked networking question in security interviews. TCP establishes a connection in three steps: SYN, SYN-ACK, ACK. It matters because scan types manipulate it. A SYN scan sends the first packet and never completes the handshake, which is why it is quieter than a full connection.

Client  --SYN-->      Server
Client  <--SYN-ACK--   Server
Client  --ACK-->      Server   (connection established)

DNS, the internet's phone book

DNS translates names to addresses. It matters for hacking because it is a rich source of reconnaissance, covered in subdomain enumeration, and because DNS itself gets abused for tunnelling and exfiltration.

How deep do you actually need to go

Enough to read a packet capture, understand a port scan, explain the handshake, and reason about how traffic flows. You do not need to configure enterprise routers. If you can explain what happens when you type a URL and press enter, from DNS to handshake to HTTP, you have enough to start.

Practise this

Capture your own traffic with Wireshark and watch the handshake and DNS happen in real packets. It makes the theory concrete. Then build on it in the VAPT syllabus.