Why this matters
Telco and bank security adverts in Ghana ask for an understanding of networks, firewalls and network traffic. Almost every alert you handle will mention an IP address, a port or a domain name, so this is everyday vocabulary for an analyst.
The pieces you must read fluently
- IP address: the number that identifies a device on a network. Addresses such as 192.168.x.x and 10.x.x.x are private, used inside homes and offices. Other addresses are public, on the wider internet.
- Port: a numbered door on a device for a particular service. Common ones: 53 for DNS, 80 for web (HTTP), 443 for secure web (HTTPS), 22 for SSH remote login, 3389 for Windows Remote Desktop.
- Protocol: the rules for a type of traffic, such as TCP, UDP, HTTP or DNS.
- DNS: the internet's phone book, turning names like example.com into IP addresses. Attackers register look alike names, so checking domains is a daily task.
- Firewall: a device or program that allows or blocks traffic based on rules, such as "block Remote Desktop from the internet".
Reading a connection record
Firewalls and other tools write records like this: