Carolina Pinto

Helping organizations turn regulation into practical security.

4 minute read

A few weeks ago I didn’t really know what a “packet” was, beyond a vague sense that it’s “how the internet works under the hood.” I’m still early in learning cybersecurity fundamentals, but this is one of the first topics that made something click — so I wanted to write down what I’m learning while it’s fresh, partly for myself and partly in case it’s useful to anyone else starting the same path.

The part that surprised me

Every email, video call, file upload, and login you send breaks down into small chunks of data called packets. They’re basically invisible when everything’s working — which is exactly why, when something goes wrong on a network, the people who know how to read them are the ones who can actually explain what happened.

That’s not just me being enthusiastic about a new topic, either. Industry analysts have pointed out a huge uptick in the importance of cybersecurity within networking — security isn’t treated as separate from keeping a network running anymore, it’s baked into the same job. And the World Economic Forum’s Future of Jobs Report ranks networks and cybersecurity among the fastest-growing skill categories through 2030, right behind AI and big data. So even as a beginner, it’s reassuring to know this isn’t a dead-end rabbit hole — it’s one of the more in-demand things I could be spending my time on right now.

The two protocols underneath everything

Before any of the “investigation” stuff made sense to me, I had to get straight on the basic envelope every packet travels in — the Internet Protocol, or IP. There are two versions in use today, and here’s the plain-language version of what I’ve learned about each.

IPv4 is still the most common. Its header has thirteen fields, but the ones that seem to matter most for actually understanding traffic are:

  • Source and Destination Address — who’s talking to whom
  • Time to Live (TTL) — a countdown that stops a packet from bouncing around a network forever
  • Protocol — what kind of data is riding inside (HTTP, DNS, etc.)
  • Identification, Flags, and Fragment Offset — these work together so that a packet split into pieces can be put back together correctly at the other end

IPv6 is the newer version, built because the internet was running out of IPv4 addresses. Its header is simpler — eight fields instead of thirteen — but does a lot of the same job, using a Hop Limit instead of TTL and a Next Header field to say what type of data comes next.

I don’t think I need to memorize every field by heart. What actually seems to matter is getting a feel for what “normal” looks like, so that something off — a weird TTL, an unfamiliar destination, a pile of fragmented packets — starts to visibly stand out instead of blending in.

My first real look at Wireshark

Once I understood headers conceptually, I opened Wireshark for the first time — it’s a free, open-source tool that’s apparently the standard a lot of working analysts reach for when they need to actually look at traffic instead of just reading about it.

The thing that made it click for me wasn’t the interface, it was the display filters — a small language for narrowing down a huge pile of packets to just the ones you care about. A few I’ve been practicing with:

  • By protocol: typing dns, http, or ftp shows only that kind of traffic
  • By IP address: ip.addr == 172.21.224.2 finds anything involving that address; ip.src and ip.dst narrow it to just sender or receiver
  • By port: tcp.port == 25 or udp.port == 53 isolates traffic tied to a specific service
  • By content: the contains operator searches for an exact string inside a stream
  • By pattern: the matches operator lets you use a regular expression when a plain string search isn’t precise enough

You can chain these with and, or, and parentheses, which is where it starts to feel less like typing commands and more like asking the tool a real question.

The other feature I liked was Follow Stream — instead of scrolling through a wall of individual packets, it reassembles a whole conversation between two devices into something you can actually read top to bottom, like a transcript.

Why I’m sticking with this

I’m not pretending to be an analyst yet — I’m just someone working through the fundamentals. But it helps to know the fundamentals themselves are landing at a good time. Cybersecurity skills currently rank second only to AI and big data in projected growth across all skill categories worldwide, and demand is expected to keep outpacing supply for a while. On the networking side specifically, things like zero-trust security and the general overlap between networking and security work are described as increasingly non-negotiable — and that overlap is exactly where packet analysis lives.

That’s encouraging as someone still early on: this isn’t a niche skill I’m learning for its own sake, it’s genuinely one of the more foundational, transferable things I could be spending time on.

If you want to try it yourself

You don’t need a corporate network or a real incident to practice. I just downloaded Wireshark, captured my own home traffic for about ten minutes, and tried to answer basic questions: What protocols is my laptop actually using? What’s it talking to? Can I filter down to just the DNS lookups from the last minute?

That’s genuinely the whole first step. I’m not claiming any expertise here — just sharing what’s clicking for me so far, in case it helps someone else who’s starting from the same place I am.

You May Also Enjoy