30/06/2026
Most SOC analysts can recite the OSI model. Few can actually read a packet.
I learned that the hard way.
A few months ago I was running a routine capture in my home lab, just practicing on a sample pcap. Nothing was "wrong." Then I noticed something small: one host sending DNS queries with subdomains 40+ characters long, every single one different, all going to the same parent domain.
No alert fired. No signature matched. It just looked off.
That's when it clicked for me: detection isn't about memorizing attack names. It's about knowing what normal looks like so well that abnormal jumps off the screen.
Here's the framework I now use for every traffic review:
1. Baseline first. You can't spot an anomaly if you don't know the normal talkers, ports, and volume for that host.
2. Check the handshake, not just the alert. A flood of SYNs with almost no completed connections tells a different story than a clean three-way handshake.
3. Follow the stream. Reconstructing a full conversation reveals intent that a single packet never will.
4. Map it to ATT&CK. "Suspicious DNS" means nothing to a manager. "Possible T1071.004 exfiltration over DNS" gets budget approved.
5. Write the timeline before you write the recommendation. Most reports fail because they jump to "block this IP" without showing the chain that got you there.
Real example: 4,000 SYN packets, one source, 1,024 destination ports, 8 seconds, almost zero SYN-ACKs returned. That ratio alone is the signature of a scan. No fancy tool needed. Just Wireshark, a filter, and knowing what you're looking at.
Unpopular opinion: certifications get you the interview. Packet-reading skill gets you the offer.
I've seen candidates with three certs freeze when asked to explain a SYN flood from a raw capture. I've also seen self-taught analysts with zero letters after their name walk through a beaconing pattern like it's second nature.
Tools change. Vendors change. The ability to look at raw traffic and tell a true story from it does notch go out of style.
What's the one network analysis skill you wish more analysts had before they touched a SIEM?
