SOC102 · Networking and Linux Foundations for Defenders

Categories: Cybersecurity
Wishlist Share

About Course

Build the networking and Linux knowledge defenders use every day: how traffic flows, which protocols matter, and how to read a Linux system safely from the command line.

Explore · 4 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

IT and help-desk professionals and beginners preparing for security monitoring work.

Prerequisites

SOC101 is recommended; you should be comfortable installing software on your own computer.

What you will be able to do

  • Explain how TCP/IP, DNS, DHCP and HTTPS work and where defenders observe them
  • Identify normal and suspicious patterns in a packet capture using Wireshark
  • Use core Linux commands to inspect processes, users, network connections and logs
  • Document a baseline of a healthy Linux server for future comparison

Lessons

  • Lesson 1 · How networks carry traffic
  • Lesson 2 · Core protocols and packet analysis
  • Lesson 3 · Linux essentials for defenders
  • Lesson 4 · Lab and assignment

Lab: Baseline a Linux host and read a packet capture

You run an Ubuntu virtual machine or WSL2 instance and record a baseline of users, listening ports, services and recent logins. You then open a sample capture in Wireshark, apply display filters for DNS, TLS and HTTP, and write down what normal traffic looks like and which flows deserve a closer look.

Free tools: VirtualBox or WSL2 with Ubuntu 24.04 LTS, Wireshark (free) and the free sample captures from the Wireshark wiki

Assessed assignment

Produce a host and network baseline report for a small office Linux file server. Include the commands you ran, the listening services and why each one should or should not exist, local accounts with sudo rights, and the top talkers from a packet capture. Finish with five specific checks you would repeat monthly to spot unwanted changes.

Criterion Weight What excellent work looks like
Accuracy of commands and output 30% Commands are correct, appropriate for Ubuntu 24.04 and their output is interpreted accurately.
Network analysis 25% Protocols and top talkers are identified with correct filters and sensible explanations of normal versus unusual.
Service and account review 25% Every listening service and privileged account is justified or flagged with a clear recommendation.
Repeatable checks 20% Monthly checks are specific, scriptable and tied to real risks.

Portfolio piece

A Linux host and network baseline report with reusable commands and monthly checks.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

Continue with SOC103 · Logs, Telemetry and Security Monitoring · 6 hours · $42.00

Continue to the next course

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Explain how TCP/IP, DNS, DHCP and HTTPS work and where defenders observe them
  • Identify normal and suspicious patterns in a packet capture using Wireshark
  • Use core Linux commands to inspect processes, users, network connections and logs
  • Document a baseline of a healthy Linux server for future comparison

Course Content

SOC102 · Networking and Linux Foundations for Defenders (4 h)
Build the networking and Linux knowledge defenders use every day: how traffic flows, which protocols matter, and how to read a Linux system safely from the command line.

  • Lesson 1 · How networks carry traffic
  • Lesson 2 · Core protocols and packet analysis
  • Lesson 3 · Linux essentials for defenders
  • Lesson 4 · Lab and assignment
  • SOC102 Assessment · Networking and Linux Foundations for Defenders
Scroll to Top