Many security problems become easier once you can describe how two systems are communicating. Networking gives you that language. You do not need to memorize every protocol, but you should understand the path a request takes and the evidence that path can leave behind.
Addresses and names are different clues
An IP address identifies a network interface in a routing context. A hostname is a human-friendly name that can resolve to one or more addresses. During troubleshooting or investigation, the name requested, the address returned, and the service that answered may each tell a different part of the story.
Ports identify endpoints
Ports let multiple network services share an address. Familiar port numbers are conventions, not guarantees. A careful analyst verifies what a service actually does instead of assuming that a number alone proves the application behind it.
Protocols define conversations
HTTP, DNS, SSH, SMTP, and other protocols define recognizable request and response patterns. Understanding normal behavior makes unusual behavior easier to identify. Defenders often compare destinations, timing, response codes, repeated failures, or mismatches between expected and observed behavior.
DNS is infrastructure and evidence
DNS translates names into records. It can also explain why a service works from one location and not another when cached answers, IPv4 and IPv6 records, or different resolvers are involved. Historical DNS activity can also provide context during an investigation.
Routing defines reachability
Routing determines where traffic can go. In a cyber range, routing is also a safety boundary. A training workstation can be given access to an assigned challenge network while unrelated networks remain outside the exercise.
Think in flows
Describe a network event as source, destination, protocol, port, expected response, and observed response. That compact model is useful for both ordinary troubleshooting and security analysis.