I know some basics in programming like i know how to read a script and i know some networking but not advanced and some linux , do you recommend to start cybersecurity at HTB ? do you think it time to get in or still i have to learn in advanced ?

I have been trying to understand network scanning below the Nmap-output level, so I ran a few controlled experiments inside my own host-only lab.

Kali was the scanner (192.168.95.135) and a MISP VM was the target (192.168.95.131).

I captured the traffic in Wireshark and compared:

• ARP resolution before local communication
• ICMP request/reply
• Nmap ARP-based host discovery
• an open TCP port
• the same port after stopping the service
• the same port with firewall filtering
• SYN scanning
• service/version detection

The clearest part for me was seeing the three TCP behaviors directly:

OPEN: SYN → SYN/ACK → RST

CLOSED: SYN → RST/ACK

FILTERED: SYN → no response → retry

I wrote up the full experiment with the Nmap output and packet captures here:

https://chronosandcode.com/what-actually-happens-when-you-scan-a-network-arp-icmp-tcp-syn-nmap-and-packet-analysis-explained/

Everything was done against systems in my own isolated lab.

I will be interested to hear what packet-level experiments helped other people understand Nmap better.

Hey everyone,

Background: I've spent the last 3 years in information security.

I'm currently working through Practical Malware Analysis, and my plan is to document what I learn — the concepts, lab walkthroughs, and techniques — as short-form videos and longer breakdowns, partly to lock in my own understanding and partly because I know a lot of people study this book and might find the bite-sized version useful.

Before I get too far into it, I'd genuinely appreciate advice from people who've either gone through PMA themselves or have made educational malware analysis content publicly:

- **Which chapters/labs actually translate well into short-form (60-90s) content**, vs. which ones are only useful as full-length walkthroughs? I'm guessing static analysis basics (PE headers, strings, imports) work fine short, but dynamic analysis / unpacking probably needs more room to breathe.

- **Responsible disclosure / OPSEC around samples** — what's the norm for showing malware behavior publicly? Sandboxed screenshots only, no live samples shared, anything else I should be careful about?

- **Sequencing** — is it better to go strictly in book order, or restructure around themes (static analysis → dynamic analysis → unpacking → anti-analysis techniques) for a content series?

- **Tooling** — beyond what's in the book (IDA, OllyDbg, etc.), is there anything more current worth introducing early to keep the content relevant?