TCP/IP in depth: IP, ICMP, TCP, UDP
You read every protocol header field by field with tcpdump and see fragmentation, handshakes and connection close-down in your own traffic.
Level 201 · 18 lessons · 15 practice labs
Lessons
The IP layer
- The IPv4 header field by field: TTL, ID, flags
- Fragmentation, MTU and the DF bit
- TTL and how traceroute works
- ICMP messages: echo, unreachable, time exceeded
- Path MTU discovery and black-hole routers
- Short task: find the largest MTU between two machines
TCP
- The TCP header: flags, sequence and acknowledgement numbers
- The three-way handshake and connection states
- Closing a connection: FIN, RST and TIME_WAIT
- Watching TCP states with ss
- The sliding window and flow control
- Lost packets and retransmission
- Short task: prove why a connection was closed with RST
UDP and the layers above
- UDP: connectionless delivery and loss
- Port numbers, /etc/services and ephemeral ports
- When DNS switches from UDP to TCP
- Short task: verify that a UDP service is up
Wrap-up
- Capstone: a packet report that documents one web request layer by layer
Practice labs
- Hop count from the TTL: From the TTL values in captured packets, work out how many hops away three sources are and their likely initial TTL.
- Starred lines in traceroute: Tell whether starred hops mean packet loss or ICMP limiting by comparing UDP, ICMP and TCP traceroute, and report it.
- TTL runs out: a routing loop: Show in a capture the same packet passing again and again with a falling TTL, find the two routers in the loop and fix the bad route.
- Capture a fragmented packet: Capture the fragments of a large UDP packet with tcpdump and explain their order from the ID, offset and MF fields.
- A wrong MTU on one interface: Find the interface MTU mismatch breaking large transfers, fix it and show with a large DF-bit ping that traffic passes.
- Small pages load, big ones hang: Find and fix the rule that blocks ICMP ‘fragmentation needed’ messages to clear the PMTUD black hole, and prove large responses arrive.
- Read the three-way handshake by its numbers: Write the relative and absolute sequence and acknowledgement numbers of a handshake in a capture, and explain the flags at each step.
- The SYN leaves, nothing answers: Capture at both ends to find where the SYN of a timing-out connection is lost, and fix the rule that blocks it.
- A pile-up of SYN_RECV: Show the connections piling up in SYN_RECV with ss, tell whether the cause is a return-path problem or spoofed requests generated in your own lab, and apply the fix.
- Closed port or firewall?: From a capture of connection attempts to three ports, tell which gets a RST, which an ICMP reject and which a silent drop.
- A mountain of TIME_WAIT: Measure the TIME_WAIT sockets a client creates with short-lived connections, show from a capture which side closes, and measure the difference with keep-alive.
- A slow transfer: loss or the receiver?: Separate the retransmissions, duplicate ACKs and zero-window advertisements in a capture to prove whether the slowness comes from loss or from the receiver.
- Where do client ports come from?: Find the system’s ephemeral port range, show that the source ports of a set of connections fall inside it, and match the destination ports to their names in /etc/services.
- Nobody reports loss in UDP: Compare sent and received packet counts at both ends of a UDP stream to measure the loss rate and locate where the loss happens.
- Some names don’t resolve: TCP 53 is closed: Prove with a capture that records with large answers fail because TCP 53 is blocked, fix the rule and repeat the query.
About this course
You read every protocol header field by field with tcpdump and see fragmentation, handshakes and connection close-down in your own traffic.
What you will learn
- The IP layer
- TCP
- UDP and the layers above
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.