From RFC to packet: verifying protocol behaviour against the spec
You learn to read protocol standards (RFCs), reproduce edge cases in the lab and compare two systems against the spec, reporting where they differ.
Level 401 · 14 lessons · 12 practice labs
Lessons
Reading RFCs
- The anatomy of an RFC: MUST, SHOULD, MAY
- Reading state machines: the TCP example
- Turning header diagrams into bits
- Short task: annotate a packet field by field against the RFC diagram
Verifying edge cases
- TCP edge cases: simultaneous open, half-open connections
- ICMP rate limits and misleading measurements
- DNS edge cases: truncation, EDNS, large responses
- Checking DHCP options against the RFC
- Short task: compare the TCP behaviour of two operating systems
Compliance and interoperability
- Interoperability bugs: who is breaking the rules
- Stack fingerprints: why they show and how to reduce them
- Writing protocol test cases
- Short task: write a report on an interoperability issue you found
Wrap-up
- Capstone: audit a service’s protocol compliance against the spec
Practice labs
- Turn an RFC into a checklist: Turn the MUST and SHOULD rules in the given RFC section into an item-by-item checklist that can be tested.
- Decode a hex dump against the RFC diagram: Decode by hand, field by field against the RFC diagram, the IP and TCP headers of a packet given as a raw hex dump, and compare with tshark output.
- Does the checksum add up?: Write a script that computes the IPv4 and TCP checksums of packets in a capture using the RFC algorithm, and find the corrupted ones.
- Catch a half-open connection: In a connection where one end died silently, show the other end’s state with ss and capture the RST that returns on the next send.
- A connection’s journey through the states: Trace every state transition of one connection from a capture and ss observations, and draw a diagram matching them to the RFC state machine.
- Two SYNs at the same moment: Produce a simultaneous open with Scapy, show both ends moving from SYN-SENT to SYN-RECEIVED in a capture, and document that the behaviour follows the RFC.
- Ping loss or a rate limit?: Prove with measurements at different rates that the loss in a router’s ICMP replies is a rate limit, not real loss.
- Audit DHCP options against the RFC: Compare the code, length and value of each option in a captured DHCP reply with the RFC definitions, and report the faulty one.
- EDNS buffer size and truncated answers: Send queries with different EDNS buffer sizes to show when the answer is truncated and falls back to TCP, and report where the server departs from the RFC.
- The SYN signatures of two systems: Compare the TTL, window and option order of SYN packets from two different operating systems, and work out which is which.
- Reduce the server’s fingerprint: Identify the distinctive TCP/IP traits a server gives away, reduce them with sysctl and service settings, and show before and after captures.
- Three rules, three tests: check them with Scapy: Write automated Scapy test cases that check three RFC rules against a lab service, and report the expected and observed result of each.
About this course
You learn to read protocol standards (RFCs), reproduce edge cases in the lab and compare two systems against the spec, reporting where they differ.
What you will learn
- Reading RFCs
- Verifying edge cases
- Compliance and interoperability
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.