Packets through an analyst’s eyes
You learn the layers, headers, ports and handshakes of a packet and how to read, step by step, what happens in recorded traffic.
Level 101 · 18 lessons · 18 practice labs
Lessons
What a packet is
- Why traffic analysis matters: the network does not lie
- Layers: what the OSI and TCP/IP models tell an analyst
- Encapsulation: frame, packet, segment and payload
- Hex and bytes: reading a packet in raw form
- Short task: mark each layer of a packet
Reading headers
- The Ethernet header: MAC addresses and EtherType
- The IP header: source, destination, TTL and protocol
- Ports and services: which application is talking
- TCP and UDP: connection-oriented and connectionless
- Services that speak UDP: DNS, DHCP and NTP
- Short task: work out who sent five packets to whom and for which service
Conversations
- The TCP three-way handshake and flags
- Closing a connection: FIN versus RST
- The journey of a web request: ARP, DNS, TCP, HTTP in order
- What normal traffic looks like and how odd traffic stands out
- DHCP: how a device joins the network
- Short task: find the start, middle and end of a session
- Capstone: explain every conversation in a small capture
Practice labs
- Mark the layers of this packet: Mark the Ethernet, IP, TCP and payload boundaries by byte offset in the hex dump of a single web packet.
- Find the text in the payload: Find which of three packets carries readable text in its raw dump and show at which byte the payload starts.
- Encapsulation: a packet inside a tunnel: Recognise a packet carrying two nested IP headers and report the inner and outer addresses separately.
- What EtherType says: IPv4 or ARP: Tell which protocol each of five frames carries from its EtherType field.
- The protocol field: count TCP, UDP and ICMP: Count packets by IP protocol field in a small capture and find the unexpected protocol.
- Same IP, different MAC: Find the packets where one IP address appears with two different MAC addresses and list the likely causes.
- Who is talking to which service: From the destination port of five packets work out which service each goes to and who is client and server.
- DNS, DHCP, NTP: separate the UDP conversations: Separate three services in mixed UDP traffic by port, identify client and server in each and find the fourth service that fits none of them.
- A familiar service on an unusual port: Recognise web, SSH and DNS services talking on non-standard ports from payload traces alone and show the evidence bytes for each.
- Find the three-way handshake: Show by number the three packets that open a connection in a capture and write their flags.
- The journey of a web request: Show the ARP, DNS, TCP and HTTP steps of one page visit in order with packet numbers.
- Normal or odd: five conversations: Find the odd one among five conversations in a small capture and explain why it stands out.
- Read an IP address from a hex dump: Extract the source and destination IP addresses from a raw byte dump by converting them to decimal.
- How many hops from the TTL: Find the likely initial TTL of four sources in a capture, calculate how many hops each crossed and separate local from remote sources.
- A new device joining through DHCP: Extract the name, assigned address and lease time of a device joining the network from the DHCP exchange.
- FIN or RST: how the connection closed: Decide from the flags whether three connections closed cleanly or abruptly.
- Find the half-closed connection: Find the connection where one side sent FIN while the other kept sending data and write which side closed.
- Who sent the RST and why: Classify five resets as closed port, aborted application or idle timeout by looking at the packets before them.
About this course
You learn the layers, headers, ports and handshakes of a packet and how to read, step by step, what happens in recorded traffic.
What you will learn
- What a packet is
- Reading headers
- Conversations
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.