TCP/IP in depth: IPv4, IPv6, TCP, ICMP, ARP
You learn every field of IP, TCP, ICMP and ARP and interpret fragmentation, state changes and the traces spoofed packets leave in traffic.
Level 201 · 16 lessons · 15 practice labs
Lessons
The IP layer
- Every IPv4 header field: ID, flags, checksum
- TTL and initial values: hop count and OS hints
- IP fragmentation, MTU and PMTUD
- The IPv6 header and extension headers
- Short task: reassemble a fragmented packet with tcpdump and Wireshark
The TCP layer
- The TCP state machine: from SYN_SENT to TIME_WAIT
- Sequence and acknowledgement numbers: relative and absolute
- Window size, scaling and MSS
- TCP options: SACK, timestamps, NOP
- Short task: list every state of a connection with packet numbers
ICMP and ARP
- ICMP types and codes: unreachable, time exceeded, redirect
- What traceroute looks like on the wire
- ARP requests, replies and gratuitous ARP
- Detecting the trace of ARP poisoning in traffic
- Short task: find packets claiming two MAC addresses for one IP
- Capstone: explain a capture full of abnormal packets field by field
Practice labs
- Decode an IPv4 header field by field: Write the identification, flags, TTL, protocol and checksum fields of one packet's IPv4 header into a table with their values.
- Guess the operating system from the initial TTL: Derive the initial TTL and the likely operating system family of four hosts in the capture from their TTL values.
- Is the bad checksum real: Tell checksum offload on the capture host apart from real corruption and prove which packets are truly damaged.
- Recognise a fragmented packet: Filter the fragmented IP packets in a capture and list each fragment's offset and MF flag.
- Reassemble the fragments: Reassemble an ICMP packet split into four fragments with tcpdump and Wireshark and verify the total payload size.
- Find the PMTUD black hole: In a capture where large transfers hang at a Kuzeyyıldızı Kargo branch, identify the missing ICMP message and the problem MTU value.
- Relative and absolute sequence numbers: Write the relative and absolute sequence numbers side by side for the first five packets of a connection.
- List the states of a connection: Map every state a TCP session passes through from SYN_SENT to TIME_WAIT to a packet number.
- Connections left half open: Separate the half-open and half-closed connections in a capture and explain on which side each one stalled.
- Read the options in a SYN packet: Compare the MSS, window scale, SACK and timestamp options in the SYN packets of two clients.
- Calculate the real window size: Take the window scale factor from the handshake and calculate the real receive window in the middle of the transfer.
- What the SACK blocks say: From the SACK blocks in a lossy transfer work out which byte ranges were missing and when they were filled.
- Classify ICMP types and codes: Count the ICMP messages in a capture by type and code and write what each one means.
- How traceroute looks on the wire: Extract the hop order, each hop's address and the probing method from a traceroute capture.
- Find the trace of ARP poisoning: Inspect the gratuitous ARP replies in a lab network capture and report the MAC claiming the gateway address and when it began.
About this course
You learn every field of IP, TCP, ICMP and ARP and interpret fragmentation, state changes and the traces spoofed packets leave in traffic.
What you will learn
- The IP layer
- The TCP layer
- ICMP and ARP
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.