Network Protocols & Packet Analysis

Encapsulation is how each network layer wraps the data above it in its own header as it travels down the stack. Your application data gains a TCP or UDP header with port numbers, then an IP header with addresses, then an Ethernet frame with hardware addresses. The receiving side strips these headers off in reverse. A packet capture lets you read every layer at once.

Read it left to right: the timestamp, then source address and port, a greater-than sign, the destination address and port, then the TCP flags. A lone [S] flag means a connection is opening (SYN), [S.] is the server's SYN-ACK agreement, and [P.] carries application data. Those three flags let you follow the life of almost any connection.

The TCP/IP model has four layers: link (hardware addresses on the wire, such as Ethernet and ARP), internet (source and destination IP addresses and routing, such as IP and ICMP), transport (ports and reliability, such as TCP and UDP), and application (the actual content, such as HTTP, DNS and TLS). Data is encapsulated down through them and read back up.

By default tcpdump tries to resolve IP addresses into hostnames, which requires a working DNS resolver. On an offline or isolated box that lookup cannot complete, so the tool appears frozen. Adding the -n flag disables name resolution, keeping the capture responsive and showing raw addresses instead of names.

Only capture and analyse traffic on networks you own or are explicitly authorised to monitor. Packet captures can contain other people's credentials, cookies and personal data, so even passive sniffing is legally restricted on networks you do not control. This course uses an isolated lab built for safe, legal practice.

A TCP header is at least 20 bytes and carries the source and destination ports, a sequence number and acknowledgment number that provide reliable ordered delivery, a data offset, the flag bits (SYN, ACK, FIN, RST, PSH, URG) that drive the connection life cycle, a window size for flow control, a checksum, and optional fields. The flags are where the three-way handshake is visible on the wire.