Security work assumes you can reason about how packets move. Use this as a study scaffold alongside lab traffic — not as a substitute for RFCs or your course materials. A classic reference point is RFC 791 (Internet Protocol); pair it with modern lab observation tools.
Mental model
- Hosts and interfaces — addresses live on interfaces; routing decides the next hop.
- Layers as contracts — Ethernet/Wi-Fi carry frames; IP routes packets; TCP/UDP deliver to ports; applications speak protocols.
- Names vs numbers — DNS resolves names to addresses; always record both in notes.
- Stateful vs connectionless — TCP handshakes and streams; UDP datagrams; ICMP for control/error messaging.
Lab checklist
- Identify your lab host’s IPv4/IPv6 addresses and default route (
ip a,ip ror OS equivalent). - Map listening services and owning processes (
ss -tulpn). - Capture a short authorized lab pcap; identify Ethernet, IP, and transport headers for one flow.
- Resolve a hostname with
digorgetent hostsand compare to what a browser would use.
Security angles to practice
- Why open ports matter for attack surface and for detection.
- How DNS and TLS names show up in telemetry differently from IP destinations.
- Distinguishing expected admin traffic from unexpected outbound connections in a lab SIEM or Zeek/Suricata view.
Ethics
Only capture or scan networks you own or have explicit written permission to assess. Prefer disposable lab networks and intentionally vulnerable targets.
networkingfoundationstcp-ip
Published 22 Oct 2026. External links open destinations outside CyberCrew — verify them before use in workshops.