Lesson 1 of 9

TCP/IP Fundamentals

Every network attack and defense begins with a deep understanding of how data actually travels across networks. You will learn the TCP/IP model, how packets are structured, and how the three-way handshake works at a byte level. This foundational knowledge is essential for understanding every network-based attack covered later in the course.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "the TCP/IP model and packet structure" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Every attack and every defense happens over a network. Understanding how data actually travels between computers gives you the mental model to spot anomalies, intercept traffic, and understand why certain attacks work the way they do.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

TCP/IP Fundamentals · Objective 1 of 4

VIDEO

Loading video…

Open Wireshark and start a capture

Launch Wireshark as root or with sudo to ensure you have permission to access network interfaces. Select your active network interface — typically eth0 for wired or wlan0 for wireless — and click the blue shark fin icon to begin capturing. A common pitfall is selecting the loopback interface (lo), which only captures local traffic and will miss real network packets. Confirm packets are flowing by watching the packet list populate in real time before proceeding.

Generate traffic

Open a terminal and run 'ping -c 10 8.8.8.8' to generate ICMP traffic, or open a browser and load a plain HTTP site like http://example.com to produce TCP and HTTP packets. The more varied your traffic, the more packet types you will see in the capture. Avoid generating traffic on encrypted HTTPS sites for this exercise, since the payload will be unreadable without the session keys. Watch the packet count climb in the Wireshark status bar to confirm your traffic is being captured.

Filter for TCP traffic

In the Wireshark display filter bar at the top, type 'tcp' and press Enter to isolate only TCP packets from the capture. The packet list will immediately shrink to show only TCP segments, making it easier to spot connection patterns. You can combine filters — for example 'tcp and ip.addr == 8.8.8.8' — to narrow down to a specific host. A common mistake is confusing display filters with capture filters; display filters only hide packets visually, they do not delete them from the capture file.

Find a three-way handshake

Scroll through the filtered packet list and look for a sequence of three packets: SYN (flags: 0x002), SYN-ACK (flags: 0x012), and ACK (flags: 0x010). The Info column in Wireshark will show '[SYN]', '[SYN, ACK]', and '[ACK]' labels to make identification easy. Click the SYN packet and expand the TCP layer in the packet details pane to see the sequence number, which will be referenced by all subsequent packets in that stream. Understanding this handshake is fundamental — every TCP connection you will ever analyze starts with these three packets.

Follow the TCP stream

Right-click any packet belonging to the connection you identified, then choose Follow > TCP Stream from the context menu. Wireshark will reassemble all the payload data from both sides of the conversation and display it in a popup window, with client data in red and server data in blue. This is one of the most powerful Wireshark features — it lets you read the full application-layer conversation without manually piecing together individual packets. Close the stream window and notice that Wireshark has automatically applied a filter to show only packets from that stream.

Back to course Next Lesson