Network Protocols and Analysis
What this domain tests
Network Protocols and Analysis tests packet-level reasoning across TCP/IP: TCP handshake and flags, UDP, DNS, HTTP, ARP, DHCP, ICMP, routing, NAT, and capture analysis. Expect questions that ask what a capture or flow proves, not just what a protocol does.
Core rules
- TCP uses SYN, SYN-ACK, ACK to establish; FIN or RST to close or reset; sequence and acknowledgment numbers reveal loss and retransmission. UDP is connectionless and has no built-in reliability.
- DNS uses UDP/53 for common queries and TCP/53 for large responses or zone transfers; DNSSEC adds integrity, not confidentiality.
- ARP resolves IPv4 to MAC within a broadcast domain; DHCP assigns addresses; ICMP reports errors and supports diagnostics.
- In captures, record direction, timestamps, endpoints, and baseline. Flows summarize; packets prove. Use display filters after capture, not overly narrow capture filters.
Worked example
A capture shows many SYNs to 10.0.0.5:443 from diverse sources, with few SYN-ACKs and no completed handshakes. That pattern suggests a SYN flood or a down service, not a DNS failure. Check whether SYNs are spoofed, whether the target backlog is exhausted, and whether a firewall is dropping. If one source sends SYNs and receives RSTs, the service is reachable but refusing; if ICMP unreachable appears, routing or firewall rejection is more likely. Reasoning depends on the observed response, not on the port alone.
Traps
Calling every reset an attack; ignoring capture direction; confusing ICMP unreachable with TCP RST; forgetting that switched traffic may not be visible without SPAN or TAP; and treating a single packet as proof of a session.