Stop memorising protocols — start reading them

Every attack, every defence, every weird bug on a network comes down to one thing: what is actually on the wire. You can memorise that DNS uses UDP port 53 for a year and still be helpless in front of a live capture. This course flips that. You will capture and read real packets until the protocols stop being trivia and become something you can see.

How every lesson is built

There are no videos. Each topic follows the same loop: read the theory → see the tools and the method → do the challenge yourself in the lab → open Show solution only if you're stuck. The challenges are not thought experiments — every command runs on a real box.

🛠 Tools

tcpdump — the universal command-line packet sniffer. Your main weapon here.
tshark — Wireshark's CLI: full protocol dissection in the terminal.
Wireshark — the graphical version, for when you save a capture and want to click through it later.
nmap, curl, dig, nc, ping, ip — to generate traffic you can then capture.

⚙️ Your lab box

Your Live-Lab is a fresh, isolated Debian box. You are user qqq with passwordless sudo. It is deliberately offline — no internet — so you only ever touch an internal network called "MegaCorp":

10.0.0.2   web01     HTTP server on port 80
10.0.0.3   ssh01     SSH on port 22
10.0.0.4   cache01   redis on 6379
10.0.0.7   shop01    HTTP web app on port 80

Being offline is a feature: external names won't resolve and external pings die, but you can still watch the outgoing query leave the box, and you can hammer the 10.0.0.x targets all day.

🎯 Challenge: Get oriented. Run ip a to see your addresses, whoami and id to confirm who you are, then watch live packets fly past with sudo tcpdump -i any -c 5. What do you see moving on the wire even when you "do nothing"?

Show solution

ip a                       # your interfaces and IPs (look for the 10.0.0.x address)
whoami                     # qqq
id                         # uid/gid/groups — confirms your privileges
sudo tcpdump -i any -c 5   # capture the first 5 packets on ANY interface

ip a lists every interface; note your address on the MegaCorp network.
-i any captures on all interfaces at once; -c 5 stops after 5 packets so it never hangs.
Even "idle", you'll usually catch ARP, DNS, or background chatter — the wire is never truly silent.

⚖️ For authorized, legal security testing only — practise on your own lab or systems you own.

Liked it? 9 more lessons are waiting.

10 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in Network Protocols & Packet Analysis

1. How This Course Works & Reading the WireFree
2. TCP/IP & The Layered Model🔒 Foundations
3. TCP — The Three-Way Handshake🔒 Core
4. UDP — Connectionless & Spoofable🔒 Core
5. DNS — The Internet's Phonebook🔒 Core
6. HTTP/S & TLS — Clear Text vs the Sealed Envelope🔒 Core
7. ARP & ICMP — The Local Wire🔒 Core
8. The OSI Model & Where TCP/IP Fits🔒 Foundations
9. NAT, Routing & VPN — Crossing Networks🔒 Core
10. Capstone — Fingerprint a Host from Its Packets🔒 Exam

Continue in the interactive course reader →