Ethical Networking and Packet Analysis

Define an authorization scope that distinguishes permitted packet analysis and spoofing labs from unauthorized activity.

Build an isolated multi-node networking lab on Ubuntu using virtual machines or containers.

Map application data, transport units, IP packets, and link-layer frames to the TCP/IP and OSI models.

Explain encapsulation and decapsulation for traffic exchanged between two applications.

Differentiate hubs, switches, routers, firewalls, access points, and proxies by their forwarding behavior.

Inventory Linux interfaces, addresses, routes, and neighbor entries with command-line tools.

Capture lab traffic in Wireshark and locate its Ethernet, IP, transport, and application-layer sections.

Apply basic Wireshark capture and display filters to isolate an authorized test flow.

Convert packet-header values among binary, decimal, and hexadecimal representations.

Decode destination, source, EtherType, and payload fields in an Ethernet frame.

Distinguish unicast, broadcast, and multicast Ethernet delivery.

Explain how an Ethernet switch learns MAC addresses and forwards or floods frames.

Analyze ARP requests, ARP replies, and Linux neighbor-cache changes in a packet capture.

Trace local-subnet delivery from an IP destination through ARP resolution to an Ethernet frame.

Interpret an IEEE 802.1Q VLAN tag and explain how it separates broadcast domains.

Diagnose a duplicate-IP or stale-neighbor problem using Linux state and packet evidence.

Decode the version, length, identification, flags, TTL, protocol, checksum, and address fields of an IPv4 header.

Derive the network address, broadcast address, and usable host range from an IPv4 CIDR prefix.

Select an IPv4 prefix length that satisfies a stated number of subnets and hosts.

Determine whether two IPv4 hosts communicate directly or through a default gateway.

Explain IPv4 fragmentation, reassembly, and path-MTU discovery from packet evidence.

Analyze ICMP echo, destination-unreachable, and time-exceeded messages in Wireshark.

Infer a packet's hop-by-hop path from routing information, TTL changes, and traceroute results.

Diagnose an IPv4 reachability failure with ip, ping, traceroute, and Wireshark.

Apply longest-prefix matching to predict a Linux router's forwarding decision.

Configure and verify static routes between isolated lab subnets.

Differentiate distance-vector, link-state, and path-vector routing approaches.

Interpret the key messages in a small OSPF adjacency and route-exchange capture.

Interpret BGP OPEN and UPDATE messages, including prefixes and AS paths, in a provided capture.

Trace an address-and-port translation through a NAT or PAT gateway.

Distinguish stateless filtering from stateful firewall connection tracking.

Diagnose a routed flow blocked or altered by routes, NAT, or nftables rules.

Choose between UDP and TCP for a stated application requirement and justify the trade-off.

Decode source port, destination port, length, and checksum fields in a UDP datagram.

Analyze the SYN, SYN-ACK, and ACK packets of a TCP three-way handshake.

Track TCP sequence and acknowledgment numbers across a short bidirectional exchange.

Explain how TCP receive windows and window scaling implement flow control.

Identify TCP retransmissions, duplicate acknowledgments, and out-of-order segments in a capture.

Analyze orderly TCP connection closure and reset-based termination.

Diagnose whether a connection problem reflects loss, latency, refusal, filtering, or application silence.

Trace recursive DNS resolution from a stub resolver through recursive and authoritative servers.

Decode DNS question and answer sections, flags, names, types, classes, and response codes.

Interpret A, AAAA, CNAME, MX, NS, TXT, and PTR records for common troubleshooting tasks.

Explain how DNS TTL values and caches affect repeated lookups and configuration changes.

Diagnose a DNS failure using dig, resolver configuration, and Wireshark.

Analyze the DHCP discover, offer, request, and acknowledgment exchange.

Interpret DHCP lease, subnet mask, router, DNS-server, and renewal parameters.

Diagnose a DHCP addressing failure from client state and packet evidence.

Generate controlled client-server traffic with curl or netcat and correlate application messages with transport flows.

Decode an HTTP/1.1 request and response, including methods, status codes, headers, cookies, and message bodies.

Distinguish HTTP/1.1, HTTP/2, and HTTP/3 by their transport use and visible packet patterns.

Trace a TLS handshake through negotiation, certificate delivery, key establishment, and encrypted application data.

Validate a server certificate's hostname, validity period, issuer chain, and trust result.

Interpret SNI and ALPN fields while identifying which TLS-protected content remains encrypted.

Analyze the observable stages of an SSH connection without attempting to recover protected content.

Trace an SMTP conversation and identify the transition from plaintext commands to STARTTLS encryption.

Expand, compress, and classify IPv6 addresses using standard notation rules.

Derive an IPv6 network prefix and identify the interface portion of an address.

Decode the fixed IPv6 header and recognize common extension headers.

Distinguish link-local, global-unicast, unique-local, loopback, unspecified, and multicast addresses.

Analyze ICMPv6 Neighbor Discovery messages used for address and router discovery.

Compare SLAAC, router advertisements, and DHCPv6 host-configuration behavior.

Explain how dual-stack hosts select between IPv4 and IPv6 destinations.

Diagnose an IPv6 connectivity problem using Linux commands and packet evidence.

Choose a capture point and interface that can observe the traffic required by an investigation.

Construct compound Wireshark display filters using protocol fields, addresses, ports, flags, and Boolean operators.

Reconstruct an application exchange with Follow Stream while preserving packet-level context.

Verify IP-fragment and TCP-stream reassembly in Wireshark.

Use Conversations, Endpoints, Expert Information, and I/O Graphs to locate abnormal flows.

Measure handshake time, round-trip time, retransmission delay, and application-response time from timestamps.

Extract selected fields and repeatable summaries from packet captures with tshark.

Separate directly observed packet facts from hypotheses when explaining a network fault.

Explain how source-address spoofing changes packet attribution and why return-path routing limits many spoofing attempts.

Construct and inspect Ethernet, ARP, IPv4, ICMP, UDP, and TCP headers with Python and Scapy in the isolated lab.

Verify how protocol checksums change when packet-header fields or payloads are modified.

Demonstrate source-IP spoofing between isolated lab nodes and identify the forged evidence in Wireshark.

Demonstrate ARP cache poisoning between isolated lab nodes and measure its effect on packet delivery.

Restore correct ARP state and forwarding behavior after an authorized poisoning experiment.

Demonstrate a forged DNS response in the isolated lab and identify the conditions under which the client accepts or rejects it.

Explain why blind TCP connection spoofing is constrained by handshakes, sequence numbers, and response routing.

Perform authorized host and service discovery inside the isolated lab and confirm the resulting traffic in Wireshark.

Differentiate TCP connect, SYN, UDP, and host-discovery scan patterns in packet captures.

Detect ARP spoofing from unsolicited replies, changing MAC mappings, and inconsistent endpoint behavior.

Select switch, host, and segmentation controls that mitigate ARP-based interception.

Detect suspicious DNS responses using timing, source, transaction, cache, and record evidence.

Validate DNSSEC-protected answers and explain what DNSSEC does and does not prevent.

Implement nftables rules that restrict a lab service and verify their effect with packet captures.

Apply ingress, egress, and reverse-path checks to reduce source-IP spoofing.

Create a capture plan that specifies the question, capture points, interfaces, filters, and expected traffic.

Reconstruct a lab topology and its principal conversations from packet and host evidence.

Identify the root cause of a multi-layer connectivity failure without changing unrelated configuration.

Recognize a controlled spoofing event and preserve the packet evidence needed to explain it.

Distinguish a protocol violation, malicious indicator, and ordinary network anomaly in a mixed capture.

Write a concise investigation report that connects packet evidence to conclusions and uncertainty.

Harden the affected lab path and verify with a new capture that the selected control works.

Defend the final diagnosis and mitigation choices against protocol-focused test questions.