Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am searching for good books and articles about TCP/IP, mainly the security aspects of TCP/IP protocols. I have TCP/IP Illustrated and the TCP Guide, but they kinda lack on description of 'classic' attacks and how the internals of protocols relate to those attacks.

PS: Seeing the first real answer made me remember to add that this is strictly for studying purposes, I have no intention of going black hat at this point, I am just preparing for job interviews :)

share|improve this question
up vote 1 down vote accepted

I really prefer this book:

It is very detailed.

Some (good and free) white paper on secure design is available here:

share|improve this answer
The Sean Convery book is spot on. Already on my kindle! – coredump Nov 19 '10 at 14:06

I would suggest to check IBM book this is great book and would help you a lot. This has TCP/IP Security related chapter also.

share|improve this answer
Why does the footer of your answer look like spam to me? – halp Nov 18 '10 at 16:41
That was my signature. I have removed it now. – maniargaurav Nov 18 '10 at 17:32
Please see the FAQ (top right corner of every page) regarding the use of signatures. Thank you. – Chris S Nov 19 '10 at 13:31
@Chris Thank for pointing me to guide line. I will make sure I won't use it. – maniargaurav Nov 19 '10 at 16:42

Unfortunately I don't know of many references that talk about attacks in terms of how they interact with the protocol stack. I'd imagine following mailing lists like Bugtraq will keep you on top of current vulnerabilities, but it sounds like you're looking for more of a primer.

I've been told that Hacking Exposed is a good general reference for those interested in learning about attack vectors; it's on my reading list, but I haven't got around to it yet.

Building Internet Firewalls, though fairly old, still offers an excellent overview of how to think about security when designing your network.

share|improve this answer
You linked the wrong book, but Hacking Exposed seems to be the closest thing to what I am searching. This is the correct link: – coredump Nov 19 '10 at 2:44
@coredump: thanks, corrected. – Murali Suriar Nov 19 '10 at 12:35

There are a number of online resources - as nutty as it sounds setup a secondary PC - or use a vps and then browse a large number of the hacking websites on the web.

BlackHat conferences while a bit expensive, will teach you a large amount about TCP/IP...

Architecturally here are few things I can tell you regarding TCP/IP

  • Since TCP/IP identifies parties by addresses hacker's attempt to spoof addresses

  • Address resolution within TCP/IP, DNS and ARP are not authenticated

  • You can easily masquerade as some other person or node

  • ARP spoofing circumvents switches....

Some TCP/IP Explolits include:

  • MAC Layer (ethernet) TCP/IP exploits
  • TCP Session hijacking
  • TCP Session application peeking/viewing
  • TCP Password Monitoring
  • Various Back channels
  • DOS:
  • Packet Generation Attacks & Relays

These few things should help you get started in google searches ... I can post more on each - however truth to be told... I would rather not Teach Hacking in a public community

share|improve this answer

There is no good books, its just in which book you have got the information you are looking for!

Check out if this page gives you the correct info -

share|improve this answer

I good (and free) resource from Cisco can be found here: ISP Security Issues in ISP Security Issues in today’s Internet

There is also the complete text to IOS Essentials in PDF format from Cisco Press along with several other documents available in the same FTP directory if you are interested in some best practices for Cisco gear. Both of these documents are from 2002.

Another good resource would be the Nmap Network Scanning book by Gordon “Fyodor” Lyon. If you understand how nmap does its thing, you will gain a much deeper understanding of networking and security.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.