Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to learn TCP/IP. Can anyone recommend some tools to help me better understand it?

share|improve this question

Scapy is a very good tool for forging packets in conjunction with wireshark, it may fit your needs.

share|improve this answer
+1, Interesting... thanks for the link! – l0c0b0x Dec 28 '09 at 13:52

I found this site a while ago for a friend, LearnTCPIP which she said helped her understand the basics, and is of course "free"

share|improve this answer
This does not seem like a very good site. They are much more interested in selling CDs than teaching. – Joel K Dec 28 '09 at 12:59

The first think you should know is that TCP and IP are different things and the original question you're asking is like asking about milk-and-cookies.

It's not light reading, but the fully authoritative source for all things TCP is the original RFC.

RFC 793

IP also has a RFC, but TCP is the harder of the two.

You didn't say why you need to know this.. Let's assume it's for an interview.

When I interview people looking for jobs who say they know TCP/IP I ask them about these sorts of things:

  • Subnetting and CIDR
  • How many /24s in a /22?
  • What are the differences between TCP and UDP?
  • Is TCP tunable? (what would you tune and why?)
  • What are TCP and IP Options?

Good luck with your studies.

share|improve this answer

Though a lot of the application layer information is outdated, TCP/IP Illustrated, Volume 1: The Protocols is a great resource for learning.

share|improve this answer
I could not agree with this comment more. I used TCP/IP Illustrated to bootstrap into TCP/IP more than a decade ago. The fundamentals haven't changed, and the late W. Richard Stevens had a way of explaining complicated concepts that made them highly accessible. Buy this book. – Brian Clapper Dec 28 '09 at 14:34
The TCP/IP Guide ( is also good. – Gerald Combs Dec 28 '09 at 18:18

I have enjoyed the Security Now podcast ( which, over the years, has covered many aspects of the TCP/IP family of protocols.

Once you have learned the theory, nothing beats installing a protocol analyzer, such as wireshark ( and getting some hands on.

share|improve this answer
Big fan of Security Now! which has made clear to a whole bunch of people why the field of computer security is harder than just putting a virus scanner on a computer and thinking that is the end of the problem. – Stephen Thompson Dec 28 '09 at 10:14

try using hping3,tcpdump and wireshark to understand and dissect the packets flowing across network.

Wireshark is very good tool for actually checking each and every byte of packets and analyzing how flags and different headers and crafted.

These all would only be helpful if have basic operating systems knowledge couple with a reading of TCP/IP illustrative volume 1 or some other basic networking book.

And if you use Linux you might also wanna check

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.