I am searching for good books and articles about TCP/IP, mainly the security aspects of TCP/IP protocols. I have TCP/IP Illustrated and the TCP Guide, but they kinda lack on description of 'classic' attacks and how the internals of protocols relate to those attacks.

PS: Seeing the first real answer made me remember to add that this is strictly for studying purposes, I have no intention of going black hat at this point, I am just preparing for job interviews :)


I really prefer this book:


It is very detailed.

Some (good and free) white paper on secure design is available here: http://cisco.com/go/safe

  • The Sean Convery book is spot on. Already on my kindle!
    – coredump
    Nov 19 '10 at 14:06

I would suggest to check IBM book this is great book and would help you a lot. This has TCP/IP Security related chapter also.


  • Why does the footer of your answer look like spam to me?
    – halp
    Nov 18 '10 at 16:41
  • That was my signature. I have removed it now. Nov 18 '10 at 17:32
  • 1
    Please see the FAQ (top right corner of every page) regarding the use of signatures. Thank you.
    – Chris S
    Nov 19 '10 at 13:31
  • @Chris Thank for pointing me to guide line. I will make sure I won't use it. Nov 19 '10 at 16:42

Unfortunately I don't know of many references that talk about attacks in terms of how they interact with the protocol stack. I'd imagine following mailing lists like Bugtraq will keep you on top of current vulnerabilities, but it sounds like you're looking for more of a primer.

I've been told that Hacking Exposed is a good general reference for those interested in learning about attack vectors; it's on my reading list, but I haven't got around to it yet.

Building Internet Firewalls, though fairly old, still offers an excellent overview of how to think about security when designing your network.


I good (and free) resource from Cisco can be found here: ISP Security Issues in ISP Security Issues in today’s Internet

There is also the complete text to IOS Essentials in PDF format from Cisco Press along with several other documents available in the same FTP directory if you are interested in some best practices for Cisco gear. Both of these documents are from 2002.

Another good resource would be the Nmap Network Scanning book by Gordon “Fyodor” Lyon. If you understand how nmap does its thing, you will gain a much deeper understanding of networking and security.


There are a number of online resources - as nutty as it sounds setup a secondary PC - or use a vps and then browse a large number of the hacking websites on the web.

BlackHat conferences while a bit expensive, will teach you a large amount about TCP/IP...

Architecturally here are few things I can tell you regarding TCP/IP

  • Since TCP/IP identifies parties by addresses hacker's attempt to spoof addresses

  • Address resolution within TCP/IP, DNS and ARP are not authenticated

  • You can easily masquerade as some other person or node

  • ARP spoofing circumvents switches....

Some TCP/IP Explolits include:

  • MAC Layer (ethernet) TCP/IP exploits
  • TCP Session hijacking
  • TCP Session application peeking/viewing
  • TCP Password Monitoring
  • Various Back channels
  • DOS:
  • Packet Generation Attacks & Relays

These few things should help you get started in google searches ... I can post more on each - however truth to be told... I would rather not Teach Hacking in a public community


There is no good books, its just in which book you have got the information you are looking for!

Check out if this page gives you the correct info - http://goo.gl/CaR44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.