1

I am trying to learn TCP/IP. Can anyone recommend some tools to help me better understand it?

6 Answers 6

4

Scapy is a very good tool for forging packets in conjunction with wireshark, it may fit your needs.

1
  • +1, Interesting... thanks for the link!
    – l0c0b0x
    Dec 28, 2009 at 13:52
2

I found this site a while ago for a friend, LearnTCPIP which she said helped her understand the basics, and is of course "free"

1
  • This does not seem like a very good site. They are much more interested in selling CDs than teaching.
    – Joel K
    Dec 28, 2009 at 12:59
2

The first think you should know is that TCP and IP are different things and the original question you're asking is like asking about milk-and-cookies.

It's not light reading, but the fully authoritative source for all things TCP is the original RFC.

RFC 793

IP also has a RFC, but TCP is the harder of the two.

You didn't say why you need to know this.. Let's assume it's for an interview.

When I interview people looking for jobs who say they know TCP/IP I ask them about these sorts of things:

  • Subnetting and CIDR
  • How many /24s in a /22?
  • What are the differences between TCP and UDP?
  • Is TCP tunable? (what would you tune and why?)
  • What are TCP and IP Options?

Good luck with your studies.

2

Though a lot of the application layer information is outdated, TCP/IP Illustrated, Volume 1: The Protocols is a great resource for learning.

2
  • I could not agree with this comment more. I used TCP/IP Illustrated to bootstrap into TCP/IP more than a decade ago. The fundamentals haven't changed, and the late W. Richard Stevens had a way of explaining complicated concepts that made them highly accessible. Buy this book. Dec 28, 2009 at 14:34
  • The TCP/IP Guide (tcpipguide.com) is also good. Dec 28, 2009 at 18:18
1

I have enjoyed the Security Now podcast (http://twit.tv/sn) which, over the years, has covered many aspects of the TCP/IP family of protocols.

Once you have learned the theory, nothing beats installing a protocol analyzer, such as wireshark (http://www.wireshark.org/) and getting some hands on.

1
  • Big fan of Security Now! which has made clear to a whole bunch of people why the field of computer security is harder than just putting a virus scanner on a computer and thinking that is the end of the problem. Dec 28, 2009 at 10:14
1

try using hping3,tcpdump and wireshark to understand and dissect the packets flowing across network.

Wireshark is very good tool for actually checking each and every byte of packets and analyzing how flags and different headers and crafted.

These all would only be helpful if have basic operating systems knowledge couple with a reading of TCP/IP illustrative volume 1 or some other basic networking book.

And if you use Linux you might also wanna check http://kernelnewbies.org/Documents/LinuxIPNetworking

You must log in to answer this question.