Reading what actually crossed the wire. Articles tagged Packet Analysis cover capture points, filters, and decoding protocol exchanges frame by frame.
The three-way handshake is the first thing anyone learns about TCP and the last thing most people actually look at. SYN, SYN-ACK, ACK is easy to draw. What is harder, and far more useful, is reading a real
Discover, Offer, Request, Ack. You can recite DORA in your sleep, and it still will not help you the day a client comes up with a 169.254 address and the server insists the pool is fine. What helps is
Every OSPF adjacency you have ever built started with a Hello packet, and almost every adjacency that refuses to build is a Hello packet being quietly thrown away. The trouble is that show ip ospf neighbor only tells you the
Pattern matching against live packet payloads. The syntax, the hex mode, the file interop, and a real capture showing the server name leaking out of an encrypted session.
Wireshark’s full dissector library driven from an SSH session: capture filters against display filters, custom field output, ring buffers and the statistics taps that make triage fast.
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
Interface selection, BPF filters, reading the output line, writing and re-filtering pcap files, and safe long captures - all from a live run of tcpdump 4.99.5 against IOS-XE routers. Includes the privilege drop that kills rotating captures, and a telnet password readable on the wire.