Summary

We covered some serious theory in this chapter. We started by looking at the IP and TCP protocol headers, and we analyzed the HTTP protocol. We then analyzed the FTP protocol, and the UDP-oriented DNS service. We looked at the ICMP protocol and saw a case study where ICMP was being used for command and control. Throughout this chapter, we learned new and advanced concepts to analyze various packets and protocols. In the next chapter, we will look at statistical flow analysis, and we will learn how it can help us conduct an efficient network forensic exercise.