-
Ethernet & ARP: Ethernet frame fields, size limits, CRC absence in captures
-
Ethernet & ARP: Ethertypes (IPv4, IPv6, ARP); unicast/broadcast/multicast addresses
-
Ethernet & ARP: VLAN tagging behavior
-
Ethernet & ARP: ARP packet types, broadcast vs. unicast, and filtering
-
IPv4 header fields (TTL, fragmentation, length, protocol ID, IP ID)
-
IPv4: Address classes, NAT, TTL-based hop estimation, IP ID strategies
-
ICMPv4 message types and error source identification
-
IPv6 address types: link-local, global, multicast
-
ICMPv6 neighbor/router discovery (solicitation & advertisement)
-
UDP traffic recognition, associated protocols, stream ID/timestamps, multicast applicability
-
DHCPv4 DORA workflow, message types, options (router, DNS, subnet), APIPA context
-
DNS request/reply identification, traffic isolation via DNS data, record types
-
The full TCP handshake and teardown process
-
iRTT measurement and MSS calculation
-
TCP flags and their function in session control
-
Sequence and ACK mechanics for reliability
-
TCP options: EOL, NOP, MSS, SACK, DSACK, window scaling
-
Duplicate ACK detection, missing segment identification through SACK/DSACK
-
Interpreting TCP stream graphs, reassembly, awareness of stream IDs and timestamps