Cyber Security Academy · Lesson

Reading Protocols

Analyze TCP, HTTP, DNS.

Reading Protocols is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Protocols Layer by Layer

Network traffic is organized in layers. Each packet wraps a higher-layer protocol inside a lower one, like envelopes within envelopes.

Reading traffic means peeling these layers in the right order.

Ethernet -> IP -> TCP -> HTTP
(frame)     (pkt)  (seg)  (data)

The TCP Handshake

A TCP connection begins with a three-way handshake: SYN, SYN-ACK, ACK. Seeing it confirms a real connection was established.

A SYN with no SYN-ACK reply often means a closed port or a firewall drop.

Client -> SYN
Server -> SYN, ACK
Client -> ACK   (connection up)

TCP Flags and State

TCP flags reveal connection state. Learn the common ones to follow a conversation.

SYN: start.
ACK: acknowledge.
FIN: graceful close.
RST: abrupt reset.

Following a Stream

Wireshark can follow a TCP stream to reassemble a conversation into readable text instead of scattered packets.

Right-click a packet and choose Follow to see the full request and response together.

Right-click -> Follow -> TCP Stream

Reading HTTP

HTTP traffic is plain text (when not encrypted). You can read the method, path, headers, and body directly.

This makes unencrypted HTTP a rich source for analysis, and a risk for the network owner.

GET /admin HTTP/1.1
Host: intranet.local
Cookie: session=abc123

HTTP/1.1 200 OK

HTTPS and TLS

HTTPS wraps HTTP in TLS, so the payload is encrypted. You still see the TLS handshake, the SNI hostname, and the certificate.

Without keys you cannot read the body, but metadata still tells a story.

TLS Client Hello
  server_name: bank.example.com  (SNI)
TLS Server Hello + Certificate

Reading DNS

DNS queries reveal which domains a host is trying to reach, often before any connection is made.

A query and its response show the requested name and the resolved address.

DNS query:    A  cdn.example.com
DNS response: cdn.example.com -> 93.184.x.x

DNS as an Indicator

DNS is a goldmine for analysts. Lookups for known-bad domains, long random subdomains, or unusually high query volume all point to suspicious behavior.

We will use this heavily when hunting for anomalies.

UDP and ICMP

Not everything is TCP. UDP is connectionless (used by DNS, DHCP, QUIC), and ICMP carries control messages like ping and unreachable errors.

Unusual ICMP volume can signal scanning or tunneling.

Using the Statistics Menu

Wireshark's Statistics menu summarizes a capture: protocol hierarchy, conversations, and endpoints.

Start analysis here to see what protocols dominate and which hosts talk the most.

Statistics -> Protocol Hierarchy
Statistics -> Conversations
Statistics -> Endpoints

Building a Mental Model

Good analysts build a picture of normal for a network. Once you know normal, anomalies jump out.

Reading protocols fluently is the foundation for everything that follows.

Quick Check

Test your understanding of reading protocols.

Recap

You learned to read network protocols.

Traffic is layered: Ethernet, IP, TCP/UDP, application.
TCP starts with SYN, SYN-ACK, ACK; flags reveal state.
Follow TCP Stream reassembles conversations.
HTTP is readable; HTTPS exposes only TLS metadata and SNI.
DNS reveals destinations; use Statistics to find normal.

Next you will detect anomalies and malicious traffic.

Frequently asked questions

Is the “Reading Protocols” lesson free?

Yes — the full text of “Reading Protocols” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Reading Protocols”?

Analyze TCP, HTTP, DNS. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Reading Protocols” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy