Meet the Packet
What is it?
A packet is a small unit of data wrapped in layers of headers. Each layer adds the information its part of the network needs to deliver the packet.
Why it matters
Every field you will ever filter on or read as evidence lives in one of these layers. Knowing the layers tells you where to look.
Where you see it
In the workspace, selecting a packet shows its layers as an expandable tree: Frame, Ethernet, IP, then TCP or UDP, then the application protocol.
What normal looks like
A well-formed packet has a source and destination IP, a source and destination port, and an application layer that matches the port (HTTP on 80, DNS on 53).
What suspicious looks like
A mismatch — an application protocol on an unexpected port, or an IP layer pointing at an address that has no business being contacted.
How analysts investigate
Read a packet from the outside in: the IP layer tells you who, the transport layer tells you which service, and the application layer tells you what was said.
Common beginner mistakes
- Reading only the summary line and never expanding the layers where the real evidence is.
- Confusing the source and destination when a conversation has packets flowing both ways.
Think of a packet like an envelope inside an envelope. The application data (say, an HTTP request) is wrapped by TCP, which is wrapped by IP, which is wrapped by Ethernet. Each layer is a header the network peels off in turn.
- IP layer — the source and destination addresses: WHO is talking.
- TCP/UDP layer — the ports: WHICH service (80 = HTTP, 53 = DNS).
- Application layer — the payload: WHAT was actually requested or answered.
Quick check
Which layer contains the destination IP address?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.