ER SEGMENTPROTOCOL LAB

Network protocols, explained packet by packet

Watch real packets travel across a network, inspect every field like in Wireshark, then see exactly how attackers abuse each protocol and how defenders stop them. Built by ER Segment for cybersecurity students.

40 protocols & services every SOC analyst and security professional must know

Transmission Control Protocol

Handshake, sequence numbers, packet loss and retransmission.

⚠ SYN flood · SYN cookies

Domain Name System

How a name becomes an IP: resolver, root, TLD, authoritative.

⚠ Cache poisoning · DNSSEC

Address Resolution Protocol

How devices find each other's MAC address on a LAN.

⚠ ARP spoofing · MITM · DAI

User Datagram Protocol

Fast, connectionless delivery with no handshake.

⚠ Amplification attacks

Internet Protocol & ICMP (ping, traceroute)

Addressing, routing, TTL, ping and traceroute.

⚠ Ping sweeps · recon

Dynamic Host Configuration Protocol

How devices get an IP address automatically.

⚠ Starvation · rogue server

Hypertext Transfer Protocol

Requests, responses, headers and cookies.

⚠ Session hijacking

Transport Layer Security

Certificates, key exchange and encryption.

⚠ SSL stripping · MITM

Encrypted remote login and tunnels.

⚠ Brute force · key theft

File Transfer Protocol

Control and data channels.

⚠ Clear-text credentials

Remote terminal (clear text)

Why it should never be used today.

⚠ Credential sniffing · Mirai

Simple Mail Transfer Protocol

How mail moves, plus SPF, DKIM and DMARC.

⚠ Email spoofing · phishing

Server Message Block (Windows file sharing)

Windows file sharing.

⚠ NTLM relay · EternalBlue

Remote Desktop Protocol

Remote Windows desktop sessions.

⚠ Brute force · BlueKeep

Lightweight Directory Access Protocol

Directory queries and logins against Active Directory.

⚠ Clear-text binds · enumeration

NT LAN Manager authentication

Windows challenge-response authentication.

⚠ Pass-the-hash · relay

Simple Network Management Protocol

Monitoring network devices.

⚠ Default community strings

Wi-Fi Protected Access

Wi-Fi encryption and the 4-way handshake.

⚠ Weak passphrases · WPA3

Delegated authorisation (“Sign in with …”)

“Sign in with …” and app permissions.

⚠ Consent phishing · token theft

Network Time Protocol

Keeping every clock in sync.

⚠ Fake time · amplification

System logging protocol

Sending logs to a SIEM.

⚠ Log tampering · log gaps

Reading mail from a mailbox

Reading email from a mailbox.

⚠ Password spraying · legacy auth

Local name resolution fallbacks

What Windows does when DNS fails.

⚠ Name poisoning

MySQL, MSSQL, PostgreSQL, MongoDB, Redis

How apps talk to their databases.

⚠ Exposed databases · weak passwords

Virtual Network Computing (RFB)

Remote screen sharing.

⚠ No-password VNC · exposure

Windows Remote Management / PowerShell Remoting

Remote PowerShell for administrators.

⚠ Lateral movement

802.1X / RADIUS

Network access control

Locking every switch port and Wi-Fi login.

⚠ Rogue devices on wall ports

Border Gateway Protocol

How networks route the internet.

⚠ Route hijacks · RPKI

Session Initiation Protocol + RTP

How office phone calls work.

⚠ Toll fraud · eavesdropping

VPN (IPsec / SSL)

Virtual Private Networks

Secure tunnels into the company network.

⚠ Unpatched gateways · password-only logins

Encrypted DNS (DoH / DoT)

Encrypted DNS and the SOC blind spot.

⚠ DNS filtering bypass by malware

Fast encrypted transport over UDP

HTTP/3 over UDP.

⚠ Inspection blind spots

NetFlow / IPFIX

Network flow records

Traffic summaries for the SOC.

⚠ Exfiltration · beaconing detection

IPv6 (NDP / RA)

IPv6 neighbour discovery & router advertisements

How IPv6 devices find their router.

⚠ Rogue router advertisements

Spanning Tree Protocol

Loop prevention between switches.

⚠ Root bridge takeover

Virtual LANs and trunk tagging

Separate networks on shared switches.

⚠ VLAN hopping

Network File System

Linux network file shares.

⚠ Open exports · no_root_squash

Container engine remote API

How the docker CLI controls containers.

⚠ Exposed Docker daemons

Industrial control (OT / ICS)

How industrial controllers are commanded.

⚠ No authentication · IT/OT segmentation

IoT publish / subscribe messaging

IoT publish / subscribe messaging.

⚠ Open brokers · fake commands

Practise this in a real lab

Every lesson here has a hands-on lab version in ER Segment's training: private labs, real tools, real attacks in a safe environment.

Explore ER Segment training →

ER SEGMENT · PROTOCOL LAB · CYBERSECURITY IS IN OUR DNA