Different packets may take different routes.
The receiving system and transport protocol
determine how the delivered data is handled.
Protocols
TCP versus UDP.
TCP and UDP are transport-layer protocols.
They commonly carry application data inside
IP packets.
TCP
Connection-oriented and designed to provide
reliable, ordered delivery of a byte stream.
Uses acknowledgements and retransmissions
to recover from packet loss.
UDP
Connectionless, with no built-in guarantee
that datagrams will arrive or arrive in order.
Commonly used for DNS queries, gaming and
real-time communication.
Applications can add their own reliability
mechanisms when using UDP. QUIC, which supports
HTTP/3, is an example.
TCP connections
The three-way handshake.
Before exchanging ordinary application data,
TCP normally establishes a connection using
a three-way handshake.
1. SYN →
The client requests a connection
↓
2. ← SYN-ACK
The server acknowledges and responds
↓
3. ACK →
The client acknowledges the server
Once the handshake completes, the TCP connection
is established and application communication
can proceed.
Security connection:
A large number of SYN packets without completed
handshakes may warrant investigation.
However, incomplete handshakes can also occur
during normal scanning or network problems.
Packet inspection
What can a packet capture reveal?
Packet capture tools record network traffic
visible to the capturing device.
Source IP
Where the packet originated
Destination IP
Where the packet is being sent
Protocol
Examples include TCP, UDP and ICMP
Ports
Help identify transport-layer endpoints
Timing
Helps identify patterns and unusual activity
Encrypted connections can conceal application
content, but packet metadata and traffic patterns
may still provide useful information.
Practical tools
Introducing Wireshark.
Wireshark is a packet analysis tool used
by network administrators, researchers
and security analysts.
It allows you to capture traffic and apply
display filters to investigate specific
conversations or protocols.
tcp
Display TCP traffic
udp
Display UDP traffic
dns
Display recognised DNS traffic
tcp.flags.syn == 1
Display TCP packets with the SYN flag set
Remember:
Wireshark display filters decide which
captured packets you see. Capture filters
decide which traffic gets recorded.
They use different syntax.
SOC investigation
Spotting unusual network activity.
Network traffic analysis helps SOC analysts
investigate suspicious behaviour.
Port scanning
One host contacting many ports or systems
Beaconing
Repeated connections at regular intervals
Data transfers
Unexpected traffic volumes or destinations
DNS anomalies
Unusual query patterns or suspicious domains
These patterns are investigative clues,
not automatic proof of malicious activity.
Analysts correlate network evidence with
logs, endpoint alerts and other context.
Try it yourself
Capture your own traffic.
On a Linux computer where tcpdump is installed,
first identify your network interfaces:
ip -br addr
Then capture a small number of packets
on your chosen interface. Replace
INTERFACE with its actual name.
sudo tcpdump -i INTERFACE -nn -c 20
The -i option selects the interface,
-nn disables hostname and port-name
resolution, and -c limits the capture
to 20 packets.
Lab safety:
Capture traffic only on networks and
devices you're authorised to monitor.
Packet captures may contain sensitive data.
Remember this
Packets tell a story.
IP handles addressing and routing.
TCP and UDP transport application data.
Packet analysis helps explain
what happened on a network.
Understanding packets gives you the foundation
for investigating network activity and
interpreting security alerts.