Unit 01 · 1 h 38 min
Layers and packets
Open a capture and read one packet from the Ethernet frame down to the application data.
Networking Essentials
Read packets, plan subnets, follow DNS and TLS, secure the edge and learn from the incidents that made the news.
- Time
- 21 h 12 min
- Lessons
- 68
- Machine
- Ubuntu 24.04 LTS
- Builds on
- Linux Foundations
What you earn
RootCertificateNetworking Essentials, certificate of completion CompTIANetwork+CompTIA Network+ CiscoCCNACisco Certified Network Associate
Prepares you for CompTIA Network+ and Cisco Certified Network Associate. Root is not affiliated with these issuers.
You will be able to
- Read any packet layer by layer with tshark, tcpdump and Wireshark
- Plan IPv4, IPv6 and cloud subnets and audit an address plan
- Spot ARP spoofing, DNS tunnelling, encrypted DNS and beacons
- Tell what TLS hides and what it still reveals, including AI traffic
- Review firewall rules and segmentation against a written policy
Units and lessons
Unit 02 · 2 h 7 min
Addresses and subnets
Size subnets, audit the plan, close IPv6 blind spots and draw site boundaries that stop a worm.
Unit 03 · 2 h 5 min
Local networks
Follow frames with MACs and ARP, unmask a fake gateway, and secure and watch the office Wi-Fi.
- 1MAC addresses and switches15 min · machine
- 2ARP: from IP to MAC16 min · machine
- 3The gateway and ARP spoofing20 min · machine
- 4Finding the device behind a MAC16 min · virtual lab
- 5Auditing Wi-Fi security settings18 min · machine
- 6Finding rogue access points18 min · virtual lab
- 7Case file: odd traffic from phones22 min · machine
Unit 04 · 1 h 37 min
TCP, UDP and ports
Compare TCP with UDP, follow the handshake, and tell open, closed and filtered ports apart.
Unit 05 · 1 h 44 min
How DNS answers
Query a zone with dig, spot encrypted DNS that skips your resolver and hunt through resolver logs.
Unit 06 · 1 h 34 min
HTTP and TLS on the wire
Read plain HTTP, take a TLS handshake apart and measure what encryption still reveals, including AI traffic.
Unit 07 · 1 h 47 min
Reading captures in Wireshark
Find your way around Wireshark, follow whole conversations, summarise traffic and pull files out of captures.
Unit 08 · 2 h 2 min
Scans, beacons and leaks
Find a port scan, data hidden in DNS, a machine calling home on a timer and a large upload leaving the office.
Unit 09 · 1 h 52 min
Firewalls and segmentation
Check rules against policy, mine the drop log, control outbound traffic and keep the plant apart from IT.
Unit 10 · 1 h 36 min
Edge devices and remote access
Find exposed admin panels, answer an emergency patch directive, evict stolen sessions and fix remote access.
Unit 11 · 1 h 18 min
Hardening network devices
Diff router configs against a baseline, lock down the management plane, keep logs off the box and patch by risk.
Unit 12 · 1 h 52 min
Capstone: investigate an incident
Work one capture from first look to written finding: entry point, beacon, internal sweep and data loss.
You are the network analyst at corp.example. Each unit adds one layer of the network, and the course ends with a full incident worked from a single capture.