You can run traceroute. Can you explain why it works? Every networking tool is applied protocol semantics. It repurposes a field, or exploits a behavior the RFC either mandated or left undefined. Traceroute is the TTL field doing a second job. The nmap SYN, FIN, NULL, Xmas, and ACK scans are RFC 793's own mandated replies turned into a probe. The idle scan reads a stranger's IP ID counter. p0f fingerprints a host from the idiosyncrasies of its TCP options. The Kaminsky attack races sixteen bits of DNS entropy. TCP/IP in Practice teaches the stack the way an engineer actually learns it: by understanding why each tool works, field by field, and then inverting every mechanism into a defense. For each technique, the book shows the defensive inversion the protocol community actually shipped - SYN cookies, GTSM, RFC 6528 sequence numbers, source-port randomization, DNS 0x20 encoding, response-rate limiting, and uRPF - as one coherent family rather than a list of unrelated fixes. Who it is for>InsideThe field-by-field core. TTL and path shape, the handshake's honest answers, ISN entropy and spoofing, the IP ID side channel, and timestamp/window/option fingerprinting - each derived from the RFC.The tool families. ARP and the blind network map, active and passive fingerprinting, UDP and ICMP inference, fragment-based evasion, covert channels, and DNS cache poisoning.The defensive inversions, assembled. Encode state in the field, add entropy, verify the field - one meta-pattern behind every modern defense.A hands-on lab. A self-contained Linux network-namespace testbed built with Scapy, hping3, tcpdump, and Wireshark. You reconstruct traceroute, a SYN scanner, the idle scan, a p0f-lite classifier, and a DNS-poisoning proof of concept - each in about a dozen lines.Six graded katas, from mapping a subnet you cannot send traffic to, to redesigning a technique the defenders already killed.Thirty-one chapters, eighteen hand-drawn diagrams, and four appendices - including a field → tool → defense quick-reference table. Samir Chekkal is the author of the In Practice series - concise, hands-on guides written by an engineer for engineers who ship real systems.
