2.3 Internet Protocol Suite

The Internet Protocol Suite, also known as the TCP/IP protocol suite, is a collection of protocols that are used to implement important functions on the Internet and in many other packet-switched networks. For network forensic investigators, the protocols that make up the Internet Protocol Suite are as important as waves are to surfers or cooking pans are to Julia Child.

Your effectiveness as a network forensic investigator will depend in part on your familiarity with the Internet Protocol Suite, including key protocols and header fields. Nearly every network forensic technique in this book relies on your understanding of these protocols, from flow record analysis to packet analysis to web proxy dissection, and more. To get the most out of this book, we highly recommend that you become proficient at recognizing and recalling the important features and basic structures of key protocols in the Internet Protocol Suite.