docrice wrote: » For the GCIA, I would recommend becoming familiar with TCP/IP headers and protocol behavior as a start. Note - I haven't read all the material below and I'm just listing them as potential good references: Wireshark Network AnalysisAmazon.com: Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Study Guide (978189393999: Laura Chappell, Gerald Combs: Books TCP/IP Illustrated, Volume 1http://www.amazon.com/TCP-Illustrated-Protocols-Addison-Wesley-Professional/dp/0321336313/ref=sr_1_6?s=books&ie=UTF8&qid=1312869043&sr=1-6 Network Intrusion DetectionAmazon.com: Network Intrusion Detection (3rd Edition) (9780735712652): Stephen Northcutt, Judy Novak: Books Nmap Network Scanninghttp://www.amazon.com/Nmap-Network-Scanning-Official-Discovery/dp/0979958717/ref=sr_1_1?ie=UTF8&qid=1312869082&sr=8-1 IP / TCP / UDP / ICMP headersTCP/IP Reference RFC 791 (IP)RFC 791 - Internet Protocol (RFC791) RFC 792 (ICMP)RFC 792 - Internet Control Message Protocol (RFC792) RFC 793 (TCP)RFC 793 - Transmission Control Protocol (RFC793) RFC 768 (UDP)RFC 768 - User Datagram Protocol (RFC76 RFC 1034 (DNS)RFC 1034 - Domain names - concepts and facilities (RFC1034) Snort User's Manualhttp://www.snort.org/assets/166/snort_manual.pdf Any material on TcpdumpManpage of TCPDUMP Binary / hex / decimal systems (this is a random page that I chose as an example)http://www.blaenkdenum.com/2006/09/binary-and-hexadecimal/ Insertion, Evasion, and Denial of Service: Eluding Network Intrusion DetectionInsertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection Mitnick vs. ShimomuraThe Mitnick attack - Computing and Software Wiki Honeynet Project ChallengesHoneynet Project Challenges | The Honeynet Project