Book · 2017
Practical Packet Analysis
by Chris Sanders
Chris Sanders walks you through Wireshark captures of real attacks, slow networks, and broken handshakes until the protocol stack stops being abstract.
What does Reddit think of Practical Packet Analysis?
Reddit has read this book but barely talks about it. r/programming surfaces it exactly once, in 2019, inside a thread about reverse-engineering tools like IDA Pro, Binary Ninja, and radare2 where someone needed a packet-capture primer to round out the kit. Nobody on Reddit argues about Practical Packet Analysis. Nobody dunks on it. Nobody calls it dated. That is the consensus: it is the default Wireshark book sysadmins paste into bootstrap threads when a junior asks how to actually read a pcap, and the discussion ends there. Treat the +0.00 sentiment as silence, not disapproval. The signal is that it keeps getting cited; the gap is that nobody bothers to defend why.
Community feedback & reader fit
Themes
- · Wireshark and tcpdump as the default capture toolchain
- · Reading a pcap when something on the network is broken
- · Sits inside r/sysadmin's recurring 'Nerd Books' bootstrap list alongside CCNA 200-301
- · Bridges the gap between the OSI model on paper and bytes on the wire
- · Cited in r/programming only when a reverse-engineering thread needs a packet primer
Common praise
- + r/sysadmin keeps pasting it into 'what should a junior read' threads, three separate times in 2023-2025.
- + The pcap walkthroughs teach you to spot a retransmission storm without Googling every flag.
- + It pairs cleanly with the CCNA 200-301 set when someone is studying for the network half of a sysadmin job.
- + Shows up in r/programming's 2019 reverse-engineering thread as the packet-capture companion to IDA Pro and radare2.
Common criticism
- − Six mentions in seven years across r/sysadmin and r/programming combined is not a fanbase, it's a footnote.
- − Every recommendation is a drive-by inside a longer book list, so nobody on Reddit has actually argued for the writing or the exercises.
- − r/netsec and r/networking, the subs where you would expect real debate, do not show up in this data at all.
Who it's for
You are the sysadmin or junior security engineer who can describe TCP in a sentence but freezes when somebody hands you a 200MB pcap and says 'figure out why payroll is slow.' Open Wireshark, work the chapters, and the colored rows start meaning something. If you already disassemble malware for a living or run a backbone, this is below your floor. If you are studying for the CCNA and want a hands-on companion that is not another exam-prep brick, r/sysadmin's recurring booklist has been quietly telling you to buy it since 2023.
Mentions over time
Top subreddits
Which Reddit comments matter for Practical Packet Analysis?
Top-upvoted quotes across the subreddits where this book is mentioned. Click through to read the full thread.
“So before I start in on that, I need to caution you to _not_ look at only IDA Pro if you have a low time investment. IDA has a four digit price tag and if you're planning on using legit copies of your stuff, it's just too much for where you're at. Binary Ninja, Hopper, and radare2 are all lower-pric…
“It's not insane... but it's not ideal either. SELinux didn't launch until 2000, and that's a pretty significant change in Linux fundamentals. ----- Nerd Books: [Cisco CCNA Certification, 2 Volume Set: Exam 200-301](
Convinced? Pick up Practical Packet Analysis
Readers also mention
Books that share discussion threads with Practical Packet Analysis — counted from the comments, not curated.
Network Warrior
Gary A. Donahue
Gary Donahue's field manual for the network engineer who inherits a closet full of Cisco gear and has to keep packets moving by Monday.
The Practice of Network Security Monitoring
Richard Bejtlich
Richard Bejtlich's field manual for catching intruders by watching the wire, built around Security Onion and the assumption that prevention will fail.
The Practice of Cloud System Administration
Thomas A. Limoncelli
Limoncelli's Volume 2 on running large distributed web services, the one r/sysadmin keeps listing right next to Volume 1 and rarely talks about on its own.
TCP/IP Illustrated, Vol. 1
W. Richard Stevens
W. Richard Stevens wrote 24 Reddit-cited pages per year's worth of networking protocol detail so you'd stop guessing what's on the wire.
The Practice of System and Network Administration
Thomas A. Limoncelli
Thomas Limoncelli's field manual for the sysadmin who wants to stop firefighting and start running a shop that doesn't wake them up at 3 a.m.
Practical Packet Analysis — frequently asked
Is Practical Packet Analysis worth buying in 2026?+
Depends on your floor. If pcap files still intimidate you, yes. r/sysadmin cited it in five separate threads from 2022 through June 2025, always as the Wireshark book to hand a junior, and nobody pushed back. If you already read tcpdump output for breakfast, the book is below your level and Reddit does not pretend otherwise. The neutral +0.00 sentiment reflects that nobody argues about it, not that anybody dislikes it.
What does Reddit think of Practical Packet Analysis?+
Reddit barely thinks about it out loud. Six total mentions in seven years across r/sysadmin (five) and r/programming (one), zero in r/netsec or r/cscareerquestions in this dataset. Every appearance is inside a larger 'Nerd Books' list next to the Cisco CCNA 200-301 set. The book is treated as settled prior art for sysadmins: cite it, move on. No defenders, no detractors, no Felurian-detour debate.
Should I read Practical Packet Analysis before the CCNA?+
Read them together. The same r/sysadmin commenter who keeps pasting the Nerd Books list bundles Practical Packet Analysis with the Cisco CCNA Certification 200-301 two-volume set as a package, with 58 and 43 upvotes on two of those posts. The CCNA gives you the model, the Sanders book makes you actually open captures. Doing one without the other is the common complaint about CCNA-only prep on r/sysadmin.
Is Practical Packet Analysis relevant for reverse engineering work?+
Tangentially. r/programming's one mention, the highest-upvoted in the dataset at 118, came inside a 2019 thread weighing IDA Pro against Binary Ninja, Hopper, and radare2, where a commenter pointed to it as the packet-capture primer that rounds out a reversing toolkit. It is not a malware analysis book. It is the network-traffic half of the workflow somebody on r/programming thought a beginner reverser was missing.