Network Protocols — detection-relevant internals

This skill encodes how network protocols actually work at the level needed to write detections that catch protocol abuse, not just known-bad indicators.

1. DNS

Resolution chain

Client → Local cache → Hosts file → Recursive resolver (configured DNS server)
  → Root servers → TLD servers → Authoritative server → Response

Detection-relevant DNS behaviours