An interesting blog post touching on many of the aspects of networking we've talked about, including IP spoofing, use of tcpdump, and identifying source networks: https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/