TCP is more complex than UDP. UDP is really just I pick my local ip and port, and send to your remote ip and port, and hope you get it. TCP has handshaking, acks, flags, resets, etc; a lot more to go wrong. Anyway, understanding DNS means understanding UDP too.

I've seen a lot of things in HTTP land that I wouldn't have been able to figure out without tcpdump. The most exciting thing is that livehttpheaders doesn't always tell the whole truth. :( But also subtle things like (TCP) load balancers mungling option fields, forged reset packets (and determining from whence they may have come), weird packet corruption.

Yes, absolutely I don't expect people coming from an offline world to know the internet stuff... but who's really offline these days?