Networking Foundations

Start here if packet captures look like noise. Every lesson in this app assumes you already know what a layer is, why a machine has two different addresses, what a subnet mask does, and how a packet reaches a network nobody has ever heard of. This page teaches those directly instead of expecting you to work them out from a trace.

There are no captures on this page at all. When you are done, the protocol map shows how the modules fit together, and TCP Foundations covers what TCP specifically assumes on top of all this.

How much networking do you already have?

This only changes what we recommend and how deeply things are explained by default. Every chapter below stays open whatever you pick, and you can change your mind at any time.

Same ideas, three depths. No packet captures anywhere on this page.

— What are the layers, and why does anyone care?
— Why does the same data have five different names?
— What is the difference between a frame and a packet?
— What makes something a client and something else a server?

Sending data across the world is too big a problem to solve in one go, so it is split into layers. Each layer solves exactly one problem and hands the result to the next. Think of posting a parcel. You write a message (that is your data). You put it in a box with an address (that is one layer). The courier puts your box in a van with a route (another layer). The van drives on roads someone else maintains (another layer). Nobody in that chain needs to understand the others' job. The courier does not read your message; you do not plan the van's route. Networking is the same idea. Your browser writes a request. TCP turns it into a numbered, reliable stream. IP addresses it so routers can forward it. Ethernet gets it across one physical wire. Four jobs, four layers, each ignorant of the others.

Layer: One job in the delivery chain, with a defined interface to the job above and below it. Each layer adds its own header on the way out and strips it on the way in.
OSI model: A seven-layer reference model (physical, data link, network, transport, session, presentation, application). Nobody implements it literally, but its layer NUMBERS are everywhere: 'a layer 2 problem' means the link layer, 'layer 3' means IP, 'layer 7' means the application.
TCP/IP model: The four-layer model the internet actually runs on: link, internet, transport, application. This is the one that maps onto real code.
Peer layer: The matching layer on the other machine. Your TCP talks to their TCP; your Ethernet talks to the next hop's Ethernet. Each pair behaves as if it had a direct line, even though everything travels down and back up the stack.

Where the models line up, and what each layer is called in practice:

OSI              TCP/IP        Examples          Called a…
───────────────  ────────────  ────────────────  ──────────
7 Application    Application   HTTP, DNS, BGP    message
6 Presentation   Application   TLS               record
5 Session        Application   —                 —
4 Transport      Transport     TCP, UDP          segment / datagram
3 Network        Internet      IPv4, ICMP, OSPF  packet
2 Data link      Link          Ethernet, ARP     frame
1 Physical       Link          copper, fibre     bits

When someone says 'that is a layer 2 issue', they mean the wire and the switch. 'Layer 3' means addressing and routing. 'Layer 7' means the application spoke nonsense. The numbers are OSI's; the stack is TCP/IP's.

✗ Common misunderstanding: The internet implements the seven-layer OSI model.

Why that's wrong: OSI was a separate, competing protocol suite that lost. Its model survived as vocabulary because the layer numbers turned out to be a useful shorthand.

Correct model: The internet implements the four-layer TCP/IP model. Layers 5 and 6 have no separate implementation — TLS is usually called 'layer 6-ish' by convention, not by design.

The packets prove it: Open any packet in this app. You will find exactly four header groups — Ethernet, IPv4, TCP, and the application data — never seven.

Every layer wraps what it was given in its own header — a small, fixed block of bytes at the front that says who it is for and what is inside. Going out, each layer adds one. Coming in, each layer reads its own and strips it off before handing the rest upward. Back to the parcel: your letter goes in an envelope with an address; the envelope goes in a courier bag with a barcode; the bag goes in a van with a manifest. The person opening it reverses that, one wrapper at a time, and never has to open a wrapper that is not theirs. That is why a captured packet looks like a set of nested boxes in this app's inspector. It literally is one.

1Your browser produces a request — just bytes. This is the message.
2TCP prepends its header (ports, sequence number, flags). The result is a segment.
3IP prepends its header (source and destination addresses, TTL, protocol number). The result is a packet.
4Ethernet prepends its header (source and destination MAC, EtherType) and appends a trailing checksum. The result is a frame.
5The frame is turned into electrical or radio signals and sent.
6The receiving card reassembles the frame, checks the trailing checksum, reads EtherType 0x0800, and hands the payload to IP.
7IP checks its own header checksum, sees protocol 6, and hands the payload to TCP.
8TCP checks the ports, finds the connection, and hands the bytes to the application.

Header: Bytes a layer adds at the FRONT of what it was given, carrying only what that layer needs to do its job.
Payload: Everything after the header — the layer above's unit, which this layer treats as meaningless bytes it must not interpret.
Trailer: Bytes added at the END. Rare: Ethernet's frame check sequence is the one you will meet, because a checksum over the whole frame can only be computed once the frame is complete.
Encapsulate / decapsulate: Adding your header on the way out; removing it on the way in.

Each layer wraps the one above it. The words segment, packet and frame name different wrappings — they are not synonyms, even though people say “packet” loosely.

Watch these fields in the lab: eth.type · ipv4.protocol