// Mission Fieldwork 01

How Networks Work

Watch one web request travel from your browser to a server and back. Then build the real thing in Linux and see it happen yourself.

Free · No signup 18 sessions · About 6 hours · Self-paced with video and labs
0 of 18 completeStart Course

// The route

The whole course, at a glance.

Three acts, eighteen sessions. Every title below jumps straight to that session.

Prefer missions to lessons? Acts 1 and 2 are also playable as Signal Path I: Browser to Server, 24 guided missions, same material, no terminal.

// Before you begin

Start with curiosity, not credentials.

Begin in the browser. When the route reaches a real lab, use a clean Ubuntu VM or WSL2 environment. Each stage states what you need, what you will change, and what evidence to keep.

// How it works

Follow the Signal Path in order.

Each stop moves through the Mission Fieldwork loop: see the model, operate the tool, build the system, change one condition, and prove the result. Video recordings support the route; they are not the only way through it.

// Video recordings

Watch the sessions on YouTube.

All recordings are free and published in order. Follow along at your own pace.

Open YouTube Playlist

// Field notes

Small facts that make packet captures click.

Each note connects an abstract idea to a value or command you can inspect yourself.

Ethernet arithmetic

1500 bytes is not the whole frame.

Add the 14-byte Ethernet header and 4-byte FCS for 1518 bytes. Preamble and inter-frame gap still consume time on the wire.

tcpdump -nn -e -r trace.pcap
Routing truth

The kernel decides before the packet leaves.

ip route get reveals the chosen route, source address and egress interface for one destination.

ip route get 1.1.1.1 ip neigh show
Capture discipline

Two filters, two languages.

A capture filter limits the PCAP. A display filter hides packets after capture. Preserve broad evidence first, then narrow the view.

tcpdump -ni any -w trace.pcap 'tcp port 443' tcpdump -nn -r trace.pcap 'tcp[tcpflags] & tcp-syn != 0'
Layer 2 state

Bridges learn from source MAC addresses.

Unknown destinations flood. Known unicasts follow the FDB, subject to VLAN membership and STP state.

bridge link show bridge vlan show bridge fdb show

// Free and open study shelf

Go deeper without buying a platform.

Project documentation, open guides and real tools, from packet reading to routing protocols.

What you can prove when you finish

You will be able to trace a request across DNS, Ethernet, IP, routing, NAT, TCP, TLS, firewalls, load balancers, and BGP, then choose evidence that distinguishes one failure from another.

Open the Toolbench →