1500 bytes is not the whole frame.
Add the 14-byte Ethernet header and 4-byte FCS for 1518 bytes. Preamble and inter-frame gap still consume time on the wire.
tcpdump -nn -e -r trace.pcap// Mission Fieldwork 01
Watch one web request travel from your browser to a server and back. Then build the real thing in Linux and see it happen yourself.
// The route
Three acts, eighteen sessions. Every title below jumps straight to that session.
Prefer missions to lessons? Acts 1 and 2 are also playable as Signal Path I: Browser to Server, 24 guided missions, same material, no terminal.
// Before you begin
Begin in the browser. When the route reaches a real lab, use a clean Ubuntu VM or WSL2 environment. Each stage states what you need, what you will change, and what evidence to keep.
// How it works
Each stop moves through the Mission Fieldwork loop: see the model, operate the tool, build the system, change one condition, and prove the result. Video recordings support the route; they are not the only way through it.
18-session curriculum
The essential route is available here without JavaScript. Browser activities need only a current browser. Systems labs name Linux, WSL2, Ubuntu VM, or Docker requirements individually.
// Video recordings
All recordings are free and published in order. Follow along at your own pace.
Open YouTube Playlist// Field notes
Each note connects an abstract idea to a value or command you can inspect yourself.
Add the 14-byte Ethernet header and 4-byte FCS for 1518 bytes. Preamble and inter-frame gap still consume time on the wire.
tcpdump -nn -e -r trace.pcapip route get reveals the chosen route, source address and egress interface for one destination.
ip route get 1.1.1.1
ip neigh showA capture filter limits the PCAP. A display filter hides packets after capture. Preserve broad evidence first, then narrow the view.
tcpdump -ni any -w trace.pcap 'tcp port 443'
tcpdump -nn -r trace.pcap 'tcp[tcpflags] & tcp-syn != 0'Unknown destinations flood. Known unicasts follow the FDB, subject to VLAN membership and STP state.
bridge link show
bridge vlan show
bridge fdb show// Free and open study shelf
Project documentation, open guides and real tools, from packet reading to routing protocols.
Capture workflow, protocol details, statistics and display filters.
Read the official guide → Free open guideA friendly path through packets, addressing, transport and routing.
Open the guide → Open-source labBuild virtual hosts, switches and links with standard Linux tools.
Run the walkthrough → Free software docsContinue from static routes into OSPF, BGP and IS-IS.
Explore FRR → Linux referenceRead the primitive behind the labs: isolated network stacks.
Read the manual → Open standardRead the IPv6 header and extension-header rules from the source.
Read RFC 8200 →You will be able to trace a request across DNS, Ethernet, IP, routing, NAT, TCP, TLS, firewalls, load balancers, and BGP, then choose evidence that distinguishes one failure from another.
Open the Toolbench →