Press Open website to send a request

Packet inspector Tap a moving packet or a step in the sequence

No packet selected.
Tap a router to make it the source; tap a link to edit it

Dijkstra iterations from R1

Each row adds the closest unvisited router to the set N′ and relaxes its links. Entries are “cost, previous hop”; ∞ means not yet reachable. Bold marks the router chosen in that step.

Tap a flying packet to drop it
IP address
Subnet mask
Network address (IP AND mask)
Broadcast address (network OR NOT mask)

network bits host bits Drag the prefix slider and watch the boundary move.

Split into subnets

2 → 4 subnets

Layers and encapsulation

Networking is organised in layers. Each layer adds its own header around the data from the layer above (encapsulation) and the receiver strips them off in reverse. The packet inspector draws exactly this nesting.

OSI layerNameTCP/IP modelUnit (PDU)ExamplesDevice
7ApplicationApplicationMessageHTTP, DNS, SMTPHosts
6PresentationTLS encryption, character encoding
5SessionSession set-up and resumption
4TransportTransportSegment / datagramTCP, UDP (ports)Hosts, firewalls
3NetworkInternetPacketIPv4, IPv6, ICMPRouter
2Data linkLinkFrameEthernet, Wi-Fi (802.11), ARPSwitch, access point
1PhysicalBits / symbolsCopper, fibre, radioCable, hub, radio

A switch reads only the Ethernet header (MAC addresses: the fixed hardware address of each network card) and forwards the frame unchanged. A router removes the frame, decrements the IP TTL (time to live, a hop counter that is reduced by 1 at each router so a looping packet eventually dies), chooses the next hop from its routing table and builds a new frame for the next link. That is why the MAC addresses change hop by hop while the IP addresses stay end to end (except where NAT rewrites them).

Opening a website, step by step

  1. ARP: the laptop knows the gateway's IP (192.168.1.1) but needs its MAC address to build a frame. It broadcasts “Who has 192.168.1.1?” to ff:ff:ff:ff:ff:ff; the router replies with its MAC.
  2. DNS: a UDP query to port 53 turns the name into an IP address (an A record).
  3. TCP three-way handshake: SYN (seq = $x$), SYN-ACK (seq = $y$, ack = $x+1$), ACK (ack = $y+1$). Both sides now know each other's starting sequence numbers.
  4. TLS 1.3 (HTTPS): ClientHello and ServerHello agree keys in one round trip; the server proves its identity with a certificate. Everything after is encrypted.
  5. HTTP: GET request, 200 OK response with the page, and an ACK.

Each TCP byte has a sequence number; the acknowledgement number is the next byte expected, so after receiving bytes $x+1 \dots x+n$ the receiver sends ack $= x+n+1$. SYN and FIN each consume one sequence number.

TCP versus UDP

FeatureTCPUDP
ConnectionHandshake before dataNone (connectionless)
ReliabilityACKs, retransmission, in-order deliveryBest effort; may lose or reorder
Flow / congestion controlSliding window, congestion windowNone
Header20–60 bytes8 bytes
Used byWeb, email, file transferDNS, voice/video calls, games, QUIC (HTTP/3)

Reliability and throughput

Intuition: the sender can only have $W$ segments "in the pipe" at once, and it must wait one round trip before the pipe can be refilled. So a bigger window or a shorter round trip means more data per second. With window $W$ segments of size MSS (maximum segment size, the data bytes in one segment) and round-trip time RTT, at most $W$ segments can be unacknowledged, so

$$\text{throughput} \le \frac{W \cdot \text{MSS}}{\text{RTT}}$$

The window must cover the bandwidth–delay product (link rate × RTT: the amount of data that fits "in flight" on the link) to keep the link busy. When a segment is lost, the sender notices either by a timeout (no ACK within the retransmission timeout, RTO) or by three duplicate ACKs (fast retransmit). Go-Back-N resends everything after the loss; Selective Repeat resends only the missing segment but needs per-segment ACKs and receiver buffering. Real TCP uses cumulative ACKs, buffers out-of-order data, fast retransmit and (with SACK) selective acknowledgement. Under random loss $p$, standard TCP's throughput falls roughly as $\text{MSS}/(\text{RTT}\sqrt{p})$ (the Mathis formula), because the congestion window halves on every loss; the lab keeps the window fixed to isolate retransmission behaviour.

IPv4 addressing and subnets

An IPv4 address is 32 bits, written as four decimal octets. A prefix length $/p$ says the first $p$ bits identify the network and the remaining $32-p$ bits identify the host:

$$\begin{gathered}\text{network} = \text{IP} \wedge \text{mask}\\ \text{broadcast} = \text{network} \vee \overline{\text{mask}}\\ \text{usable hosts} = 2^{32-p} - 2\end{gathered}$$

The two subtracted addresses are the network and broadcast addresses (a /31 point-to-point link uses both, RFC 3021; a /32 is a single host). Private ranges (RFC 1918) are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16; they are not routed on the public Internet.

NAT and DNS

Network address translation lets a whole campus share one public address. The router rewrites the private source address and port (192.168.1.23:52814) to its public address and a unique port (198.51.100.7:40123), remembers the mapping, and reverses it for replies. DNS is a distributed, cached database: a stub resolver asks a recursive resolver, which asks root, top-level-domain (.ke) and authoritative servers, then caches the answer for its TTL.

Routing

In link-state routing (OSPF, IS-IS) every router floods link-state advertisements (LSAs) so all routers share the same map, then each runs Dijkstra's algorithm to build a shortest-path tree and a forwarding table of next hops. When a link fails, the adjacent routers flood new LSAs and everyone recomputes: the network converges on new routes. Distance-vector protocols (RIP) instead exchange distance tables with neighbours using the Bellman–Ford equation $D_x(y) = \min_v \{c(x,v) + D_v(y)\}$.

Simplifications: the Internet cloud stands for several routers (it lowers the TTL by 6), sequence numbers start from small round values instead of random 32-bit ones, the TLS handshake is shown as three flights, and addresses come from the documentation ranges 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24.

1. Subnetting 192.168.10.77/26

  1. Mask: 26 ones then 6 zeros = 11111111.11111111.11111111.11000000 = 255.255.255.192.
  2. The last octet 77 = 01001101. AND with 11000000 gives 01000000 = 64, so the network is 192.168.10.64.
  3. Set the 6 host bits to 1: 01111111 = 127, so the broadcast address is 192.168.10.127.
  4. Usable hosts: $2^{6} - 2 = 62$, from 192.168.10.65 to 192.168.10.126.
  5. 192.168.10.130 lies in a different /26 (128–191), so the two hosts need a router to talk.

These are the defaults in the Subnetting tab.

2. Sequence and acknowledgement numbers

The client picks ISN 1000 and the server 5000 (as in the lab).

  • SYN: seq 1000. SYN-ACK: seq 5000, ack 1001 (the SYN used one number). ACK: seq 1001, ack 5001.
  • Without TLS, the GET carries 96 bytes at seq 1001, so the server's ACK is 1097. The 200 OK carries 1200 bytes at seq 5001; the client acknowledges 6201.

3. TTL along the path

The laptop sends with TTL 64. The campus router decrements it to 63; the Internet cloud (about 6 routers) brings it to 57 at the web server. Open the inspector on the GET request and step through its hops to watch the TTL field change while the IP addresses stay put, except at NAT.

4. Dijkstra on the default routing network

From R1 the iterations table shows R2 (cost 2) and R4 (cost 1) as immediate neighbours. R4 is closest, so it joins first and its links lower R5 to $1+1 = 2$ and R3 to $1+3=4$. Continuing, the shortest route R1 → R6 is R1 → R4 → R5 → R6 with cost $1 + 1 + 2 = 4$. Take the R4–R5 link down and the route becomes R1 → R2 → R3 → R6 at cost $2+3+5 = 10$, or via R4–R3 at $1+3+5=9$: the table chooses 9.

5. Window and throughput

In the reliability lab the one-way delay is 1 s and the sender emits one segment every 0.25 s, so a segment's ACK returns after RTT = 2 s plus 0.25 s of transmission. With $W = 6$ the ideal rate is $W / (\text{RTT} + t_{tx}) = 6 / 2.25 \approx 2.67$ segments per second; at $W \ge 9$ the window covers the round trip and the sender is limited to $1/t_{tx} = 4$ segments per second. The “Ideal” statistic shows this bound for the current window.

Challenges complete automatically when you achieve them in the labs above.

    Guided experiments

    1. Run the request twice. The second time ARP and DNS are cached: how many fewer packets are sent, and how much sooner does the page arrive?
    2. Inspect the same packet on the LAN and on the Internet side of the router. Which fields change (highlighted in amber) and why?
    3. Add a second switch between the laptop and the router. Does the ARP request still reach the router? Does the TTL change?
    4. In the reliability lab set loss to 25 % and compare Go-Back-N with Selective Repeat at W = 8. Count retransmissions.
    5. Set loss to 0 % and increase W from 1 to 16. Where does goodput stop increasing, and why?
    MAC address
    48-bit link-layer address of a network interface, e.g. 3c:22:fb:91:0a:17. Only meaningful on the local link.
    IP address
    Logical, routable address of a host interface (32 bits in IPv4, 128 in IPv6).
    Port
    16-bit number identifying an application endpoint on a host (443 = HTTPS, 53 = DNS).
    TTL
    Time to live: decremented by each router; a packet reaching 0 is discarded, preventing endless loops.
    MSS
    Maximum segment size: largest TCP payload, typically 1460 bytes on Ethernet (1500-byte MTU minus 40 bytes of headers).
    RTT
    Round-trip time: delay for a segment to reach the receiver and its ACK to return.
    RTO
    Retransmission timeout, set from a smoothed RTT estimate plus a margin for its variation.
    Default gateway
    The router a host sends packets to when the destination is outside its own subnet.
    CIDR
    Classless inter-domain routing: addresses written with a prefix length, e.g. 10.0.0.0/8.