Measured on a real machine
Carries measurements from a real machine, with the commands to reproduce them
Part 1 · Addresses and identity
3Subnet arithmetic by hand — six questions with one answerFind the network ID, subnet mask, broadcast, host count, host range and next network with a single method, then go on to subnetting, route summarization and VLSM, with five exercises whose answers open on a click
Part 1 · Addresses and identity
5Multicast — an address that refers to no machine at allThe machine you are on has already joined several multicast groups without being told, and the address mapping throws five bits away
Part 2 · Cables and waves
6The physical layer — there are no bits on the wireWhy encoding has to exist, why the pairs are twisted, why it stops at a hundred metres, what is in the auto-negotiation base page, and why duplex mismatch is the quietest failure this layer has
Part 2 · Cables and waves
9Wi-Fi — a radio that cannot hear itselfEverything that separates Wi-Fi from Ethernet follows from one fact of physics, and the measured speed on a laptop that never moved swung by almost seven times
Part 3 · Inside one network
11Collision and broadcast domains — the line everyone can name and few can placeWhat each device actually stops, and thirty years in which one boundary shrank to nothing while the other never moved at all
Part 3 · Inside one network
14Spanning Tree — the protocol that fixes a problem Ethernet createdWhy one redundant cable can take down a whole network, how Radia Perlman solved it in 1985, what is in the 35-byte BPDU, and every step of the development from 802.1D to what replaced it
Part 3 · Inside one network
16ARP — the seam the whole stack rests its trust onThe question ARP actually asks is not the one people think, a cache rule from 1982 that is still in force, why every packet is nearly a third empty padding, and why there is nothing at all to verify
Part 4 · Across networks
17Routing — what the gateway actually does nextNineteen articles on this site mention routes, and none explained how a router decides. This one answers with a single rule you can measure on your own machine
Part 4 · Across networks
18MTU — the number nobody sets, and everybody has to guess rightEight articles on this site mention MTU and none explains it. This one finds the edge with a single command, then shows why the mechanism that hunts for it breaks so often
Part 4 · Across networks
19TCP and UDP — two answers to the question IP does not answerWhat is in the eight-byte and twenty-byte headers, why the handshake takes three messages, the two windows people most often confuse, and why TIME_WAIT on a real machine does not match what the RFC says
Part 5 · Diagnostic tools
24Packet capture — the tool that sees less than everyone thinksFive articles on this site tell you to go and capture packets. This one explains how that works, why it needs special privilege, and why on a switch you will see almost nothing
Part 6 · The services that make it usable
25DHCP — to ask for an address you need an addressThe chicken-and-egg problem an RFC posed in 1985, why it takes four messages, why 81 percent of the header is still legacy nobody uses, and reading a real packet off your own machine
Part 6 · The services that make it usable
27HTTP — a protocol that promises very littleWhat a request and a response actually look like, where the body ends, how two ends can read the same message differently, and the effect of caching measured in real bytes from this site
Part 6 · The services that make it usable
28TLS — HTTPS does not mean safeThe three promises the RFC makes and the four people think it makes, this site's real certificate chain, the name check that carries the whole thing alone, and what stays visible even once encrypted
Part 7 · Boundaries and filtering
31Firewalls — the last matching rule winsA firewall does not decide what is safe, it decides what matches a rule — and the packet filter shipping with macOS defaults to pass, not block
Part 7 · Boundaries and filtering
32Stateful and stateless — what a firewall remembers, and what remembering costsA stateful firewall runs its own state machine alongside the endpoints, invents a connection for UDP where none exists, and pays three prices for the privilege
Part 8 · Out to the wider world
33BGP — the internet works because everyone believes the neighboursThe routing article ended saying nothing proves the neighbour is telling the truth. This one shows that BGP's own standards documents say exactly that
Part 8 · Out to the wider world
35IPv6 — not IPv4 with longer addressesA header twice the size that makes routers do less work, the four things that were deleted, why broadcast disappeared entirely, how a machine finds its own address, and why ICMPv6 cannot be switched off
Part 8 · Out to the wider world
36VPNs and tunnels — a packet wrapped inside a packetThe machine this was written on has fifteen tunnel interfaces set to five different MTUs, and one of them is larger than the wire it rides on