Measured on a real machine
Carries measurements from a real machine, with the commands to reproduce them
Part 2 · Cables and waves
The physical layer — there are no bits on the wireWhy encoding has to exist, why the pairs are twisted, why it stops at a hundred metres, what is in the auto-negotiation base page, and why duplex mismatch is the quietest failure this layer has
Part 2 · Cables and waves
Wi-Fi — a radio that cannot hear itselfEverything that separates Wi-Fi from Ethernet follows from one fact of physics, and the measured speed on a laptop that never moved swung by almost seven times
Part 3 · Inside one network
Spanning Tree — the protocol that fixes a problem Ethernet createdWhy one redundant cable can take down a whole network, how Radia Perlman solved it in 1985, what is in the 35-byte BPDU, and every step of the development from 802.1D to what replaced it
Part 3 · Inside one network
ARP — the seam the whole stack rests its trust onThe question ARP actually asks is not the one people think, a cache rule from 1982 that is still in force, why every packet is nearly a third empty padding, and why there is nothing at all to verify
Part 4 · Across networks
Routing — what the gateway actually does nextNineteen articles on this site mention routes, and none explained how a router decides. This one answers with a single rule you can measure on your own machine
Part 4 · Across networks
TCP and UDP — two answers to the question IP does not answerWhat is in the eight-byte and twenty-byte headers, why the handshake takes three messages, the two windows people most often confuse, and why TIME_WAIT on a real machine does not match what the RFC says
Part 6 · The services that make it usable
DHCP — to ask for an address you need an addressThe chicken-and-egg problem an RFC posed in 1985, why it takes four messages, why 81 percent of the header is still legacy nobody uses, and reading a real packet off your own machine
Part 6 · The services that make it usable
HTTP — a protocol that promises very littleWhat a request and a response actually look like, where the body ends, how two ends can read the same message differently, and the effect of caching measured in real bytes from this site
Part 6 · The services that make it usable
TLS — HTTPS does not mean safeThe three promises the RFC makes and the four people think it makes, this site's real certificate chain, the name check that carries the whole thing alone, and what stays visible even once encrypted
Part 7 · Boundaries and filtering
Firewalls — the last matching rule winsA firewall does not decide what is safe, it decides what matches a rule — and the packet filter shipping with macOS defaults to pass, not block
Part 7 · Boundaries and filtering
Stateful and stateless — what a firewall remembers, and what remembering costsA stateful firewall runs its own state machine alongside the endpoints, invents a connection for UDP where none exists, and pays three prices for the privilege
Part 8 · Out to the wider world
IPv6 — not IPv4 with longer addressesA header twice the size that makes routers do less work, the four things that were deleted, why broadcast disappeared entirely, how a machine finds its own address, and why ICMPv6 cannot be switched off