Don't read how a protocol works. Watch it work.

“Who has this IP?” Broadcast the question, watch the switch flood, get one unicast answer, fill the cache.

The three-way handshake, sequence and ACK numbers, and an honest four-way teardown.

Ping: echo request and reply, TTL counting down hop by hop, and how traceroute reads the failures.

A datagram finds its way across a real LAN: forwarding decision, NAT/PAT at the gateway, TTL falling hop by hop.

No handshake, no guarantees. Four datagrams on a clean wire, then one that vanishes—and nobody reports it.

Turning a name into an address: four questions, three referrals, one answer—then a warm cache that asks nobody.

One request, one response—in plain text. Then watch a single page turn out to need four of them, and a revisit that sends no page at all.

Send a password over port 80 and read it off the wire. Then send the same request over TLS 1.3: its content turns opaque while IPs, size, timing and sometimes the hostname remain visible.

Port 21 carries the conversation, not the file. Watch the second connection get negotiated, then see why a server-initiated active-mode connection is commonly blocked by NAT or a firewall.

A machine with no address shouts into the whole subnet—and four packets later it has an IP, a gateway, DNS and a lease with an expiry date.

One email from Alice’s laptop to Bob’s phone: SMTP hands it off twice and stops at a mailbox, then IMAP reads it in place—or POP3 downloads it, with optional deletion demonstrated clearly.

Negotiate the terminal in IAC command bytes, then type a password into the room. Character mode costs two packets a keystroke; line mode fixes that and nothing else.

Poll a router’s byte counter twice and turn the difference into 45 Mbit/s. Pull a cable and the router speaks first, on port 162. Then ask again with SNMPv3—signed, sealed, and still not anonymous.