ShadowXLab — Network Lab

Networking Foundations — Visual Engine

Computer → NIC → MAC → Data Link

START HERE

Click the components to see what the device actually uses when it communicates.

💻Computer

→

🔌NIC

→

🏷️MAC

→

📦Ethernet Frame

→

🔀Switch

Computer

A networked computer uses a network interface to send and receive traffic. The NIC is the boundary between the host and the network.

NIC

Ethernet0

MAC / Layer 2

AA:BB:CC:11:22:33

IP / Layer 3

192.168.1.10

Layer 1Signals / media

Layer 2MAC / Ethernet / frames

Layer 3IP / routing / packets

MAC Address + Ethernet Frame

LAYER 2

48-bit hardware/interface address

MAC

AA:BB:CC:11:22:33

6 hex pairs = 48 bits

DEST MACAA:BB:CC:44:55:66L2

SRC MACAA:BB:CC:11:22:33L2

TYPEIPv4L2

PAYLOADIP packet → TCP segment → application dataDATA

FCSFrame check sequenceL2

Remember

MAC is used for local Layer-2 delivery. IP is used for Layer-3 logical addressing and routing. A switch primarily makes forwarding decisions from MAC information.

Binary Number System — Powers of Two

CALCULATE IT

Networking values are built from bits. Toggle the bits below and watch the decimal value and calculation change.

8-bit binary

00000000

Decimal

2⁸ = 256 possible combinations.

Selected weights: none

Decimal → Binary

11000000

128 + 64 = 192

Binary → Decimal

192

128 + 64 = 192

IPv4 = 32 Bits = 4 Octets

BUILD THE ADDRESS

Each octet is 8 bits. That gives 2⁸ = 256 values, numbered 0–255.

11000000

10101000

00000001

00001010

CIDR 255.255.255.0

Network

192.168.1.0

Broadcast

192.168.1.255

Usable Hosts

254

Network / Host

24 / 8

Binary subnet mask

11111111.11111111.11111111.00000000

ARP — IP → MAC

WATCH IT HAPPEN

The sender knows the destination IP, but local Ethernet delivery needs the destination MAC.

PC-01

IP 192.168.1.10

MAC AA:BB:CC:11:22:33

→

ARP REQUEST

PC-02

IP 192.168.1.20

MAC AA:BB:CC:44:55:66

ARP Cache

192.168.1.20 → not learned yet

Encapsulation + Complete Packet Journey

TRACE EVERYTHING

DATAGET /index.htmlAPPLICATION

SEGMENTTCP 51542 → 443L4

PACKET192.168.1.10 → 192.168.1.100L3

FRAMEAA:BB:CC:11:22:33 → AA:BB:CC:44:55:66L2

BITSSignals carried by the physical mediumL1

Application creates dataGET /index.html

TCP adds ports51542 → 443

IP adds logical addresses192.168.1.10 → 192.168.1.100

NIC/Ethernet adds MAC addressesSource MAC → Destination MAC

Physical medium carries bitsSignals across the link

Press Trace Packet to animate encapsulation and delivery.

Break / Fix — Find the Layer

NOC + SOC THINKING

Introduce a fault, observe the symptom, identify the layer, then restore the network.

Network healthy. Choose a fault to investigate.

🗺️ Class 2 Learning Path

FOLLOW IN ORDER

01 · FoundationsDecimal → Binary → Octal → Hexadecimal → Powers of 2

02 · IPv432 bits → octets → address structure

03 · SubnettingCIDR → network → broadcast → host range

04 · AddressingClasses → IPv6 → modern addressing

🎯 Subnetting Practice — Find the Answers

/25 • /26 • /27 • /28 • /30

192.168.1.10/25Find network, broadcast and host range.

192.168.1.70/26Find the correct subnet block.

10.10.10.100/27Calculate block size and range.

172.16.5.130/28Identify network and broadcast.

Practice: click a scenario. The calculator above will update so the learner can verify the result.

▸ FOUNDATIONS · NUMBER SYSTEMS

Number Systems — The Foundation of IP Addressing

DECIMAL • BINARY • OCTAL • HEX

DECIMAL0–9

BINARY0–1

OCTAL0–7

HEXADECIMAL0–9 A–F

Convert a decimal number

192₁₀ = 11000000₂ = 300₈ = C0₁₆

Binary place values — powers of 2

How to calculate: each bit has a weight: 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1. A bit set to 1 contributes its weight; a bit set to 0 contributes nothing. Example: 11000000 = 128 + 64 = 192.

🧠 Binary Practice Lab

LEARN → CALCULATE → VERIFY

Decimal → BinarySee repeated division / powers-of-two reasoning.

172 → BinaryPractice an IPv4 octet.

255 → BinaryWhy a full octet is 11111111.

128 → BinaryUnderstand the highest bit.

Practice: choose an example above and then explain which powers of 2 produce the decimal value.

▸ NETWORK ADDRESSING · IPv4

IPv4 Address Structure — 32 Bits

4 OCTETS × 8 BITS

19211000000

16810101000

1000001010

2500011001

192.168.10.25 contains four 8-bit octets. The subnet mask decides which bits identify the network and which bits identify hosts.

▸ ADDRESSING MODELS · CLASSES

IPv4 Address Classes — Historical Classification

A • B • C • D • E

A1–126 first octet
Large networks
/8 historical default

B128–191 first octet
Medium networks
/16 historical default

C192–223 first octet
Small networks
/24 historical default

D224–239
Multicast

E240–255
Experimental / reserved

Important: modern networks use CIDR rather than relying on Class A/B/C boundaries. Address classes are still useful as a historical and learning concept.

▸ SUBNETTING · NETWORK / HOST CALCULATIONS

Subnet Calculator — Identify Network, Broadcast & Hosts

CALCULATE IT VISUALLY

IPv4 address

CIDR prefix

NETWORK192.168.10.0

BROADCAST192.168.10.255

TOTAL ADDRESSES256

HOST BITS8

FIRST VALID HOST192.168.10.1

LAST VALID HOST192.168.10.254

USABLE HOSTS254

Calculation: /24 leaves 8 host bits. 2⁸ = 256 addresses. Network and broadcast are reserved in a traditional IPv4 subnet, leaving 254 usable host addresses.

🌍 IPv6 Visual Lab — 128 Bits

HEX • 8 GROUPS • 128 BITS

💻 CLIENT2001:db8:1::10

🚪 ROUTER2001:db8:1::1

🖥️ SERVER2001:db8:2::50

IPv6 address: 128 bits represented as eight hexadecimal groups. Example: 2001:0db8:0001:0000:0000:0000:0000:0010 can be compressed to 2001:db8:1::10. IPv6 has no broadcast address; multicast and anycast are used for corresponding delivery patterns.

🧪 Networking Mastery Quiz

PRACTICE • FEEDBACK • XP

Question

SCORE

0 XP

Answer questions to build networking confidence.

Layer Models

Layer Model

Click any layer below to see its job, PDU name, and example protocols. Layers also auto-highlight as a request travels through the topology above.

Modern protocols don't always map to exactly one layer — treat these as "commonly associated with," not an absolute rule.

Packet Timeline

No packet sent yet. Press "Send Request" on the canvas above.

Encapsulation / Decapsulation — Wireshark Simulator

TSHARK LIVE CAPTURE

Watch HTTP data get wrapped in headers layer by layer as it leaves the Client (encapsulation), then unwrapped hop by hop as the Server reads it (decapsulation) — while a Wireshark-style packet list and a live tshark capture log record the exact same frame, in real time.

💻 Client — Encapsulation ↓

🖥️ Server — Decapsulation ↑

No.TimeSourceDestinationProtoLenInfo

No frames captured yet — press "Capture Packet" above.

Select a captured frame to expand its encapsulated protocol layers, top (Frame) to bottom (Application data) — exactly how Wireshark's packet-details pane works.

$ tshark -i eth0 -Y "http || tcp.port==80"
Capturing on 'eth0'...

Network Canvas

Client → Switch → Router → Server

LIVE TOPOLOGY

Click any device to inspect it. Press Send Request to watch an HTTP request travel hop by hop, with the OSI layer, protocol, and device updating live below.

💻

Client

PC-01

🔀

Switch

SW-1

📡

Router

RTR-1

🖥️

Server

SRV-1

📦

Current Device

—

Protocol

—

OSI Layer

—

TCP/IP Layer

—

Device Inspector

Click any device on the canvas to inspect its configuration.

Packet Inspector

HTTP GET /index.html

Click the 📦 on the canvas — or send a request — to see this same packet fully built. The layer matching the current step is highlighted.

Switch → Router → IP — Live Visual Explanation

🧭 Deep Dive — Switching, Routing, ARP & IP

HOW IT ACTUALLY WORKS, STEP BY STEP

A · SwitchingLearning, flooding, forwarding, VLANs

B · Routing ProtocolsStatic, RIP, OSPF, EIGRP, BGP

C · ARP WorkingIP → MAC, stage by stage

D · IP WorkingLocal vs remote, TTL, fragmentation

E · VLSM PracticalsSize subnets to actual host needs

F · Subnetting ToolkitAND visualizer, splitter, wildcard, self-check drills

▸ LAYER 2 · SWITCHING

How a Switch Actually Forwards Frames

LEARN • FLOOD • FORWARD • FILTER • AGE

The core idea: a switch is a Layer‑2 device. It never reads an IP address to make its forwarding decision — it only reads the source and destination MAC address of each frame. Everything a switch does comes down to one table: the MAC address table (also called the CAM table), which maps MAC address → physical port.

1 · LearnRead source MAC of an incoming frame, bind it to the port it arrived on.

2 · FloodDestination MAC unknown → send the frame out every port except the one it arrived on.

3 · ForwardDestination MAC known → send the frame out only that one port.

4 · Filter / AgeSame-segment traffic is filtered; unused entries expire (~300s) to keep the table accurate.

Click a stage above. Below is a live MAC table so you can see it fill in exactly the way a real switch builds it, one frame at a time.

PORT—

MAC ADDRESS—

STATUSempty

Why this matters for troubleshooting: a switch floods when it doesn't yet know a destination MAC — this is normal, not a fault. If flooding never stops for a given MAC, that host may never be replying (check the host, not the switch). Two more ideas that build on this table:
• Collision domain: every switch port is its own collision domain — this is why switches (unlike old hubs) don't suffer collisions.
• Broadcast domain: a switch does not break up a broadcast domain — a broadcast (destination FF:FF:FF:FF:FF:FF) still goes out every port. Only a router (or a VLAN boundary) stops a broadcast from spreading.
• VLANs: a VLAN is a way to split one physical switch into multiple logical broadcast domains. Devices in different VLANs cannot reach each other without a router or Layer‑3 switch doing the forwarding — this is exactly why "switching" (Layer 2) and "routing" (Layer 3) are different jobs.
• Loops & STP: if two switches are cabled together twice for redundancy, flooding can loop forever. Spanning Tree Protocol (STP) blocks the redundant path logically so the topology stays loop-free, while still keeping the backup link ready if the primary fails.

▸ ARP · IP‑TO‑MAC RESOLUTION

ARP Working — Stage by Stage

WHY IT EXISTS AND EXACTLY WHAT HAPPENS

Why ARP exists: your application only knows the destination's IP address. But to actually put a frame on the wire, the NIC needs the destination's MAC address. Address Resolution Protocol (ARP) is the translator that bridges Layer 3 (IP) down to Layer 2 (MAC) for devices on the same local network.

Broadcast — request goes to everyone Unicast — reply goes to one host only Idle link

💻SOURCE192.168.1.10

🔀SWITCHL2 forwarding

🖥️TARGET192.168.1.20

💻HOST B192.168.1.30

💻HOST C192.168.1.40

Click a stage below to animate the wire

1Check local ARP cache first

2Cache miss → broadcast ARP Request

3Every host on the LAN receives it

4Only the owner replies, unicast

5Requester caches the mapping

Click stage 1 to start the walkthrough — each click animates the diagram above and narrates exactly what's happening on the wire.

WHO SENDS—

FRAME TYPE—

DEST MAC ON WIRE—

Good to know:
• ARP request is always a Layer‑2 broadcast (FF:FF:FF:FF:FF:FF) — every NIC on the segment processes it, but only the host whose IP matches replies.
• ARP reply is a unicast sent directly back to the requester's MAC.
• The result is stored in the ARP cache (viewable with arp -a) so the next packet to that IP skips steps 2–4 entirely.
• Gratuitous ARP: a host can announce "this IP is mine" without being asked — used after an IP change or failover to update everyone's cache proactively.
• ARP spoofing (attack): because ARP has no built‑in authentication, an attacker can send a false reply claiming to own another host's IP, poisoning caches to intercept traffic — this is exactly what the Security Arena's ARP‑spoof lab investigates above.
• ARP only operates within one Layer‑2 segment/subnet — it never crosses a router. To reach a remote network, a host ARPs for its default gateway's MAC, not the final destination's.

▸ LAYER 3 · IP WORKING

How a Host Decides: Local Delivery or Send to Gateway?

THE ACTUAL DECISION EVERY PACKET GOES THROUGH

The core idea: before sending anything, a host does simple binary math: it ANDs its own IP with its subnet mask to get its own network, and ANDs the destination IP with that same mask. If the two network results match, the destination is local — the host ARPs directly for it. If they don't match, the destination is remote — the host ARPs for its default gateway instead and hands the packet off, unchanged at Layer 3, for the router to forward.

My IP / mask

Subnet mask

Destination IP

Default gateway

Fill in the fields above to see the routing decision worked out live.

What happens after the decision, hop by hop:
1. Source MAC/IP and destination MAC/IP are stamped on the packet/frame (destination MAC is the target host if local, or the gateway if remote).
2. Each router that forwards the packet decrements TTL (Time To Live) by 1. If TTL hits 0, the packet is dropped and an ICMP "Time Exceeded" is sent back — this is exactly how traceroute maps a path.
3. At every hop, the router rewrites the Layer‑2 header (new source/destination MAC for the next link) but leaves the source/destination IP untouched end‑to‑end — this is the key difference between what a switch touches (MAC, per‑hop) and what stays constant across the whole journey (IP).
4. If a link's MTU is smaller than the packet, IPv4 routers may fragment it into smaller pieces (or drop it and send "Fragmentation Needed" if the Don't Fragment bit is set) — the destination reassembles the fragments before handing data up to the transport layer.

▸ LAYER 3 · ROUTING PROTOCOLS

Static Routing vs Dynamic Routing Protocols

RIP • OSPF • EIGRP • BGP

The core idea: a router forwards packets using its routing table — a list of destination networks and the next hop to reach them. That table can be built two ways: static (an admin types the routes in by hand) or dynamic (routers exchange information automatically using a routing protocol so the table stays correct as the network changes).

Static RoutingManually configured, no overhead, doesn't adapt to failure

RIPDistance-vector, hop count, max 15 hops

OSPFLink-state, cost metric, fast convergence

EIGRPAdvanced distance-vector, Cisco, DUAL algorithm

BGPPath-vector, runs the entire internet between ISPs/ASes

Distance-Vector vs Link-StateWhat's actually different under the hood

Click a protocol above to see what it actually does, how it decides the best path, and where it's used in the real world.

Try it — routing table lookup (longest prefix match)

How a router really chooses: when several routes could match a destination, the router always picks the route with the longest (most specific) matching prefix — not the first one in the list, not the shortest one.

ROUTING TABLE10.0.0.0/8 → Gi0/0
10.10.0.0/16 → Gi0/1
10.10.10.0/24 → Gi0/2
0.0.0.0/0 → Gi0/3 (default)

Destination IP to look up

Type an IP above.

▸ PRACTICALS · VLSM

IP Addressing Practicals — VLSM (Variable Length Subnet Masking)

SIZE THE SUBNET TO THE NEED

The core idea: plain subnetting slices a network into equal-size blocks. VLSM slices it into different-size blocks so each subnet only gets as many host addresses as it actually needs — no waste. The rule is always: carve the largest requirement first, then keep carving what's left for smaller ones.

Sales · needs 50 hostsClick to see which prefix fits

Engineering · needs 20 hostsClick to see which prefix fits

Point-to-point router link · 2 hostsClick to see which prefix fits

Guest Wi-Fi · needs 10 hostsClick to see which prefix fits

Working from 192.168.1.0/24: click a requirement above to size it correctly, in order from biggest to smallest — that's the standard VLSM workflow.

Quick sizing table (host bits → usable hosts):
/30 = 2 hosts • /29 = 6 • /28 = 14 • /27 = 30 • /26 = 62 • /25 = 126 • /24 = 254
Formula: usable hosts = 2^(host bits) − 2. To find the smallest prefix that fits N hosts, find the smallest host-bit count h where 2ʰ − 2 ≥ N.

▸ TOOLKIT · SEE IT, BUILD IT, TEST YOURSELF

🧰 Subnetting Mastery Toolkit

BITWISE AND • EQUAL-SPLIT • WILDCARD • SELF-CHECK DRILLS

Four extra ways to learn subnetting until it clicks: watch the actual bitwise AND that produces a network address, split a block into equal subnets and locate any IP inside it, generate a wildcard mask for ACLs, and test yourself against randomly generated problems with instant right/wrong feedback.

▸ F1 · WHY THE NETWORK ADDRESS IS WHAT IT IS

Bitwise AND Visualizer

IP ∧ MASK = NETWORK

The whole subnetting rule in one operation: the network address is simply the IP address ANDed with the subnet mask, bit by bit. Where the mask bit is 1, the IP's bit passes through unchanged (that's the network portion). Where the mask bit is 0, the result is forced to 0 (that's the host portion, zeroed out). Change the values below and watch every bit resolve.

IPv4 address

CIDR prefix

▸ F2 · CARVE ONE BLOCK INTO EQUAL SUBNETS

Equal-Split Subnet Planner + IP Locator

SPLIT • LIST EVERY BLOCK • FIND WHERE AN IP LANDS

How it works: splitting a network into N equal subnets means borrowing log₂(N) bits from the host portion — every new subnet gets the same size. Enter a base network and pick how many equal pieces you need; optionally enter an IP to see exactly which piece it falls into, highlighted in the table.

Base network

Base CIDR

Split into how many equal subnets?

Locate this IP (optional)

▸ F3 · SUBNET MASK vs WILDCARD MASK

Wildcard Mask Calculator + Full CIDR Reference

USED IN ACLS & OSPF NETWORK STATEMENTS

What a wildcard mask is: it's the exact inverse of a subnet mask (255 − each octet). Where a subnet mask uses 1 = network bit, a wildcard mask uses 0 = must match and 1 = don't care. Routers use wildcard masks in access-control lists and OSPF network statements instead of subnet masks.

CIDR prefix

SUBNET MASK255.255.255.0

WILDCARD MASK0.0.0.255

▸ F4 · TEST YOURSELF, NOT JUST READ

Self-Check Subnetting Drills

RANDOM PROBLEM • YOUR ANSWER • INSTANT FEEDBACK

Click New Problem for a random IP/CIDR. Work out the network address, broadcast address, first usable host, and last usable host yourself, type them in, then hit Check Answers — each field turns green or red instantly, with the correct value shown if you're off.

Problem: click "New Problem" to begin.

Network address

Broadcast address

First usable host

Last usable host

No attempt yet.

STREAK

0 correct

Lab 01

Lab 01 — Follow the Packet

BEGINNER

Scenario: the Client requests a page from the Server. Follow the packet through Client → Switch → Router → Server, watching which device, protocol, and OSI layer is involved at every stage — then answer the challenge below.

Challenge: which OSI layer is primarily responsible for getting this frame to the correct device on the local network segment?

Layer 7 — Application

Layer 4 — Transport

Layer 3 — Network

Layer 2 — Data Link

Binary Number System → IPv4 Addressing

The Internet — From Your NIC to a Global Network

Phase 2 — Core Protocol Labs

Twelve Protocol & Perimeter Labs

DATA-DRIVEN

Each tab loads a self-contained scenario — its own topology, its own protocol messages, its own challenge — using the same simulation engine as Lab 01.

Phase 4 — Security Arena

Security Arena — Five Investigation Labs

SIMULATED EVENTS ONLY

Every event, IP address, and packet in this section is synthetic — generated for this lab only. No real scanning, spoofing, or attack traffic is ever produced. For each scenario: check the normal baseline, reveal the anomaly, then answer what changed and why it matters.

Failure Analysis + Network Security Simulation

Network Monitoring

Mini SOC — Monitoring & Alerts

SIMULATED

Every event and alert below is synthetic, generated from the labs above — nothing here reflects real traffic. Click Investigate to jump straight into the matching lab.

Total Events

Blocked

Active Alerts

DNS Queries

Active Alerts

CRITICAL — Possible SYN Flood

Destination: 10.0.0.10:443 · ~500 SYN/s observed (baseline ~10/s)

HIGH — Unsolicited ARP Reply

192.168.1.20 MAC binding changed without a matching request

MEDIUM — Port Scan Detected

203.0.113.77 touched 4 ports on 10.0.0.10 within 90ms

MEDIUM — DNS Query Anomaly

Single host generating 40 queries/min for randomized subdomains

MEDIUM — HTTP Enumeration

203.0.113.90 probing /admin, /.env, /wp-login.php at ~30 req/s

Traffic Log

Time	Event	Source	Detail	Status
14:02:11	Firewall	10.0.0.10	TCP/443 → ALLOW (rule #1)	Allowed
14:02:15	Firewall	198.51.100.9	TCP/23 → DENY (rule #3)	Blocked
14:02:20	NAT	10.0.0.10:51000	Translated → 203.0.113.10:40001	Translated
14:02:24	DNS	10.0.0.10	Query: www.example.local → 192.168.1.100	Resolved
14:02:44	Firewall	203.0.113.5	TCP/445 → DENY (implicit)	Blocked

Build Roadmap

What's Next

Phase 1 — Live

Foundation

Canvas, packet animation, device inspector, OSI/TCP-IP panels, packet inspector, Lab 01.

Phase 2 — Live

Core Protocols

IP addressing, MAC addressing, switching, routing, ARP, DNS, DHCP, TCP, UDP labs.

Phase 3 — Live

Perimeter

Firewall, NAT, HTTP/HTTPS + TLS, and a Mini SOC monitoring preview.

Phase 4 — Live

Security Arena

Port scan, ARP spoofing, SYN flood, DNS anomaly, and HTTP anomaly investigation labs.

Phase 5

Investigator

Network Incident Investigator and the Enterprise Network Incident capstone.

When a Network Component Fails

NOC TROUBLESHOOTING

Select a failure → observe the symptom → locate the layer

💻HOST192.168.1.10

🔀SWITCHL2 forwarding

🌐GATEWAY192.168.1.1

Healthy baseline

Host has link, a valid IP configuration, local Layer-2 resolution, and a reachable gateway. NOC troubleshooting moves from the lowest observable layer upward.

Symptom

Normal connectivity

Likely Layer

L1–L7 as appropriate

First Check

Link + interface status

How Attackers Interfere — Layer by Layer

SOC DETECTION

Educational simulation — no real traffic is generated

L1 — Physical interference

Example: physical link disruption or unauthorized access to network equipment. Impact can appear as link loss, intermittent connectivity, or device availability problems.

BASEBaseline traffic: no suspicious events—

Select an OSI layer to see the security concept, observable symptoms, and SOC evidence.

Simulation only: the lab models attacker behavior and telemetry; it does not execute attacks against real systems.

NOC → SOC Investigation Workflow

CONNECT THE CONCEPTS

NOC + SOC mindset

NOC focuses on availability, performance, and connectivity. SOC adds the security question: could the observed network behavior indicate malicious or unauthorized activity?

Verify link/interface status and physical connectivity. Verify IP / mask / gateway and local addressing. Check ARP / MAC behavior for local delivery. Check DNS / ports / services when connectivity exists. Compare telemetry for unexpected changes or anomalies.

0 / 5 investigation checks completed.

Watch a Packet Move: MAC → Switch → IP → Router

NOC / SOC VISUAL

Scenario: PC-A sends traffic to a server on another network

💻PC-A IP 192.168.1.10
MAC AA:AA:AA:10

🔀SWITCH L2
MAC forwarding

🌐ROUTER G0/0
192.168.1.1

🖥️SERVER 10.10.20.50
MAC BB:BB:BB:50

Source IP

192.168.1.10

Default Gateway

192.168.1.1

Destination IP

10.10.20.50

Protocol

TCP / 443

L2 FRAMEPC creates Ethernet frame for its next-hop gatewayDST MAC = GW

SWITCHReads destination MAC and forwards the frame out the correct portMAC → PORT

L3 PACKETRouter reads destination IP and checks its routing table10.10.20.50

ROUTERRouter selects the next hop / interface for the destination network10.10.20.0/24

NEW L2A new Ethernet frame is built on the outgoing interfaceNEXT-HOP MAC

① NIC creates the Ethernet frame

The host knows the destination is outside its local subnet, so the Ethernet frame is addressed to the default gateway's MAC address. The IP packet still carries the final destination IP 10.10.20.50. This is the key distinction: MAC identifies the local Layer-2 next hop; IP identifies the Layer-3 destination.

IP Address: What Does It Actually Do?

Interactive network identity

Network: 192.168.1.0
Broadcast: 192.168.1.255
Usable hosts: 192.168.1.1 – 192.168.1.254

IP = Layer 3 identity

Routers use destination IP information to decide which network or next hop should receive the packet.

MAC = Layer 2 local delivery

Switches forward Ethernet frames using MAC addresses. MAC is used for the local link, not for end-to-end routing across the Internet.

Switch = local forwarding

A switch learns source MAC addresses and associates them with ports. It then forwards frames based on the destination MAC.

Router = network-to-network

A router separates IP networks and makes Layer-3 forwarding decisions using routes, interfaces, and next-hop information.

What Changes at the Switch and Router?

CRITICAL CONCEPT

At the switch

Destination MAC is examined. The switch looks in its MAC address table and selects an output port. The IP destination is not the switch's primary forwarding decision in a normal Layer-2 switching path.

At the router

Destination IP is examined. The router performs a routing lookup, decrements the IPv4 TTL, and sends the packet toward the selected next hop/interface.

Important: MAC can change

When a packet crosses a router, the Layer-2 frame is removed and a new frame is created for the next link. Therefore, the MAC addresses seen on each local segment can change.

Important: IP normally stays end-to-end

The source and destination IP addresses identify the Layer-3 endpoints. NAT can modify addresses, but that is a separate function and should not be confused with ordinary routing.

Binary Number System — Learn It Visually

0 / 1 • POWERS OF 2

A computer represents binary values using two states: 0 and 1

00001010

2⁷

128

2⁶

2⁵

2⁴

2³

2²

2¹

2⁰

00001010 = (0×128) + (0×64) + (0×32) + (0×16) + (1×8) + (0×4) + (1×2) + (0×1)
= 8 + 2 = 10

Why powers of 2? Each binary position doubles as you move left: 1, 2, 4, 8, 16, 32, 64, 128. An 8-bit binary number can therefore represent 256 values: 0 through 255. That is why each IPv4 octet ranges from 0–255.

Decimal ↔ Binary Converter

IPv4 OCTET

Try any IPv4 octet: 0–255

192 decimal = 11000000 binary
Calculation: 128 + 64 = 192

The eight bit positions inside one IPv4 octet

Bit	2⁷	2⁶	2⁵	2⁴	2³	2²	2¹	2⁰
Value	128	64	32	16	8	4	2	1

Example: 192 = 128 + 64, so its binary representation is 11000000. The first two bits are ON and the remaining six are OFF.

Binary11000000

→

Decimal128 + 64 = 192

→

IPv4 Octet192.168.1.10

Now Connect Binary to an IPv4 Address

WHY 192.168.1.10?

OCTET 1

11000000

192

OCTET 2

10101000

168

OCTET 3

00000001

OCTET 4

00001010

IPv4 = 32 bits. It is divided into four 8-bit octets: 8 + 8 + 8 + 8 = 32 bits. Each octet is written in decimal for humans, but the underlying value is binary. This is the bridge from the binary number system to subnet masks, network addresses, broadcast addresses, and routing.

What Actually Happens When You Access the Internet?

LIVE WAN VISUALIZATION

Example: 192.168.1.10 opens an HTTPS server on another network

💻YOUR DEVICE192.168.1.10
MAC AA:10

🔀LAN SWITCHL2
MAC → PORT

🚪DEFAULT GATEWAY192.168.1.1
NAT / ROUTING

☁️INTERNETISP • ROUTERS • BGP • TRANSIT

🖥️REMOTE SERVER203.0.113.50
TCP/443

HOP 1

HOST192.168.1.10

HOP 2

GATEWAY192.168.1.1

HOP 3+

ISP ROUTERSWAN forwarding

HOP N

TRANSITMultiple networks

FINAL

SERVER203.0.113.50

Source IP

192.168.1.10

Gateway

192.168.1.1

Destination IP

203.0.113.50

Application

HTTPS : 443

Start with the key idea:
Your device does not send an Ethernet frame directly to the remote Internet server's MAC address. It sends the local frame to its default gateway. The switch handles local MAC forwarding; the gateway/router handles Layer-3 forwarding toward the destination network. Across the WAN, routers repeatedly make Layer-3 forwarding decisions until the packet reaches the destination network.

What Is Actually Happening Inside the Internet?

MENTAL MODEL

🔀 SwitchLocal Ethernet forwarding using MAC addresses and ports.

🌐 RouterLayer-3 forwarding using destination IP and routing information.

🏢 ISPConnects customer networks to larger provider and transit networks.

🗺️ BGPInternet routing between autonomous systems; routers learn reachable prefixes.

🔎 DNSResolves names such as example.com into IP addresses before the connection.

🔄 NATMay translate private addresses at the network edge when accessing the Internet.

🚚 TCPProvides reliable transport and uses ports to identify services.

🔐 HTTPSApplication-layer web communication protected by TLS.

Switch
Inside the local LAN, the switch is concerned primarily with Ethernet frames and MAC addresses. The router becomes important when traffic must leave the local IP network.

🏠 Local network
MAC addresses matter for Ethernet delivery. ARP/neighbor discovery helps a host determine the Layer-2 next hop. The switch forwards the frame locally.

🌍 Across routed networks
IP addresses and routing information determine where the packet should go next. Each routed hop has its own local Layer-2 delivery mechanism.

When the Internet Path Breaks — NOC / SOC View

TROUBLESHOOTING

🔎 DNS outageName fails to resolve; direct IP connectivity may still work.

🚪 Gateway downLocal network may work while external networks fail.

🏢 ISP path issueCustomer edge is healthy but upstream reachability fails.

🗺️ Routing issueA destination prefix may become unreachable or take a different path.

🧱 Firewall policyConnectivity may exist but a port or application flow is filtered.

🖥️ Server issueThe network path works but the destination service is unavailable.

Choose a failure scenario.
The simulation will show what a user experiences and where a NOC/SOC analyst should start looking.

See the Network.Follow the Packet. Defend the System.

Computer → NIC → MAC → Data Link

MAC Address + Ethernet Frame

Binary Number System — Powers of Two

IPv4 = 32 Bits = 4 Octets

ARP — IP → MAC

PC-01

PC-02

Encapsulation + Complete Packet Journey

Break / Fix — Find the Layer

🗺️ Class 2 Learning Path

🎯 Subnetting Practice — Find the Answers

Number Systems — The Foundation of IP Addressing

🧠 Binary Practice Lab

IPv4 Address Structure — 32 Bits

IPv4 Address Classes — Historical Classification

Subnet Calculator — Identify Network, Broadcast & Hosts

🌍 IPv6 Visual Lab — 128 Bits

🧪 Networking Mastery Quiz

Question

Layer Model

Packet Timeline

Encapsulation / Decapsulation — Wireshark Simulator

Client → Switch → Router → Server

Device Inspector

Packet Inspector

🧭 Deep Dive — Switching, Routing, ARP & IP

How a Switch Actually Forwards Frames

ARP Working — Stage by Stage

How a Host Decides: Local Delivery or Send to Gateway?

Static Routing vs Dynamic Routing Protocols

IP Addressing Practicals — VLSM (Variable Length Subnet Masking)

🧰 Subnetting Mastery Toolkit

Bitwise AND Visualizer

Equal-Split Subnet Planner + IP Locator

Wildcard Mask Calculator + Full CIDR Reference

Self-Check Subnetting Drills

Lab 01 — Follow the Packet

Twelve Protocol & Perimeter Labs

Security Arena — Five Investigation Labs

Mini SOC — Monitoring & Alerts

What's Next

When a Network Component Fails

How Attackers Interfere — Layer by Layer

NOC → SOC Investigation Workflow

Watch a Packet Move: MAC → Switch → IP → Router

IP Address: What Does It Actually Do?

What Changes at the Switch and Router?

Binary Number System — Learn It Visually

Decimal ↔ Binary Converter

Now Connect Binary to an IPv4 Address

What Actually Happens When You Access the Internet?

What Is Actually Happening Inside the Internet?

When the Internet Path Breaks — NOC / SOC View

See the Network.
Follow the Packet. Defend the System.