How Data Travels in Networks

The browser does not start with a server IP. It starts with a name. DNS (next module) turns example.com into an address your Internet layer can use. Treat that as a preview, not a full DNS course: if name resolution fails, no TCP handshake with the site ever begins. nslookup of example.com on your own machine is a safe way to see that a name becomes an IP — you are asking a resolver, not scanning a LAN.

For HTTPS, the next idea is a TCP handshake: the client sends SYN, the server answers SYN-ACK, the client sends ACK. Only then do application bytes (the HTTP request) ride inside TCP. You do not need the flag diagram memorized as trivia; you need the mechanism: no completed handshake, no reliable byte stream. UDP-based apps skip that setup and just send datagrams. A web click almost always waits on TCP after DNS.

Encapsulation then dresses the request for the local hop. Application data is wrapped by TCP (ports, sequence), then IP (your source address, the server's destination address, a TTL counter), then Ethernet or Wi-Fi (your NIC MAC as source, the next-hop MAC as destination — usually the default gateway, not the server). Layer 1 puts that frame on the wire. The server is often many networks away. The first frame only has to reach the next device that will take IP responsibility.

Your NIC emits a frame. On a typical LAN a switch copies that frame toward the port where it last saw the destination MAC. The switch is a Layer-2 device: it does not "open" the IP packet to decide. If the destination MAC is the router, the frame arrives at the gateway. ARP (later in this topic) is how your host learned that MAC. Wrong MAC, wrong next hop — even if the IP header is perfect.

The router de-encapsulates the frame, reads the destination IP, looks up a route, decrements TTL, and encapsulates a new frame toward its next hop. New MACs, same goal IP (NAT can rewrite IPs later — Module 5). That repeat is the WAN: hop after hop across ISP and backbone routers until the server's network. At the server, de-encapsulation runs in reverse: bits → frame → packet → segment → HTTP. The response climbs down the server's stack and walks home by the same rules.

TTL (Time To Live in IPv4; Hop Limit in IPv6) is why a routing loop does not live forever. Each router subtracts one. At zero, the packet is dropped and the router should send an ICMP Time Exceeded to the sender. traceroute abuses that politely: it sends probes with TTL=1, then 2, then 3, so each successive router is the one that expires the probe and reveals itself. Stars in traceroute often mean "this hop did not answer ICMP," not "the earth opened." That is a diagnostic on paths you are allowed to test — your own loopback, your own gateway — not a reason to trace a company you do not own.

Packet versus frame is the vocabulary that keeps this story honest. The IP packet is the letter with the city on it. The frame is the truck that carries it to the next warehouse. Warehouses (routers) unload the truck and load a new one. If you confuse the two, you will expect a remote server's MAC to appear on your LAN, or think a switch should fix a missing default route. ip route on your machine shows the first truck destination: the default via.

A reply from 127.0.0.1 means your Internet/Transport stack can talk to itself. ip route show names the first hop for everyone else. That is enough to ground this lesson. Do not nmap. Do not traceroute the school.

# YOUR VM / WSL / spare machine only
ping -c 4 127.0.0.1

# How this host forwards (default via = first router hop)
ip route
ip route show

# Tiny TTL demo — loopback, not a foreign network
command -v traceroute >/dev/null && traceroute -n 127.0.0.1 || \
  command -v tracepath >/dev/null && tracepath -n 127.0.0.1 || \
  echo 'traceroute/tracepath optional; ip route is the lesson'

# Optional: nslookup of a public documentation name (resolver query, not a LAN scan)
# nslookup example.com

# NEVER: traceroute, ping flood, or path discovery against networks you do not own
# NEVER: treat a hop list as permission to "test" those routers

You mapped OSI, then TCP/IP headers; now you can follow one message: DNS preview, handshake, frame to a switch, packet to a router, TTL as a hop budget, traceroute as expired probes. Next up — Quiz — OSI Model — ten APPLY scenarios that check whether you can place an incident on the right floor and the right hop, not reciting pizza.