Learn
The Network Stack
See every layer of the network from Linux. Frames, packets, connections, all from the terminal.
Nobody teaches networking from the Linux command line. Cisco teaches it with packet tracers. Textbooks teach it with diagrams. We teach it by running tshark and watching real Ethernet frames cross a real interface. This track takes you from your NIC to HTTP, one layer at a time. Every lesson has a command that produces output you can read. Every line of that output teaches you something about how networks actually work. You will dissect frames, decode MAC addresses, watch ARP questions and answers, trace packets through routing tables, see the TCP handshake happen in real time, and decode /proc/net/tcp by hand. When you finish, you will understand the network stack better than most engineers who have been doing this for ten years. Because most of them never looked.
23 hands-on labs across 5 modules, about 11 hours of work. Every lab runs on a real virtual machine in your browser, and checks your work on the machine itself.
Modules and labs
Before you send a single packet, meet the hardware. Your NIC is a device with a driver, a MAC address, and counters you have never looked at.
- The Interface - Every Linux system has network interfaces with names, MAC addresses, drivers, and counters. This lesson teaches you how to find and read all of it.
- The Driver - Every NIC runs a kernel driver. The sysfs device/uevent file tells you which one, and modinfo tells you what it does.
- Interface Statistics - Your NIC counts every packet, every byte, and every error. The numbers are in /proc/net/dev, /sys/class/net, and ip -s link show.
IP does not travel alone. Ethernet wraps it in a frame with a 14-byte header. See the envelope, decode the addresses, watch ARP ask its question.
- Watching Traffic - tshark and tcpdump let you see every packet that crosses your interface. This is where networking becomes real.
- The Ethernet Frame - One packet, fully dissected. Ethernet header wraps IP wraps ICMP. Envelopes inside envelopes.
- MAC Addresses - MAC addresses identify network hardware. The MAC sublayer stamps them into every frame. This lesson teaches both, and clears up the confusion between them.
- EtherType - EtherType is the 2-byte tag in every Ethernet frame that tells the kernel which protocol is inside. One wire, multiple protocols, one tag to sort them.
- ARP - ARP answers one question: "I know your IP, what is your MAC?" Watch it happen from scratch. See every field. Flush the cache and trigger it again.
- Building a Bridge - A Linux bridge is a software switch. Three hosts are already plugged into one. Watch it learn MAC addresses, read its forwarding database, and see frames flow t
Every packet hits the routing table. One row decides where it goes. No match means dropped. IP addressing, routing, ICMP, and forwarding.
- IP Addresses and Subnets - One card, one MAC, two IP addresses. CIDR is the ruler, the kernel picks its identity per destination, and your own address is just a /32 route.
- The Routing Table - The kernel checks this table for every single packet. ip route get shows the exact decision for one destination.
- ICMP and Ping - ICMP is how IP reports its own failures. Send echo requests, catch them on the wire, dissect every field, break a ping on purpose, and map a path with tracerout
- IP Forwarding - Flip one bit and your Linux box becomes a router. /proc/sys/net/ipv4/ip_forward controls everything.
- Packet Filtering - A firewall inspects Layer 3 and Layer 4 headers and makes a decision per packet. nftables is how Linux does it.
TCP builds reliable connections. UDP does not bother. Ports identify services. Sockets tie it all together. See every connection the kernel is tracking.
- TCP vs UDP - TCP is a conversation. UDP is a shout. ss shows you both, live, right now.
- The TCP Handshake - SYN, SYN-ACK, ACK. Three packets before a single byte of data. Watch the handshake happen in real time.
- Ports and Sockets - A socket is IP plus port plus protocol. /proc/net/tcp is the kernel connection spreadsheet, in hex.
- TCP States - Every TCP connection moves through a series of states. ss shows you where each connection is in its lifecycle. This is how you diagnose broken connections.
- TCP Tuning - The kernel exposes dozens of TCP tuning knobs via sysctl. Buffer sizes, keepalive timers, backlog queues. This is what SREs adjust on production servers.
DNS, TLS, HTTP. The protocols that sit on top of TCP. Every connection starts with a name lookup and ends with data. See all of it from the terminal.
- DNS - Every network connection starts with a name lookup. dig lets you make DNS queries and see the full response. This is the bridge between names and IP addresses.
- TLS - The handshake inside the handshake. Certificate chain, cipher negotiation, all visible in the terminal.
- HTTP - Request line, headers, status code, body. The protocol you use a thousand times a day, seen raw.
- The Full Stack - One curl request. Every layer visible from Linux. Frame, IP, TCP, TLS, HTTP, all in one capture.
Frequently asked questions
How many labs are in The Network Stack?
The Network Stack has 23 hands-on labs, roughly 11 hours of guided work, spread across 5 modules.
Do I need my own server or hardware to do the The Network Stack labs?
No. Every lab boots a real virtual machine in your browser, with a real Linux shell. There is nothing to install, and nothing on your own machine to break.
What level is The Network Stack?
Labs in this track are rated beginner. The track starts from the beginning, so no prior experience is assumed.