Chapter 2 · The student-friendly guide

Network Models,
Addressing & Wireshark

How layers, models and addresses team up to move one packet across the world — untangled into pictures, analogies & memory hooks.

LayeringOSI & TCP/IPMAC & IP AddressingEncapsulationEthernet

Use ← → arrow keys, the dots below, or the ☰ menu. Switch to the Lab Guide up top.

The big picture

Your 4-stop journey

💡

Think of it like… a global postal system. Layers are the departments, models are the rulebooks, addresses are how a parcel finds you, and Ethernet is the delivery van on your street.

🧱

Layering & Models

Why we split networking into layers, and the two stacks: OSI & TCP/IP.

📦

Encapsulation

How data is wrapped in headers going down — and unwrapped going up.

📍

Addressing

Four layers, four addresses: MAC, IP, ports & names. Classes & special IPs.

🔌

On the Wire

Wireshark to see traffic, and Ethernet — the LAN that carries the frames.

Quick recap from Chapter 1

First, what’s a protocol again?

A protocol = agreed rules for exchanging data

It defines the What, How & When — through three elements: Syntax (format) · Semantics (meaning) · Timing (when/how fast).

What must devices agree on?

Data formats · address formats · address mapping · routing · error detection · acknowledgements.

💡

Think of it like… two people agreeing to speak the same language, take turns, and confirm they heard each other — before any real conversation can happen.

Part 1 · Layering & Models

Why layers? Divide & conquer

Building a whole network at once is HARD

So we split the giant job into smaller jobs called layers. Each layer solves ONE part of the problem and has its own protocol.

🧩

Simpler

Each piece small enough to understand.

🔁

Swappable

Change one layer (Wi-Fi→cable) without the rest.

♻️

Reusable

Upper layers reuse the services below.

💡

Think of it like… a car factory assembly line. No one person builds the whole car — each station does one job and passes it on.

Part 1 · Layering & Models

How one layer talks to the others

1 · Serves the layer above

Each layer offers a ready-made service to the one on top of it.

2 · Relies on the layer below

…while quietly using the services of the layer underneath.

3 · Talks through an interface

Layers only meet at a clean interface — never reach across.

💡

Think of it like… ordering at a restaurant: you talk to the waiter (the interface), not the chef. The kitchen serves the waiter, who serves you.

Part 1 · Layering & Models

A protocol stack — and the two famous ones

🗂️

OSI Model

A theoretical reference model by ISO (1984). 7 layers. A logical map to understand & troubleshoot — rarely built strictly, it’s the common language.

🌐

TCP/IP Model

The practical model that runs the Internet, from DARPA / DoD. 4–5 layers, defined by an actual protocol suite (TCP, IP…). What your devices really use.

🧠

Memory hook: OSI = the textbook theory (ISO). TCP/IP = the real-world practice (Internet). You learn on OSI; you live on TCP/IP.

Part 1 · The OSI Model

Meet the 7 layers

7ApplicationUser-facing apps & services

6PresentationTranslate, encrypt, compress

5SessionSet up & manage sessions

4TransportEnd-to-end delivery (ports)

3NetworkLogical addressing & routing (IP)

2Data LinkPhysical addressing & framing (MAC)

1PhysicalBits on the wire — cables & signals

🧠

Memory hooks: top→bottom “All People Seem To Need Data Processing”; bottom→top “Please Do Not Throw Sausage Pizza Away”.

Part 1 · The OSI Model

The master table — responsibilities, protocols, PDUs

Layer	What it does	Example protocols	PDU
7 Application	User interface & network services	HTTP, FTP, SMTP, DNS	Data
6 Presentation	Translation, encryption, compression	MPEG, GIF, ASCII	Data
5 Session	Start, manage & end sessions	SIP	Data
4 Transport	Process-to-process, ack, segmentation	TCP, UDP	Segment
3 Network	Logical addressing, routing	IP, ICMP, RIP	Packet
2 Data Link	Physical addressing, media access, error detection	802.3, 802.5	Frame
1 Physical	Encoding, signaling, cabling	EIA/TIA, Manchester	Bits

Part 1 · Models

What the data is CALLED at each layer (PDU)

Same data — different name & packaging as it moves down the stack:

📄
Data
Application

🧩
Segment
Transport

📦
Packet
Network

🔲
Frame
Data Link

〰️
Bits
Physical

🧠

Memory hook: “Do Sergeants Pay For Beer?” → Data · Segment · Packet · Frame · Bits (top to bottom).

Part 2 · Encapsulation

Wrapping & unwrapping the data

Going down the stack, each layer adds its own header (encapsulation). The receiver strips them off going up (de-encapsulation).

ApplicationFTP Data

TransportTCPData

NetworkIPTCPData

Data Link802.3IPTCPDataCRC

Physical1 0 1 0 1 1 0 1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0

💡

Think of it like… Russian nesting dolls: each layer wraps the data in its own envelope on the way out. The receiver opens them in reverse order.

Part 1 · The TCP/IP Model

The practical stack — who lives at each layer

TCP/IP layer	OSI	Typical devices
Application	OSI 5–7	Clients & Servers
Transport	OSI 4	(ports: TCP / UDP)
Network / Internet	OSI 3	Routers & Gateways
Data Link	OSI 2	Switches & Bridges
Physical	OSI 1	Hubs & Repeaters

Self-Test #1

Models & Encapsulation

Tap a green answer to reveal it.

Q Why do we split networking into layers?

A Divide & conquer — manage complexity; each layer solves one part & offers a service to the layer above.

Q List the 7 OSI layers, top to bottom.

A Application, Presentation, Session, Transport, Network, Data Link, Physical.

Q PDU at Transport / Network / Data Link?

A Segment / Packet / Frame.

Q Going DOWN the stack, what happens to the data?

A Each layer adds its own header (encapsulation); the receiver strips them (de-encapsulation).

Part 3 · Addressing

Four layers, four addresses

Layer	Address type	Example	Identifies
Application	Name / Email	user@gtr.com.my	Which person / service
Transport	Port number	:443 (HTTPS)	Which app on the device
Network	IP address	192.168.100.23	Which device / network (logical)
Data Link	MAC address	6C:F0:49:68:95:68	Which physical NIC (burned-in)

💡

Think of it like… addressing a parcel: the person’s name (app), their flat number (port), the building’s street address (IP), and the exact mailbox bolted to the wall (MAC).

Part 3 · Addressing

Decimal · Binary · Hex — same value, 3 outfits

Decimal	Binary (8 bits)	Hex
0	0000 0000	00
10	0000 1010	0A
108	0110 1100	6C
255	1111 1111	FF

Hex is binary shorthand

1 hex digit = exactly 4 bits, so hex keeps long binary readable:

6C = 0110 1100
F0 = 1111 0000

💡

Think of it like… the same money shown as a number, in tally marks, and in a tidy stack of notes. Decimal for humans, binary on the wire, hex the compact label.

Part 3 · Addressing

The MAC (physical) address

A permanent 48-bit address burned into every network card by the maker. Written as 12 hex digits in 6 pairs (octets).

First 24 bits = OUI — the vendor, assigned by IEEE.

Last 24 bits = serial — a unique number for this card.

💡

Think of it like… a car’s VIN: the first half says who made it (the brand/OUI), the second half is that exact car’s serial. It never changes.

Part 3 · Addressing

Three kinds of MAC delivery

Unicast

One device → one device.

Begins with 00

Multicast

One device → a group.

1st-byte LSB = 1

Broadcast

One device → everyone on the LAN.

FF:FF:FF:FF:FF:FF

💡

Think of it like… unicast = a phone call (one person), multicast = a group text (a chosen few), broadcast = shouting through a megaphone (the whole room hears it).

Part 3 · Addressing

The IPv4 address

A logical 32-bit address, written as 4 decimal octets. Split into a network portion + a host portion, divided by the subnet mask. 32 bits ≈ 4.3 billion addresses.

192

168

100

NETWORK (mask 255.255.255.0) · HOST — Mask bits = 1 → network · Mask bits = 0 → host.

💡

Think of it like… your MAC is your NAME (fixed), your IP is your MAILING ADDRESS (changes when you move to a new network). The mask splits “city” from “house number.”

Part 3 · Addressing

IPv4 classes — read the first octet

Class	1st octet	Default mask	Purpose
A	1 – 127	255.0.0.0 (/8)	Huge networks
B	128 – 191	255.255.0.0 (/16)	Medium networks
C	192 – 223	255.255.255.0 (/24)	Small networks
D	224 – 239	—	Multicast
E	240 – 255	—	Experimental

🧠

Memory hook: A/B/C are for normal hosts; D = “Delivery to a group” (multicast); E = Experimental. Boundaries 127·191·223 are just 128·192·224 minus one.

Part 3 · Addressing

Special & private addresses

🔁

Loopback

127.0.0.1

Tests your own NIC.

⚠️

APIPA

169.254.x.x

Self-assigned when DHCP fails.

📢

Broadcast

255.255.255.255

To all on the local net.

🗂️

Network addr

host bits = 0

Names the whole network.

🔒

Private ranges (RFC 1918): 10.0.0.0/8 · 172.16.0.0–172.31.255.255 · 192.168.0.0/16 — internal only, need NAT to reach the Internet.

Self-Test #2

Addressing

Tap a green answer to reveal it.

Q How many bits is a MAC address vs an IPv4 address?

A MAC = 48 bits (hex); IPv4 = 32 bits (dotted-decimal).

Q In a MAC address, what do the first 24 bits identify?

A The OUI — the vendor/manufacturer (assigned by IEEE).

Q Which class is 130.45.2.1, and its default mask?

A First octet 130 → Class B → /16 (255.255.0.0).

Q What is 127.0.0.1 for?

A Loopback — tests the local NIC; traffic never leaves the device.

Part 4 · On the Wire

Wireshark — X-ray glasses for your network

🔎

A free packet sniffer / analyzer

Captures live traffic · shows it readable, layer by layer · save a trace to share · reveals MAC, IP, port & app data in each packet.

It sees every layer’s address

● Application — email / app data
● Transport — port address
● Network — IP address
● Data Link — MAC address

Tip: run ip addr to see your own MAC & IP.

💡

Think of it like… X-ray glasses for traffic — you see inside every packet. With great power comes responsibility: only sniff networks you’re allowed to. USE RESPONSIBLY.

Part 4 · On the Wire

Ethernet — the LAN workhorse

IEEE 802.3

The family of LAN technologies. Spans a small area, uses full-duplex (both directions at once), and carries the frames everything else rides on.

🔧 MAC addressing

🔲 Ethernet frames

🚦 CSMA/CD

〰️ Encoding

Speeds: 10BaseT → 100BaseT → 1 / 10 / 40 / 100 Gbps.

💡

Think of it like… Ethernet is the local roads + delivery vans of your building. IP picks the destination city; Ethernet drives each frame to the right door, then checks it arrived intact.

Part 4 · On the Wire

Anatomy of an Ethernet frame

Preamble + SFD
8 B

Dest MAC
6 B

Src MAC
6 B

Type
2 B

Data + Pad
46–1500 B

FCS
4 B

🔎

Ethernet II vs 802.3: field 4 is Type (Ethernet II) or Length (802.3). 802.3 also splits Data Link into LLC (802.2) over MAC. The Type field demuxes to IP (0x0800) or ARP (0x0806); FCS is the CRC error check.

💡

Think of it like… a shipping crate: a heads-up it’s coming (preamble), to/from labels (MACs), a contents tag (type), the goods (data), and a tamper seal checked on arrival (FCS).

Self-Test #3

Wireshark & Ethernet

Tap a green answer to reveal it.

Q In one line, what does Wireshark do?

A Captures & displays network traffic — a packet sniffer / analyzer.

Q Which IEEE standard is Ethernet, and what duplex?

A IEEE 802.3; full-duplex.

Q What does the FCS field do in an Ethernet frame?

A Error detection — a CRC-32 the receiver checks.

Q What does the Type field do?

A Identifies the upper-layer protocol (IP 0x0800, ARP 0x0806) so the receiver can demultiplex.

One-page cheat sheet

Chapter 2 in a single glance

Why layer?

Divide & conquer
Each layer = a service above
Two stacks: OSI & TCP/IP

OSI 7 (7→1)

App·Pres·Session·Transport·
Network·Data Link·Physical
“All People Seem To Need…”

TCP/IP

App·Transport·Internet·Link
DARPA — runs the Internet

PDUs (down)

Data → Segment → Packet
→ Frame → Bits
Header added each layer down

MAC address

48-bit hex · burned-in
OUI (vendor) + serial
unicast / multicast / broadcast

IPv4 address

32-bit · dotted-decimal
network + host via mask
~4.3 billion addresses

IP classes

A 1-127 · B 128-191
C 192-223 · D multicast · E exp

Special IPs

127.0.0.1 = loopback
255.255.255.255 = broadcast
169.254.x.x = APIPA

Ethernet (802.3)

LAN · full-duplex · CSMA/CD
Frame: Pre·SFD·Dst·Src·
Type·Data·FCS(CRC)

From a model to a moving packet.

You can now picture how layers, addresses and Ethernet hand a single packet across the world — and use Wireshark to watch it happen. Revise with the cheat sheet, test yourself with the quizzes.

Next up → Chapter 3

Ready to make it real? Switch to the 🧪 Lab Guide — capture packets and decode addresses on Kali Linux.

1 / 26

Chapter 2 · Hands-on labs

Models, Addressing & the Wire — live on Kali Linux

Six small, beginner-friendly labs. Just type the commands and read the output — no programming. Each one maps to a Chapter 2 topic and ends by tying what you saw back to the slide.

SET-UP · Open the Kali Terminal. A couple of labs use two terminals (A & B) — just open a second tab. Capturing packets needs sudo. Tools used are pre-installed on Kali; the only one you may need to add is ipcalc: sudo apt install -y ipcalc. The ❯ is just the prompt — the Copy button grabs only the command.

USE RESPONSIBLY · Only capture or sniff traffic on networks you own or are allowed to test. These labs only ever look at your own machine and its traffic.

1 · Your machine 2 · Bits & hex 3 · MAC 4 · IPv4 5 · Layers 6 · Wireshark ✓ Answers

Meet Your Machine: MAC & IP

Maps to Ch.2:The four addresses — your machine has a MAC (Layer 2) and an IP (Layer 3) at the same time. You’ll learn:Find your own IP, subnet, MAC address and gateway — the simplest possible start. Tools:ip (no setup, no sudo)

Your IP address & subnet (look at the line that isn’t lo):

ip -br addr

Representative — yours will differ

lo      UNKNOWN   127.0.0.1/8
eth0    UP        192.168.1.23/24

So this machine’s IP is 192.168.1.23 and the /24 is its subnet (the local network).

Your MAC address — the card’s permanent name (the link/ether line):

ip link show

Representative

2: eth0: <BROADCAST,MULTICAST,UP> ...
    link/ether 6c:f0:49:68:95:68 brd ff:ff:ff:ff:ff:ff

Your gateway — the “door” out to other networks (the default via line):

ip route

Representative

default via 192.168.1.1 dev eth0

Neighbours you’ve talked to — their IP and MAC, side by side:

ip neigh

Why it matters · Your machine has TWO addresses at once: a MAC (fixed, identifies the card) and an IP (where you are on the network). The gateway is the door to everything beyond your LAN — exactly the “four addresses” idea from the slides.

Your turn · If you took this laptop to a café and joined their Wi-Fi, which address would change — the MAC or the IP? (answer below)

Addresses Are Just Bits: Decimal · Binary · Hex

Maps to Ch.2:Data representation — text, MACs and IPs are all just bits; we write them in decimal, binary or hex. You’ll learn:Convert between the three number “outfits” with one-line Linux commands — no maths by hand. Tools:xxd, printf, bc

A letter, as bits and hex. See the 0s and 1s behind “A”:

echo -n "A" | xxd -b
echo -n "A" | xxd

Verified output

00000000: 01000001          A      <- binary (8 bits)
00000000: 41                A      <- hex

So A = 01000001 in binary = 41 in hex. Same letter, two outfits.

Decimal → hex with printf (try the IP octet 192):

printf '%X\n' 192

Verified output

C0

Hex → decimal (put 0x in front of the hex):

printf '%d\n' 0xC0

Verified output

Decimal ↔ binary with bc (obase = output base):

echo "obase=2; 192" | bc
echo "ibase=2; 11000000" | bc

Verified output

11000000
192

Why it matters · One IP octet, 192 = C0 = 11000000 — three ways to write the same value. Humans read decimal, the wire uses binary, and MAC/IP addresses are written in hex. They’re all the same bits underneath.

Your turn · Convert 255 to binary and to hex using the commands above. (answer below)

MAC Addresses: The Vendor & the 3 Types

Maps to Ch.2:The MAC address — 6 octets = OUI (vendor) + serial; unicast / multicast / broadcast. You’ll learn:Read your MAC, spot the vendor half, and recognise the three delivery types by sight. Tools:ip, tcpdump

Read your MAC again and look at the six pairs:

ip link show

Your MAC, split in two halves

6c:f0:49 : 68:95:68
└──────┘   └──────┘
 OUI        serial
(vendor)   (this card)

The first 3 octets (6c:f0:49) are the OUI — the maker, registered with the IEEE. The last 3 are this card’s unique serial. (You can paste the first 3 into any “MAC vendor lookup” site to see the brand.)

Recognise the 3 delivery types by how the address looks:

Tell them apart by sight

Unicast    6c:f0:49:68:95:68    one card  (a normal MAC)
Broadcast  ff:ff:ff:ff:ff:ff    everyone  (all F's)
Multicast  01:00:5e:00:00:fb    a group   (starts 01:00:5e)

Watch a broadcast on the wire — capture ARP and look at the destination:

sudo tcpdump -e -nn -c 5 arp

Representative — note the all-F's destination

... 6c:f0:49:68:95:68 > ff:ff:ff:ff:ff:ff, Request who-has 192.168.1.1

Why it matters · A MAC is 6 hex octets: the first half says who made the card, the second half is its serial. A destination of ff:ff:ff:ff:ff:ff means “everyone on this LAN” — that’s a broadcast.

Your turn · Is 01:00:5e:00:00:fb a unicast, broadcast, or multicast address? (answer below)

IPv4 Made Easy with ipcalc

Maps to Ch.2:The IPv4 address — network + host split by the mask; the network & broadcast addresses; classes. You’ll learn:Let one friendly command work out the network, host range, broadcast and class for you. Tools:ipcalc (sudo apt install ipcalc), ip

Find your IP and mask (e.g. 192.168.1.23/24):

ip -br addr

Let ipcalc do the maths — feed it your address and mask:

ipcalc 192.168.1.23/24

Representative output

Address:   192.168.1.23
Netmask:   255.255.255.0 = 24
=>
Network:   192.168.1.0/24
HostMin:   192.168.1.1
HostMax:   192.168.1.254
Broadcast: 192.168.1.255
Hosts/Net: 254          Class C, Private Internet

Read it off: the Network is the .0, the usable range is HostMin → HostMax, the Broadcast is the .255, there are 254 usable hosts, and it’s Class C.

Shrink the network and watch the numbers change (a sneak peek at subnetting, Chapter 6):

ipcalc 192.168.1.23/26

Smaller network → fewer hosts

Network:   192.168.1.0/26
Broadcast: 192.168.1.63
Hosts/Net: 62          Class C

Why it matters · The mask splits an IP into a network part and a host part. ipcalc shows the network address, the usable host range, the broadcast and the class — every IPv4 idea from the slides, worked out for you.

Your turn · Run ipcalc 10.0.0.5/8. What class is it, and roughly how many hosts? (answer below)

See the Layers in One Packet

Maps to Ch.2:The OSI / TCP-IP models, PDUs & encapsulation — one packet holds every layer, nested inside the last. You’ll learn:Capture one real packet and watch Ethernet → IP → TCP → data appear, layer by layer. Tools:tcpdump, curl (two terminals)

Start capturing in Terminal A (-e shows Layer 2, -vv shows detail):

sudo tcpdump -i any -c 3 -e -vv -nn 'tcp port 80'

Make some traffic in Terminal B:

curl -s http://example.com -o /dev/null

Read one packet back in Terminal A — every layer is there:

Representative — one packet, annotated by layer

6c:f0:49:68:95:68 > 52:54:00:aa:bb:cc, ethertype IPv4 (0x0800)   <- Layer 2  (Ethernet: MACs + type)
   (ttl 64, proto TCP (6), length 56)                            <- Layer 3  (IP: ttl, protocol)
   192.168.1.23.49152 > 93.184.216.34.80: Flags [S], win 8192    <- Layer 4  (TCP: ports, flags)
        GET / HTTP/1.1                                            <- Layer 7  (the data)

Why it matters · One packet is the whole stack at once: the Ethernet frame wraps the IP packet, which wraps the TCP segment, which wraps your data. That nesting is encapsulation and the PDUs from the slides.

Your turn · In the output, which line shows the IP addresses, and which shows the MAC addresses? (answer below)

Wireshark & the Ethernet Frame

Maps to Ch.2:Wireshark + the Ethernet frame — see every layer’s address, and read the frame’s dest/src MAC and Type. You’ll learn:Use the Wireshark window to expand a packet’s layers, then read the same frame on the command line. Tools:wireshark, tcpdump

Open Wireshark (Applications ▸ Sniffing, or the command below). Double-click your interface (eth0/wlan0) to start, browse a website, then click the red square to stop.

sudo wireshark &

Click any packet, then in the middle pane click the ▸ triangles to expand each layer. You’ll see one address per layer:

The layer tree (each layer shows its own address)

▸ Ethernet II   Src/Dst MAC      <- Layer 2
▸ Internet Protocol   Src/Dst IP <- Layer 3
▸ Transmission Control Protocol  <- Layer 4  (ports)
▸ Hypertext Transfer Protocol    <- Layer 7  (host name)

Prefer the terminal? Read the Ethernet frame header with tcpdump (-e = show Layer 2):

sudo tcpdump -i any -e -c 5 -nn

Representative — the frame header: dst, src, type

6c:f0:49:68:95:68 > 52:54:00:aa:bb:cc, ethertype IPv4 (0x0800), length 74
52:54:00:aa:bb:cc > ff:ff:ff:ff:ff:ff, ethertype ARP  (0x0806), length 42

Each frame begins with dest MAC > src MAC, then the ethertype — 0x0800 = IPv4, 0x0806 = ARP. That Type field tells the receiver which upper layer to hand the data to.

Why it matters · Wireshark and tcpdump show every layer’s address at once — MAC (L2), IP (L3), port (L4), name (L7). And a frame really is just dst MAC · src MAC · Type · data · FCS, exactly like the slide’s diagram.

Your turn · As a packet travels through routers, which address changes at every hop, and which stays the same the whole way? (answer below — it’s the heart of Chapter 3)

✓

Answer Key & Where Next

Lab 1. The IP would change (you’d get a new address from the café’s network). The MAC stays the same — it’s burned into the card and goes everywhere with you.

Lab 2. 255 = 11111111 in binary (echo "obase=2; 255" | bc) and FF in hex (printf '%X\n' 255).

Lab 3. 01:00:5e:00:00:fb is multicast — the 01:00:5e prefix is the giveaway (it’s a “send to a group” address, not one card and not everyone).

Lab 4. 10.0.0.5/8 → first octet 10 → Class A; a /8 has about 16.7 million hosts (16,777,214 usable).

Lab 5. The line with 192.168.1.23 > 93.184.216.34 shows the IP addresses; the first line with the two xx:xx:xx:xx:xx:xx values shows the MAC addresses.

Lab 6. The MAC changes at every hop (it’s only local to each link); the IP stays the same end-to-end. That’s “IP end-to-end, MAC hop-to-hop” — the big idea of Chapter 3.

This lab’s tool	Returns in…
ip addr / neigh (Lab 1, 3)	Chapter 3 — MAC, ARP, frames
ipcalc / IPv4 (Lab 4)	Chapter 4 & 6 — the IP header, masks & subnetting
tcpdump layers (Lab 5, 6)	Chapter 4 & 5 — IP TTL, ICMP, fragmentation
Wireshark (Lab 6)	Every later chapter — your go-to packet viewer

Nice work · With nothing but built-in Linux commands you’ve seen your own addresses, turned numbers into bits, decoded a MAC, worked out a network, and watched the layers inside a real packet.

Chapter 2 — Network Models, Addressing & Wireshark · Slides + Hands-On Kali Labs

Network Models,Addressing & Wireshark

Your 4-stop journey

Layering & Models

Encapsulation

Addressing

On the Wire

First, what’s a protocol again?

A protocol = agreed rules for exchanging data

What must devices agree on?

Why layers? Divide & conquer

Building a whole network at once is HARD

How one layer talks to the others

A protocol stack — and the two famous ones

OSI Model

TCP/IP Model

Meet the 7 layers

The master table — responsibilities, protocols, PDUs

What the data is CALLED at each layer (PDU)

Wrapping & unwrapping the data

The practical stack — who lives at each layer

Models & Encapsulation

Four layers, four addresses

Decimal · Binary · Hex — same value, 3 outfits

Hex is binary shorthand

The MAC (physical) address

Three kinds of MAC delivery

Unicast

Multicast

Broadcast

The IPv4 address

IPv4 classes — read the first octet

Special & private addresses

Loopback

APIPA

Broadcast

Network addr

Addressing

Wireshark — X-ray glasses for your network

A free packet sniffer / analyzer

It sees every layer’s address

Ethernet — the LAN workhorse

IEEE 802.3

Anatomy of an Ethernet frame

Wireshark & Ethernet

Chapter 2 in a single glance

Why layer?

OSI 7 (7→1)

TCP/IP

PDUs (down)

MAC address

IPv4 address

IP classes

Special IPs

Ethernet (802.3)

From a model to a moving packet.

Models, Addressing & the Wire — live on Kali Linux

Meet Your Machine: MAC & IP

Addresses Are Just Bits: Decimal · Binary · Hex

MAC Addresses: The Vendor & the 3 Types

IPv4 Made Easy with ipcalc

See the Layers in One Packet

Wireshark & the Ethernet Frame

Answer Key & Where Next

Network Models,
Addressing & Wireshark