Tag archive
Build a path with a 1400-byte bottleneck link, send a 1500-byte Don't-Fragment packet into it, and watch ICMP fragmentation-needed teach the sender the Path MTU — the mechanism that silently breaks when firewalls drop ICMP.
Clear the ARP cache, ping a neighbor, and capture the broadcast 'who has 10.0.0.2?' request and unicast 'is-at' reply that make IPv4 delivery on a link actually work.
Boot a client with no IP address at all, run a DHCP client against a tiny server, and capture the full Discover-Offer-Request-Ack (DORA) exchange on the wire.
Build a point-to-point GRE tunnel, ping across the overlay, and capture the underlay to watch IP protocol 47 carry your inner packets in the clear — completing the WireGuard/VXLAN/GRE tunnel trilogy.
Build a real client → r1 → r2 → server path in containers, run traceroute, and capture the ICMP time-exceeded messages that turn a simple loop-prevention field into a hop-by-hop map.
Build a point-to-point VXLAN overlay, ping across it, then capture the underlay and watch the inner ICMP appear in plain text — proof that encapsulation and encryption are two different jobs.
Build a WireGuard tunnel between two containers, then capture the same ping twice — encrypted UDP on the real link, cleartext ICMP inside wg0 — to see exactly where a VPN's encryption applies.
Run a tiny lab CA, sign a server cert and a client cert, then watch a -Verify server accept the client that presents a certificate and reject the one that doesn't — with a 'certificate required' TLS alert.
Sign a DNS zone, validate it with a trust anchor and watch the AD flag appear — then flip one byte of the data and see the resolver reject the answer with SERVFAIL.
Open one TLS 1.3 connection, capture the handshake, and pinpoint the exact boundary where cleartext ends: SNI and the ALPN offer are visible, but the certificate is not.
Query the same name twice and watch the TTL shrink, compare short and long TTLs, then ask for a name that doesn't exist and see why NXDOMAIN comes back with an SOA — and gets cached anyway.
Open a single TCP connection in a two-node container lab and annotate its entire life in one packet capture: the three-way handshake, one data exchange, and the four-way teardown.