Field Guide · Networking
The networking family's core mental models in one place, redrawn to a common style. This is a gallery, not a lesson: each diagram carries one idea and a pointer to the guide that develops it. Read it as a map of a single packet's life — how it's wrapped, where it goes, how the destination is found, and how the conversation opens — and use it to find which guide to open when a diagram raises a question.
Every other guide in the family zooms in on one stage. This one pulls back so the stages line up: a packet is wrapped in layered headers, addressed at two scopes at once, routed hop by hop toward a name that DNS resolves, and only then does a TCP and TLS handshake open the conversation the application wanted. The diagrams below follow that order.
Each layer wraps the one above it with its own header; the wire carries the outermost wrapper, and each device unwraps only as far as it needs to.
The same four layers, read as "what each one adds and the address it decides on":
A packet is addressed at two scopes at once. The destination IP is chosen once and rides end to end; the destination MAC is rewritten at every router hop, because it only ever names the next link.
How a host decides whether a destination is even on its own link — the mask draws the line between the network part and the host part of an address:
When a packet is bound off-link, the router picks exactly one next-hop by applying three tie-breakers in a fixed order — each only consulted if the previous one left a tie.
And the name has to become an address first. A stub resolver asks one recursive resolver, which does the walking — root, then TLD, then the authoritative server — and caches the answer for its TTL:
Only once the destination is reachable does the conversation open — first TCP's three-way handshake to establish a reliable channel, then, for anything encrypted, the TLS handshake on top of it.
TLS 1.3 then negotiates keys and authenticates the server's name in a single round trip before any application data flows:
Encapsulation, the layers, and the end-to-end-IP-vs-hop-MAC path → Networking — Follow the Packet. The mask and local-vs-remote → Subnetting & CIDR.
The longest-prefix → distance → metric funnel (and the verified AD values) → IP Routing & Route Tables. Stub / recursive resolution and TTL → DNS.
The TCP and TLS handshakes → Networking and TLS & Certificates. For reading trouble rather than mechanism → Misconceptions, Sage-Advice, the Command Card, and the Triage Trees.
This is a consolidation: every diagram is a redrawn view of a model developed in its home guide, kept deliberately conceptual — no administrative-distance numbers, no exact handshake byte order — so the authoritative, version-specific specifics stay where they were verified: the Cisco AD values in IP Routing, TLS 1.3 as RFC 8446 with its roughly-one-round-trip handshake and forward secrecy in TLS & Certificates, and the encrypted-transport and DNSSEC details in DNS. Nothing here is a security assurance — a completed handshake means the channel is open and, for TLS, that the server's name is authenticated over an encrypted channel; it does not mean the endpoint is trustworthy or that you are authorized, which is the distinction the Misconceptions and Zero Trust guides draw. Terms are in the Glossary; 00 · Start Here indexes the set.