NETWORK FOUNDATIONS • FICTIONAL PACKET WALKTHROUGH
Read the packet.
Follow the layers.
Learn what a packet capture can tell you, how data is wrapped as it moves down the network stack, and how several network clues can suggest an operating-system family. Everything in the interactive viewer is sample data generated in your browser.
How data gets wrapped for the network
OSI is a seven-layer learning model. Real TCP/IP stacks do not always map one protocol to exactly one OSI layer; the diagram groups common protocols to show the direction. As data is sent, each lower layer adds the information it needs. At the receiver, those wrappers are read and removed in reverse.
START: application data is ready at Layer 7.
Example: an HTTPS message begins as application data, is carried in TCP segments, placed in IP packets, framed for the local link (such as Ethernet or Wi‑Fi), then transmitted as signals. A router removes the incoming link frame and creates a new link frame for the next hop; it forwards the IP packet, subject to routing and network translation.
Follow one synthetic packet
Start with direction and time, then read from the link layer inward. Check the packet’s source and destination, protocol and ports, flags, and any visible application metadata. Encrypted TLS payloads remain unreadable without the session keys; a capture can still show useful connection metadata.
WHAT TO NOTICE
Can packets identify an operating system?
Sometimes they can suggest a family or device type, especially when several signals from the same host are available. They cannot reliably prove the exact OS from one packet. Use only captures from a network you own or are authorized to monitor.
CLUES TO CORRELATE
IP TTL / hop limit
Compare the observed value with plausible initial values and known path length. Routers decrement IPv4 TTL or IPv6 hop limit.Reading TTL: the value shown in a capture is usually the remaining IPv4 TTL after routers decrement it (IPv6 uses hop limit). A captured 117 could be consistent with an initial 128 across about 11 hops, but route length, tunneling, proxies, and configuration vary. Treat these as common examples, never a reliable OS lookup table.
TCP SYN options
Option support, values, and order can vary among TCP stacks. Compare a pattern across flows.Initial window
Window size may help distinguish stack fingerprints, but settings and middleboxes can change it.DHCP / local link
On an authorized local LAN, DHCP options and link-layer metadata add context. A MAC address usually does not cross a router.LOW CONFIDENCE A single TTL or TCP window value is not an OS verdict. Firewalls, NAT, proxies, virtual machines, custom stacks, route length, and tuning can alter observations. Combine clues and verify against endpoint inventory or host telemetry.
SAFE ESTIMATION EXERCISE
The HTTPS sample shows IPv4 TTL 52 and a TCP SYN with MSS, window scaling, SACK, and timestamps.
Possible reading
If a path-length estimate suggests a starting TTL near 64, that can be consistent with a Linux/Unix-like stack—but the guess is weak.Next validation
Compare additional flows and check an authorized asset inventory or endpoint telemetry before labeling the host.Passive vs active: passive fingerprinting studies packets already observed. Active OS detection sends probes and requires explicit authorization; this guide’s interactive sample sends nothing.
Which endpoint is the website server?
These packets are generated sample data; they do not come from this live website and nothing is captured or sent. The fictional site training-portal.example.test uses HTTPS. Follow the packet direction and port to identify its server endpoint.
FICTIONAL CAPTURE · TCP FLOW
| Packet | Source endpoint | Destination endpoint | Clue |
|---|---|---|---|
| 1 · SYN | 192.0.2.24:51514 | 198.51.100.40:443 | Client starts connection |
| 2 · SYN/ACK | 198.51.100.40:443 | 192.0.2.24:51514 | Server replies |
| 3 · TLS | 192.0.2.24:51514 | 198.51.100.40:443 | Encrypted web session |
Choose the website server endpoint:
Select an endpoint to see the explanation.
TTL MINI-CHALLENGE
A packet from the same fictional host arrives with IPv4 TTL 117. Which is the most careful interpretation?
Choose the most cautious interpretation.
Three quick checks
Try the questions before you move on to the hands-on labs.
Which layer uses TCP ports?
A router forwards a packet. Which address usually changes on a new Ethernet link?
What does a TTL value tell you about OS?
Move from packet basics to investigation
Use the packet-reading checklist when following DNS, endpoint connections, authentication events, and incident timelines. The labs use fictional evidence and never probe outside the simulation.
Technical references: RFC 894: IPv4 datagrams over Ethernet · RFC 791: Internet Protocol · RFC 9293: TCP · Nmap TCP/IP fingerprinting methods (reference only; this page does not run Nmap).