Syllabus Lesson 97 of 156 · Packets, DNS and IP addresses
Packets, DNS and IP addresses

Packets, ports and layers

Why it matters Every privacy tool you will meet in this leg (encrypted DNS, VPNs, relays, Tor) works by hiding one layer of your traffic from one party. If you can picture the layers, you can tell at a glance what any tool really hides, and from whom.

Welcome to the deep half of the course. From here on, everything below the web page is simulated in our practice world, watched. A web page cannot capture real network traffic, and nothing about you is recorded. You need only the Python from Leg 2 and some patience with new words, which we define as we go.

Letters inside envelopes

Imagine posting a letter inside an envelope, inside a bigger envelope, inside a parcel. Each wrapper has its own label, meant for a different person: the courier reads the parcel label, the building's post room reads the next envelope, and only the person it is for reads the letter.

Internet traffic works the same way. Your message is split into small pieces, and each piece is wrapped in several layers, each with its own label.

Packet: one small piece of data travelling across a network, with labels (called headers) saying where it comes from and where it is going. A web page usually arrives as many packets.

Protocol: an agreed set of rules for talking, like the format of an address on an envelope. IP, TCP, UDP, TLS and HTTP are all protocols.

The layers, from outside in

  1. IP (the parcel label). The Internet Protocol carries a source address and a destination address, so every router (a box that passes packets from one network to the next, like a sorting office) along the way knows where to pass the packet next.
  2. TCP or UDP (the flat number). An address gets a packet to a computer; a port number says which program on that computer should receive it. TCP adds delivery checks and puts pieces back in order; UDP is quicker and simpler, with no guarantees.
  3. TLS (the sealed envelope). The encryption from lesson 81 and lesson 82. Everything inside is unreadable to anyone on the path.
  4. HTTP (the letter). The actual request: "GET /p/tent", with cookies, headers and form data.

IP address: a number that identifies a device's connection to the internet, such as 203.0.113.7. It works like a postal address for packets. The addresses in this course come from ranges reserved for examples, so none belongs to a real person.

Port: a number from 0 to 65535 that picks a program on a computer. Web servers listen on port 443 for HTTPS (and 80 for plain HTTP). DNS, from the next lesson, normally uses port 53.

One packet of a visit to https://shopa.example/p/tent looks roughly like this:

IP    from 203.0.113.7  to 198.51.100.20      (visible to every router)
 TCP  from port 51432   to port 443           (visible: "this is HTTPS")
  TLS  [encrypted bytes]                       (sealed)
   HTTP GET /p/tent, Cookie: sid=...           (only the server can read this)

A newer version of HTTP, HTTP/3, swaps TCP for a protocol called QUIC that runs over UDP and builds the encryption in. The envelope picture still holds: addresses outside, sealed content inside.

Who sees which layer

Who carries itWhat they can read
Your Wi-Fi (home, café, office)IP addresses, ports, sizes, timing, and the site name sent while the encryption is set up (the "handshake"), unless Encrypted Client Hello from lesson 82 is used
Your internet provider and every network on the wayThe same: the outer labels, never the sealed content
The website's serverEverything, once it opens the envelope: your IP address, the page you asked for, your cookies

Notice the server always sees your IP address. It has to: it needs somewhere to send the reply. That single fact drives half of this module.

A common misconception: "HTTPS hides everything about my browsing". It seals the letter, but the parcel label, the flat number, the size and the time of posting all stay visible. Each tool in this leg moves or hides one of those outer labels.

Try it Open your browser's developer tools (F12, or Cmd+Option+I on a Mac), go to the Network tab and reload a page. In Chrome or Edge, right-click the column headings and switch on Protocol and Remote Address. You will see entries like h2 or h3 (HTTP/2 or HTTP/3) and an IP address with :443 on the end: the server's address and port, exactly the outer labels from this lesson.

Recap

  • Traffic travels as packets wrapped in layers: IP, then TCP or UDP, then TLS, then HTTP.
  • IP addresses and ports are outer labels everyone on the path can read.
  • TLS seals the HTTP request so only the server can read it.
  • The server always sees your IP address, because it must reply to it.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back