You build two routers and three hosts inside your own machine and run every experiment there. Encapsulation and MTU, ARP, subnet masks, routing tables, NAT, TCP and congestion control, DHCP and DNS, IPv6 and firewalls. Thirty lessons that take you to the point where you can work through "it will not connect" from the top down. Every output in the text was produced by actually running it.
The 30 lessons are grouped into eight chapters. Working through them in order is the best way, but you are welcome to read only the part you are stuck on right now. Note: networking commands cannot run inside the browser. Use the practice environment you build in lesson 1 (a single Docker container), or a virtual machine you are happy to throw away. Never try them on your company or home network.
It starts by building one network you are allowed to break. Rather than memorising the layer model, you see why commands divide up by layer — right down to why sending 56 bytes puts 98 bytes on the wire.
How a frame gets where it is going inside a single LAN. Reading MAC addresses, what a switch remembers, how VLANs separate traffic, and the fact that ARP has no authentication.
This chapter is the backbone of the course. Once you see an IP address as thirty-two ones and zeros, subnet masks, subnetting and summarisation all collapse into the same single calculation. It closes on design.
A router only knows the next hop. Reading a routing table, which of four matching routes wins, static and dynamic routes, and NAT. You create "it gets there but never comes back" again and again.
ICMP, ports, TCP and UDP. Ping works but larger transfers vanish; the bandwidth is unchanged but the speed drops by an order of magnitude — you cause both in a form where the numbers explain them.
Where an address comes from, and how a name gets resolved. The four DHCP packets, and the three usual culprits behind "I fixed DNS but nothing changed".
IPv6 is not crammed in at the end as an afterthought. There are only two rules for abbreviating the notation, one interface normally carries three addresses, addresses appear with no configuration at all — and then the pitfalls of dual stack.
Now you switch to the blocking side. You create the real accident where iptables shuts IPv4 down completely while IPv6 walks straight through, then finish by planting five kinds of fault and identifying each one with just eight checks.
Once you have finished all 30 lessons, take charge of the servers running on this network in Linux System Administration. If the commands themselves still feel shaky, go back to Linux for Beginners. Membership unlocks every course.