Advanced lesson
Follow a Packet: Ports, Protocols and Routing
Follow a web request through a small network and use the OSI model as a troubleshooting aid, not a memorization exercise.
Reviewed September 2026 · 3 minute read
Turn the layers into questions
| OSI layer | Plain purpose | Useful check |
|---|---|---|
| 1 · Physical | Carry the signal. | Power, cable and radio conditions. |
| 2 · Data link | Deliver frames on the local link. | Switch port, VLAN and local addressing behavior. |
| 3 · Network | Address and route packets. | IP prefix, gateway and routes. |
| 4 · Transport | Carry traffic between application endpoints. | Required TCP/UDP traffic and connection behavior. |
| 5 · Session | Organize a conversation. | Session establishment and recovery. |
| 6 · Presentation | Represent and transform information. | Encoding and encryption-related behavior. |
| 7 · Application | Provide the service the user needs. | Name lookup and the actual application transaction. |
Real protocols do not always fit neatly into one box. The model helps organize checks; it does not prove the fault is at a particular layer.
A short port reference
| Common use | Typical transport / port | Remember |
|---|---|---|
| DNS | UDP and TCP / 53 | Encrypted DNS can use other transports and ports. |
| DHCP for IPv4 | UDP / 67 server, 68 client | Initial lease traffic is different from ordinary routed web traffic. |
| SSH / SFTP | TCP / 22 | SFTP uses SSH; it is not ordinary FTP. |
| HTTP | TCP / 80 | Do not infer encryption from a web page alone. |
| HTTPS | TCP / 443; HTTP/3 uses UDP / 443 | TLS and the application still need to succeed. |
| NTP time service | UDP / 123 | Accurate time helps logs and authentication. |
TCP provides an ordered byte stream with retransmission. UDP sends datagrams without those transport guarantees; applications can add their own reliability. A failed ping does not prove that a permitted web connection fails, and a successful ping does not prove the web application works.
The printer is local; the website is elsewhere
Worked example
192.168.20.10/26 opens a remote website
Traffic for a local address in that subnet can be delivered on the local network. A destination outside it needs an appropriate route, often through the default gateway. The router chooses a matching route; the return path and access rules must work too.
Network address translation (NAT) may change addresses at a boundary. NAT does not replace a deliberate firewall policy. A switch doing Layer 3 routing may also enforce policy away from the main gateway.
Choose the useful check
A lab workstation can reach its gateway and resolve the approved test service, but the HTTPS transaction fails. What would you investigate next?
Show the next investigation
Check the required transport and application behavior, access rules, TLS error and service status. Keep the known-good gateway and DNS observations. Do not open all ports to make the symptom disappear.
Put it into practice
Check what you learned
Choose an answer for each question, then check your understanding. Your answers stay in this browser.
Read the answers and explanations
- That every required application transaction works.
Ping and application tests ask different questions.
- Both forward and return routing, plus the applicable policy.
A usable conversation needs the required traffic to travel in both directions.
- To choose useful checks and describe evidence.
The model organizes reasoning; it does not replace observations.
Sources and further reading
- IANA: service names and port numbers
The authoritative registration list. A familiar port number does not prove that traffic is safe or that an application uses its default.
- IETF RFC 1918: private IPv4 addresses
The primary reference for the private address ranges used in our examples.
- IETF RFC 8200: IPv6
The protocol reference behind IPv6; use it for deeper study after the short lesson.
Keep your momentum
Ready for the next step?
If you can explain the example and your answer, try the next lesson. Revisit the feedback whenever you need it.
FryAVSI · Updated September 10, 2026
Reference this lesson or use a section’s direct link for a particular chart or example. How to cite an example.
FryAVSI · Northeast Ohio and beyond
Turn the learning into a working result.
Share your site, the challenge and the result you need. Our team can help plan or carry out the work.