DumpAnyInteractive Network Protocol Visualizations
Understand network protocols through step-by-step animations. From TLS handshakes to TCP congestion control, DNS resolution to VPN tunnels — each protocol is broken down into interactive steps. Click through and learn.
HTTPS / Encryption
TLS 1.2 Four-Way Handshake
The foundation of HTTPS connections. Client and server negotiate encryption parameters, verify identities, and exchange keys through a four-way handshake, establishing a secure channel over an insecure network.
CA Certificate Trust Chain
How does a browser verify that an HTTPS site's certificate is trustworthy? Through a chain of trust from the server certificate up to a root CA — verifying signatures at each level, ultimately tracing back to a trust anchor pre-installed in the OS.
MITM Proxy — How It Works
How do debugging tools (Charles, DumpAny, etc.) decrypt HTTPS traffic? By acting as a "man in the middle," re-encrypting traffic with a self-signed CA certificate for transparent decryption.
SSL Strip Downgrade Attack
A classic MITM attack: the attacker intercepts HTTP-to-HTTPS redirects and rewrites HTTPS links to HTTP. The client believes they're on a secure connection but everything is transmitted in cleartext. HSTS is the key defense.
TLS Session Resumption & 0-RTT
Does HTTPS need a full handshake on every reconnect? No. TLS has two ways to 'remember' a session — Session ID and Session Ticket — so reconnects skip the full handshake. Tickets go further: they enable 0-RTT data.
mTLS — Mutual TLS Authentication
Normal HTTPS only has the client verify the server. mTLS flips it: the server also verifies who the client is. Common in corporate networks, API gateways, and K8s clusters — both ends hold certs and check each other's ID.
DNS over HTTPS (DoH)
Traditional DNS queries are plaintext — every ISP and router along the way can see where you go. DoH stuffs DNS queries inside HTTPS, so middleboxes only see an encrypted byte stream — they can't even guess the domain.
SSL Strip Attack — Full Timeline
SSL Strip is a classic downgrade attack: the attacker intercepts the server's HTTPS redirect and rewrites https to http, while the victim believes they're on a secure site. From plaintext request to leaked credentials, to HSTS killing the attack.
TCP Protocol
TCP Three-Way Handshake
The standard process for establishing a TCP connection. Client and server exchange three messages to synchronize initial sequence numbers (ISN) and establish a bidirectional reliable channel.
TCP Four-Way Teardown
The standard process for closing a TCP connection. Since TCP is full-duplex, each direction must be closed independently, requiring four messages. The active closer enters TIME_WAIT at the end.
TCP Congestion Control
How does TCP avoid flooding the network? By dynamically adjusting the congestion window (cwnd), switching between slow start and congestion avoidance, and backing off on packet loss.
TFO + TLS 1.3 0-RTT Comparison
For the same page request: the left side walks through traditional TCP + TLS — 3 RTTs before any data. The right side uses TFO + TLS 1.3 0-RTT and stuffs data into the very first packet.
The Nagle / Delayed ACK 200ms Deadlock
Nagle wants to batch small packets, Delayed ACK wants to batch ACKs — the two 'wait-and-batch' strategies collide into the classic 200ms stall.
Application Layer
DNS Resolution — Full Chain
What happens behind the scenes when you type a URL into your browser? DNS resolution is a recursive chain — from local cache to root servers, to TLD, to authoritative servers.
QUIC Fast Handshake
QUIC is the transport layer for HTTP/3, built on UDP. It combines transport security (TLS 1.3) and transport (replacing TCP) into a single protocol, enabling 1-RTT and even 0-RTT handshakes.
WebSocket Protocol Upgrade
WebSocket upgrades an HTTP connection to a full-duplex WebSocket connection via the HTTP Upgrade mechanism. After a single handshake, client and server can send messages to each other at any time.
HTTP/2 Multiplexing
HTTP/1.1 lets one connection handle only one request at a time, so browsers open 6 connections and queue. HTTP/2 runs multiple streams over a single connection, plus HPACK header compression, to actually saturate the bandwidth.
OAuth 2.0 Authorization Code + PKCE
How does a third-party app safely get your account data? Authorization Code + PKCE (RFC 7636) is the recommended OAuth flow — a code_challenge/code_verifier pair proves client identity and stops intercepted auth codes from being replayed.
gRPC — Four Stream Types
gRPC runs on HTTP/2, so beyond plain unary RPC it supports three streaming RPC patterns. The four modes differ only in how many request/response messages each side sends.
HTTP Cache Revalidation
Why doesn't the browser re-download the same CSS every time? Cache-Control freshness plus ETag/Last-Modified conditional requests. A fresh cache hit costs zero network round trips; after expiry a 304 confirms nothing changed and still saves bandwidth.
DHCP DORA — Four Steps
How does a new device get an IP automatically? DHCP runs Discover / Offer / Request / Ack. Discover and Request are broadcasts (no IP yet); Offer and Ack are targeted replies to the device's MAC.
ARP — Address Resolution Protocol
What do you do when you know the IP but not the MAC? ARP broadcasts "Who has 10.0.0.2?" on the subnet, the target replies unicast with its MAC, the source caches it, and can then send Ethernet frames directly.
WebRTC ICE — STUN/TURN Connection Setup
Two peers both behind NAT need to connect directly. ICE first asks STUN for your public address, runs connectivity checks on candidate pairs, and falls back to a TURN relay when punching fails.
MySQL Connection & Query Protocol
From TCP connect to result set, the full MySQL handshake and query flow: greeting → auth → COM_QUERY → result set.
Proxy & Tunneling
HTTP CONNECT Tunnel
The HTTP CONNECT method establishes a TCP tunnel — most commonly used by HTTPS forward proxies. The client connects to the target through the proxy; the proxy knows nothing about the TLS traffic inside the tunnel.
SOCKS5 Proxy Protocol
SOCKS5 is one of the most widely used proxy protocols, sitting above TCP. It doesn't care what upper-layer protocol is being transported — HTTP, HTTPS, SSH, FTP can all be forwarded through SOCKS5.
SSH Tunnel — Three Modes
SSH isn't just for remote login — it can create encrypted tunnels. Three modes: local forwarding (-L), remote forwarding (-R), and dynamic forwarding (-D), each for different scenarios.
How VPN Works
VPN creates a virtual network interface (tun/tap) and modifies the routing table to redirect all (or some) network traffic through an encrypted tunnel, providing network-layer global proxying.
TUN Virtual Device — L3 IP Tunnel
TUN is the foundation of VPN and tunneling technologies. It creates a virtual IP packet channel between the OS kernel and userspace — the kernel hands IP packets matching the routing table to a userspace program, which can encrypt, encapsulate, or modify them before sending them out.
STUN NAT Traversal — UDP Hole Punching
In P2P communication, devices behind NAT don't know their public address. The STUN protocol uses a simple request-response mechanism that lets clients ask a STUN server, "What's my public IP and port?" — preparing for subsequent UDP hole punching.
CDN Full-Chain Origin Fetch
A user in Tokyo requests an image. The request walks up the chain from the nearest edge: Edge → Regional node → Origin. Every layer caches; on a hit the response is nearly instant.
K8s Service → Pod Traffic Path
When you hit a Service's ClusterIP, how does the packet get DNAT'd to one of its Pods? From the node entry to the Pod's NIC, then the return path.
SSH Port Forwarding — Three Data Flows
One encrypted SSH tunnel, three modes. -L / -R / -D differ only in who listens and who makes the outbound connection. Watch the packets.
Web Security
XSS Cross-Site Scripting — Three Attack Patterns
Reflected, Stored, and DOM-based XSS have entirely different data flows, but the fatal trust boundary is the same: treating user input as executable code.
SSRF Server-Side Request Forgery — Using the Server as a Proxy into the Internal Network
The server trusts a user-supplied URL and becomes the attacker's pivot into internal services. A firewall stops external traffic, but it can't stop the server's own outbound requests.