Skip to content

🧩 Stage 1: Foundations – Internet, TCP/IP, and HTTPS Concepts

🎯 Learning Objectives

By the end of this stage, you should be able to:

  • Explain how HTTP and HTTPS fit into the TCP/IP model.
  • Describe what happens when you open a website (from DNS resolution to data transfer).
  • Identify the layers involved in secure web communication.
  • Use curl, tcpdump, and Wireshark to observe HTTP vs HTTPS traffic.

📆 Suggested Duration

1 week (5–7 hours total) - 3h theory - 3–4h labs and analysis

📘 Section 1: Review of the TCP/IP Stack

🧠 Concepts to Learn

  • Layers:
  • Application → HTTP, HTTPS, DNS, etc.
  • Transport → TCP, UDP
  • Internet → IP
  • Link → Ethernet, Wi-Fi = Role of each layer in web communication. = How encapsulation works (Ethernet → IP → TCP → HTTP).

🧩 Visualization

1
2
3
4
Application:   HTTP
Transport:     TCP (Port 80) / TLS over TCP (Port 443)
Network:       IP
Link:          Ethernet / Wi-Fi

🔍 Self-Check

  • What’s the difference between TCP and UDP?
  • Why does HTTP use TCP instead of UDP?
  • What happens if you remove one layer?

🧪 Lab 1 – Observe Layered Communication

  1. Open Wireshark and start capturing packets on your interface.
  2. Visit http://example.com in a browser.
  3. Filter by tcp.port == 80.
  4. Look at the packet details — expand the Frame → Ethernet → IP → TCP → HTTP layers.
  5. Observe how each layer encapsulates the one above.

📘 Section 2: TCP Basics for HTTP

🧠 Concepts to Learn

  • TCP 3-way handshake: SYN → SYN/ACK → ACK.
  • Connection establishment and teardown.
  • Retransmissions and congestion control.
  • TCP ports: how servers listen on port 80 (HTTP) or 443 (HTTPS).

🧪 Lab 2 – Capture and Analyze a TCP Handshake

  1. Start Wireshark, filter: tcp.port == 80.
  2. In a terminal: 
    1
    curl -v http://example.com
  3. Observe in Wireshark:
  4. Three packets: SYN, SYN/ACK, ACK.
  5. The data packets following the handshake.
  6. Optional: repeat with a different website or port.

🔍 Self-Check

  • Which side starts the handshake?
  • Which flags indicate connection closing?
  • What happens if a packet is lost?

📘 Section 3: From HTTP to HTTPS

🧠 Concepts to Learn

  • HTTP is plain text over TCP (no encryption).
  • HTTPS = HTTP over TLS over TCP.
  • Ports:
  • HTTP → TCP/80
  • HTTPS → TCP/443
  • TLS provides:
  • Confidentiality (encryption)
  • Integrity (MAC)
  • Authentication (certificates)

🧪 Lab 3 – Compare HTTP vs HTTPS

Run both: 

1
2
curl -v http://example.com
curl -v https://example.com

Observe:

  • With HTTP: immediate GET request after TCP handshake.
  • With HTTPS: there’s a TLS handshake before any HTTP data appears.

Then:

  1. Capture both sessions with Wireshark.
  2. Filter tcp.port == 80 and tcp.port == 443.
  3. Compare:
  4. For port 80: you can read HTTP headers in plain text.
  5. For port 443: all application data is encrypted after the TLS handshake.

🔍 Self-Check

  • Why does HTTPS need an extra handshake?
  • What happens if a server doesn’t support TLS?
  • How can you tell if TLS handshake failed?

📘 Section 4: DNS Resolution and the Path to the Server

🧠 Concepts to Learn

  • DNS translates domain names to IP addresses.
  • Process:
  • Your browser checks local cache.
  • If not found, it queries a DNS resolver.
  • DNS uses UDP port 53, sometimes TCP (for large responses or DNSSEC).

🧪 Lab 4 – Trace DNS and Connection Setup

  1. Run: 

    1
    dig example.com
    Observe the A record (IPv4 address).

  2. Then: 

    1
    curl -v https://example.com

  3. Note the IP used and match it with the DNS result.
  4. Optionally capture both with Wireshark:

udp.port == 53 → DNS query/response. tcp.port == 443 → TLS handshake.

🔍 Self-Check

  • What happens if DNS fails?
  • Why does HTTPS depend on DNS for certificates?

📘 Section 5: End-to-End Flow – What Happens When You Open https://example.com

🧠 Step-by-Step

  1. DNS Resolution – Browser gets IP of the server.
  2. TCP Handshake – SYN → SYN/ACK → ACK.
  3. TLS Handshake – Negotiate encryption keys and verify certificate.
  4. HTTP Request – Browser sends encrypted HTTP request (GET /).
  5. Server Response – Encrypted HTTP response returned.
  6. TLS Close + TCP FIN – Graceful teardown.

🧩 Visualization

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
Client                        Server
  |---DNS Query/Response------>|
  |---TCP SYN----------------->|
  |<--TCP SYN/ACK--------------|
  |---TCP ACK----------------->|
  |---TLS ClientHello--------->|
  |<--TLS ServerHello----------|
  |   ... TLS handshake ...    |
  |---HTTP Request (encrypted)->|
  |<--HTTP Response (encrypted)-|
  |---TCP FIN----------------->|

🧪 Lab 5 – Full HTTPS Flow Capture

  1. Start Wireshark.
  2. Visit https://example.com.
  3. Stop capture and follow the flow:
  4. DNS → TCP handshake → TLS handshake → encrypted data.
  5. Draw the sequence in a diagram to visualize the layers and timing.

🧠 Knowledge Check

Answer these to ensure understanding: 1. What is the difference between TCP and TLS handshakes? 1. Which port does HTTPS use and why? 1. Can you read HTTP headers in an HTTPS capture? Why or why not? 1. Which layers in the TCP/IP stack does TLS belong to?

🧰 Tools Used

  • curl – for HTTP/HTTPS requests and verbose output
  • tcpdump – for CLI packet captures
  • Wireshark – for deep inspection
  • dig – for DNS lookup

🏁 Stage 1 Completion Outcome

You should now be able to: ✅ Trace every step of an HTTP/HTTPS session. ✅ Identify where encryption begins. ✅ Read packet captures and differentiate between HTTP and HTTPS traffic. ✅ Confidently explain “what happens when you open a secure website.”