network

A Network Protocol Learning Roadmap: 42 Hands-On Labs and 151 Code-Reading Sessions, Mapped

Kaoru Nagashima

— 3 min read

The hardest part of learning networking isn't any single protocol — it's ordering. Textbooks are exhaustive, RFCs are infinite, and certification material optimizes for memorization. This post is a map through two free courses I publish: Protocol Lab (42 hands-on labs) and Protocol in Code (23 tracks / 151 code-reading sessions), organized by goal instead of by table of contents.

Note: Both courses are free and live in their repositories. This post is just the map.

Two courses, two rhythms

Protocol Lab (beginner) Protocol in Code (intermediate)
Rhythm Read a slice of RFC → run it in containerlab → capture packets → explain it in your own words Read a Core Question → read 30–200 lines of Python → run the walkthrough → answer from the code
One unit A 40–60 minute lab A 30–45 minute session
Example Run two BGP routers and watch UPDATE messages in tcpdump Read BGP best-path selection as a sequence of ordered if-statements

The default flow: run the protocol in a lab first, then read it as code when it hooks you. The reverse works too — reading the code first, then watching real packets confirm your mental model, is its own kind of satisfying.

If in doubt: the first twelve labs

Protocol Lab's labs 01–12 are a designed on-ramp: BGP (how routes spread) → RPKI (whether to believe them) → DNS (how names resolve) → TCP (what "delivered" means) → TLS (who you're talking to) → HTTP → QUIC → a finale that traces one web request through every layer. Two labs per weekend finishes it in six weeks.

The genre map

Past that point, navigate by genre, not by number. Both courses share the same genre structure:

  • Routing — labs on BGP/RPKI/OSPF/BFD/anycast/ECMP → code tracks bgp(15) → ospf(12) → rip(6) → rpki(5)
  • Names & trust — DNS/DNSSEC/DoT-DoH/DANE labs → dns(8) → dnssec(5) → tls(9)
  • Transport — TCP/congestion/PMTUD/QoS labs → tcp(11) → tcp2(6) → qos(5)
  • The web path — TLS/HTTP/QUIC/load-balancing labs → http-quic(10) → lb(6)
  • The local segment — DHCP/ARP/NDP/VLAN/IGMP labs → arp(4) → stp(5) → igmp(4)
  • Addresses & reachability — NAT/traceroute labs → dhcp(6) → nat(6) → ice(5) → icmp(5)
  • Time & liveness — ntp(4) → ha(4) (VRRP+BFD)
  • Foundations & finale — parser(5) (how bytes are read at all), meta(5) (see below)

Goal-based routes (intermediate course)

Web engineer — everything between fetch() and the server: dns → tcp → tls → http-quic → lb → tcp2 → meta (55 sessions). Afterwards you can decompose a slow request end to end: resolution, handshakes, head-of-line blocking, backend selection, TIME_WAIT pileups.

Infra / network engineer — the router-room route: parser → arp → dhcp → icmp → bgp → ospf → rip → rpki → stp → ha → meta (72 sessions). Pairs naturally with the corresponding containerlab labs.

Security-minded — parser → tls → dnssec → rpki → arp → nat → ice → meta (44 sessions). The recurring theme: what is signed versus what is merely believed — DNSSEC's INSECURE, RPKI's NOT_FOUND, ARP's unauthenticated cache. "No" comes in two flavors, and the difference is the design.

SRE / operations — tcp → tcp2 → lb → qos → ntp → ha → icmp → nat → igmp → meta (56 sessions). The recurring theme: silence means failure — the same inference tuned from BFD's 150 milliseconds to TCP keepalive's two hours.

Every route ends at "Same Shape"

The final track, Same Shape, Different Protocol, is the course's closing argument. It imports real code from across all the other tracks and shows the structures you've been reading all along: the expiring dict (a DNS cache, a TLS ticket store, a DHCP lease table, and a NAT conntrack table are the same code), election as a comparison function, tri-state verdicts, silence-as-failure across five orders of magnitude — and the fact that all 22 capstone "toy loops" share one skeleton.

You set out to learn 22 protocols. You actually learned one program, twenty-two times.

Getting started

# Beginner course (needs Docker + containerlab)
git clone https://github.com/pathvector-studio/protocol-lab
# → start at labs/bgp-01-as-prefix-announcement.md

# Intermediate course (needs only Python 3.10+)
git clone https://github.com/pathvector-studio/protocol-in-code
PYTHONPATH=src python3 examples/dns/session_04_walkthrough.py
# → pick your route in LEARNING_PATHS.md

The full lab-by-lab cross-reference table and route definitions live in each repo's LEARNING_PATHS.md; this post is the summary.

Both courses are free. If they help you, a ⭐️ on the repos goes a long way — and individual lab and session articles are being published here steadily.

Read more