Lion Cipher Lab
Trace one HTTPS request end to end: DNS, routing, TCP, TLS, HTTP
- Foundations
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Two very different rooms ask you the same question. The first is an interview room: "what happens when you type a URL into your browser and press Enter?" is the most-asked technical question in the industry, and it is asked precisely because it has no bottom — a nervous candidate says "it loads the website," a good one walks calmly from name resolution through routing, TCP, TLS, HTTP and rendering, and pauses at each layer to say what could go wrong there. The second room is on-call at 2am, where someone has just said "the site is slow" or "the site is down," and the only thing standing…
What you'll learn
- following one request through every network layer
- watching DNS delegation with dig +trace (and Resolve-DnsName on Windows)
- reading a traceroute honestly, including what it cannot tell you
- recognising the TCP three-way handshake in a live packet capture
- reading a TLS handshake: SNI, certificate chain, negotiated version and cipher
- reading curl -v as a full-stack trace of one request
- breaking a request into per-layer timings with curl -w
- bisecting 'it's slow' and 'it's broken' by layer
- mapping symptoms (NXDOMAIN, RST, timeout, 502, 504) to causes
- knowing which layer a defender actually has telemetry for
Steps in this lab
- The question everyone gets asked — and the map you need to answer it
- Layer 1 — name resolution: watch DNS walk down from the root
- Layer 2 — getting there: the hops between you and the address
- Layer 3 — the TCP connection: three packets, and two very different failures
- Layer 4 — the TLS handshake: agreeing on keys and checking who you are talking to
- Layer 5 — the HTTP exchange, and the punchline: curl -v shows you all of it at once
- Put a stopwatch on it: which layer actually costs the milliseconds?
- The judgment step: "it's slow" / "it's broken" — how a professional bisects it
- The defender's view: which layer actually has evidence
- What you actually learned — and how to say it out loud