Send SYN, SYN-ACK, and ACK across two endpoints, predict which packet flips each side to `ESTABLISHED`, and read a real `tcpdump` capture line by line where each `ack` is the previous `seq` plus one.

`connect()` looks instant in your code, but the socket sits quiet for one round trip first, while two machines trade three small messages to agree on where each will start counting bytes.

Close each direction of a connection on its own, predict why only the active closer lingers in `TIME-WAIT`, and read the `FIN`, `RST`, and `CLOSE-WAIT` rows an abort or a leak leaves in `ss -tan`.

`ss -tan` can show a socket sitting idle for a minute or more after your program moved on, still holding its place so a late-arriving byte from the old conversation cannot land in a new one.

Meter the sender's in-flight bytes against a receive window that shrinks as the receiver's buffer fills, watch three duplicate acknowledgments fire a fast retransmit while a silent wire falls back to a doubling timer, and unshift a scaled `win` value off `tcpdump`.

`tcpdump` prints a line like `win 501` on nearly every acknowledgment, and that one number is a live ceiling: send past it and the receiver has nowhere to put the bytes, so the sender waits.

Strip TCP's twenty-byte header down to UDP's eight, trace a two-packet DNS exchange against TCP's setup-and-teardown, and decide which workloads go connectionless by weighing a resend's wait against a lost message's cost.

`dig example.com` answers in a single round trip: one packet out, one packet back, and the server holds nothing after it replies. The same fetch over a fresh TCP connection must set the link up before the request can leave.

Size a packet to the smallest link on its path, predict whether an oversize one splits into all-or-nothing fragments or bounces back a too-big report, and read TCP's `mss` as the handshake-time ceiling that avoids fragmentation, until a filtered report hangs the transfer.

`ping -M do -s 1472 example.com` goes through, but bump the size to `-s 1473` and it fails with "message too long": one byte past a limit set not by your machine, but by a link somewhere along the way.