Send SYN, SYN-ACK, and ACK across two endpoints, predict which packet flips each side to ESTABLISHED, and read a real tcpdump capture line by line where each ack is the previous seq plus one.

connect() looks instant in your code, but the socket sits quiet for one round trip first, while two machines trade three small messages to agree on where each will start counting bytes.

Close each direction of a connection on its own, predict why only the active closer lingers in TIME-WAIT, and read the FIN, RST, and CLOSE-WAIT rows an abort or a leak leaves in ss -tan.

ss -tan can show a socket sitting idle for a minute or more after your program moved on, still holding its place so a late-arriving byte from the old conversation cannot land in a new one.

Meter the sender's in-flight bytes against a receive window that shrinks as the receiver's buffer fills, watch three duplicate acknowledgments fire a fast retransmit while a silent wire falls back to a doubling timer, and unshift a scaled win value off tcpdump.

tcpdump prints a line like win 501 on nearly every acknowledgment, and that one number is a live ceiling: send past it and the receiver has nowhere to put the bytes, so the sender waits.

Strip TCP's twenty-byte header down to UDP's eight, trace a two-packet DNS exchange against TCP's setup-and-teardown, and decide which workloads go connectionless by weighing a resend's wait against a lost message's cost.

dig example.com answers in a single round trip: one packet out, one packet back, and the server holds nothing after it replies. The same fetch over a fresh TCP connection must set the link up before the request can leave.

Size a packet to the smallest link on its path, predict whether an oversize one splits into all-or-nothing fragments or bounces back a too-big report, and read TCP's mss as the handshake-time ceiling that avoids fragmentation, until a filtered report hangs the transfer.

ping -M do -s 1472 example.com goes through, but bump the size to -s 1473 and it fails with "message too long": one byte past a limit set not by your machine, but by a link somewhere along the way.