Watch the internet work, one packet at a time.
Protocol Explorer is an interactive network protocol visualizer. Pick a protocol, press play, and the packets move between a client, a router, a DNS resolver and a server while a capture table stays in sync with the animation. Click any packet and Protocol Explorer decodes its headers byte by byte — Ethernet, IPv4, TCP, TLS — so the field you read about in a textbook is the field you can point at on screen.
The library covers 33 protocols across four categories: core transport, application, security, and the plumbing that holds networks together. Four of them — HTTP, HTTPS, TCP and UDP — are free, including the overview and the first three steps of each exchange. Everything else belongs to Protocol Explorer Pro, a one-time $4.99 pass.
| Access | What is included | Price and account |
|---|---|---|
| Free | All 33 protocol overviews; full lessons for HTTP, HTTPS, TCP and UDP; the first three steps of each free lesson. | $0. No account is needed to read overviews or follow the four free lessons. |
| Protocol Explorer Pro | All 33 full lessons, every exchange step and the complete byte-level packet inspector. | $4.99 once, with no subscription. An account is required to buy Pro and restore the licence across devices. |
See the pricing page for the complete Free and Pro comparison, or follow the packet reading guide to put these protocols in context.
TCP handshake · UDP datagrams · HTTP requests and responses · HTTPS and TLS
Play, pause, step forward or replay at half or double speed. Every lesson is four to seven events long, and each event explains one message.
The inspector splits a frame into its protocol layers, labels every field, and marks which bytes the lesson cannot show because they are encrypted or random.
Network view shows who is talking to whom. Sequence view stacks the participants and orders the messages, which is the layout you want before an interview.
Protocol Explorer keeps lesson progress in this browser. Your Pro licence can be restored by signing in on another device.
The directory below describes the subject of each lesson, not a live network capture. Each scenario is a simplified, scripted teaching example; the linked specification is the authority for protocol behavior.
| Protocol | What the lesson explains | Primary source |
|---|---|---|
| HTTP | Client requests, server responses, methods, status codes and headers. | RFC 9110; RFC 9112 |
| HTTPS | HTTP carried through a TLS-protected connection. | RFC 9110; RFC 8446 |
| WebSocket | A persistent, two-way message channel between a client and server. | RFC 6455 |
| WebRTC | Browser real-time media and data connections negotiated between peers. | RFC 8825; RFC 8831 |
| QUIC | Secure, multiplexed transport over UDP, used by HTTP/3. | RFC 9000; RFC 9114 |
| TCP | Connection setup, ordered byte streams, acknowledgements and retransmissions. | RFC 9293 |
| UDP | Lightweight datagrams without built-in delivery or ordering guarantees. | RFC 768 |
| IP | Packet addressing and forwarding across interconnected networks. | RFC 791 |
| BGP | Route exchange between autonomous systems on the internet. | RFC 4271 |
| IPv6 | 128-bit addressing, packet headers and neighbor discovery. | RFC 8200; RFC 4861 |
| DNS | Name resolution and the resource records returned by DNS servers. | RFC 1034; RFC 1035 |
| DNS over HTTPS | DNS queries and responses transported through HTTPS. | RFC 8484 |
| DNSSEC | DNS signatures that let resolvers validate signed DNS data. | RFC 4033 |
| DHCP | Dynamic leases for host IP addresses and network configuration. | RFC 2131 |
| ICMP | Network-layer error reports and diagnostic messages. | RFC 792 |
| NTP | Clock synchronization using timestamps and network delay estimates. | RFC 5905 |
| Wi-Fi | Wireless LAN association and the exchange needed to join a network. | IEEE 802.11 |
| WPA3 | Modern Wi-Fi authentication and link security. | Wi-Fi Alliance |
| RADIUS | Centralized authentication and configuration for network access. | RFC 2865 |
| Captive Portal | Network access that is gated until a user completes sign-in. | RFC 8908; RFC 8910 |
| SMTP | Mail transfer between sending and receiving mail systems. | RFC 5321 |
| POP3 | Retrieval of messages from a mail server. | RFC 1939 |
| IMAP | Remote access to mailbox folders, messages and flags. | RFC 9051 |
| FTP | File transfer using separate control and data connections. | RFC 959 |
| SMB | File and print sharing between networked computers. | Microsoft MS-SMB2 |
| SSH | Secure remote login and other protected network operations. | RFC 4251 |
| TLS/SSL | TLS authentication and encryption; SSL is a legacy predecessor. | RFC 8446 |
| HTTP Proxy | Forwarded HTTP requests and CONNECT tunnels. | RFC 9110 |
| SOCKS5 | Proxy negotiation and relaying TCP or UDP traffic. | RFC 1928 |
| Reverse Proxy | An intermediary that receives client requests and forwards them upstream. | HTTP Semantics, RFC 9110 |
| WireGuard | Authenticated, encrypted tunnels for IP traffic. | WireGuard protocol |
| IPsec | IP-layer security associations and authenticated or encrypted packets. | RFC 4301 |
| Modbus | Industrial device request and response messages over serial or TCP links. | Modbus Organization specification |
Students meeting TCP/IP for the first time, engineers preparing for interviews, backend developers who want to stop guessing what a timeout means, and instructors who need a diagram that actually moves. Protocol Explorer is a teaching model, not a packet analyser: use it to build the mental picture, then go read the RFC or open a real capture.