DHCP, ARP, NAT and routing

A home network in miniature, running in this page: three hosts on a learning switch, a DHCP server, a router with NAT and a second subnet with a server behind it, an ISP router, and two machines on the internet. Every frame is a labelled dot crossing a wire, and every frame is real enough to save as a packet capture. Two more tabs do the same for routing protocols: link state with Dijkstra’s algorithm, distance vector with its famous failure, and BGP between autonomous systems. Nothing here talks to a real network.

For the addresses themselves — masks, ranges, splitting a network — use the IP subnet calculator. For what happens above IP, see TCP, simulated and TLS 1.3 and QUIC handshakes; for names, DNS lookup.

How to use it

Pick a scenario and press Start. Each step does something — boots a host, sends a ping, adds a route — then plays until it has happened and pauses so you can read what happened and why, with links to the RFC section. Next step moves on, Back rewinds (the simulation is deterministic, so it replays the earlier steps), ⏭ jumps to the end of a step and Step ⇥ advances to the next single event. Space plays and pauses; → is the next step. Hop time sets how long a frame takes to cross a wire on screen; it never changes what happens. ⛶ Full screen (or f) gives the diagram the whole window.

DHCP, ARP and NAT has six scenarios:

DHCP: DISCOVER, OFFER, REQUEST and ACK, a second client, a renewal at T1 (a unicast REQUEST, after an ARP for the server), a pool that runs out, and a returning client getting its old address back. The DHCP panel shows the lease table and decodes the last DHCP message — op, xid, flags, ciaddr, yiaddr, chaddr and every option (53 message type, 54 server identifier, 51 lease time, 1 mask, 3 router, 6 DNS, 58 and 59 T1/T2, 50 requested address, 55 parameter list, 12 host name).
ARP and the learning switch: the ARP request flooded by the switch, the reply sent only to one port, the second ping with no ARP, unknown-unicast flooding after the switch forgets a MAC, and ARP entries ageing out. The timers are shortened so the waits are bearable.
A ping through NAT: the default gateway, the router’s lookup, the source rewritten to the outside address with a new identifier, the reply translated back; two hosts using the same ICMP identifier getting outside "ports" 1024 and 1025; mappings timing out; and what happens without NAT (the reply has nowhere to go).
Port forwarding: an outside SYN dropped, then a rule sending TCP 8080 to the inside server’s port 80 and the handshake completing.
Longest-prefix match: a blackhole /24 that beats the default route, then a /32 host route that beats the /24. The Route lookup panel lists every route for any destination you type, marks the ones that contain it and the winner. Open in subnet calculator opens the subnet calculator's Contains tab with the router’s prefixes and your address.
Playground: your own network, no script. Edit it in Edit the network under the event log — the LAN and second-subnet prefixes, the WAN address, NAT on or off, the DHCP pool and lease time, up to six hosts (DHCP or a static address), static routes (to a next hop or a blackhole) and port forwards — then Apply and open the Playground.

Tap a host to run DHCP, renew or release, ping anything, or open a TCP connection; tap the router to turn NAT off; tap the switch to make it forget. The panels show the NAT table, every ARP cache and the switch’s MAC table with their timers counting down, and the last frames in plain words. Download .pcap (in Do something) saves every frame a host or router has sent so far as a classic libpcap file that Wireshark, tcpdump -r and the site’s packet capture viewer open: Ethernet, ARP, IPv4, ICMP echo, UDP/DHCP and TCP with correct checksums. It is one merged capture of all the wires (frames on the outside carry the translated addresses); frames the switch only passes on are not repeated. Open in packet viewer opens the same capture straight in the packet capture viewer in a new tab, without saving a file.

Routing protocols has a link-state scenario — every router floods its LSA, then runs Dijkstra step by step (permanent routers green, tentative ones amber with their distance, the tree in bold; the panel lists every step and every relaxed link), a link fails, a cost changes — and two distance-vector ones: RIP counting to infinity after a failure, and the same failure with split horizon, poison reverse and triggered updates. The playground uses your topology: one link per line as A-B 4 in Edit the topology.

BGP has five scenarios on a tiny internet: AS400 announcing 192.0.2.0/24, our AS65001 with two routers (R1, R2) and two providers (AS200, AS300). Routes arrive and AS_PATH loops are rejected; LOCAL_PREF chooses our exit; MED from AS200 picks one of its two links (compared only between routes from the same AS); AS-path prepending moves the traffic coming in; a session failure withdraws a route and everyone reroutes. The Decision process panel shows every candidate and the tie-breakers in order, with the reason each route was eliminated. Tap a router or AS to set LOCAL_PREF, weight, MED and prepending, or take a session down.

The page works in any current browser, at phone width too. A share link carries the scenario and step, your network and topology, and the settings.

What it models

DHCP (RFC 2131, options RFC 2132). The client state machine (INIT, SELECTING, REQUESTING, BOUND, RENEWING, REBINDING) with retransmitted DISCOVERs, T1 and T2 timers and lease expiry; the broadcast flag deciding whether the server broadcasts or unicasts straight to chaddr and yiaddr (§4.1); a server that offers a returning client its previous address, else the requested one, else the lowest unused, holds offers briefly, and NAKs requests it cannot honour. Not modelled: relay agents (the router does not forward DHCP), DECLINE after an ARP probe, INFORM.
ARP (RFC 826). Requests broadcast, replies unicast, the target caching the sender from the request, existing entries refreshed by any ARP seen, three retries a second apart before the queued packets are dropped, and entries expiring.
The switch (IEEE 802.1D §7.8): learns source MACs per port, forwards known unicast, floods broadcasts and unknown unicast, filters frames for the port they came from, ages entries out.
Routing (RFC 1812 §5.2.4.3): the longest matching prefix, then the lower metric, then the first in the table; TTL decremented at each router; blackhole routes; no route means a drop. Routers never forward broadcasts.
NAT (RFC 3022, RFC 4787). Network address and port translation with endpoint-independent mapping (one inside address and port keeps its outside port whoever it talks to), outside ports handed out from 1024, address-dependent filtering (only a remote the inside host has sent to may answer), the ICMP echo identifier used as the port (RFC 5508), per-protocol timeouts, and static port forwards whose replies are translated back. Hairpinning, ALGs and ICMP error translation are not modelled.
Link state (OSPF-like, RFC 2328). One router-LSA per router with a sequence number, flooded to every neighbour except the sender and not re-flooded if not newer (§13); SPF held back briefly after the last LSA; Dijkstra with the two-way check (a link counts only if both ends list it, §16.1); ties broken by the smaller name, equal-cost alternatives noted. One area, no hellos, DR election, acknowledgements or ageing.
Distance vector (RIP, RFC 2453): periodic updates, a metric of hops capped at 16, a router always believing its current next hop (§3.9.2), split horizon, poisoned reverse and triggered updates (§3.4), and an interface failure noticed at once.
BGP (RFC 4271). UPDATEs and WITHDRAWs, AS_PATH prepending and loop rejection, next-hop-self on eBGP, LOCAL_PREF carried over iBGP, no re-advertising iBGP routes to iBGP peers, MED sent per session, and the decision process: weight (a Cisco extension), LOCAL_PREF, locally originated, AS_PATH length, ORIGIN, MED (same neighbour AS only), eBGP over iBGP, IGP cost to the next hop, lowest router ID (§9.1.2.2). Our AS gives no transit between its providers. No MRAI timer, communities, route reflectors or damping.

Times are simulated: a link inside the house takes 10 ms, a WAN link 30 ms, so that you can follow them; the timers (leases, ARP and NAT lifetimes) are in simulated seconds, and the scenarios shorten some of them.

Privacy

Everything runs in your browser. Nothing is sent anywhere: the network, the frames and the capture file exist only in this page. Your edited network and settings are kept in this browser’s local storage, and in a share link only if you make one.

Works with

How to use it

What it models

Privacy