NavSproutNavSprout / A home for good tools✳
Submit

INTERACTIVE LEARNING TOOL

Protocol Explorer · SSH

Explore internet protocols with animated messages, real arrival order and packet inspection.

Read the learning guides ↓
PROTOCOL EXPLORERLearn how the internet works
Now learningSSH · Secure remote accessOverview · 5 steps
Learning progress0%
0 / 14 complete · 0 in progress
Client192.168.1.10Router192.168.1.1InternetWeb Server203.0.113.10

Protocol overview

SSH

Active

Secure Shell

Establish an authenticated encrypted channel for a remote shell. Separate server identity verification, user authentication and channel multiplexing.

Layer
Security over transport
Default port
22
Transport
TCP
Data format
Version strings + encrypted packets
Defined in
RFC 4251, RFC 4253
Read the complete guide ↗

Packet flow

DNSTCPRequestResponse
No.TimeSourceDestinationProtocolInfoSize
10.000s192.168.1.10203.0.113.10SSHClient identification77 B
20.024s203.0.113.10192.168.1.10SSHServer identification79 B
30.048s192.168.1.10203.0.113.10SSHKEXINIT · conceptual payload87 B
40.072s203.0.113.10192.168.1.10SSHKey exchange reply · conceptual payload87 B
50.096s192.168.1.10203.0.113.10SSHNEWKEYS · conceptual payload60 B
60.120s192.168.1.10203.0.113.10SSHEncrypted user authentication · illustrative bytes102 B
70.144s192.168.1.10203.0.113.10SSHEncrypted channel open · illustrative bytes102 B

NAVSPROUT · PROTOCOL FIELD GUIDES

SSH, packet by packet.

Establish an authenticated encrypted channel for a remote shell. Separate server identity verification, user authentication and channel multiplexing.

PROTOCOL FIELD GUIDE

How SSH works

Establish an authenticated encrypted channel for a remote shell. Separate server identity verification, user authentication and channel multiplexing.

Default port
22
Transport / carrier
TCP
Category
security

1. Exchange identification

Client and server send SSH-2.0 version strings before binary packet negotiation. These initial identification strings are visible on the network.

2. Negotiate algorithms and keys

KEXINIT lists algorithm preferences. Key exchange establishes shared secrets, while a server host-key signature authenticates the exchange.

3. Verify the host key

A known-host entry or another trusted mechanism binds the key to a host. A changed key needs investigation before trust is established again.

4. Authenticate the user

After NEWKEYS, protected messages authenticate a user with a supported method such as a public key. Server verification and user login are separate checks.

5. Open channels

An encrypted connection can multiplex shell, exec and forwarding channels with separate channel IDs and flow control.

Protocol relationships

Protocols cooperate across layers. Compare the neighboring lessons to distinguish addressing, delivery, application semantics and encryption.

Standards and editorial method

Written and implemented independently by NavSprout. Lessons summarize public protocol standards using synthetic documentation addresses and fictional credentials. Consult the standards for complete wire formats and normative behavior.

RFC 4251 ↗ RFC 4253 ↗

Check your understanding

What does a server host key help authenticate?

Why it’s hereNAVSPROUT ORIGINAL

Reading definitions is easier when you can connect them to a packet. This first-party learning tool pairs static explanations with a visual lab, byte inspection and a short knowledge check. All course data and application resources ship with NavSprout.

  1. Choose DNS and follow the lookup from client to authoritative server.
  2. Switch to the sequence view, then inspect a packet and select a field to highlight its bytes.
  3. Compare TCP with UDP, answer the quiz and export your progress.

Frequently asked questions

What happens when I open a website?

A typical first HTTPS visit can involve DNS resolution, a transport connection, a TLS handshake and an HTTP exchange. Caches, connection reuse and HTTP/3 can change this sequence.

How are TCP and UDP different?

TCP presents a reliable ordered byte stream. UDP preserves individual datagram boundaries without built-in delivery guarantees. Applications choose the behavior they need.

Are these real captured packets?

No. Frames are generated locally for teaching. Header lengths and checksums are calculated, while TLS ciphertext and some negotiation payloads are illustrative. Downloaded PCAP files contain synthetic examples, not live traffic.

Can I learn without JavaScript or an account?

All 14 protocol guides and their lesson explanations are available as ordinary HTML without signing in. JavaScript powers animations, byte inspection, local progress and quizzes.

Where is my progress saved?

Only in this browser’s local storage. Export a progress JSON file to move it to another device. Clearing browser data can remove progress.

MAKE A THOUGHTFUL CHOICE

Your shortlist, side by side.

Pricing models are indicative. Check each official website for current plans and limits.