Computer A opens https://zttechacademy.com. These are the real bytes of the frames it sends and receives, in order.
A frame is the unit of data that actually travels on an Ethernet network. This lab shows the real bytes of each frame a computer sends to reach a website: first ARP to find the gateway, then DNS to find the address, then the start of the TCP connection. Every byte belongs to a field in a protocol header, and the colors show which layer it belongs to.
Why it matters. Packet captures in Wireshark show exactly these bytes. Being able to read them is how engineers prove what the network is really doing.
How to use this lab. Tap bytes in the dump or fields in the list to see what they mean, step through with the field buttons, or press Transmit to watch a frame go out byte by byte.
Where it fits. It pairs with Packet Journey (the layers) and with the Handshake lab, which looks closely at frames 5 to 7.
The MAC addresses and the server address 203.0.113.5 are made-up examples (203.0.113.0/24 is reserved for documentation). The real zttechacademy.com resolves to a different IP. Every frame is shown as captured at Computer A’s network card. Capture tools such as Wireshark usually hide the preamble, the padding and the FCS, because the network card adds and removes them.