Blue Team · Fundamentals
Ordinary actions.
Every hidden system.
Start with a website, a power button, Wi-Fi, an email or a network file. Follow the hardware, processes, messages and evidence underneath.
Choose the action you recognise
From URL to Pixels
Follow a browser navigation from the address bar through name resolution, network transport, web infrastructure and the rendering pipeline.
Open the system →Journey 02 · 14 chaptersFrom Power Button to Desktop
Follow electrical reset, firmware, trusted boot, kernel start, network readiness and Windows sign-in until Explorer owns the interactive desktop.
Open the system →Journey 03 · 11 chaptersFrom Wi-Fi to VPN
Follow a Windows device from radio discovery and Wi-Fi authentication through IP configuration, VPN policy, tunnel keys and protected application traffic.
Open the system →Journey 04 · 11 chaptersFrom Send to Inbox
Follow a message from the compose window through MIME construction, authenticated submission, DNS routing, filtering, mailbox storage and recipient synchronisation.
Open the system →Journey 05 · 10 chaptersFrom Network Path to Open File
Follow a UNC path through the Windows redirector, name resolution, SMB negotiation, authentication, authorisation, caching and file I/O.
Open the system →Browse by system plane or OSI layer
Local stages stay outside OSI. Network stages can appear under several layers because one action crosses a stack.
Local only: not an OSI operation
See how the browser interprets address-bar input, parses a URL and starts a cross-document navigation.
From URL to PixelsBrowser state, cache and policyUnderstand the local decisions that can satisfy, alter or stop a request before a new network connection exists.
From URL to PixelsBrowser rendering pipelineTurn streamed HTML, CSS, scripts and images into layout, paint records, rasterised tiles and composed pixels.
From Power Button to DesktopPower, reset and the CPU reset vectorTrace the electrical and processor state changes that move a PC from mechanical power-off to its first firmware instruction.
From Power Button to DesktopUEFI, POST and device enumerationSee how UEFI discovers memory and devices, executes early diagnostics and builds the firmware view of the machine.
From Power Button to DesktopTPM measured boot and Secure BootSeparate signature enforcement from measurement and follow the evidence that forms the platform boot trust chain.
From Power Button to DesktopBoot manager and operating-system loaderFollow UEFI from its boot entry into Windows Boot Manager and the loader that prepares the kernel image.
From Power Button to DesktopKernel initialisation and memory managementSee how ntoskrnl.exe takes ownership of processors, virtual memory, interrupts, objects and the first system processes.
From Power Button to DesktopDrivers, Plug and Play, storage and filesystemsTrace how Windows binds devices to drivers, mounts volumes and makes the system disk available through the I/O stack.
From Power Button to DesktopWindows session and service startupFollow smss.exe, csrss.exe, wininit.exe and services.exe as Windows creates sessions and starts configured services.
From Power Button to DesktopCredential Provider, Winlogon and secure attention sequenceFollow Ctrl+Alt+Delete, LogonUI and the credential provider boundary before authentication reaches LSASS.
From Send to InboxCompose, draft and local stateSee how an email client represents recipients, body content and attachments before any submission starts.
From Send to InboxMessage format, MIME and attachmentsOpen the message envelope and content tree that turn rich text, alternative bodies and files into Internet Message Format bytes.
From Network Path to Open FilePath parsing, UNC paths and DFSSee how Windows separates a local path, a UNC server-share path and a DFS namespace before network I/O begins.
From Network Path to Open FileClient redirector, VFS and local cacheTrace a file open from the Windows I/O Manager through the SMB redirector and Client-Side Caching decisions.
OSI Layer 1
Follow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link.
From Power Button to DesktopNetwork interface and link readinessSee how the NIC driver, NDIS and link technology move an interface from discovered hardware to a usable local link.
From Wi-Fi to VPNWireless hardware, driver and radioTrace a Wi-Fi request from the Windows WLAN service through NDIS and the adapter into a selected radio channel.
From Wi-Fi to VPNScanning, beacon and probe framesCompare passive beacon listening with active probe exchanges and inspect the information elements that describe a wireless network.
From Wi-Fi to VPN802.11 authentication and associationFollow the management-frame exchange that creates a Wi-Fi link before WPA or IP configuration completes.
From Network Path to Open FileRouting, transport and port 445Trace the selected file server through route lookup, neighbour resolution and TCP connection establishment to SMB Direct Hosting.
OSI Layer 2
Follow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link.
From Power Button to DesktopNetwork interface and link readinessSee how the NIC driver, NDIS and link technology move an interface from discovered hardware to a usable local link.
From Power Button to DesktopIP addressing, routes and neighbour discoveryFollow DHCP or IPv6 autoconfiguration into address selection, routing-table state and the local next-hop mapping.
From Wi-Fi to VPNWireless hardware, driver and radioTrace a Wi-Fi request from the Windows WLAN service through NDIS and the adapter into a selected radio channel.
From Wi-Fi to VPNScanning, beacon and probe framesCompare passive beacon listening with active probe exchanges and inspect the information elements that describe a wireless network.
From Wi-Fi to VPN802.11 authentication and associationFollow the management-frame exchange that creates a Wi-Fi link before WPA or IP configuration completes.
From Wi-Fi to VPNWPA2, WPA3 and key establishmentSee how personal Wi-Fi turns a passphrase or SAE exchange into per-session keys and protected data frames.
From Wi-Fi to VPN802.1X, EAP and RADIUSFollow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server.
From Wi-Fi to VPNIPv4 and IPv6 configurationTrace DHCP, router advertisements and duplicate-address checks into a usable dual-stack interface.
From Wi-Fi to VPNARP, neighbour discovery, routing and DNSFollow an application name from resolver choice through route selection and next-hop link-layer resolution.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Wi-Fi to VPNTunnel traffic, DNS, MTU and evidenceOpen the nested packet, route and resolver state that governs traffic after the VPN connects.
From Network Path to Open FileRouting, transport and port 445Trace the selected file server through route lookup, neighbour resolution and TCP connection establishment to SMB Direct Hosting.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
OSI Layer 3
Follow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link.
From URL to PixelsNetwork path and enterprise controlsCompare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network.
From Power Button to DesktopIP addressing, routes and neighbour discoveryFollow DHCP or IPv6 autoconfiguration into address selection, routing-table state and the local next-hop mapping.
From Power Button to DesktopDNS, time and domain-controller locationTrace the DNS SRV lookups, site awareness and time checks a domain member uses before authentication.
From Power Button to DesktopMachine account and secure channelSee how a domain member proves its computer identity and maintains the Netlogon secure channel used by domain operations.
From Power Button to DesktopLSASS authentication and access-token creationTrace local, Microsoft-account and domain credentials through authentication packages into a Windows logon session and access token.
From Power Button to DesktopUser profile, Group Policy and desktop shellFollow userinit.exe through profile loading, policy processing, logon scripts and the launch of explorer.exe.
From Wi-Fi to VPN802.1X, EAP and RADIUSFollow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server.
From Wi-Fi to VPNIPv4 and IPv6 configurationTrace DHCP, router advertisements and duplicate-address checks into a usable dual-stack interface.
From Wi-Fi to VPNARP, neighbour discovery, routing and DNSFollow an application name from resolver choice through route selection and next-hop link-layer resolution.
From Wi-Fi to VPNCaptive portals and connectivity checksSee how Windows distinguishes local Wi-Fi association from Internet access and how a portal redirects unauthenticated clients.
From Wi-Fi to VPNVPN identity, policy and route selectionTrace a VPN profile from user or device identity through policy checks into full-tunnel or split-tunnel route intent.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Wi-Fi to VPNTunnel traffic, DNS, MTU and evidenceOpen the nested packet, route and resolver state that governs traffic after the VPN connects.
From Send to InboxMailbox session, identity and OAuthTrace a modern mail client from cached account state through token acquisition to an authorised mailbox session.
From Send to InboxSubmission-service discoverySee how a client finds the right mailbox or SMTP submission endpoint before it sends message content.
From Send to InboxSMTP submission, TLS and authenticationFollow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server.
From Send to InboxQueues, DNS MX and recipient routingTrace an accepted message through queue selection, recipient-domain lookup and next-hop calculation.
From Send to InboxServer-to-server SMTP and transport securityFollow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy.
From Send to InboxSPF, DKIM and DMARCSeparate source authorisation, message signatures and domain-alignment policy during receiving-mail evaluation.
From Send to InboxSynchronisation, notifications, rendering and evidenceTrace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation.
From Network Path to Open FileName resolution, site and server discoveryFollow a UNC hostname or DFS namespace through DNS, suffix search, Active Directory site logic and referral selection.
From Network Path to Open FileRouting, transport and port 445Trace the selected file server through route lookup, neighbour resolution and TCP connection establishment to SMB Direct Hosting.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
OSI Layer 4
Compare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network.
From URL to PixelsTCP or QUIC transportCompare TCP connection establishment with QUIC over UDP, including reliability, multiplexing, reuse and fallback.
From URL to PixelsEdge, origin and application processingFollow a request through CDN, WAF, reverse proxy, load balancer, web server, application, cache and database components.
From Power Button to DesktopDNS, time and domain-controller locationTrace the DNS SRV lookups, site awareness and time checks a domain member uses before authentication.
From Power Button to DesktopMachine account and secure channelSee how a domain member proves its computer identity and maintains the Netlogon secure channel used by domain operations.
From Power Button to DesktopLSASS authentication and access-token creationTrace local, Microsoft-account and domain credentials through authentication packages into a Windows logon session and access token.
From Power Button to DesktopUser profile, Group Policy and desktop shellFollow userinit.exe through profile loading, policy processing, logon scripts and the launch of explorer.exe.
From Wi-Fi to VPN802.1X, EAP and RADIUSFollow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server.
From Wi-Fi to VPNCaptive portals and connectivity checksSee how Windows distinguishes local Wi-Fi association from Internet access and how a portal redirects unauthenticated clients.
From Wi-Fi to VPNVPN identity, policy and route selectionTrace a VPN profile from user or device identity through policy checks into full-tunnel or split-tunnel route intent.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Wi-Fi to VPNTunnel traffic, DNS, MTU and evidenceOpen the nested packet, route and resolver state that governs traffic after the VPN connects.
From Send to InboxMailbox session, identity and OAuthTrace a modern mail client from cached account state through token acquisition to an authorised mailbox session.
From Send to InboxSubmission-service discoverySee how a client finds the right mailbox or SMTP submission endpoint before it sends message content.
From Send to InboxSMTP submission, TLS and authenticationFollow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server.
From Send to InboxQueues, DNS MX and recipient routingTrace an accepted message through queue selection, recipient-domain lookup and next-hop calculation.
From Send to InboxServer-to-server SMTP and transport securityFollow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy.
From Send to InboxSPF, DKIM and DMARCSeparate source authorisation, message signatures and domain-alignment policy during receiving-mail evaluation.
From Send to InboxSynchronisation, notifications, rendering and evidenceTrace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation.
From Network Path to Open FileName resolution, site and server discoveryFollow a UNC hostname or DFS namespace through DNS, suffix search, Active Directory site logic and referral selection.
From Network Path to Open FileRouting, transport and port 445Trace the selected file server through route lookup, neighbour resolution and TCP connection establishment to SMB Direct Hosting.
From Network Path to Open FileSMB negotiation, signing and encryptionInspect SMB2 NEGOTIATE fields, dialect choice, capabilities and pre-authentication protection before user authentication.
From Network Path to Open FileSession setup, SPNEGO, Kerberos and NTLMFollow SMB SESSION_SETUP through protocol negotiation into Kerberos service-ticket or NTLM challenge-response authentication.
From Network Path to Open FileFile open, leases, oplocks, I/O and closeTrace SMB CREATE through durable handles, caching leases, reads, writes, flushes and final close semantics.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
OSI Layer 5
Follow TLS 1.3 from ClientHello through certificate validation, key establishment, ALPN and protected application data.
From Power Button to DesktopMachine account and secure channelSee how a domain member proves its computer identity and maintains the Netlogon secure channel used by domain operations.
From Power Button to DesktopLSASS authentication and access-token creationTrace local, Microsoft-account and domain credentials through authentication packages into a Windows logon session and access token.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Send to InboxMailbox session, identity and OAuthTrace a modern mail client from cached account state through token acquisition to an authorised mailbox session.
From Send to InboxSMTP submission, TLS and authenticationFollow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server.
From Send to InboxServer-to-server SMTP and transport securityFollow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy.
From Send to InboxSynchronisation, notifications, rendering and evidenceTrace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation.
From Network Path to Open FileSMB negotiation, signing and encryptionInspect SMB2 NEGOTIATE fields, dialect choice, capabilities and pre-authentication protection before user authentication.
From Network Path to Open FileSession setup, SPNEGO, Kerberos and NTLMFollow SMB SESSION_SETUP through protocol negotiation into Kerberos service-ticket or NTLM challenge-response authentication.
From Network Path to Open FileTree connect, shares and namespacesSee how an authenticated SMB session attaches to a named share and turns a relative path into a server-side namespace.
From Network Path to Open FileFile open, leases, oplocks, I/O and closeTrace SMB CREATE through durable handles, caching leases, reads, writes, flushes and final close semantics.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
OSI Layer 6
Trace a modern mail client from cached account state through token acquisition to an authorised mailbox session.
From Send to InboxSMTP submission, TLS and authenticationFollow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server.
From Send to InboxServer-to-server SMTP and transport securityFollow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy.
From Send to InboxSynchronisation, notifications, rendering and evidenceTrace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation.
From Network Path to Open FileSMB negotiation, signing and encryptionInspect SMB2 NEGOTIATE fields, dialect choice, capabilities and pre-authentication protection before user authentication.
From Network Path to Open FileSession setup, SPNEGO, Kerberos and NTLMFollow SMB SESSION_SETUP through protocol negotiation into Kerberos service-ticket or NTLM challenge-response authentication.
OSI Layer 7
Trace a hostname through local caches, resolvers, recursive queries and authoritative answers without assuming every lookup uses port 53.
From URL to PixelsNetwork path and enterprise controlsCompare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network.
From URL to PixelsTLS and certificate validationFollow TLS 1.3 from ClientHello through certificate validation, key establishment, ALPN and protected application data.
From URL to PixelsHTTP request and responseRead the same HTTP semantics across text-based HTTP/1.1, framed HTTP/2 and QUIC-carried HTTP/3.
From URL to PixelsEdge, origin and application processingFollow a request through CDN, WAF, reverse proxy, load balancer, web server, application, cache and database components.
From URL to PixelsNavigation commit and security boundariesSee how the browser accepts a response, chooses a renderer, commits a document and enforces origin and process boundaries.
From Power Button to DesktopIP addressing, routes and neighbour discoveryFollow DHCP or IPv6 autoconfiguration into address selection, routing-table state and the local next-hop mapping.
From Power Button to DesktopDNS, time and domain-controller locationTrace the DNS SRV lookups, site awareness and time checks a domain member uses before authentication.
From Power Button to DesktopMachine account and secure channelSee how a domain member proves its computer identity and maintains the Netlogon secure channel used by domain operations.
From Power Button to DesktopLSASS authentication and access-token creationTrace local, Microsoft-account and domain credentials through authentication packages into a Windows logon session and access token.
From Power Button to DesktopUser profile, Group Policy and desktop shellFollow userinit.exe through profile loading, policy processing, logon scripts and the launch of explorer.exe.
From Wi-Fi to VPN802.1X, EAP and RADIUSFollow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server.
From Wi-Fi to VPNIPv4 and IPv6 configurationTrace DHCP, router advertisements and duplicate-address checks into a usable dual-stack interface.
From Wi-Fi to VPNARP, neighbour discovery, routing and DNSFollow an application name from resolver choice through route selection and next-hop link-layer resolution.
From Wi-Fi to VPNCaptive portals and connectivity checksSee how Windows distinguishes local Wi-Fi association from Internet access and how a portal redirects unauthenticated clients.
From Wi-Fi to VPNVPN identity, policy and route selectionTrace a VPN profile from user or device identity through policy checks into full-tunnel or split-tunnel route intent.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Wi-Fi to VPNTunnel traffic, DNS, MTU and evidenceOpen the nested packet, route and resolver state that governs traffic after the VPN connects.
From Send to InboxMailbox session, identity and OAuthTrace a modern mail client from cached account state through token acquisition to an authorised mailbox session.
From Send to InboxSubmission-service discoverySee how a client finds the right mailbox or SMTP submission endpoint before it sends message content.
From Send to InboxSMTP submission, TLS and authenticationFollow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server.
From Send to InboxQueues, DNS MX and recipient routingTrace an accepted message through queue selection, recipient-domain lookup and next-hop calculation.
From Send to InboxServer-to-server SMTP and transport securityFollow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy.
From Send to InboxSPF, DKIM and DMARCSeparate source authorisation, message signatures and domain-alignment policy during receiving-mail evaluation.
From Send to InboxGateway filtering, scanning and sandboxingTrace message, attachment and URL evidence through layered mail-security decisions before mailbox delivery.
From Send to InboxMailbox delivery, storage and indexingFollow the accepted message into mailbox folders, metadata tables, quotas and search indexes.
From Send to InboxSynchronisation, notifications, rendering and evidenceTrace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation.
From Network Path to Open FileName resolution, site and server discoveryFollow a UNC hostname or DFS namespace through DNS, suffix search, Active Directory site logic and referral selection.
From Network Path to Open FileSMB negotiation, signing and encryptionInspect SMB2 NEGOTIATE fields, dialect choice, capabilities and pre-authentication protection before user authentication.
From Network Path to Open FileSession setup, SPNEGO, Kerberos and NTLMFollow SMB SESSION_SETUP through protocol negotiation into Kerberos service-ticket or NTLM challenge-response authentication.
From Network Path to Open FileTree connect, shares and namespacesSee how an authenticated SMB session attaches to a named share and turns a relative path into a server-side namespace.
From Network Path to Open FileAccess tokens, share permissions and ACLsFollow an SMB request through share checks, NTFS security descriptors and the effective access decision.
From Network Path to Open FileFile open, leases, oplocks, I/O and closeTrace SMB CREATE through durable handles, caching leases, reads, writes, flushes and final close semantics.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
System: Bootloader
System: Firmware
Trace the electrical and processor state changes that move a PC from mechanical power-off to its first firmware instruction.
From Power Button to DesktopUEFI, POST and device enumerationSee how UEFI discovers memory and devices, executes early diagnostics and builds the firmware view of the machine.
From Power Button to DesktopTPM measured boot and Secure BootSeparate signature enforcement from measurement and follow the evidence that forms the platform boot trust chain.
From Power Button to DesktopBoot manager and operating-system loaderFollow UEFI from its boot entry into Windows Boot Manager and the loader that prepares the kernel image.
System: Hardware
Turn streamed HTML, CSS, scripts and images into layout, paint records, rasterised tiles and composed pixels.
From Power Button to DesktopPower, reset and the CPU reset vectorTrace the electrical and processor state changes that move a PC from mechanical power-off to its first firmware instruction.
From Power Button to DesktopUEFI, POST and device enumerationSee how UEFI discovers memory and devices, executes early diagnostics and builds the firmware view of the machine.
From Power Button to DesktopTPM measured boot and Secure BootSeparate signature enforcement from measurement and follow the evidence that forms the platform boot trust chain.
From Power Button to DesktopNetwork interface and link readinessSee how the NIC driver, NDIS and link technology move an interface from discovered hardware to a usable local link.
From Wi-Fi to VPNWireless hardware, driver and radioTrace a Wi-Fi request from the Windows WLAN service through NDIS and the adapter into a selected radio channel.
From Wi-Fi to VPNScanning, beacon and probe framesCompare passive beacon listening with active probe exchanges and inspect the information elements that describe a wireless network.
From Wi-Fi to VPN802.11 authentication and associationFollow the management-frame exchange that creates a Wi-Fi link before WPA or IP configuration completes.
From Wi-Fi to VPNWPA2, WPA3 and key establishmentSee how personal Wi-Fi turns a passphrase or SAE exchange into per-session keys and protected data frames.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Network Path to Open FileRouting, transport and port 445Trace the selected file server through route lookup, neighbour resolution and TCP connection establishment to SMB Direct Hosting.
System: Kernel
Trace a hostname through local caches, resolvers, recursive queries and authoritative answers without assuming every lookup uses port 53.
From URL to PixelsLocal network and encapsulationFollow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link.
From URL to PixelsNetwork path and enterprise controlsCompare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network.
From URL to PixelsTCP or QUIC transportCompare TCP connection establishment with QUIC over UDP, including reliability, multiplexing, reuse and fallback.
From URL to PixelsTLS and certificate validationFollow TLS 1.3 from ClientHello through certificate validation, key establishment, ALPN and protected application data.
From URL to PixelsHTTP request and responseRead the same HTTP semantics across text-based HTTP/1.1, framed HTTP/2 and QUIC-carried HTTP/3.
From URL to PixelsEdge, origin and application processingFollow a request through CDN, WAF, reverse proxy, load balancer, web server, application, cache and database components.
From URL to PixelsNavigation commit and security boundariesSee how the browser accepts a response, chooses a renderer, commits a document and enforces origin and process boundaries.
From URL to PixelsBrowser rendering pipelineTurn streamed HTML, CSS, scripts and images into layout, paint records, rasterised tiles and composed pixels.
From URL to PixelsEvidence and troubleshootingCorrelate browser, endpoint, DNS, network, proxy, edge and application records to find the stage that diverged.
From Power Button to DesktopKernel initialisation and memory managementSee how ntoskrnl.exe takes ownership of processors, virtual memory, interrupts, objects and the first system processes.
From Power Button to DesktopDrivers, Plug and Play, storage and filesystemsTrace how Windows binds devices to drivers, mounts volumes and makes the system disk available through the I/O stack.
From Power Button to DesktopWindows session and service startupFollow smss.exe, csrss.exe, wininit.exe and services.exe as Windows creates sessions and starts configured services.
From Power Button to DesktopNetwork interface and link readinessSee how the NIC driver, NDIS and link technology move an interface from discovered hardware to a usable local link.
From Power Button to DesktopIP addressing, routes and neighbour discoveryFollow DHCP or IPv6 autoconfiguration into address selection, routing-table state and the local next-hop mapping.
From Power Button to DesktopDNS, time and domain-controller locationTrace the DNS SRV lookups, site awareness and time checks a domain member uses before authentication.
From Power Button to DesktopMachine account and secure channelSee how a domain member proves its computer identity and maintains the Netlogon secure channel used by domain operations.
From Power Button to DesktopCredential Provider, Winlogon and secure attention sequenceFollow Ctrl+Alt+Delete, LogonUI and the credential provider boundary before authentication reaches LSASS.
From Power Button to DesktopLSASS authentication and access-token creationTrace local, Microsoft-account and domain credentials through authentication packages into a Windows logon session and access token.
From Power Button to DesktopUser profile, Group Policy and desktop shellFollow userinit.exe through profile loading, policy processing, logon scripts and the launch of explorer.exe.
From Wi-Fi to VPNWireless hardware, driver and radioTrace a Wi-Fi request from the Windows WLAN service through NDIS and the adapter into a selected radio channel.
From Wi-Fi to VPNScanning, beacon and probe framesCompare passive beacon listening with active probe exchanges and inspect the information elements that describe a wireless network.
From Wi-Fi to VPN802.11 authentication and associationFollow the management-frame exchange that creates a Wi-Fi link before WPA or IP configuration completes.
From Wi-Fi to VPNWPA2, WPA3 and key establishmentSee how personal Wi-Fi turns a passphrase or SAE exchange into per-session keys and protected data frames.
From Wi-Fi to VPN802.1X, EAP and RADIUSFollow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server.
From Wi-Fi to VPNIPv4 and IPv6 configurationTrace DHCP, router advertisements and duplicate-address checks into a usable dual-stack interface.
From Wi-Fi to VPNARP, neighbour discovery, routing and DNSFollow an application name from resolver choice through route selection and next-hop link-layer resolution.
From Wi-Fi to VPNVPN identity, policy and route selectionTrace a VPN profile from user or device identity through policy checks into full-tunnel or split-tunnel route intent.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Wi-Fi to VPNTunnel traffic, DNS, MTU and evidenceOpen the nested packet, route and resolver state that governs traffic after the VPN connects.
From Network Path to Open FilePath parsing, UNC paths and DFSSee how Windows separates a local path, a UNC server-share path and a DFS namespace before network I/O begins.
From Network Path to Open FileClient redirector, VFS and local cacheTrace a file open from the Windows I/O Manager through the SMB redirector and Client-Side Caching decisions.
From Network Path to Open FileName resolution, site and server discoveryFollow a UNC hostname or DFS namespace through DNS, suffix search, Active Directory site logic and referral selection.
From Network Path to Open FileRouting, transport and port 445Trace the selected file server through route lookup, neighbour resolution and TCP connection establishment to SMB Direct Hosting.
From Network Path to Open FileSMB negotiation, signing and encryptionInspect SMB2 NEGOTIATE fields, dialect choice, capabilities and pre-authentication protection before user authentication.
From Network Path to Open FileSession setup, SPNEGO, Kerberos and NTLMFollow SMB SESSION_SETUP through protocol negotiation into Kerberos service-ticket or NTLM challenge-response authentication.
From Network Path to Open FileTree connect, shares and namespacesSee how an authenticated SMB session attaches to a named share and turns a relative path into a server-side namespace.
From Network Path to Open FileAccess tokens, share permissions and ACLsFollow an SMB request through share checks, NTFS security descriptors and the effective access decision.
From Network Path to Open FileFile open, leases, oplocks, I/O and closeTrace SMB CREATE through durable handles, caching leases, reads, writes, flushes and final close semantics.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
System: Network Device
Trace a hostname through local caches, resolvers, recursive queries and authoritative answers without assuming every lookup uses port 53.
From URL to PixelsLocal network and encapsulationFollow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link.
From URL to PixelsNetwork path and enterprise controlsCompare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network.
From URL to PixelsTCP or QUIC transportCompare TCP connection establishment with QUIC over UDP, including reliability, multiplexing, reuse and fallback.
From URL to PixelsTLS and certificate validationFollow TLS 1.3 from ClientHello through certificate validation, key establishment, ALPN and protected application data.
From URL to PixelsHTTP request and responseRead the same HTTP semantics across text-based HTTP/1.1, framed HTTP/2 and QUIC-carried HTTP/3.
From URL to PixelsEdge, origin and application processingFollow a request through CDN, WAF, reverse proxy, load balancer, web server, application, cache and database components.
From URL to PixelsNavigation commit and security boundariesSee how the browser accepts a response, chooses a renderer, commits a document and enforces origin and process boundaries.
From URL to PixelsEvidence and troubleshootingCorrelate browser, endpoint, DNS, network, proxy, edge and application records to find the stage that diverged.
From Wi-Fi to VPN802.1X, EAP and RADIUSFollow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server.
From Wi-Fi to VPNTunnel traffic, DNS, MTU and evidenceOpen the nested packet, route and resolver state that governs traffic after the VPN connects.
From Send to InboxServer-to-server SMTP and transport securityFollow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy.
From Send to InboxGateway filtering, scanning and sandboxingTrace message, attachment and URL evidence through layered mail-security decisions before mailbox delivery.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
System: Service
Trace a hostname through local caches, resolvers, recursive queries and authoritative answers without assuming every lookup uses port 53.
From URL to PixelsLocal network and encapsulationFollow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link.
From URL to PixelsNetwork path and enterprise controlsCompare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network.
From URL to PixelsTCP or QUIC transportCompare TCP connection establishment with QUIC over UDP, including reliability, multiplexing, reuse and fallback.
From URL to PixelsTLS and certificate validationFollow TLS 1.3 from ClientHello through certificate validation, key establishment, ALPN and protected application data.
From URL to PixelsHTTP request and responseRead the same HTTP semantics across text-based HTTP/1.1, framed HTTP/2 and QUIC-carried HTTP/3.
From URL to PixelsEdge, origin and application processingFollow a request through CDN, WAF, reverse proxy, load balancer, web server, application, cache and database components.
From URL to PixelsNavigation commit and security boundariesSee how the browser accepts a response, chooses a renderer, commits a document and enforces origin and process boundaries.
From URL to PixelsEvidence and troubleshootingCorrelate browser, endpoint, DNS, network, proxy, edge and application records to find the stage that diverged.
From Power Button to DesktopDrivers, Plug and Play, storage and filesystemsTrace how Windows binds devices to drivers, mounts volumes and makes the system disk available through the I/O stack.
From Power Button to DesktopWindows session and service startupFollow smss.exe, csrss.exe, wininit.exe and services.exe as Windows creates sessions and starts configured services.
From Power Button to DesktopNetwork interface and link readinessSee how the NIC driver, NDIS and link technology move an interface from discovered hardware to a usable local link.
From Power Button to DesktopIP addressing, routes and neighbour discoveryFollow DHCP or IPv6 autoconfiguration into address selection, routing-table state and the local next-hop mapping.
From Power Button to DesktopDNS, time and domain-controller locationTrace the DNS SRV lookups, site awareness and time checks a domain member uses before authentication.
From Power Button to DesktopMachine account and secure channelSee how a domain member proves its computer identity and maintains the Netlogon secure channel used by domain operations.
From Power Button to DesktopCredential Provider, Winlogon and secure attention sequenceFollow Ctrl+Alt+Delete, LogonUI and the credential provider boundary before authentication reaches LSASS.
From Power Button to DesktopLSASS authentication and access-token creationTrace local, Microsoft-account and domain credentials through authentication packages into a Windows logon session and access token.
From Power Button to DesktopUser profile, Group Policy and desktop shellFollow userinit.exe through profile loading, policy processing, logon scripts and the launch of explorer.exe.
From Wi-Fi to VPNWireless hardware, driver and radioTrace a Wi-Fi request from the Windows WLAN service through NDIS and the adapter into a selected radio channel.
From Wi-Fi to VPN802.1X, EAP and RADIUSFollow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server.
From Wi-Fi to VPNIPv4 and IPv6 configurationTrace DHCP, router advertisements and duplicate-address checks into a usable dual-stack interface.
From Wi-Fi to VPNARP, neighbour discovery, routing and DNSFollow an application name from resolver choice through route selection and next-hop link-layer resolution.
From Wi-Fi to VPNCaptive portals and connectivity checksSee how Windows distinguishes local Wi-Fi association from Internet access and how a portal redirects unauthenticated clients.
From Wi-Fi to VPNVPN identity, policy and route selectionTrace a VPN profile from user or device identity through policy checks into full-tunnel or split-tunnel route intent.
From Wi-Fi to VPNVPN handshake, keys and virtual adapter creationFollow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface.
From Send to InboxMailbox session, identity and OAuthTrace a modern mail client from cached account state through token acquisition to an authorised mailbox session.
From Send to InboxSubmission-service discoverySee how a client finds the right mailbox or SMTP submission endpoint before it sends message content.
From Send to InboxSMTP submission, TLS and authenticationFollow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server.
From Send to InboxQueues, DNS MX and recipient routingTrace an accepted message through queue selection, recipient-domain lookup and next-hop calculation.
From Send to InboxServer-to-server SMTP and transport securityFollow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy.
From Send to InboxSPF, DKIM and DMARCSeparate source authorisation, message signatures and domain-alignment policy during receiving-mail evaluation.
From Send to InboxGateway filtering, scanning and sandboxingTrace message, attachment and URL evidence through layered mail-security decisions before mailbox delivery.
From Send to InboxMailbox delivery, storage and indexingFollow the accepted message into mailbox folders, metadata tables, quotas and search indexes.
From Send to InboxSynchronisation, notifications, rendering and evidenceTrace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation.
From Network Path to Open FileClient redirector, VFS and local cacheTrace a file open from the Windows I/O Manager through the SMB redirector and Client-Side Caching decisions.
From Network Path to Open FileName resolution, site and server discoveryFollow a UNC hostname or DFS namespace through DNS, suffix search, Active Directory site logic and referral selection.
From Network Path to Open FileSMB negotiation, signing and encryptionInspect SMB2 NEGOTIATE fields, dialect choice, capabilities and pre-authentication protection before user authentication.
From Network Path to Open FileSession setup, SPNEGO, Kerberos and NTLMFollow SMB SESSION_SETUP through protocol negotiation into Kerberos service-ticket or NTLM challenge-response authentication.
From Network Path to Open FileTree connect, shares and namespacesSee how an authenticated SMB session attaches to a named share and turns a relative path into a server-side namespace.
From Network Path to Open FileAccess tokens, share permissions and ACLsFollow an SMB request through share checks, NTFS security descriptors and the effective access decision.
From Network Path to Open FileFile open, leases, oplocks, I/O and closeTrace SMB CREATE through durable handles, caching leases, reads, writes, flushes and final close semantics.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.
System: User Process
See how the browser interprets address-bar input, parses a URL and starts a cross-document navigation.
From URL to PixelsBrowser state, cache and policyUnderstand the local decisions that can satisfy, alter or stop a request before a new network connection exists.
From URL to PixelsDNS resolution in the browserTrace a hostname through local caches, resolvers, recursive queries and authoritative answers without assuming every lookup uses port 53.
From URL to PixelsLocal network and encapsulationFollow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link.
From URL to PixelsNetwork path and enterprise controlsCompare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network.
From URL to PixelsTCP or QUIC transportCompare TCP connection establishment with QUIC over UDP, including reliability, multiplexing, reuse and fallback.
From URL to PixelsTLS and certificate validationFollow TLS 1.3 from ClientHello through certificate validation, key establishment, ALPN and protected application data.
From URL to PixelsHTTP request and responseRead the same HTTP semantics across text-based HTTP/1.1, framed HTTP/2 and QUIC-carried HTTP/3.
From URL to PixelsEdge, origin and application processingFollow a request through CDN, WAF, reverse proxy, load balancer, web server, application, cache and database components.
From URL to PixelsNavigation commit and security boundariesSee how the browser accepts a response, chooses a renderer, commits a document and enforces origin and process boundaries.
From URL to PixelsBrowser rendering pipelineTurn streamed HTML, CSS, scripts and images into layout, paint records, rasterised tiles and composed pixels.
From URL to PixelsEvidence and troubleshootingCorrelate browser, endpoint, DNS, network, proxy, edge and application records to find the stage that diverged.
From Power Button to DesktopCredential Provider, Winlogon and secure attention sequenceFollow Ctrl+Alt+Delete, LogonUI and the credential provider boundary before authentication reaches LSASS.
From Power Button to DesktopUser profile, Group Policy and desktop shellFollow userinit.exe through profile loading, policy processing, logon scripts and the launch of explorer.exe.
From Wi-Fi to VPNCaptive portals and connectivity checksSee how Windows distinguishes local Wi-Fi association from Internet access and how a portal redirects unauthenticated clients.
From Wi-Fi to VPNVPN identity, policy and route selectionTrace a VPN profile from user or device identity through policy checks into full-tunnel or split-tunnel route intent.
From Wi-Fi to VPNTunnel traffic, DNS, MTU and evidenceOpen the nested packet, route and resolver state that governs traffic after the VPN connects.
From Send to InboxCompose, draft and local stateSee how an email client represents recipients, body content and attachments before any submission starts.
From Send to InboxMailbox session, identity and OAuthTrace a modern mail client from cached account state through token acquisition to an authorised mailbox session.
From Send to InboxMessage format, MIME and attachmentsOpen the message envelope and content tree that turn rich text, alternative bodies and files into Internet Message Format bytes.
From Send to InboxSubmission-service discoverySee how a client finds the right mailbox or SMTP submission endpoint before it sends message content.
From Send to InboxSMTP submission, TLS and authenticationFollow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server.
From Send to InboxSynchronisation, notifications, rendering and evidenceTrace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation.
From Network Path to Open FilePath parsing, UNC paths and DFSSee how Windows separates a local path, a UNC server-share path and a DFS namespace before network I/O begins.
From Network Path to Open FileClient redirector, VFS and local cacheTrace a file open from the Windows I/O Manager through the SMB redirector and Client-Side Caching decisions.
From Network Path to Open FileFile open, leases, oplocks, I/O and closeTrace SMB CREATE through durable handles, caching leases, reads, writes, flushes and final close semantics.
From Network Path to Open FileAudit evidence, failures and troubleshootingCorrelate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state.