How your home network works, from the cable up

September 10, 2026

The win for tonight: a hand-drawn map of your home network with every number on it real — your Mac's address, the router's, the range the router hands out, and where the rack will sit — and the ability to explain each number. Nothing gets installed. About ninety minutes: forty reading, fifty at the terminal.

Key idea —

A homelab is a small network with some computers on it. Every hard problem later — "why can't I reach the node", "why did its address change", "why does the cluster think a node is gone" — is a networking question. So the course starts with the network you already have, and only adds the rack once you can read it.

1. Two computers and a cable (5 min)

Start with the smallest possible network: your Mac and your gaming desktop, joined by one Ethernet cable. For one to talk to the other, each needs a way to say who it is and who it wants. Every network device carries two different kinds of name for this, and confusing them is the root of most beginner networking pain.

The MAC address is stamped into the network chip at the factory — twelve hex digits like a4:83:e7:2b:91:0c. It never changes and it is only meaningful on the local wire: it says which physical port a frame is for. Think of it as the chassis number on a car.

The IP address is assigned when the device joins a network, and can change every time it joins — four numbers like 192.168.1.37. It says where in the world a packet should go, and it is what everything you type or configure uses. Think of it as which parking bay the car is in today.

On that one cable, the Mac already knows the desktop's MAC address (it asks: "who has 192.168.1.40?", the desktop answers "me, at a4:83:…"). This question-and-answer is called ARP, and you will see its cache tonight.

2. Subnets: who counts as a neighbour (8 min)

Now add more devices. An IP address on its own does not tell a device whether another address is next door (reachable by shouting on the local wire) or far away (has to go via the router). The subnet answers that.

An IPv4 address is 32 bits. A subnet says "the first n bits are the network; the rest identify the device inside it". You will see it written two ways that mean the same thing:

Notation	Meaning
`192.168.1.0/24`	first 24 bits fixed (`192.168.1`), last 8 bits vary
mask `255.255.255.0`	same thing: 255 = "fixed", 0 = "varies"

A /24 therefore has 256 addresses, 192.168.1.0 to 192.168.1.255. Two of them are unusable by convention: .0 names the network itself, .255 is the broadcast address — send to it and every device on the subnet hears you. By convention (not rule) the router takes .1. That leaves 253 addresses for devices, which is why almost every home network is a /24.

Cloudflare's definition is the one to keep: "a subnet, or subnetwork, is a network inside a network". The test for "same subnet" is mechanical: mask both addresses with the subnet mask; if the results match, they are neighbours and talk directly. If not, the packet goes to the router.

3. The router: one foot in each network (6 min)

Cloudflare again: "a router is a device that connects two or more packet-switched networks or subnetworks". Your ISP's TP-Link box has exactly two: your /24 on the inside, and the ISP's network on the outside. It has an address on each.

When your Mac wants 142.250.x.x (a Google server), it masks the address, sees it is not on the local subnet, and hands the packet to its default gateway — the router's inside address, 192.168.1.1. That is all "gateway" means: the address I send things to when I don't know where else to send them.

Going out, the router does one more thing. The whole house shares a single public address from the ISP, so the router rewrites the source of every outgoing packet to its own public address and remembers who asked, so it can rewrite the replies back. That is NAT, network address translation (MDN's one-paragraph version). Two consequences matter for the homelab: nothing outside can reach a device inside unless the router is told to forward a port (you will never do this — lessons 8 and 10 use tunnels instead), and your ISP router is a single point that everything in the house passes through.

4. DHCP: who hands out the addresses (8 min)

Nobody typed 192.168.1.37 into your Mac. The router runs a DHCP server — Dynamic Host Configuration Protocol, "a standard protocol … that allows a server to dynamically distribute IP addressing and configuration information to clients".

When a device joins, it broadcasts discover ("anyone got an address for me?"), the router broadcasts an offer, the device requests it, the router acknowledges. Four steps, always in that order, and the answer contains four things: an IP address, the subnet mask, the gateway, and the DNS server to use. So one DHCP reply is what tells a device everything from sections 2 and 3.

The address is a lease: it expires, typically after a day, and the device renews it. Usually you get the same address back. Usually. The router hands addresses out from a pool — say .100 to .199 — and the rest of the subnet it leaves alone.

That last fact is the whole reason the rack needs a plan. A server whose address might change is a server you will lose. There are two ways to pin it:

A DHCP reservation on the router: "this MAC address always gets .11". The node still asks; it just always gets the same answer.
A static address typed into the node itself, chosen from outside the pool so the router never gives it to someone else.

The course uses static addresses for the nodes, because the hypervisor you install in lesson 3 requires the address to never change, and a static address does not depend on the ISP router staying configured. Outside the pool, inside the subnet. That sentence is the IP plan.

5. DNS: names for the numbers (4 min)

You type google.com, not 142.250.x.x. DNS is "the phonebook of the Internet": it turns names into addresses. Your Mac asks whichever DNS server DHCP told it about — usually the router, which forwards the question to the ISP.

For the rack you want names too (pve1 beats 192.168.1.11), and there is a domain reserved for exactly this: home.arpa (RFC 8375). It will never clash with a real website. So node one will be pve1.home.arpa. Who answers for that name is a later lesson; for now, just know that the name is yours to use.

6. And the switch? (2 min)

The TL-SG2008 is an eight-way cable. Frames come in one port; the switch learns which MAC address lives on which port and sends each frame only there. It works at the MAC layer and does not care about IP addresses at all — which is why you could plug it in tonight with zero configuration and it would just work. What "managed" and "L2+" buy you, and why it has an IP address of its own anyway, is lesson 2.

Drill: which layer is each of these?0 of 7

a4:83:e7:2b:91:0c

192.168.1.0/24

A lease that expires after 24 hours

The switch learning which port a device is on

Turning pve1.home.arpa into an address

The default gateway

"Who has 192.168.1.40?"

7. Hands on: map your network (50 min)

Every command below runs on your Mac; the desktop equivalents are noted. Write the answers on paper as you go — a box per device, its address inside, lines for cables, a cloud for Wi-Fi. That drawing is tonight's deliverable.

Draw the map0 of 7

Read your own DHCP lease
ipconfig getpacket prints the actual DHCP reply your Mac received. Find the four things from section 4: yiaddr (your address), subnet_mask, router (the gateway) and domain_name_server. Note lease_time too — it is in seconds. Use en0 for Wi-Fi on a MacBook; on the desktop, ipconfig /all in PowerShell shows the same fields.
```
ipconfig getpacket en0
ipconfig getifaddr en0          # just the address
```
Done when: You can write down your address, the mask, the gateway and the DNS server, and say which of them came from the router.
Work out the subnet
From the address and mask, write the subnet in /n form. Mask 255.255.255.0 is /24; if yours is different, count the fixed bits (each 255 is eight). Then write the first and last usable address.
Done when: You have one line like "192.168.1.0/24 — usable .1 to .254" on the map.
Log in to the router and find the DHCP pool
Open the gateway address in a browser. The login is usually printed on the router's label. Find the DHCP settings page (TP-Link calls it Network → DHCP Server or Advanced → Network → DHCP) and note the start and end of the pool and the lease time. Change nothing.
Done when: The pool is drawn on the map as a shaded range, e.g. ".100–.199". Everything outside it is free for the rack.
See who else is on the subnet
Ping the broadcast address so every device answers, then dump the ARP cache: it lists each IP your Mac has recently resolved, with its MAC. Match what you can (the router, the desktop, phones, the TV). Anything you cannot name is worth a note.
```
ping -c 3 192.168.1.255      # your broadcast address
arp -a
```
Done when: Each device you know is a box on the map with its IP; the router is the one whose IP matches the gateway.
Watch a packet leave the house
traceroute prints every router a packet passes through. The first hop is your gateway; the second is the ISP. Count the hops to a public address, then to a name, and notice that the name works only because DNS resolved it first.
```
traceroute -m 8 1.1.1.1
traceroute -m 8 one.one.one.one
```
Done when: Hop 1 on the map is your router; you can point at where the house ends and the ISP begins.
Place the rack on the map
Draw the long cable from the router to the office, the switch at its end, and three boxes hanging off the switch. Give them addresses outside the DHCP pool: the course convention is switch .10, nodes .11, .12, .13, with .20–.49 reserved for VMs. If your pool covers those, pick another free run and write it down.
Done when: Five addresses for the rack, none inside the pool, all inside the subnet. Copy them into the rack-plan reference sheet.
Start the runbook
Create RUNBOOK.md in this folder (or your vault). First entry: the date, the subnet, gateway, DNS, DHCP pool and lease time, the router model and its admin address, and the rack address plan. Every lesson from here adds to it.
Done when: A stranger could read the file and tell you your subnet and which addresses are free.

8. Retrieval (3 min)

No looking back.

Q1. A device with address 192.168.1.37/24 wants to reach 192.168.1.200. What happens?

Q2. Why give the Proxmox nodes addresses outside the DHCP pool?

Q3. Which of these does a switch look at when forwarding a frame?

Q4. What does a DHCP reply contain besides an IP address?

Q5. How many usable device addresses does a /24 have?