Packet to Prompt

One request, traced from a laptop's network card to a model's response and back, across 21 hops.

What this is. Networking is usually taught as isolated protocols, cloud as console screenshots, and AI systems as architecture diagrams. This is the same request through all three. Every hop shows the header values before and after, the literal record a sensor at that point emits, the part of the picture that sensor cannot see, and the techniques that abuse that specific step.

Two ways to use it. Read mode shows everything. Walk mode holds back each hop's evidence until you commit to an answer, then scores what you missed. Either way the export is a Markdown file you can keep.

Mode

Chapter 1

Campus LAN

Seven hops from a laptop's network card to the edge of the building. Four devices rewrite something; one pair of addresses never changes.

Processed by Corporate DNS resolver at 10.20.10.53

What changes here

Header values before and after this hop
Field	Before	After
Query name	(none)	assistant.example.com (changed at this hop)
Query type	(none)	A (changed at this hop)
Answer	(none)	203.0.113.10 (changed at this hop)
Record TTL	(none)	60 (changed at this hop)
Transport	UDP/53	UDP/53

What a sensor records

Zeek / dns.log

1755958800.118273	CHhAvVGS1DHFjwGM9	10.20.30.41	54721	10.20.10.53	53	udp	42311	0.001842	assistant.example.com	1	C_INTERNET	1	A	0	NOERROR	F	F	T	T	0	203.0.113.10	60.000000	F

Blind spot. Zeek reads this because the query is plaintext UDP. The same lookup over DNS-over-HTTPS would be indistinguishable from any other HTTPS request, and the resolver would be the only party that still saw the name.

What abuses this hop

T1071.004 Application Layer Protocol: DNSThe same resolver path that answers this query will happily carry encoded data in query names.
T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB RelayWhen the configured resolver fails, Windows falls back to broadcast name resolution, which anyone on the segment can answer.

The answer comes back with a TTL of 60. What does that number control?

AHow many routers the reply may cross before it is discarded
BHow long the TCP connection to 203.0.113.10 may stay open
CHow long the client and any resolver may cache this answerCorrect answer
DHow many times the resolver will retry the query

This is the DNS record TTL, measured in seconds of cache lifetime. The hop limit that discards a packet after a set number of routers is the IP header TTL, a different field in a different protocol. The two share a name and nothing else, and confusing them is why a stale DNS answer gets blamed on the network.

Chapter 2

Cloud VPC

The first seam. The request leaves equipment the company owns, and every control from here is an API someone else operates. The evidence changes format at the boundary, and one hop stops producing packet-level evidence entirely.

Chapter 3

AI inference

The second seam. The request stops being a packet and becomes a prompt. Nothing below this line has an opinion about what the text says, which is why the last seven hops are where the AI-specific risk lives.

Take it with you

The export is the whole path as a Markdown reference: every hop with its field table, the sensor record it produces, the blind spot in that record, and the techniques attached to it.

Campus LAN

01The name is resolvedBefore any packet can be addressed, the laptop asks the corporate resolver where assistant.example.com lives.

02The laptop asks who owns the gatewayThe destination is off-subnet, so the host needs a MAC address for its default gateway before it can send anything at all.

03The network card builds the frameThe TCP SYN is wrapped in an IP header, then an Ethernet header, and leaves the host.

04The access switch forwards without touching the packetThe switch looks up the destination MAC, adds an 802.1Q tag on the uplink trunk, and changes nothing above layer 2.

05The gateway routes the packetThe layer 3 switch matches the default route, rewrites both MAC addresses, and decrements the TTL.

06The edge firewall translates the sourceThe internal address is replaced by the public address of the site, and the source port is rewritten so the translation stays unique.

07TLS is negotiated in the clear, then the door closesThe ClientHello names the server it wants before any encryption exists, and it is the last thing a network sensor gets to read.

Cloud VPC

08The load balancer terminates the sessionThe TLS session ends at the load balancer, which opens a second connection to the target and records what was asked for.

09The security group makes an allow decisionThe task interface evaluates its inbound rules, and the connection entry it creates decides the return path as well.

10The route table picks the longest matchThe subnet's route table decides whether traffic stays inside the VPC or leaves it, and the most specific route always wins.

11The metadata service, one hop awayThe task can reach 169.254.169.254, and so can anything running on it that can be made to fetch a URL.

12The model API resolves to a private addressThe service name points at an interface endpoint inside the VPC, so the call to the model never touches the internet.

13The task receives the request on its own interfaceIn awsvpc networking mode the container has its own interface, its own address, and its own security group.

14The API validates the caller's tokenThe service checks the bearer token, and the identity it derives here is what every downstream decision will trust.

AI inference

15The gateway applies policyModel routing, quotas, and content policy are enforced in one place before anything reaches a model.

16Retrieval pulls documents into the promptThe question is embedded, the nearest chunks are fetched, and their text is about to become part of the model's input.

17The context window is assembledSystem prompt, retrieved chunks, conversation history, and the user's question become one flat sequence of tokens.

18The model is invokedThe assembled context crosses the API boundary and comes back as a stream of tokens.

19The model asks for a toolThe response is not prose but a request to run a function, and the application decides whether to run it.

20The response is filtered on the way outThe completion passes an output policy before any of it is streamed back to the browser.

21The browser renders the answerThe response is Markdown, and rendering it is the last place this request can still do damage.

Take it with you