Computer Networks

A computer network is a group of devices (like laptops, phones, printers, and servers) connected so they can share data and services. Example: Your home Wi-Fi where your phone and smart TV both use the same internet connection.

We use networks to communicate, share files, use shared printers, access the internet, and run apps hosted on other computers. Without networks, each computer would work alone.

The Internet is the world’s largest network, connecting millions of smaller networks globally using common rules (TCP/IP).

A host is any device on a network that can send or receive data. Examples: desktop, mobile phone, cloud server, IoT camera.

An IP address is a unique logical address used to identify a device on an IP network. Think of it like a postal address for digital communication.

IPv4 is the older and still widely used IP version with 32-bit addresses. Example: 192.168.1.25

IPv6 is the newer IP version with 128-bit addresses, created mainly because IPv4 addresses are limited. Example: 2001:db8::1

A MAC address is a hardware address assigned to a network interface, used in local communication (Layer 2). It is usually written like: 00:1A:2B:3C:4D:5E

A protocol is a set of rules that devices follow to communicate correctly. Example: HTTP for web pages, TCP for reliable delivery.

Bandwidth is the maximum amount of data a connection can carry per second. Example: A 100 Mbps link has higher capacity than a 10 Mbps link.

Latency is the delay between sending and receiving data. Lower latency means faster response (important for gaming and video calls).

Throughput is the real data speed you actually get in practice. It is often lower than bandwidth due to overhead and congestion.

Jitter is the variation in delay between packets. High jitter can make voice/video calls sound broken or choppy.

Packet loss happens when some packets never reach the destination. Causes include congestion, bad cables, weak Wi-Fi, or overloaded devices.

A packet is a small chunk of data sent across a network. Large messages are split into many packets, then reassembled at the receiver.

A frame is the Layer-2 format used on local links (like Ethernet) to carry packets.

A router connects different networks and forwards IP packets to their destinations. Example: Home router connects your LAN to your ISP.

A switch connects devices inside a LAN and forwards traffic based on MAC addresses.

A hub is an old device that sends incoming data to all ports. Unlike a switch, it does not intelligently forward traffic.

A modem connects your local network to your internet provider’s access network (cable/DSL/fiber ONT context).

A NIC (Network Interface Card) is the hardware component that gives a device network connectivity.

LAN means Local Area Network: a network in a small area like home, office, or school lab.

WAN means Wide Area Network: a network spanning large areas, often connecting branches/cities/countries.

MAN means Metropolitan Area Network: covers a city-scale area.

PAN means Personal Area Network: very short-range network around one person (e.g., Bluetooth devices).

Topology is how network devices are arranged physically or logically.

Common topologies: star, bus, ring, mesh, tree, hybrid. Modern LANs are mostly star-based (switch in center).

Clients request services; servers provide them. Example: Browser (client) requesting a page from a web server.

In peer-to-peer, devices can both provide and request resources directly from each other.

DNS converts human-friendly domain names (example.com) into IP addresses.

DHCP automatically gives devices IP settings (IP, subnet mask, gateway, DNS).

It is the router IP a host uses to send traffic outside its local subnet.

A subnet mask tells which part of an IPv4 address is network and which part is host.

CIDR uses prefix length, like /24, to define network size.

A port identifies a service/application on a host. Example: HTTPS usually uses port 443.

TCP: reliable, ordered, connection-based. UDP: faster, lightweight, no delivery guarantee.

HTTP is the protocol browsers and servers use to transfer web content.

HTTPS is HTTP protected by TLS encryption, providing confidentiality and integrity.

FTP is a file transfer protocol; classic FTP is insecure unless protected (FTPS/SFTP alternatives).

SSH securely connects to remote machines for command-line access and file transfer/tunneling.

Ping checks if a host is reachable and measures round-trip time.

Traceroute shows the path (hops) packets take to reach a destination.

NAT translates private addresses to public addresses, allowing many devices to share one public IP.

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

A firewall allows or blocks network traffic based on security rules.

Wi-Fi is wireless networking based on IEEE 802.11 standards.

Ethernet is the most common wired LAN technology (IEEE 802.3).

Data can be sent and received at the same time.

A device can send or receive at one moment, but not both simultaneously.

A collision domain is where data collisions can happen on shared media. Modern switched Ethernet greatly reduces collision issues.

OSI is a 7-layer reference model:

1. Physical 2) Data Link 3) Network 4) Transport 5) Session 6) Presentation 7) Application

A practical model used on the Internet: Link, Internet, Transport, Application.

Layer 1 handles electrical/optical/radio signals and bit transmission over physical media.

Layer 2 handles framing, MAC addressing, and local link delivery.

Layer 3 handles IP addressing and routing between different networks.

Layer 4 provides end-to-end transport (reliability, ports, segmentation, flow handling).

Encapsulation means each layer adds its own header (and sometimes trailer) before sending.

At the receiver, each layer removes the corresponding headers to recover original data.

ARP maps an IPv4 address to a MAC address on a local network.

NDP is IPv6 neighbor discovery for address resolution and related local functions.

Broadcast sends traffic to all devices in a local broadcast domain.

Multicast sends traffic to a selected group of interested receivers.

Unicast is one sender communicating with one receiver.

Anycast sends to the nearest (routing-wise) node among multiple nodes sharing the same address.

VLAN creates separate logical LANs on the same physical switch infrastructure.

To improve security, reduce unnecessary broadcasts, and organize departments/services cleanly.

Trunking carries multiple VLANs over one link using tags (802.1Q).

STP prevents Layer-2 loops by blocking redundant links while keeping backup paths.

They can create broadcast storms, duplicated frames, and unstable MAC tables.

A catch-all route used when no specific route matches destination.

Routes are manually configured by admins.

Routers automatically exchange route information via routing protocols.

Distance-vector: shares route distance/next-hop. Link-state: shares topology and computes shortest paths.

RIP is a simple distance-vector protocol using hop count metric (max 15 hops).

OSPF is a scalable link-state IGP using costs and area design.

EIGRP is an advanced Cisco-origin routing protocol with fast convergence properties.

BGP is the Internet’s inter-domain routing protocol between autonomous systems.

An AS is a network/admin domain under one policy, identified by an ASN.

ASN is the numeric identifier of an Autonomous System in BGP.

MTU is the largest packet size a link can carry without fragmentation.

Fragmentation splits packets into smaller pieces when they exceed MTU.

It adds overhead and can reduce performance/reliability when fragments are lost.

MSS is the largest TCP payload size negotiated for a connection.

SYN -> SYN-ACK -> ACK. This establishes a reliable TCP connection.

Usually FIN/ACK sequence for graceful close; RST for immediate reset.

Flow control protects the receiver from being overwhelmed (TCP receive window).

TCP adjusts sending rate to reduce congestion and stabilize the network.

QoS prioritizes important traffic (e.g., voice) to meet latency/loss goals.

DSCP is a packet marking used by QoS policies for classification and treatment.

VPN creates a secure encrypted tunnel over public networks.

Site-to-site connects whole networks. Remote-access connects individual users/devices.

ACL is a list of permit/deny rules controlling traffic.

Stateful firewalls track connection state and make context-aware decisions.

A proxy receives requests from clients and forwards them to destination servers.

A reverse proxy sits before backend servers for load balancing, TLS offload, and protection.

A load balancer distributes user requests across multiple servers.

CDN caches content near users to reduce latency and improve availability.

SNMP is used to monitor/manage network devices (interfaces, CPU, alerts, etc.).

Syslog is a standard way to send device and service logs to central log servers.

NTP synchronizes clocks across systems, which is vital for logs and troubleshooting.

Combining multiple contiguous routes into one larger prefix.

Smaller routing tables, fewer updates, faster processing, better scalability.

ECMP uses multiple equal-cost paths for load sharing and resilience.

The time network devices need to agree on updated routing after a change/failure.

Routes repeatedly appearing/disappearing, causing instability and CPU churn.

BFD quickly detects link/neighbor failures and informs routing protocols.

Gateway redundancy protocols that present one virtual default gateway for hosts.

Routing based on policy rules (source/app/marks), not only destination prefix.

MPLS forwards packets based on labels, enabling efficient and flexible traffic engineering.

LDP distributes MPLS label mappings between routers.

SR encodes path instructions as segments, reducing state complexity in core networks.

VXLAN encapsulates Layer-2 traffic over Layer-3 networks using VNI identifiers.

Overlays decouple logical network design from physical layout, improving scale and flexibility.

EVPN (often using BGP) advertises MAC/IP reachability for modern data center fabrics.

Underlay = physical/routed transport. Overlay = virtual network built on top of it.

The logic that decides where traffic should go (routing decisions/signaling).

The forwarding process that moves packets based on control-plane instructions.

Plane used for configuration, monitoring, automation, and administrative control.

SDN centralizes/control logic in software and programs forwarding behavior.

NFV runs network functions (firewall, LB, router) as software on virtualized infrastructure.

Directing traffic through ordered security/network services (e.g., FW -> IDS -> Proxy).

Fine-grained policy enforcement between workloads to reduce lateral movement risk.

Traffic between internal systems inside a data center/network.

Traffic entering or leaving a data center/network boundary.

TCP retransmits a segment early after duplicate ACK signals probable loss.

SACK lets receiver specify exactly which blocks arrived, improving loss recovery efficiency.

When one blocked packet/stream delays others behind it in queue/order.

HTTP/2 multiplexes streams and compresses headers, reducing overhead and improving performance.

QUIC (over UDP) integrates TLS 1.3, low-latency setup, multiplexed streams, connection migration.

Fewer round trips for setup and better handling of packet loss across independent streams.

Deep Packet Inspection analyzes packet headers/payload for security or policy decisions.

IDS detects suspicious traffic and alerts administrators.

IPS detects and actively blocks malicious traffic in real time.

A large distributed attack flooding a service to make it unavailable.

Rate limits, traffic scrubbing, anycast distribution, WAF/CDN, upstream filtering.

No implicit trust; verify identity/device/context continuously and enforce least privilege.

PKI manages digital certificates, keys, and trust relationships.

Both sides (client and server) authenticate with certificates before exchanging data.

Continuous collection of metrics/logs/events/traces for visibility and automation.

Admins define desired outcomes; systems translate/validate/implement policies automatically.

Common simplified order: highest weight (vendor-specific), highest local-pref, shortest AS-path, best origin type, lowest MED (often same neighboring AS), eBGP over iBGP, lowest IGP metric to next-hop, oldest path, lowest router ID. Note: exact behavior may vary by vendor/policy.

Local Preference controls outbound path choice inside your AS and reflects business intent.

AS-path prepending makes your route look longer so external networks are less likely to prefer it.

Route reflectors reduce iBGP full-mesh requirements, improving scale.

BGP confederation splits one large AS into internal sub-ASes for manageability.

RPKI lets operators validate whether a prefix is authorized for a specific origin ASN.

A network wrongly announces someone else’s prefix, potentially diverting/blackholing traffic.

It marks/filters invalid route origins, reducing successful hijacks/misconfig impact.

A router can restart control processes while forwarding continues temporarily, reducing disruption.

PIC pre-installs backup forwarding paths so failover is much faster after failure.

TI-LFA provides deterministic, very fast local protection using segment-routing constructs.

Optimizing path use for performance, utilization, reliability, and cost.

RSVP-TE uses per-tunnel signaling state. SR-TE encodes path intent in segments with less in-core signaling complexity.

Controlling packet queues to balance delay, drop behavior, and fairness.

Tail drop drops only when queue is full. AQM (RED/CoDel) drops/marks earlier to reduce latency and queue buildup.

Excessive queue buffering causes very high latency under load, harming interactive traffic.

ECN marks packets to signal congestion without immediate packet drops (if endpoints support it).

Priority Flow Control pauses selected traffic classes to avoid loss, but poor tuning may cause HOL issues.

RoCEv2 is sensitive to congestion/loss; requires careful design (ECN/PFC/tuning/monitoring).

A scalable, predictable data center topology with leaf switches connecting to multiple spines.

Simple policy model, clear failure domains, and strong operational scalability.

Guaranteeing strict delay/loss/jitter targets even during failures and bursty traffic.

Creating isolated logical networks with separate policies and SLAs over shared infrastructure.

Segment Routing over IPv6 uses IPv6 headers to encode path and service behavior.

Metrics, logs, and traces together provide complete troubleshooting context.

Use a structured approach: verify physical errors, interface counters, queue drops, MTU consistency, routing changes, and packet captures with synchronized timestamps.

Without accurate time, events across devices cannot be correlated reliably.

Intentionally introducing controlled failures to test resilience and validate recovery plans.

Blast radius is the potential impact scope of a change; minimize with canaries and staged rollout.

By combining requirements mapping, lab simulation, pilot rollout, observability checks, SLO verification, and regular failure testing.

When you enter a domain (for example, example.com), your device checks:

1. Browser cache
2. OS cache
3. Local resolver cache (often on router or ISP)

If not found, resolver queries:

• Root server -> points to TLD servers (.com)
• TLD server -> points to authoritative name server
• Authoritative server -> returns final record (A/AAAA/CNAME, etc.)

Then your device connects to the returned IP. Key idea: DNS is hierarchical and heavily cached to improve speed.

• Recursive query: requester asks resolver for final answer; resolver does all lookups.
• Iterative query: server responds with best next referral; requester (or resolver) continues querying.

Clients usually send recursive queries to local resolvers; resolvers perform iterative queries upstream.

TTL controls how long records stay cached.

• Higher TTL: fewer DNS queries, better performance, slower change propagation.
• Lower TTL: faster failover/change updates, but higher DNS query load.

Choosing TTL is a trade-off between agility and scalability.

Split-horizon DNS returns different answers based on query source. Example:

• Internal users get private IP for internal app access.
• External users get public IP through reverse proxy.

Used for security, performance, and hybrid deployments.

An attacker sends fake ARP replies mapping victim IP to attacker MAC. Devices update ARP cache and send traffic to attacker. Impact: MITM, traffic interception, session hijacking, denial. Mitigation: Dynamic ARP Inspection, static ARP for critical hosts, VLAN segmentation, endpoint security.

1. Client sends SYN with initial sequence number (ISN).
2. Server replies SYN-ACK with its ISN and acknowledges client ISN+1.
3. Client sends ACK acknowledging server ISN+1.

After this, both sides have synchronized sequence space and can exchange reliable data.

They provide:

• Ordered data reconstruction
• Loss detection
• Duplicate detection
• Reliable retransmission control

Without sequence/ACK numbers, reliable ordered delivery would not be possible.

Sliding window defines how much unacknowledged data sender can have "in flight." Larger effective window can increase throughput on high-latency links. Receiver window + congestion window together constrain send rate.

Typical pattern:

• Slow Start: exponential growth
• Congestion Avoidance: linear growth
• On loss/ECN: reduce sending rate

This feedback loop avoids persistent overload while using available bandwidth.

BDP = bandwidth * RTT. It estimates required in-flight data to fully utilize a link. If sender window << BDP, link is underutilized. Important for tuning high-speed/long-distance connections.

Sender transmits packets assuming path MTU. If a router can't forward due to MTU and DF behavior, it returns ICMP feedback. Sender lowers packet size accordingly. Broken ICMP paths can break PMTUD, causing black-hole behavior.

Tunnels add encapsulation overhead, reducing effective payload size. If MSS/MTU aren’t adjusted, fragmentation or drops can occur. MSS clamping avoids oversized TCP segments and improves stability.

NAT rewrites addresses/ports, which:

• Conserves IPv4
• Hides internal topology

But complicates inbound connections, P2P, and some protocols embedding IP/port in payload.

PAT (Port Address Translation) maps many private hosts to one public IP using distinct source ports. Basic 1:1 NAT maps one private IP to one public IP. PAT is common in home/enterprise internet access.

State tables track active flows (source/destination IP/port, protocol, timers, flags). They allow return traffic for established sessions and enable stateful filtering decisions.

• Stateless: each packet checked independently against rules.
• Stateful: device tracks connection context and allows related return traffic automatically.

Stateful approaches usually simplify policy and improve security posture.

Clients typically use random high source ports (ephemeral range) for outbound sessions. Knowing this helps identify client-side flows and NAT mappings in captures/logs.

Asymmetric routing means forward and return traffic use different paths. Stateful devices seeing only one direction may drop packets due to missing session state. Important in multi-homed and ECMP designs.

ECMP usually hashes flow fields (5-tuple) to pick a path. Per-flow balancing can create uneven utilization if a few "elephant flows" dominate. Engineers tune hashing fields and capacity to improve distribution.

Microbursts are very short traffic spikes that overflow buffers quickly. Average metrics may look normal, but packets drop during bursts. High-frequency telemetry and queue stats are needed to detect them.

Large buffers reduce drops but can increase latency (bufferbloat). Small buffers reduce latency but can drop bursts. Best setting depends on workload (interactive vs bulk traffic).

They signal/drop earlier before queues fill completely. Result: lower average queue delay, improved interactive performance, less global synchronization of TCP flows.

Common pipeline:

1. Classify traffic (ACL/NBAR/port/app)
2. Mark packets (DSCP/CoS)
3. Queue/schedule (priority, weighted fair queuing)
4. Police/shape rates

This enforces traffic intent consistently.

• Policing drops/marks excess immediately.
• Shaping buffers and smooths excess to fit target rate.

Use shaping for WAN smoothing; policing for strict enforcement.

Strict priority can starve other classes if priority traffic is unlimited. Best practice: cap priority bandwidth and monitor class drops/latency.

BGP carries AS_PATH. If router sees its own AS in path, it rejects route. This is a core inter-domain loop prevention mechanism.

MED suggests preferred ingress point into an AS (lower often preferred). Typically compared only among routes from same neighboring AS unless policy overrides.

Each iBGP router must peer with every other iBGP router: n*(n-1)/2 sessions. Large n becomes operationally heavy, so route reflectors/confederations are used.

Route damping suppresses flapping routes temporarily. It improves stability but can delay recovery for valid routes if too aggressive. Modern operators use cautious policies.

CoPP protects router/switch CPU by rate-limiting and filtering traffic destined to control plane (routing protocols, SSH, SNMP).

Isolated management access improves security and keeps operations available during data-plane incidents.

Dedicated management network physically/logically separate from production traffic for safer device administration and recovery.

Frequent causes:

• Control-plane attacks/floods
• Route churn/flapping
• Excessive logging/debug
• Hardware offload miss (punt to CPU)
• Feature misconfiguration

Always correlate with control-plane counters and event timelines.

Packets that cannot be handled in hardware forwarding path and are sent to CPU for processing. Too much punt traffic can degrade performance severely.

Hardware forwarding (ASIC/NP) is fast, line-rate. Software forwarding uses CPU, slower, used for exceptions/control/unsupported features.

Same IP is announced from multiple sites. Users reach nearest site by routing policy. Benefits: lower latency, DDoS absorption distribution, regional failover simplicity.

Stickiness keeps a user tied to same backend. Needed for stateful apps not using shared session store. Prefer stateless app design when possible.

L4 balances based on transport info (IP/port/protocol), faster and simpler. L7 inspects application data (HTTP headers/path/cookies), more flexible but heavier.

Where TLS ends defines visibility, policy enforcement point, and trust boundary. Termination at edge improves offload/inspection; end-to-end TLS improves privacy/isolation.

PFS ensures past sessions remain secure even if long-term server key is later compromised (using ephemeral key exchange).

DNSSEC adds cryptographic signatures to DNS data to prevent spoofed/tampered DNS responses. It protects integrity/authenticity, not confidentiality.

They remove meaningful segmentation and increase blast radius. Security becomes reactive instead of preventive.

After initial compromise, attacker moves between internal systems to escalate access. Segmentation and least privilege reduce this risk.

Inspection of internal traffic between workloads. Needed because modern attacks often spread internally after entry.

Typically:

• Latency
• Throughput
• Errors (drops/retransmissions)
• Saturation (link/CPU/queue utilization)

1. Define symptom precisely
2. Scope impact (who/where/when)
3. Check recent changes
4. Validate physical/link layer
5. Verify routing and policy
6. Inspect transport behavior
7. Capture packets if needed
8. Confirm fix + add prevention action

Without baseline, “abnormal” cannot be measured. Baselines help detect regressions, capacity trends, and incident onset quickly.

Design changes so failures affect smallest possible scope:

• staged rollout
• canary sites
• quick rollback
• maintenance windows
• pre/post verification checks

Assume links/devices/regions will fail. Use redundancy, fast failover, observability, and tested runbooks from day one.

They run post-incident reviews, automate repetitive ops, tighten SLOs, test failure scenarios regularly, and prioritize learning over blame.