Networking Fundamentals

A computer network is a collection of connected devices that can communicate with each other and share resources.

Networks allow computers to share data, applications, printers, storage, and internet access efficiently.

A node is any device connected to the network, such as a computer, router, switch, server, or mobile device.

A protocol is a set of rules that defines how devices communicate over a network.

The Internet is a global network of interconnected networks using standard protocols such as TCP/IP.

A LAN (Local Area Network) is a network confined to a small geographic area such as a home, office, or campus.

A WAN (Wide Area Network) connects networks over a large geographical area, such as cities, countries, or continents.

A MAN (Metropolitan Area Network) covers a metropolitan area, usually larger than a LAN but smaller than a WAN.

A PAN (Personal Area Network) is a small network used around an individual, such as Bluetooth devices.

A switch connects devices within the same network segment. A router connects different networks and directs traffic between them.

An IP address is a unique identifier assigned to a network device so it can be located and reached.

IPv4 is the fourth version of the Internet Protocol and uses 32-bit addresses.

IPv6 is the next-generation IP protocol using 128-bit addresses to provide a much larger address space.

IPv4 supports about 4.3 billion unique addresses, which is no longer enough for the modern internet.

IPv6 addresses the exhaustion of IPv4 addresses and adds improvements like simpler configuration and better security design.

A MAC address uniquely identifies a network interface card (NIC) on the local network.

An IP address identifies a device on a network layer. A MAC address identifies the hardware interface on the local link.

A subnet is a smaller network created by dividing a larger IP network into segments.

Subnetting is the process of splitting a larger network into smaller sub-networks for better organization and efficiency.

A subnet mask is used with an IP address to determine the network and host portions of the address.

A default gateway is the device that forwards traffic from a local network to other networks, such as the internet.

DNS (Domain Name System) translates human-readable domain names like example.com into IP addresses.

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and network settings to devices.

NAT (Network Address Translation) allows multiple devices on a private network to share one public IP address.

Private IP addresses are ranges reserved for internal networks and are not routable on the public internet.

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

A public IP address is reachable from the internet and is assigned to a device or network router.

A loopback address is used by a device to send traffic to itself, commonly 127.0.0.1 for IPv4 and ::1 for IPv6.

A port is a numbered endpoint used by transport layer protocols to identify specific services or applications.

A socket is an endpoint for communication, identified by IP address and port number.

TCP (Transmission Control Protocol) is a connection-oriented protocol that provides reliable, ordered delivery.

UDP (User Datagram Protocol) is a connectionless protocol designed for speed, often used in streaming or DNS.

TCP provides reliability and ordering. UDP is faster and simpler but does not guarantee delivery or ordering.

The OSI model is a 7-layer reference model for understanding how network communication works.

1. Physical
2. Data Link
3. Network
4. Transport
5. Session
6. Presentation
7. Application

The TCP/IP model is the practical networking model used on the internet, usually simplified into 4 or 5 layers.

• Link
• Internet
• Transport
• Application

The physical layer deals with the actual transmission of bits over a cable, radio signal, or optical fiber.

It handles local delivery between devices on the same network segment, often using MAC addresses.

The network layer handles routing and delivery between networks using IP addresses.

The transport layer provides data delivery services such as connection setup, reliability, and segmentation.

The application layer contains protocols used by programs, such as HTTP, DNS, SMTP, and SSH.

A packet is a formatted unit of data transmitted over a network.

A frame is the Data Link layer unit of data, containing a header, payload, and trailer.

A segment is the Transport layer PDU for TCP or UDP.

A datagram is a self-contained packet, often associated with UDP.

A router forwards packets between networks based on IP routing information.

A switch forwards frames within a local area network using MAC addresses.

A hub is a basic device that repeats signals to all connected devices, unlike a switch.

A firewall filters traffic based on security rules to control what enters or leaves a network.

A network interface is the hardware or software component that connects a device to a network.

Bandwidth is the maximum rate at which data can be transferred over a network link.

Latency is the time delay between sending a packet and receiving it.

Throughput is the actual data rate achieved at application level, often lower than theoretical bandwidth.

RTT (Round Trip Time) is the time for a packet to travel to a destination and back.

Packet loss occurs when packets are dropped during transmission, often due to congestion or errors.

Jitter is variation in packet delay, which can affect real-time traffic like VoIP and video.

A connectionless protocol does not establish a dedicated session before sending data.

A connection-oriented protocol establishes a session before sending data and verifies delivery.

A network topology describes the physical or logical arrangement of devices and links in a network.

In bus topology, all devices share a single communication medium.

In star topology, all devices connect to a central device such as a switch or hub.

In ring topology, devices are connected in a circular path.

In mesh topology, devices have multiple redundant links to others for resilience.

A NIC (Network Interface Card) is the physical or virtual interface used to connect a device to a network.

Ethernet is the dominant LAN technology used for wired networking.

Wi-Fi is a wireless local network technology based on IEEE 802.11 standards.

CSMA/CD (Carrier Sense Multiple Access with Collision Detection) was used in Ethernet hubs before switches dominated.

CSMA/CA is used in Wi-Fi to avoid collisions by sensing the carrier before transmitting.

ARP (Address Resolution Protocol) resolves an IP address to a MAC address on the same local network.

ICMP (Internet Control Message Protocol) is used for error reporting and diagnostics, such as ping.

Ping uses ICMP Echo Request and Echo Reply to test connectivity between devices.

Traceroute shows the path packets take through intermediate routers to a destination.

A hostname is a human-readable label for a device or server, such as web01.

A domain name is a name used for websites and services, such as example.com.

DNS resolution is the process of converting a domain name into an IP address.

A recursive DNS query asks a resolver to fully resolve a name on behalf of the client.

A DNS resolver is the server that answers DNS queries from clients.

Caching stores previously resolved DNS answers to speed up future lookups.

A DNS record stores information such as A, AAAA, MX, CNAME, and TXT records.

An A record maps a hostname to an IPv4 address.

An AAAA record maps a hostname to an IPv6 address.

A CNAME record aliases one hostname to another hostname.

An MX record specifies the mail server responsible for a domain.

A TXT record stores arbitrary text, often used for SPF, DKIM, or verification data.

HTTP (Hypertext Transfer Protocol) is the protocol used for transferring web pages and resources.

HTTPS is HTTP over TLS/SSL, providing encryption and identity verification.

TLS (Transport Layer Security) encrypts communications and authenticates endpoints.

SSL (Secure Sockets Layer) is the older predecessor to TLS.

The TCP handshake is the sequence of SYN, SYN-ACK, and ACK used to establish a connection.

A three-way handshake is the standard process used by TCP to connect two endpoints.

Session establishment is the process of creating a communication state before data transfer begins.

Sequence numbers help TCP track the order of bytes and detect missing or duplicated data.

Acknowledgement is the confirmation that data has been received successfully.

Flow control prevents a sender from overwhelming a receiver with too much data at once.

Congestion control helps prevent network overload by reducing transmission rates when congestion is detected.

Window size is the amount of data a receiver is willing to accept at once.

Connection teardown is the process of closing a TCP connection cleanly.

A FIN packet indicates the sender has no more data to send.

A SYN flood is a denial-of-service attack that overwhelms a server with half-open TCP connections.

A port scan probes multiple ports to discover which services are exposed.

A firewall rule defines which traffic is allowed or denied based on source, destination, port, and protocol.

A VPN (Virtual Private Network) creates an encrypted tunnel over a public network.

Tunneling wraps one protocol inside another, often for private communication over a public network.

A proxy is an intermediary server that forwards requests between clients and servers.

A forward proxy acts on behalf of a client requesting resources from the internet.

A reverse proxy sits in front of servers and handles requests on their behalf.

Load balancing distributes traffic across multiple servers to improve performance and availability.

A web server serves web resources such as HTML, CSS, images, and APIs over HTTP or HTTPS.

An application server runs application logic and often serves business functions behind a web layer.

A database server stores and serves structured data used by applications.

A DNS server resolves domain names to IP addresses.

A DHCP lease is the temporary assignment of an IP address to a device.

APIPA (Automatic Private IP Addressing) assigns a self-contained private IP when DHCP fails, usually in the 169.254.0.0/16 range.

A broadcast address sends traffic to all devices in a network.

Multicast sends data to a selected group of hosts rather than all hosts or a single host.

Anycast sends packets to the nearest or best destination among multiple servers with the same address.

A route is a path or rule describing how packets should be forwarded to a destination.

A routing table contains destination networks and the next hop used to reach them.

A next hop is the next router or network device to which a packet should be forwarded.

Subnet masks are often written as CIDR notation like /24 or dotted decimal like 255.255.255.0.

CIDR (Classless Inter-Domain Routing) is a method for allocating IP addresses and routing more flexibly than the old class-based system.

VLSM (Variable Length Subnet Masking) allows different subnet sizes within the same address block.

Subnet size depends on the number of host bits. More host bits means more addresses per subnet, fewer subnets.

A network address is the first address in a subnet and is not usually assigned to hosts.

A broadcast address is the last address in a subnet used to reach all hosts inside it.

Subnets reduce broadcast domains, improve routing efficiency, and help organize networks by function or geography.

A broadcast domain is a network segment where broadcast traffic reaches all devices.

A collision domain is a network segment where multiple devices contend for the same medium.

Switches reduce collisions and allow simultaneous communication per port.

A VLAN (Virtual LAN) logically segments a network without changing physical topology.

VLANs improve network segmentation, performance, and security.

Trunking carries multiple VLANs across a link between switches.

IEEE 802.1Q is the VLAN tagging standard used on Ethernet networks.

Static routing uses manually configured routes.

Dynamic routing uses protocols such as OSPF and BGP to automatically learn routes.

OSPF (Open Shortest Path First) is a link-state routing protocol widely used inside enterprise networks.

BGP (Border Gateway Protocol) is used to exchange routing information between autonomous systems on the internet.

An autonomous system is a collection of IP networks under a single administrative control.

RIP (Routing Information Protocol) is a legacy distance-vector protocol used in smaller networks.

A routing loop occurs when packets circle between routers without reaching their destination.

They use metrics, route aging, split horizon, and link-state information.

A default route is the route used when there is no specific route for a destination.

A metric is a value used to choose between multiple possible routes.

A hop count is the number of routers a packet passes through.

MTU discovery finds the largest packet size that can pass without fragmentation.

Fragmentation splits a packet into smaller parts when it exceeds the MTU of a link.

It adds overhead, complexity, and may hurt performance or reliability.

A DNS forwarder sends unresolved queries to another DNS server.

A DNS zone is a portion of the DNS namespace managed by a specific authority.

A recursive resolver performs the work of resolving a domain name by querying other servers.

Authoritative DNS servers provide the final answer for a domain’s records.

TTL (Time To Live) is the time a DNS record is cached before refresh.

TCP is the transport protocol responsible for connection and reliability. HTTP is an application protocol that defines resource requests and responses.

A client sends a request, the server processes it, and returns a response.

A status code tells the client the result of the request, such as 200, 404, or 500.

HTTP keep-alive reuses a TCP connection for multiple HTTP requests.

HTTP/1.1 is a widely used HTTP version with persistent connections and pipelining support.

HTTP/2 introduces multiplexing, header compression, and binary framing for improved performance.

HTTP/3 runs over QUIC instead of TCP, reducing latency and improving multiplexing.

QUIC is a transport protocol designed for low-latency, secure, multiplexed network communication.

The TLS handshake negotiates protocol version, certificates, and session keys before secure communication.

TLS protects data in transit from eavesdropping, tampering, and impersonation.

Certificate validation ensures the server identity presented is trusted and matches the expected hostname.

A certificate authority signs digital certificates used to establish trust in TLS.

mTLS (mutual TLS) requires both client and server to authenticate using certificates.

A socket pair is the pair of local and remote endpoints used for a TCP or UDP connection.

A half-open connection exists when one side has accepted or sent data while the other side is not fully established.

Connection pooling reuses existing network connections instead of creating new ones repeatedly.

A reverse DNS lookup resolves an IP address back to a hostname.

A packet sniffer captures network traffic for analysis and troubleshooting.

Wireshark is a widely used packet analysis tool for inspecting network traffic.

netstat displays active network connections and listening ports on a device.

ss is a modern Linux socket inspection tool similar to netstat.

iptables is a Linux firewall utility that filters and forwards network traffic.

nftables is a modern Linux firewall framework replacing older iptables-based filtering.

A NAT table maps internal addresses to external addresses and ports for internet access.

Port forwarding redirects traffic arriving on a port to another device or port.

A DMZ (Demilitarized Zone) is a network segment hosting public-facing services separate from internal networks.

Segmentation divides networks into smaller logical or physical areas to isolate traffic and improve security.

A VPN concentrator handles many IPSec or SSL VPN connections from clients.

Network address planning assigns subnets and IP ranges logically to reduce conflict, support growth, and maintain security.

NAT allows private IPv4 networks to share a smaller set of public addresses.

Private addresses are not routable on the public internet; public addresses are.

DNS resolves names; DHCP provides addresses and network config. Together they make devices usable without manual configuration.

Host discovery identifies active devices on a network, often using ping or ARP.

Network scanning explores a range of hosts, ports, or services to understand the network.

The network edge is where local networks meet external networks or the internet.

A local route is used to send traffic directly to devices within the same network.

A remote route forwards traffic to a different network or destination.

A routing protocol is a set of rules for routers to exchange and compute routes.

A link-state protocol shares network topology information so routers can compute shortest paths.

A distance-vector protocol exchanges routing tables and chooses routes based on distance metrics.

Packet encapsulation wraps a packet with protocol headers as it moves down the stack.

Decapsulation removes protocol headers as data moves up the network stack toward the application.

Layering helps explain how protocols interact and why debugging network issues requires checking multiple layers.

Network troubleshooting is the process of identifying and fixing connectivity, performance, and configuration problems.

End-to-end connectivity means a packet can travel from one host to another across all required network layers.

Network reliability is the ability to provide consistent connectivity and service despite failures or congestion.

The goal is to understand how data moves, how devices identify each other, and how networks remain reliable, scalable, and secure.

It is a conceptual tool for understanding where a network problem may exist, such as physical media, addressing, routing, or application protocol errors.

Link-layer addressing such as MAC addresses is used only within a local segment and is not routed across the internet.

Routers use destination IP addresses, routing tables, and longest-prefix matching to forward packets.

Longest-prefix matching selects the most specific route for a destination among multiple routing table entries.

Route aggregation reduces routing table size and improves scalability in large networks.

BGP routers exchange network reachability information across autonomous systems, allowing internet-scale routing.

Policy routing forwards traffic based on rules beyond destination prefix, such as source, protocol, or application-specific criteria.

Equal-Cost Multi-Path routing sends traffic across multiple equal-cost paths for load balancing and redundancy.

MPLS (Multiprotocol Label Switching) uses labels for faster forwarding in service provider and enterprise networks.

QoS (Quality of Service) prioritizes traffic classes to improve latency, reliability, or throughput for critical applications.

Traffic shaping controls the rate or pattern of transmitted traffic to enforce policy or avoid congestion.

Traffic policing enforces limits by dropping or marking packets that exceed configured thresholds.

Congestion occurs when demand exceeds available network capacity, causing queue growth and packet loss.

AIMD (Additive Increase / Multiplicative Decrease) is a standard congestion control strategy in TCP.

TCP increases data flow gradually and reduces it sharply when packet loss or delay indicates congestion.

Slow start is the initial phase of TCP congestion control where the sender starts conservatively and ramps up quickly.

Fast retransmit detects missing packets and retransmits them before the retransmission timeout expires.

Fast recovery speeds normal transmission after a packet loss, instead of waiting for a full timeout cycle.

Additive increase means the sender gradually increases the congestion window as network conditions allow.

Multiplicative decrease reduces the congestion window sharply when congestion is detected.

Dual-stack networking supports both IPv4 and IPv6 simultaneously on the same device or network.

NAT64 allows IPv6-only clients to communicate with IPv4 servers through translation.

DNS64 synthesizes AAAA records for IPv6 clients so they can access IPv4-only services via NAT64.

Anycast DNS sends queries to the nearest DNS server replica, improving resilience and latency.

HTTP connection reuse reduces overhead by keeping existing TCP connections open for multiple requests.

Connection coalescing merges multiple logical network connections into fewer physical connections for efficiency.

Multiplexing allows multiple independent streams or requests to share a single connection efficiently.

Head-of-line blocking occurs when one delayed packet blocks the delivery of others in the same flow.

Because older TCP-based architectures have issues with blocking, especially under loss conditions.

0-RTT allows reconnection without full handshake when connection context is already known.

HTTP/3 runs over QUIC, which integrates encryption at the transport layer.

A SYN cookie is a technique used to protect servers from SYN flood attacks without storing many half-open connections.

A DDoS attack overwhelms a target with a flood of traffic from many sources, often distributed across botnets.

By rate limiting, filtering, CDN use, scrubbing centers, and distributed defense systems.

A CDN (Content Delivery Network) caches content near users to improve performance and reduce origin load.

Health checks verify that backend servers are available before sending traffic to them.

Session affinity keeps a client connected to the same backend for repeated requests, often for stateful workloads.

A network intrusion is unauthorized access or malicious activity on a network.

Packet filtering allows or denies traffic based on network attributes such as IP, port, and protocol.

Deep packet inspection examines packet payloads to identify patterns, protocols, or malicious content.

A transparent proxy intercepts traffic without requiring client configuration.

An explicit proxy requires clients to configure proxy settings.

An ingress controller manages inbound traffic into a Kubernetes or application environment.

Egress filtering restricts outbound traffic to approved destinations and services.

An ACL (Access Control List) defines which traffic is allowed or denied based on matching rules.

It isolates critical systems from general user traffic to reduce lateral movement and blast radius.

Lateral movement is the movement of an attacker across internal systems after initial access.

Network forensic analysis inspects network data to understand what happened during a security event.

Packet capture retention is the storage policy for captured traffic used for troubleshooting or investigations.

Network telemetry is observations from network devices such as flows, counters, and packet statistics.

NetFlow is a protocol for collecting IP traffic metadata for analysis and capacity planning.

sFlow samples network traffic and exports metadata for monitoring and analytics.

SNMP (Simple Network Management Protocol) is used to monitor and manage network devices.

RMON (Remote Monitoring) provides remote monitoring of network traffic and device health.

The management plane handles device configuration, monitoring, and operational control.

The control plane decides how packets are routed and how network state is computed.

The data plane forwards actual user traffic based on the decisions of the control plane.

It improves scalability, manageability, and operational clarity in modern networks.

SDN (Software-Defined Networking) decouples the control plane from the data plane for centralized management and automation.

NFV (Network Functions Virtualization) runs network functions such as routers and firewalls as software instead of dedicated hardware.

Overlay networking creates a virtual network on top of an underlying physical network.

VXLAN is a tunneling protocol used for overlay networking in data centers and cloud environments.

Underlay networking is the physical or infrastructure network that carries overlay traffic.

Network virtualization abstracts physical networking resources into logical networks and services.

Hardware offload moves tasks such as packet filtering or encryption into optimized hardware for performance gains.

NIC teaming combines multiple network interfaces to provide redundancy or higher throughput.

A network sensor monitors traffic for anomalies, inspection, or security detection.

Network forensics reconstructs events using captured data, packet traces, and traffic logs.

Packet timestamps are used to reconstruct timing and ordering across network events.

A handshake timeout occurs when a TCP connection cannot be established within an expected time window.

A retransmission timeout occurs when a sender waits too long without acknowledgment and re-sends the data.

Slow path forwarding is packet handling by software or control logic rather than hardware acceleration.

Fast path forwarding is optimized hardware-level forwarding of traffic.

Packet classification identifies traffic type or policy group based on fields like IP, port, and protocol.

A service chain is a sequence of network functions applied to a packet, such as firewall, NAT, and load balancing.

Zero-trust networking assumes no trust by default and requires verification for every access request.

Identity-based networking authorizes traffic or access based on identity rather than just network location.

Automation reduces human errors, speeds changes, and enables consistent deployment at scale.

Intent-based networking allows administrators to define desired outcomes, and the system translates them into configuration.

Network observability is the ability to infer full behavior of a network from telemetry, logs, and traces.

Cloud networking abstracts physical infrastructure into virtual networks, load balancers, VPCs, and service discovery.

A VPC (Virtual Private Cloud) is a private, isolated network environment in the cloud.

A cloud subnet is a segment of a VPC used to isolate workloads and manage routing.

A security group is a cloud firewall rule set applied to instances or workloads.

An availability zone is an isolated data center location used in cloud platforms for resilience.

An edge network is the boundary between end users and backend services, often involving CDNs and regional gateways.

Latency budget design assigns acceptable delay targets to services, dependencies, and network hops.

Because performance, security, cost, and complexity often pull in different directions.

The hardest part is often understanding interactions between protocols, topology, policy, and real-world failures.

It helps engineers diagnose system behavior, design scalable systems, and build secure, reliable communication paths.