Networking

The client sends SYN with its initial sequence. The server replies SYN-ACK, acknowledging the client's and offering its own. The client ACKs the server's. After these three segments both sides have synced sequence numbers and the connection is ESTABLISHED, ready for data.

The client asks a recursive resolver, which walks the hierarchy if not cached: root servers point to the TLD servers, which point to the domain's authoritative servers that return the record. The resolver caches answers up to their TTL. Queries use UDP/53, falling back to TCP for large responses. Recursive resolvers do the legwork; authoritative servers own the zone's records.

A switch operates at layer 2 (data link), forwarding Ethernet frames by MAC within a segment. A router operates at layer 3 (network), forwarding IP packets between networks by IP. SSH is a layer 7 (application) protocol. The gotcha: SSH rides on TCP (layer 4) but is application-layer, not transport.

TCP is connection-oriented and reliable — handshake, ordering, acks, retransmission — at the cost of latency. UDP is connectionless and best-effort: no handshake, no retransmit, lower latency. Real-time voice prefers UDP: a late retransmitted packet is useless to play back, so dropping it keeps latency low, which matters more than perfect delivery.

ARP (Address Resolution Protocol) maps an IPv4 address to a MAC on a local segment. To reach an IP, a host broadcasts an ARP request ("who has this IP?") to ff:ff:ff:ff:ff:ff; the owner replies with its MAC, cached by the sender. ARP works at layer 2 within one broadcast domain; routers handle traffic beyond it.

The classic quick test: telnet host port — a successful connect means the port is open. Better tools: nc -zv host port (netcat, scriptable, no payload sent) and nmap -p port host to scan a range. A ping only proves ICMP reachability of the host, not that a specific TCP port is listening.

A /25 leaves 7 host bits, so 2^7 = 128 total addresses. Two are reserved — the network address (10.0.0.0) and the broadcast (10.0.0.127) — leaving 126 usable for hosts. The general rule is 2^(32−prefix) total addresses, minus 2 for network and broadcast on an IPv4 subnet.

The shell finds curl via $PATH. curl resolves example.com to an IP — /etc/hosts then DNS per nsswitch.conf (recursive resolver → root → TLD → authoritative). It opens TCP to port 443 with the three-way handshake, then performs the TLS handshake (certificate validation, key exchange). Over that encrypted channel it sends the HTTP request; the server replies with a status code and body.

The client opens a TCP connection with the three-way handshake to port 21 — the control channel for commands and replies. Data transfers use a separate data channel. In active mode the server connects back to the client; in passive mode the client opens a second connection to a server-chosen port — passive is firewall/NAT-friendly. Splitting control from data is FTP's defining trait.

A load balancer spreads incoming requests across several backends to raise throughput and availability. Round-robin sends each request to the next server in turn, ignoring load. Least-connections picks the backend with the fewest active connections, better for uneven request durations. Ip-hash maps a client's IP to a fixed backend, giving session stickiness.

NAT rewrites IP addresses in packets crossing a boundary, mapping private addresses to public ones. SNAT rewrites the source address so internal hosts share a public IP outbound. DNAT rewrites the destination to publish an internal service behind a public IP. PAT (NAT overload) is SNAT that also rewrites ports, so many hosts share one public IP, distinguished by port number.

A router matches the destination IP against its routing table and forwards to the next hop of the route with the longest prefix match — the most specific route wins. When several sources offer a route to the same prefix, administrative distance breaks the tie: a lower distance is more trusted (connected < static < OSPF < BGP), so the router installs that one.

AAA stands for Authentication (who you are), Authorization (what you may do), and Accounting (logging what you did). Network devices delegate it to a central server so credentials aren't configured per-device. The two main protocols are RADIUS (UDP, combines authn and authz) and TACACS+ (TCP, separates the three A's and encrypts the whole payload, common for device administration).

DDoS attacks fall into three layers. Volumetric attacks (UDP/ICMP floods, amplification) saturate the link with raw bandwidth. Protocol attacks (SYN flood) exhaust connection-table or firewall state. Application-layer attacks (HTTP flood) send valid-looking requests that consume server CPU/DB. Each targets a different resource, and the source is distributed across many hosts to be hard to block.

Three families. Distance-vector (RIP) shares its whole routing table with neighbours and picks routes by hop count — simple but slow to converge. Link-state (OSPF) floods link descriptions so every router builds a topology map and runs shortest-path (Dijkstra) — fast convergence, more CPU/memory. Path-vector (BGP) advertises full AS-paths and is policy-driven for inter-domain scale. They trade simplicity for convergence and scale.

An L2 switch forwards Ethernet frames by MAC address within one broadcast domain. A router forwards IP packets between networks by IP address (L3). An L3 switch is a switch with hardware routing — it does both, fast. An Ethernet frame carries: preamble + start-frame-delimiter, destination MAC, source MAC, EtherType/length, the payload, and a trailing CRC (FCS) for error detection.

Name resolution is overridden locally. ping resolves the name through nsswitch.conf, which usually checks /etc/hosts before DNS — so a static entry there (mapping shop.example.com to the wrong IP) wins over the real DNS answer. The mismatch between ping's IP and nslookup's confirms it, since nslookup queries DNS directly. Fix: clean /etc/hosts and audit how the rogue entry appeared.

Path MTU Discovery finds the largest packet that can cross a path without fragmentation. In IPv4 the sender marks packets Don't-Fragment; a router whose link MTU is too small drops it and returns an ICMP 'fragmentation needed' with the smaller MTU, so the sender shrinks. If a firewall blocks that ICMP, packets vanish silently and connections hang (a black hole). IPv6 has no in-path fragmentation and relies on PMTUD entirely.

eBGP runs between different autonomous systems; iBGP runs between routers inside one AS. A core rule: a router does not re-advertise an iBGP-learned route to another iBGP peer, preventing loops inside the AS. So every iBGP speaker must peer with every other — a full mesh — or use route reflectors, which may pass iBGP routes onward and scale the AS without N² sessions.

BGP picks a path by running attributes in order: highest weight (local), then local-preference, locally-originated, shortest AS-path, lowest origin, lowest MED, eBGP over iBGP, lowest IGP metric, then tie-breakers. To steer your own outbound traffic you set local-preference (it stays inside your AS). To influence inbound traffic you affect what others prefer — AS-path prepend, MED, or communities — which is harder since the choice is theirs.

IPsec sets up via IKE in two phases. Phase 1 (IKE SA) authenticates the peers (pre-shared key or certificates) and builds a secure channel via a Diffie-Hellman exchange. Phase 2 (IPsec SA) negotiates the data SAs and keys for ESP/AH. Tunnel mode encrypts the whole original IP packet under a new outer IP header — used for site-to-site gateways. Transport mode protects only the payload, keeping the original header — host-to-host.

An overlay is a virtual network built on top of a physical (underlay) one by encapsulating traffic in tunnels, decoupling logical topology from physical wiring. MPLS labels packets and forwards by label-switched paths in provider/WAN cores — fast and traffic-engineered. VXLAN encapsulates L2 Ethernet frames inside UDP/IP, stretching L2 segments across an L3 fabric in data centres and scaling to 16M segments versus VLAN's 4094.

The RIB (Routing Information Base) is the control-plane table holding all routes from every protocol — possibly several candidates per prefix — used to decide the best path. The FIB (Forwarding Information Base) is the data-plane table, the distilled best paths used to forward packets, programmed into hardware (TCAM) for line-rate lookup. ECMP lets the FIB hold equal-cost next hops. Control plane chooses; data plane forwards.