The OSI Model
The 7-layer reference model — a mental framework for networking The OSI (Open Systems Interconnection) model was developed by the ISO in 1984 as a conceptual…
Networking
The TCP/IP Model
The 4-layer model that actually runs the internet The TCP/IP model (also called the Internet Protocol Suite) is the practical, implementation-driven…
Encapsulation
How data gets wrapped at each layer for transmission Encapsulation is the process by which each layer of the networking stack wraps the data from the layer…
Ethernet
Layer 2 — the protocol that connects everything on a LAN Every piece of data that moves across a local network is wrapped in an Ethernet frame. The frame…
Switching
How switches learn, forward, and filter traffic A switch is fundamentally a MAC-address-to-port mapping engine. It maintains a table (historically called the…
VLANs (802.1Q)
Logical network segmentation at Layer 2 A VLAN (Virtual LAN) is a logical partition of a physical switch into multiple independent broadcast domains. Without…
IPv4
32-bit addressing, subnetting, and the protocol that built the internet An IPv4 address is a 32-bit number, written as four octets in dotted-decimal…
IPv6
128-bit addresses — solving exhaustion and simplifying the protocol IPv6 addresses are written as 8 groups of 4 hexadecimal digits, separated by colons. The…
IP Routing
How routers make forwarding decisions Every host and router maintains a routing table (also called a FIB — Forwarding Information Base). When a packet…
Dynamic Routing (OSPF & BGP)
OSPF, BGP, and how the internet finds paths Routes within a single Autonomous System (AS). Optimized for fast convergence within a single administrative domain.
TCP Deep Dive
Reliable, ordered, connection-oriented transport Every TCP segment carries a 20-byte minimum header (up to 60 bytes with options). This header is the control…
TCP State Machine
Connection lifecycle from LISTEN to CLOSED Every TCP connection traverses a well-defined state machine. Understanding these states is essential for…
UDP
Connectionless, fast, no guarantees UDP (User Datagram Protocol) is the other major Layer 4 transport protocol. Where TCP provides a reliable, ordered byte…
Ports & Sockets
How the OS multiplexes network connections A port is a 16-bit number (0-65535) that identifies a specific process or service on a host. Ports exist at Layer…
How DNS Works
The complete resolution process — from query to answer DNS is not a single server or a flat lookup table. It is a globally distributed, hierarchical database…
DNS Record Types
A, AAAA, CNAME, MX, TXT, SRV, and more DNS is more than name-to-IP mapping. Each record type serves a specific purpose in the DNS ecosystem. Here is a…
Advanced DNS
Split-horizon, anycast, DNSSEC, and encrypted DNS Split-horizon (also called "split-brain" or "views") is a DNS configuration where the same domain name…
HTTP (1.1 / 2 / 3)
The application protocol of the web — from 1.1 to 3 HTTP (Hypertext Transfer Protocol) is a request-response protocol operating at Layer 7. The client sends…
TLS
Transport Layer Security — encryption, authentication, integrity TLS (Transport Layer Security) sits between the application layer and the transport layer.…
mTLS & Certificate Management
Mutual authentication and practical certificate operations In standard TLS, only the server authenticates itself to the client by presenting a certificate.…
Web Servers
What they do, how they handle connections, and how they fit in the stack A web server is a process that listens on a TCP socket (typically port 80/443),…
Firewalls
Packet filtering — stateless, stateful, and Linux iptables/nftables A stateless firewall evaluates each packet independently against a static rule set. It…
NAT
Network Address Translation — the IPv4 survival hack IPv4 has ~4.3 billion addresses. There are ~20+ billion connected devices. NAT is the hack that made…
VPNs
Encrypted tunnels — IPsec, OpenVPN, and WireGuard A VPN creates an encrypted tunnel between endpoints, making it appear as if they share a private network…
NAT Types & Behavior
How different NATs affect connectivity — RFC 4787 classification The old "cone NAT" terminology is imprecise and frequently misused. RFC 4787 (2007) replaced…
STUN, TURN & ICE
The protocols that punch through NATs Defined in RFC 8489 (supersedes RFC 5389 and the original RFC 3489). STUN's core purpose is simple: tell a client what…
Tailscale Architecture
How Tailscale achieves direct, encrypted connections through NATs Tailscale's architecture is split into two completely separate planes: a control plane…
Tailscale Features
MagicDNS, ACLs, subnet routers, and the full feature set Every device on a tailnet gets a stable DNS name automatically. No manual DNS records, no editing…
NAT Traversal Deep Dive
How direct connections happen through NATs — based on Tailscale's "How NAT Traversal Works" Devices behind NAT lack direct internet reachability. The core…
Namespaces & Virtual Interfaces
The kernel primitives that make container networking possible A network namespace is a kernel construct that provides a complete, independent copy of the…
Netfilter Internals
The kernel framework behind iptables, conntrack, and NAT Netfilter is a kernel framework that provides hook points in the network stack where kernel modules…
iproute2 & Traffic Control
Modern Linux networking tools: ip, tc, and sysctl knobs iproute2 is the modern replacement for the legacy net-tools package. It provides a unified interface…
eBPF Fundamentals
Sandboxed programs in the kernel — the programmable data plane eBPF (extended Berkeley Packet Filter) allows you to run sandboxed, event-driven programs…
XDP & tc-bpf
Programmable packet processing at line rate XDP is the earliest programmable hook point in the Linux networking stack. It processes packets at the NIC driver…
Cilium
eBPF-powered networking for Kubernetes Cilium is an eBPF-based CNI (Container Network Interface) plugin for Kubernetes. It replaces traditional…
Cloud-Init Basics
The industry standard for instance initialization Cloud-init is the de facto standard for configuring Linux instances at first boot. It handles everything…
User-Data & Cloud-Config
Configuring instances with YAML and scripts User-data is the blob you pass to an instance at launch time. Cloud-init inspects the first bytes to determine…
Network Configuration
Configuring networking via cloud-init and Netplan Cloud-init supports two network configuration formats. The format is specified in the network-config data…
Docker Networking
Container networking from the kernel up Docker networking is not magic — it is built entirely on Linux kernel primitives: network namespaces, virtual…
CNI (Container Network Interface)
The CNCF standard that Kubernetes uses for pod networking CNI (Container Network Interface) is a CNCF specification that defines a standard interface between…
Pod Networking
How every Pod gets a unique, routable IP The Kubernetes networking model is built on three non-negotiable constraints. Every CNI plugin must satisfy all…
Services
Service discovery, load balancing, and the kube-proxy implementation Pod IPs are ephemeral. Every time a Pod restarts, gets rescheduled, or scales, it gets a…
Ingress & Gateway API
L7 routing — exposing services to the outside world Ingress provides L7 (HTTP/HTTPS) routing into the cluster. Instead of one LoadBalancer per Service…
Network Policies
Pod-level firewall rules and service mesh basics By default, Kubernetes has a flat, open network — every Pod can talk to every other Pod, across all…
