Networking Crash Course#

Table of Contents#

1. 1. How the Internet Works: Packets & Routers
2. 2. OSI vs TCP/IP Layer Models
3. 3. MAC Addresses, Ethernet & ARP
4. 4. IPv4, IPv6, CIDR & NAT
5. 5. Transport Layer: TCP vs UDP
6. 6. TCP 3-Way Handshake & Teardown
7. 7. DNS: Domain Name System
8. 8. HTTP Evolution: HTTP/1.1, HTTP/2 & HTTP/3
9. 9. TLS 1.3 Handshake & HTTPS
10. 10. Load Balancing: Layer 4 vs Layer 7
11. 11. AWS Cloud Networking: VPC, Security Groups & NACLs
12. 12. Essential Network Diagnostics CLI
13. 13. Networking Quick Reference

1. How the Internet Works: Packets & Routers#

The modern Internet is a packet-switched network. When you stream a 4K video or load a web page, data is sliced into discrete chunks called packets (typically ~1500 bytes each, bounded by the MTU — Maximum Transmission Unit).

Each packet contains:

• Header: Metadata including Source IP, Destination IP, sequence numbers, and checksums.
• Payload: The raw slice of application data being transmitted.

Packet Switching vs Circuit Switching: Traditional telephone calls used dedicated physical circuits (if a line went quiet, bandwidth was wasted). Packet switching allows billions of devices to share the exact same optical fiber and copper wires by interleaving packets dynamically.

2. OSI vs TCP/IP Layer Models#

Network communication is organized into modular abstraction layers. While the OSI 7-layer model is the theoretical reference standard, the practical Internet runs on the TCP/IP 4-layer stack:

1. Application Layer (OSI 7, 6, 5): User-facing protocols (HTTP, DNS, SSH, WebSockets, SMTP). Data unit: Message / Stream.
2. Transport Layer (OSI 4): End-to-end process-to-process communication, port numbers, reliability, and flow control (TCP, UDP, QUIC). Data unit: Segment (TCP) / Datagram (UDP).
3. Network Layer (OSI 3): Host-to-host logical routing across multiple interconnected networks (IPv4, IPv6, ICMP, BGP). Data unit: Packet.
4. Link / Physical Layer (OSI 2, 1): Hop-to-hop physical delivery between directly connected hardware on the same local subnet (Ethernet, Wi-Fi, MAC addresses, fiber optics). Data unit: Frame / Bits.

3. MAC Addresses, Ethernet & ARP#

Within a Local Area Network (LAN), devices communicate using their globally unique 48-bit MAC (Media Access Control) Address (e.g. 52:54:00:12:34:56) burned into the Network Interface Card (NIC).

• Address Resolution Protocol (ARP): Bridges Layer 3 (IP) to Layer 2 (MAC). When your computer wants to send a packet to local IP 192.168.1.1, it broadcasts: "Who has IP 192.168.1.1? Tell MAC AA:BB:CC:DD:EE:FF". The router responds with its physical MAC address.
• Network Switch: Operates at Layer 2, learning MAC addresses per port to forward frames only to the destination port rather than broadcasting to all ports.

4. IPv4, IPv6, CIDR & NAT#

IP addresses route packets across heterogeneous networks globally:

• IPv4: 32-bit addresses written as 4 decimal octets (e.g. 172.217.16.206), yielding ~4.3 billion total addresses.
• IPv6: 128-bit addresses written in hexadecimal (e.g. 2607:f8b0:4005:805::200e), effectively providing an infinite address space.
• CIDR (Classless Inter-Domain Routing): Uses prefix notation (e.g. 192.168.1.0/24). The /24 means the first 24 bits represent the network prefix, leaving 8 bits (256 - 2 = 254 hosts) for individual machine addresses.
• NAT (Network Address Translation): Allows thousands of private devices on a home or cloud VPC subnet (e.g. 10.0.0.0/8, 192.168.0.0/16) to share a single public IP address by tracking ephemeral port mappings.

5. Transport Layer: TCP vs UDP#

Operating systems provide two fundamental transport protocols over IP:

1. TCP (Transmission Control Protocol):
   • Connection-oriented: Requires a 3-way handshake before data transfer.
   • Reliable & Ordered: Every byte is acknowledged; lost packets are retransmitted; packets arriving out-of-order are reassembled seamlessly.
   • Congestion & Flow Control: Automatically throttles sending rate to avoid saturating network buffers.
   • Used by: HTTP/1.1, HTTP/2, SSH, PostgreSQL, Redis, SMTP.
2. UDP (User Datagram Protocol):
   • Connectionless: Sends packets ("fire and forget") with zero setup delay.
   • Unreliable & Unordered: No acknowledgments, no retransmissions, no packet reordering.
   • Used by: DNS queries, live video streaming, multiplayer games, VoIP, and modern HTTP/3 (via QUIC).

6. TCP 3-Way Handshake & Teardown#

Before any data can flow over a TCP connection, client and server synchronize sequence numbers:

Client                                          Server
  |                                               |
  | -------- SYN (seq = X) -------------------->  |  1. Client requests connection
  |                                               |
  | <------- SYN-ACK (seq = Y, ack = X + 1) ----  |  2. Server acknowledges and responds
  |                                               |
  | -------- ACK (seq = X + 1, ack = Y + 1) ----> |  3. Connection ESTABLISHED
  |                                               |
  | ================= Data Transfer ============= |
  |                                               |
  | -------- FIN (I'm done sending) ------------> |  4. Graceful Teardown
  | <------- ACK -------------------------------- |
  | <------- FIN -------------------------------- |
  | -------- ACK -------------------------------> |  (Client enters TIME_WAIT)

7. DNS: Domain Name System#

DNS is the decentralized phonebook of the Internet, translating human-friendly names (techtoday.click) into machine-routable IP addresses (44.193.134.238):

1. Browser / OS Cache: Checks local memory and /etc/hosts.
2. Recursive Resolver (e.g. 8.8.8.8, 1.1.1.1): If not cached, the resolver queries the root name servers (.).
3. Root Server: Directs query to the .click Top-Level Domain (TLD) server.
4. TLD Server: Directs query to the Authoritative Name Server hosting records for techtoday.click.
5. Authoritative Server: Returns the final A record (IPv4) or AAAA record (IPv6).

8. HTTP Evolution: HTTP/1.1, HTTP/2 & HTTP/3#

• HTTP/1.1 (1997): Text-based protocol. Introduced persistent TCP connections (Keep-Alive), but suffered from Head-of-Line (HoL) Blocking: only one request/response could travel over a single TCP socket at a time.
• HTTP/2 (2015): Binary protocol. Introduced Multiplexing: multiple interleaved requests and responses travel concurrently over a single TCP connection; header compression (HPACK).
• HTTP/3 (2022): Replaces TCP with QUIC running over UDP. Solves transport-layer packet-loss HoL blocking, incorporates zero-round-trip encryption (0-RTT), and supports seamless IP migration when switching from Wi-Fi to cellular.

9. TLS 1.3 Handshake & HTTPS#

HTTPS secures plain HTTP traffic using Transport Layer Security (TLS 1.3):

1. Confidentiality: Symmetric AES-256-GCM / ChaCha20 encryption ensures eavesdroppers only see scrambled ciphertext.
2. Integrity: Cryptographic hashes prevent data tampering in flight.
3. Authentication: X.509 certificates signed by trusted Certificate Authorities (CAs) prove the server owns the domain name.
4. 1-RTT Handshake: TLS 1.3 negotiates symmetric session keys using Elliptic Curve Diffie-Hellman (ECDHE) in just a single round-trip before application data flows.

10. Load Balancing: Layer 4 vs Layer 7#

1. Layer 4 Load Balancers (Transport Layer • AWS NLB, HAProxy TCP mode, IPVS):
   • Operates at the transport layer (IP and Port only, 4-tuple: source IP, source port, dest IP, dest port).
   • Does not decrypt TLS or parse HTTP headers; passes raw TCP/UDP streams through.
   • Delivers millions of packets per second with ultra-low latency and minimal memory/CPU overhead.
2. Layer 7 Load Balancers (Application Layer • AWS ALB, Nginx, Envoy, Traefik):
   • Operates at the application layer (terminates TLS, parses HTTP headers, cookies, URL paths).
   • Can route /api/* to Service A and /static/* to S3/CDN.
   • Supports intelligent retry policies, gRPC stream routing, sticky sessions, and rate-limiting.

11. AWS Cloud Networking: VPC, Security Groups & NACLs#

Cloud networking in AWS provides a virtualized software-defined network that isolates resources, controls traffic flow, and secures communication boundaries:

1. VPC & Subnets: The Foundation

• VPC (Virtual Private Cloud): Your own isolated virtual network within an AWS region, defined by a private CIDR block (e.g. 10.0.0.0/16, providing 65,536 private IP addresses).
• Public Subnet: A subnet whose route table has an explicit route to an Internet Gateway (IGW): 0.0.0.0/0 → igw-xxxx. EC2 instances here can be assigned public IPs and receive direct traffic from the public Internet (ideal for public web servers or load balancers).
• Private Subnet: A subnet with no direct route to the Internet. Instances only have private IPs (e.g. 10.0.2.15), shielding databases, internal microservices, and backend workers from direct public scans or attacks.
• NAT Gateway (Network Address Translation): Placed in a public subnet so instances in private subnets can initiate outbound requests (e.g. downloading OS security updates or calling external APIs) while preventing unauthorized external clients from initiating inbound connections to them.

2. Security Groups (Instance-Level Firewall • Stateful)

A Security Group acts as a virtual firewall controlling traffic directly at the Elastic Network Interface (ENI) level of an EC2 instance or container:

• Stateful: If an inbound request is permitted (e.g. port 443 HTTPS), the return/response traffic is automatically allowed back out, regardless of outbound rules.
• Default Behavior: Denies all inbound traffic by default; allows all outbound traffic by default.
• Allow Rules Only: You can only write Allow rules (you cannot write explicit Deny rules in a Security Group).
• Security Group Referencing: Instead of hardcoding IP addresses, rules can reference another Security Group ID (e.g. "Allow port 5432 PostgreSQL only from instances attached to sg-web-backend").

3. Network ACLs (Subnet-Level Firewall • Stateless)

A Network Access Control List (NACL) acts as an outer perimeter firewall controlling traffic entering and exiting an entire subnet:

• Stateless: Inbound and outbound rules are evaluated completely independently. If you allow inbound traffic on port 80/443, you must also explicitly allow outbound traffic on ephemeral ports (1024–65535) so the server can send the response packet back!
• Rule Numbering & Order: Rules are processed in strict numerical order (e.g. rule 100, 200, 300). The first rule that matches the packet determines the outcome. The final catch-all rule is an implicit * Deny All.
• Supports Allow and Deny: Unlike Security Groups, NACLs can explicitly block abusive or malicious IP addresses (e.g. Rule 50: Deny 198.51.100.42/32).

4. Secure Access: AWS VPN & Bastion Hosts

How developers and operators securely connect into private subnets without exposing servers to the public Internet:

• AWS Client VPN: A managed software VPN endpoint. Remote engineers install an OpenVPN client on their laptops, authenticate via corporate SSO (or certificates), and receive an internal IP address that routes directly into the private VPC subnets.
• AWS Site-to-Site VPN: Encrypted IPsec tunnel connecting an entire corporate office or data center network to your AWS VPC via a Virtual Private Gateway (VGW) or Transit Gateway (TGW).
• Bastion Host (Jump Box): A hardened EC2 instance placed in the public subnet with an extremely strict Security Group (allowing SSH only from your specific office IP). Administrators SSH into the bastion, and from there jump to private instances.
• AWS Systems Manager (SSM) Session Manager: Modern cloud-native alternative to bastions. Allows one-click shell access to private EC2 instances through IAM authentication without needing any open inbound ports or public IPs.

12. Essential Network Diagnostics CLI#

# Test end-to-end connectivity and latency
ping -c 4 8.8.8.8

# Inspect DNS resolution flow and records
dig techtoday.click +trace
nslookup google.com

# Trace intermediate router hops
traceroute 1.1.1.1

# Inspect active TCP sockets and listening server ports
ss -tulpn
netstat -tuln

# Inspect HTTP requests, response headers, and timings
curl -Iv https://techtoday.click

# Capture live network packets on eth0 interface
sudo tcpdump -i eth0 -n port 80 or port 443

13. Networking Quick Reference#

Next Steps: Advance to enterprise routing, BGP, TCP congestion algorithms, and kernel sysctl tuning in the Networking Detailed Course. Return to the TechToday Homepage.