Networking for beginners
A series for those who write software, run servers or simply want to understand what happens between pressing Enter in the address bar and the page appearing.
The series has one principle: for every protocol, not only why it is needed but how it works. Which bytes go over the wire, who answers them, what happens when something breaks. That is why almost every part has packet headers, commands and tcpdump output. To repeat the examples, any Linux machine (WSL will do) with tcpdump and Wireshark on your workstation is enough.
The order is bottom-up through the stack and then outwards: first the basics (the models, Ethernet, Wi-Fi and PPPoE), then IPv4 with ARP and ICMP, the UDP and TCP transports, the DHCP and DNS services, a separate block on IPv6 with Neighbor Discovery, SLAAC and DHCPv6, then VLAN, VXLAN, IPsec with IKEv2, VPNs and proxies, routing with OSPF and BGP, and finally TLS with certificates.
The OSI and TCP/IP models
The first part of a networking series: why the stack is layered, the OSI and TCP/IP models, encapsulation, and who handles which headers along the way.
Ethernet
An Ethernet frame byte by byte, MAC address structure, the 64-byte minimum frame, the switch address table, duplex, copper and fibre, loops and STP.
Wi-Fi
How radio differs from cable: CSMA/CA, channels and width, 802.11 frames, joining an AP, the WPA2 handshake and WPA3 SAE, hidden nodes, roaming.
PPPoE
Why ISPs wrap PPP in Ethernet: finding the concentrator with PADI, PADO, PADR, PADS, the PPP session with LCP, PAP, CHAP and IPCP, and why MTU is 1492.
IPv4 — addresses, masks and subnets
What an IPv4 address and mask are, computing the network and host count, subnetting, how a host decides it needs a gateway, and non-routable addresses.
IPv4 — header, routing and NAT
The IPv4 header field by field, why TTL exists, longest prefix match, fragmentation and why it is avoided, how NAT works, port forwarding and CGNAT.
ARP
How a host learns a neighbour's MAC: ARP request and reply, the neighbour table and its states, gratuitous ARP, proxy ARP, address conflicts and spoofing.
ICMP
How ICMP messages work, what ping and traceroute do, how Path MTU Discovery works and what breaks when a firewall blocks ICMP.
UDP
What the transport layer adds to IP: the 8-byte UDP header, ports and sockets, what connectionless means, UDP behind NAT and direct connections through NAT.
TCP
How TCP turns IP into a reliable stream: header and sequence numbers, the handshake, retransmission and SACK, windows and slow start, TIME_WAIT, tcpdump.
DHCPv4
How a machine with no address gets an address, gateway and DNS: DISCOVER, OFFER, REQUEST, ACK byte by byte, options, leases, relay, reservations, two servers.
DNS
The name tree and zones, recursive and authoritative servers, a query's path from stub to answer, the DNS format, record types, TTL, DNSSEC, DoT and DoH, dig.
IPv6: addresses and the header
How IPv6 addresses are written, link-local, ULA, multicast and anycast, the IPv6 header and extension headers, fragmentation, and why there is no NAT.
ICMPv6 and Neighbor Discovery
ICMPv6 as a mandatory part of IPv6, Neighbor Discovery instead of ARP, finding routers via RA, DAD, MLD, Redirect, and why ICMPv6 must not be filtered.
SLAAC
How an IPv6 host builds an address without a server: RA prefix plus interface ID, valid and preferred lifetimes, the A, L, M, O flags, radvd.
DHCPv6
Why DHCPv6 exists next to SLAAC and how it differs from DHCPv4: DUID, multicast, IA, stateful and stateless modes, the message exchange, prefix delegation.
VLAN
How one network becomes several: the 802.1Q tag, access and trunk ports, native VLAN, MAC tables per VLAN, router on a stick, L3 switches, VLAN hopping, Linux.
VXLAN
Why VXLAN when there is VLAN: an Ethernet frame inside UDP, VNI, VTEP and underlay, flood-and-learn and EVPN, overhead and MTU, clouds, Kubernetes, Linux.
IPsec and IKEv2
How IPsec encrypts at the network layer: ESP and AH, modes, SA and SPI, policies; how IKEv2 agrees on keys: exchanges, PSK, certificates, EAP, NAT-T, MOBIKE.
VPN and proxies
What a VPN is in terms of interfaces and routes, full and split tunnels, HTTP CONNECT and SOCKS5, how a proxy differs from a VPN, and what DPI sees.
OSPF
Why dynamic routing and how link-state differs from distance-vector: Hello, adjacency, LSA, Dijkstra, DR and BDR, areas, FRR on two routers.
BGP
How autonomous systems agree on routes: the BGP session, messages, path attributes, eBGP and iBGP, route reflectors, best path selection, RPKI, FRR.
TLS and certificates
What TLS promises, the TLS 1.3 handshake, forward secrecy, X.509 certificates and the chain of trust, CAs, Let's Encrypt and ACME, revocation and CT.