Appendix A — Glossary (plain language)

ALPN (Application-Layer Protocol Negotiation) — a field in the TLS ClientHello where the client advertises which HTTP version it supports (h2, http/1.1, h3), avoiding a separate negotiation round trip.

ACME (Automatic Certificate Management Environment) — the protocol used by Let's Encrypt and many certificate automation systems to issue and renew TLS certificates.

Alt-Svc (Alternative Services) — an HTTP header that tells clients the same origin is available over another protocol or endpoint, commonly used to advertise HTTP/3 support.

Anycast — announcing the same IP prefix from multiple geographic locations via BGP; each user is routed to the nearest one automatically.

BGP (Border Gateway Protocol) — the internet's routing protocol; how Autonomous Systems tell each other which IP prefixes they own and how to reach them.

Cache-Control — the response header that tells browsers and CDNs whether and how long to cache a response (no-store, max-age, immutable, s-maxage).

CDN (Content Delivery Network) — a network of edge servers, distributed geographically, that cache content close to users to cut latency and origin load.

Certificate Transparency (CT) — public append-only logging for publicly trusted certificates, letting domain owners and browsers detect unexpected or misissued certificates.

Circuit Breaker — a pattern that stops sending requests to a struggling backend once its error rate crosses a threshold, letting it recover instead of being bombarded.

CORS (Cross-Origin Resource Sharing) — the browser-enforced mechanism that lets a server explicitly permit JavaScript on other origins to read its responses.

CSP (Content Security Policy) — a response header that whitelists which sources a page may load scripts, styles, and other resources from, as a defense against XSS.

D-NAT (Destination NAT) — rewriting a packet's destination address; Netflix's load balancer uses this to route a public VIP to a private backend server.

DNS (Domain Name System) — the internet's phone book; resolves a hostname like www.netflix.com into an IP address.

DNSSEC — cryptographic signing of DNS records so resolvers can detect and reject forged answers (authentication, not encryption).

DoH / DoT (DNS over HTTPS / DNS over TLS) — encrypting DNS queries so ISPs and network eavesdroppers can't see which domains you look up.

ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) — the key exchange method TLS 1.3 uses so both sides derive the same session key without ever transmitting it, and a fresh key pair is generated per connection (forward secrecy).

ECH (Encrypted ClientHello) — a TLS mechanism that encrypts sensitive ClientHello fields such as SNI when supported by the client, resolver, and server-side infrastructure.

Forward Proxy — a proxy that serves clients, making requests to the internet on their behalf; the server never sees the client's real address.

Forward Secrecy — the property that recording an encrypted session today doesn't let an attacker decrypt it later, even if they steal the server's long-term private key.

Health Check — a periodic probe (TCP connect, HTTP GET /health, or a deep dependency check) a load balancer uses to decide whether a backend should keep receiving traffic.

HPACK — the header-compression scheme HTTP/2 uses, referencing previously seen header values by index instead of repeating them.

HSTS (HTTP Strict Transport Security) — a response header telling the browser to only ever use HTTPS for a domain, closing the window where an attacker could intercept the first plaintext HTTP request.

HTTP/3 — HTTP semantics mapped onto QUIC rather than TCP; standardized in RFC 9114.

INP (Interaction to Next Paint) — the Core Web Vital for interaction responsiveness, replacing FID as a Core Web Vital in March 2024.

IP Address — a device's unique numeric address on a network (IPv4: 32-bit, 203.0.113.45; IPv6: 128-bit, 2001:db8::1).

JWT (JSON Web Token) — a signed (not encrypted) token format for carrying claims about an authenticated user between client and server.

Load Balancer (L4 / L7) — a system that distributes requests across many backend servers; L4 routes by IP/port only, L7 decrypts TLS and routes by URL, headers, or cookies.

mTLS (Mutual TLS) — a TLS handshake where both the client and server present certificates, so both sides authenticate each other.

NAT (Network Address Translation) — rewriting IP addresses in transit; S-NAT rewrites the source (outbound), D-NAT rewrites the destination (inbound).

OSI Layers — a 7-layer conceptual model (Physical, Data Link, Network, Transport, Session, Presentation, Application) describing how data moves across a network; the internet's TCP/IP model collapses this to 4.

QUIC — the UDP-based transport protocol underlying HTTP/3; implements its own reliability and congestion control, eliminating TCP-level head-of-line blocking.

Rate Limiting — controlling how many requests a client can make in a given period, using algorithms like token bucket or sliding window.

Reverse Proxy — a proxy that serves servers, receiving client requests and forwarding them to backends the client never sees directly (Nginx, Envoy, Cloudflare).

S-NAT (Source NAT) — rewriting a packet's source address; your home router uses this to share one public IP among many private devices.

Service Mesh — a sidecar-proxy architecture (e.g., Envoy) that handles mTLS, retries, and tracing between microservices transparently, without the application code knowing.

SLI (Site Local In) — inbound traffic entering a datacenter from the internet.

SLO (Site Local Out) — outbound traffic leaving a datacenter to the internet; for media platforms, typically 3–50× larger than SLI.

SNI (Server Name Indication) — the hostname the client sends in plaintext during the TLS handshake, so a server hosting many sites on one IP knows which certificate to present.

SSL Termination — decrypting TLS at an edge proxy or load balancer rather than at the origin server, so the edge can inspect, cache, and route based on the plaintext request.

TCP (Transmission Control Protocol) — the reliable, ordered, connection-oriented transport protocol underlying HTTP/1.1 and HTTP/2; uses sequence numbers, ACKs, and retransmission to deliver an ordered byte stream while the connection remains healthy.

TLS (Transport Layer Security) — the protocol that encrypts, authenticates, and integrity-protects a connection; HTTPS is HTTP running inside TLS.

UDP (User Datagram Protocol) — a fast, connectionless, unreliable transport protocol; used by DNS and as the foundation QUIC builds reliability on top of.

VIP (Virtual IP Address) — an IP address not permanently bound to one physical server, allowing transparent failover between whichever server or router currently holds it.

VRRP (Virtual Router Redundancy Protocol) — a protocol letting multiple physical routers share one virtual IP, so a backup can take over within seconds if the master fails.

WAF (Web Application Firewall) — a layer that inspects HTTP requests for known attack patterns (SQLi, XSS, path traversal) before they reach the application.

Appendix B — Further reading

Specifications (the ground truth):

RFC 9110 — HTTP Semantics
RFC 9113 — HTTP/2
RFC 9114 — HTTP/3
RFC 9000 — QUIC
RFC 8446 — TLS 1.3
RFC 1035 — Domain Names (DNS)
RFC 9460 — SVCB and HTTPS DNS resource records
RFC 8305 — Happy Eyeballs v2
RFC 8484 — DNS Queries over HTTPS (DoH)
RFC 4271 — BGP-4
RFC 5798 — VRRP
RFC 6265 — HTTP State Management Mechanism (cookies)
RFC 7519 — JSON Web Token (JWT)

Books and long-form references:

High Performance Browser Networking by Ilya Grigorik (free online) — TCP, TLS, HTTP/2 performance in depth, from the engineer who helped design several of them.
Computer Networking: A Top-Down Approach — the standard networking textbook; good for the theory underneath Parts 1–4 of this guide.

Living references (things that change — check these, not a cached memory of them):

MDN Web Docs (developer.mozilla.org) — the definitive reference for HTTP headers, CORS, CSP, and cookies.
web.dev (web.dev, by Google) — Core Web Vitals and rendering performance, kept current as the metrics evolve.
Cloudflare Learning Center (cloudflare.com/learning) — clear, accurate explainers on DNS, CDNs, DDoS, and TLS, from a company that operates all of them at scale.
OWASP Top 10 (owasp.org) — the standard reference for the web attack classes in Chapter 12.
Envoy and Nginx official documentation — for the proxy configuration patterns in Chapters 8 and 9.

In this wiki:

Networking from Zero (TCP/IP): hands-on companion for Parts 1–4 (home lab, packet captures, subnetting practice, Go labs).
The OSI Model, One Click at a Time: the layer-by-layer view of one request.
Operating Systems, Linux, and Containers: the Linux networking stack and containers from the OS's own point of view.
Go — The Complete Field Guide: the language used in Part 9's labs.
security/real-life-guide.md and security/real-life-security-guide-v1.md: deeper security engineering than Chapter 12's survey.
scale-perf/real-life-scale-guide.md: load-testing the load balancers and CDNs from Chapters 9–10.

Appendix C — Answers to "Check yourself" (Chapters 14–25)

Ch 14 (1) In the TLS handshake, via ALPN: the client lists protocols in the ClientHello and the server picks one in its reply, which already has to happen, so nothing extra is added. (2) The Alt-Svc response header (helps on later visits) and the DNS HTTPS record (helps on the first visit, because it's known before connecting). (3) "This connection can't serve that hostname. Open a new connection for it", typically after connection coalescing sent a request to the wrong server. (4) Go's standard library has no HTTP/3, so a CDN or load balancer terminates QUIC for users and talks HTTP/2 or HTTP/1.1 to the Go service.

Ch 15 (1) private: only the user's browser may store it. no-cache: anyone may store it but must revalidate before each use. no-store: nobody stores it. (2) To give shared caches (CDNs) a different lifetime from browsers, e.g. long at the edge (where you can purge) and short in browsers (where you can't). (3) It saves transferring the body again. It doesn't save the round trip or the origin's work to compute the validator. (4) If the origin uses an unkeyed header (say X-Forwarded-Host) to build the response, one request with a malicious value is cached under the normal key and served to everyone.

Ch 16 (1) A wildcard covers names that may not exist yet, so the CA can't fetch an HTTP token from each one; only control of the DNS zone (a TXT record) proves control of all of them. (2) CAA prevents other CAs from issuing for your domain; CT detects any certificate that was issued, including by CAs that ignored CAA or by your own colleagues. (3) On macOS Go uses the OS verifier, which fetches missing intermediates itself; Go's own verifier (used on Linux) only uses what the server sent. (4) Full automation of issuance and deployment everywhere, monitoring with tighter thresholds, and no manual steps or keystores that someone updates by hand.

Ch 17 (1) TCP connect took ~20 ms ≈ 1 RTT, and a TLS 1.3 handshake is ~1 RTT, so 1.1 s means a stall such as loss and retransmission, an overloaded terminator, or a large certificate flight. (2) Browser DevTools (Console and Network): CORS is enforced by the browser on the response, and curl doesn't apply browser policy. (3) It pins one hostname to one IP for one command while keeping SNI and Host correct, so you can test a specific edge or backend without changing the machine's DNS for everything else.

Ch 19 (1) ReadHeaderTimeout: it bounds the whole header phase. WriteTimeout only governs writing the response, which a slow-header client never reaches. (2) Browsers ignore HSTS received over plain HTTP, because an attacker could inject it; sending it only over TLS is correct and avoids confusion. (3) /healthz keeps returning 200 (the process is fine, don't restart it); /readyz returns 503 so the load balancer stops sending new requests. (4) So the load balancer always closes idle connections first and never sends a request on a connection the server is closing (the 502 race).

Ch 20 (1) The entries appended by proxies you control, read from the right, skipping your own proxies' addresses. Never the left-most, which the client wrote. (2) SetXForwarded builds the headers from the real connection after Rewrite has removed the client's versions; Director appends to whatever the client sent. (3) Go's server resolves the framing (removing Content-Length when Transfer-Encoding is present) before the handler runs, so the handler can't see the conflict. (4) 504 means the backend accepted the request but was too slow; 502 means the proxy couldn't get a valid response at all (refused, reset, crashed, malformed).

Ch 21 (1) Because the request can commit and then fail; a response cache has no success to store, so only a key recorded with the side effect stops the retry from repeating it. (2) Backoff spreads one client's retries over time; jitter spreads different clients' retries apart so they don't arrive in synchronised waves. (3) A cap on retries as a fraction of normal requests (e.g. 20%), which guarantees retries can't multiply load by more than that factor during an outage. (4) Closed (calls flow, failures counted) → Open after a threshold (calls fail immediately) → Half-open after a cool-down (a trial call is allowed) → Closed on success, or back to Open on failure.

Ch 22 (1) Only at connect time is the final IP known: DNS may change between check and fetch, and redirects introduce new destinations. (2) The initial URL is public and passes; the server it reaches answers with a redirect to an internal address, which a client that checked only the first URL follows. (3) A stolen token request from an SSRF usually comes through at least one extra hop (a proxy, a container bridge), and with a hop limit of 1 the token response never reaches it.

Ch 23 (1) SLI: the fraction of requests that were good (for example non-5xx and under 300 ms). SLO: the target for that fraction over a window (99.9% over 30 days). Error budget: the bad fraction the SLO allows (0.1%), to be spent deliberately. (2) The budget is being spent 14.4 times faster than sustainable: 2% per hour, the whole monthly budget in about two days. (3) Both windows must exceed the threshold; after the fix the 5-minute window is clean, so the condition is false even though the 1-hour window still is. (4) Budget left: ship features and take risks. Budget gone or burning fast: prioritise reliability work until it recovers.

Ch 24 (1) WriteTimeout covers the whole response, and a stream's response never finishes, so the deadline set when the request started expired at 3 s. (2) Idle timeouts on load balancers, proxies, and NAT devices that close connections with no traffic. (3) When the client must send data continuously or with low latency over the same connection (chat, games, collaborative editing). For server-to-client updates, SSE is simpler and proxy-friendlier.

Ch 25 (1) Steps 2–5 (DNS, TCP, TLS), which only the first visit pays for; step 9 shows the same request without them. If they dominate, the fixes are connection reuse, preconnect, a CDN edge closer to users, or HTTP/3. (2) The pre-flight gives a clear early answer, but DNS can change between the check and the connection (rebinding), and redirects add new destinations; only the check inside the dialer sees the address actually connected to. (3) The pooled connection is deliberately kept open for reuse, alongside the runtime's netpoller descriptors; it's a leak only if the count keeps growing with each request.