Appendix F — Answers to "Check yourself"

Ch 1 (1) Loss, reordering, duplication, corruption, delay, path changes. (2) Each problem can be solved once, independently, and each piece can be replaced without rewriting everything else. (3) The internet is the network; the web is one application (HTTP) running on it.

Ch 2 (1) Each layer wrapping the layer above's data in its own header. (2) The link-layer (Ethernet) header is rewritten at every hop; the IP header stays the same end to end. (3) Because routers only read the IP layer — a new transport protocol above it needs no changes below it.

Ch 3 (1) Link (Ethernet/Wi-Fi), Internet (IP), Transport (TCP/UDP), Application (HTTP/DNS). (2) It promises nothing about delivery, order, timing, or duplication — best effort only. (3) Keep the network core simple and put intelligence at the endpoints; it lets you innovate at the edges without changing the middle. (4) Many link layers at the bottom, many applications at the top, and exactly one protocol (IP) in the narrow middle.

Ch 3 Practice 1 = Link · 2 = Internet · 3 = Application · 4 = Transport · 5 = Link · 6 = Transport (TCP) · 7 = Application (DNS name) · 8 = Internet.

Ch 4 (1) DHCP, DNS, route lookup, ARP, TCP handshake, NAT, routing across the internet, TLS handshake, HTTP request, response and close. (2) Step 1, DNS. (3) TCP (step 4) and TLS (step 7). (4) DNS resolution, TCP/TLS setup (distance), server processing time, or the transfer itself.

Ch 5 (1) 6 bytes; the first three identify the manufacturer (the OUI). (2) Tells the receiver which protocol is inside so it can hand the payload to the right code. (3) It's silently discarded — the link layer does not retransmit. (4) Your router's (the next hop), not the website's.

Ch 6 (1) An IP address into a MAC address, on the local network only. (2) You don't know who has it, so you must ask everyone; but the answerer knows exactly who asked. (3) No — ARP frames have no IP header and no TTL, so routers don't forward them. (4) Your default gateway's.

Ch 7 (1) By noting the source MAC of every frame and the port it arrived on. (2) Floods it out every port except the one it came in on. (3) No; a router (or a VLAN boundary) does. (4) Ethernet frames have no TTL, so a looping broadcast circulates forever and saturates the network.

Ch 8 (1) Radio is unreliable and half-duplex, so the link layer retries locally rather than leaving it to TCP. (2) Airtime is shared; a device transmitting slowly occupies the channel for longer, starving everyone else. (3) Jitter — the variability of latency. It's larger on Wi-Fi because of contention and retries.

Ch 9 (1) 32 bits; each octet is 8 bits, and the largest 8-bit number is 255. (2) A network part and a host part. (3) They're reserved: all-zero host bits names the network itself; all-one host bits is the broadcast address. (4) DHCP failed — it never got an address.

Ch 10 (1) How many leading bits of the address are the network part. (2) 256 minus the mask value. (3) Block size 64; .100 is in the 64-block (64–127), .140 is in the 128-block (128–191) — different networks. (4) /25 has more network bits, so fewer host bits, so fewer addresses.

Ch 11 (1) Because a subnet must start on a multiple of its own block size; allocating small ones first strands unusable gaps. (2) 30 → /27; 60 → /26; 2 → /30. (3) No — a /28 has block size 16, so it must start at 0, 16, 32, 48… .20 isn't a multiple of 16.

Ch 12 (1) 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. (2) The mapping between an inside address+port and an outside address+port; ports let it distinguish many devices sharing one public address. (3) There's no existing NAT mapping for an unsolicited inbound packet, so the router has nowhere to send it. (4) Your ISP NATs you as well, so your "public" address is shared and changeable — port forwarding becomes impossible.

Ch 13 (1) "Send anything I don't otherwise recognise to 192.168.1.1." (2) The /24 — longest prefix match wins. (3) Changes the link-layer (MAC) header and decrements the TTL; leaves the IP addresses and payload alone. (4) Exchanging reachability information between independent networks — it's how the global routing table is built.

Ch 14 (1) By sending packets with TTL 1, 2, 3… and collecting the "time exceeded" errors each router sends back. (2) No — that router simply chose not to reply. (3) Routers deprioritise traffic addressed to themselves; only believe it if the latency persists on all later hops. (4) Path MTU Discovery (causing hangs) and, on IPv6, address resolution (breaking the network entirely).

Ch 15 (1) MTU 1500; MSS 1460 after 20 bytes of IP and 20 of TCP header. (2) Drops it and sends back an ICMP "fragmentation needed" message with the correct size. (3) The connection establishes, small requests work, then it hangs when a full-size packet is sent. (4) They add an outer header, reducing the space available for your data below the standard 1500.

Ch 16 (1) IPv4's 4.3 billion addresses ran out. (2) One run of all-zero groups, compressed; only once, because otherwise you couldn't tell how many groups each :: replaced. (3) A link-local address — every IPv6 interface has one automatically; it's used for local plumbing and is never routed. (4) Neighbor Discovery (IPv6's ARP) runs over ICMPv6, so blocking it stops address resolution entirely.

Ch 17 (1) DISCOVER, OFFER, REQUEST, ACK. (2) The client has no address yet, so it can't send a unicast packet; and it doesn't know where the server is. (3) DHCP failed. (4) Subnet mask, default gateway, DNS servers (also lease time, domain, NTP).

Ch 18 (1) Ask a root server → referred to the .com servers → referred to example.com's servers → get the answer. (2) How long an answer may be cached; you must lower it before a change and wait out the old TTL, or people keep getting the old answer. (3) The recursive resolver does the legwork and caches; the authoritative server holds the real data for one domain. (4) When the answer is too large for a UDP packet (the truncated flag is set). (5) The full delegation chain from the root down to the authoritative answer.

Ch 19 (1) Because many connections share the same server IP and port; only the client's address and port distinguish them. (2) 0.0.0.0 listens on all interfaces (reachable from the network); 127.0.0.1 listens only on loopback (reachable only from that machine). (3) By the 4-tuple — each client has a different source IP and/or port. (4) Refused = the host replied with RST (nothing listening). Timeout = nothing came back at all (dropped, or host unreachable).

Ch 20 (1) Port numbers and a checksum. (2) A late voice packet is useless; waiting for a retransmission would make the call worse, not better. (3) The client has no IP address yet, so it can't complete a TCP handshake. (4) Sequence numbers, acknowledgements, retransmission, ordering, and rate control.

Ch 21 (1) After two, the client knows the server heard it, but the server doesn't yet know the client heard the reply. (2) SYN = "synchronise, here's my starting sequence number"; ACK = "I received up to here". (3) The host is reachable but nothing is listening on that port. (4) Something is silently dropping your packets (a firewall), or the host is unreachable. (5) MSS, window scaling, SACK support, timestamps.

Ch 22 (1) Bytes. (2) An ACK repeating the same number, meaning "I'm still missing that byte"; after three, the sender fast-retransmits immediately without waiting for a timeout. (3) There are no later packets to generate duplicate ACKs, so recovery waits for the retransmission timer (~200 ms+). (4) It tells the sender exactly which ranges arrived, so only the true gaps are resent — critical on lossy or high-latency paths.

Ch 23 (1) Each direction is closed independently, so each side sends its own FIN and gets its own ACK. (2) The side that closes first; about 60 seconds on Linux. (3) Your application received the peer's FIN but never called close() — a socket leak in your code. (4) No — it controls FIN_WAIT_2. TIME_WAIT is hardcoded.

Ch 24 (1) How many more bytes the receiver is willing to accept right now. (2) Because throughput ≈ window ÷ RTT, and 65,535 bytes ÷ 0.1 s ≈ 5 Mbit/s. (3) The receiving application isn't reading fast enough — it's not a network problem. (4) 100 Mbit/s × 0.04 s = 4 Mbit = 500 KB.

Ch 25 (1) Packet loss. (2) It starts small; it then doubles every round trip, which is exponential, not slow. (3) It finishes during the slow-start ramp before reaching full speed. (4) Each connection gets its own congestion window, so N connections claim roughly N times the bandwidth share.

Ch 26 (1) Buffers small writes until a full segment accumulates or outstanding data is acknowledged, to avoid tiny wasteful packets. (2) Delays the acknowledgement briefly, hoping to piggyback it on returning data. (3) The sender withholds the second small write waiting for an ACK; the receiver withholds the ACK waiting for data to piggyback on — both wait until the timer fires. (4) Set TCP_NODELAY, or write the whole message in a single call.

Ch 27 (1) Bandwidth is capacity per second; latency is delay. (2) Page loads are dominated by round trips, which depend on distance, not capacity. (3) Excessive latency from oversized buffers filling at the bottleneck; test by pinging while running a large transfer. (4) So the queue forms in your smart queue-management device rather than in the dumb modem buffer you can't control.

Ch 28 (1) A request line, headers, a blank line, and an optional body. (2) 4xx = the client's request was wrong; 5xx = the server failed. (3) One IP address hosts many websites; the server needs to know which one you want. (4) It reuses the TCP (and TLS) connection, saving one or two round trips per request.

Ch 29 (1) Confidentiality, integrity, authentication. (2) Without it you could have a perfectly encrypted connection to an attacker. (3) Server Name Indication — the hostname you're requesting, sent in plaintext so one IP can serve many sites. (4) Chain leads to a trusted root; the name matches; it's within its validity dates; it isn't revoked.

Ch 30 (1) Only one request at a time per connection, forcing browsers to open many connections. (2) TCP delivers bytes strictly in order, so one lost packet stalls all multiplexed streams on that connection. (3) A brand-new protocol number would be blocked by middleboxes; UDP passes everywhere. (4) The connection is identified by an ID rather than the IP/port 4-tuple, so it survives moving between networks.

Ch 31 (1) Disables name resolution — otherwise tcpdump generates DNS traffic that appears in its own capture and slows it down. (2) SYN; SYN+ACK; PSH+ACK (data); RST (reset/refused). (3) A single capture only shows what arrived there; comparing both ends proves whether a packet was sent and lost. (4) 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'.

Ch 32 (1) Conversations; Protocol Hierarchy; Follow TCP Stream; Expert Information; set the time column to "since previous displayed packet". (2) The receiving application is too slow to read its buffer — not a network problem. (3) Capture filters (tcpdump syntax) decide what's recorded; display filters (Wireshark syntax) decide what's shown. (4) Analyze → Expert Information.

Ch 33 (1) Listening TCP and UDP sockets, numerically. (2) rtt = measured round-trip time (distance); cwnd = congestion window (how much it's allowed to send); retrans = retransmissions (loss). (3) The application isn't closing sockets — a leak. (4) sudo ss -tulnp | grep :8080 or sudo lsof -i :8080.

Ch 34 (1) Ping by IP versus by name — it splits the problem into "DNS" or "not DNS" instantly. (2) It's DNS. (3) Refused proves you reached the host, so the network path works and only the service is missing. (4) To distinguish "never sent" from "sent but lost in transit".

Ch 52 (1) NIC → RX ring → softirq/GRO → netfilter PREROUTING (conntrack, DNAT) → routing → INPUT → TCP (SYN queue, accept queue) → socket receive buffer → read(). Drops can happen at the ring (rx_missed), conntrack (table full), the accept queue (ListenOverflows), or the receive buffer. (2) Forwarding lets the host route the namespace's packets at all. MASQUERADE rewrites the private source to the host's address so replies can find their way back. (3) The accept queue is full: the application isn't calling accept() fast enough. It's a process problem, not a network one. (4) Every new flow that needs tracking: NAT, Docker port publishing, Kubernetes Services, and stateful firewall rules all start dropping new connections.

Ch 53 (1) A stateless filter doesn't remember the inbound SYN, so the outbound SYN-ACK to the client's ephemeral port needs its own allow rule. (2) All of them on the path: "refused" means the SYN reached the host and the kernel answered. (3) policy drop makes anything not explicitly allowed be dropped; the established,related rule lets replies through. It goes first so that the vast majority of packets (replies) are accepted after one cheap lookup. (4) Tests can be run after every change and from every segment, so drift and forgotten paths are caught automatically.

Ch 54 (1) Outbound it's a routing table (which peer to send a destination to); inbound it's an access list (which source addresses a peer may use). (2) WireGuard over IPv6 adds 80 bytes (40 IP + 8 UDP + 32 WireGuard); 1500 − 80 = 1420 works over either IP version. (3) It rewrites the MSS in TCP SYNs so TCP never sends segments too big for the tunnel; it can't help UDP or protocols that don't negotiate MSS. (4) MTU: small packets (SSH keystrokes) fit, large ones (a clone's data) don't. Test with ping -M do -s and a large download through the tunnel.

Ch 55 (1) At the registrar, because delegation is NS records in the parent zone, which the registry publishes. (2) A/AAAA records for nameservers named inside the zone they serve (ns1.example.com for example.com); without them the lookup would be circular. (3) Negative caching: the earlier NXDOMAIN is cached for the lower of the SOA minimum and the SOA record's TTL. (4) Lower the TTL to ~60 s at least one old-TTL period before, switch, verify, keep the old LB running, raise the TTL after a day, and remove the old LB after a week. (5) A DNSSEC failure resolves with dig +cd but SERVFAILs without it; a nameserver outage fails both ways and dig @ns1... +norecurse times out.

Ch 56 (1) The server isn't sending its intermediate certificate (browsers may fetch or cache it; other clients don't), or the client uses a different trust store. (2) Change the certificate for new handshakes without restarting or dropping existing connections, and choose a certificate per SNI name. (3) Fully automated issuance, deployment, and monitoring; no manual renewals anywhere, including load balancers, CDNs, keystores, and appliances. (4) For example: CDN edge, cloud load balancer, Kubernetes ingress, the service's own TLS listener, a Java keystore, a mobile app pin.

Ch 57 (1) gRPC multiplexes all calls over a long-lived HTTP/2 connection, and an L4 balancer balances connections, so each client sticks to one backend. (2) Readiness: "can I serve real traffic now?", including critical dependencies and draining state. Liveness must not depend on external dependencies, or a dependency outage restarts every instance. (3) Fail readiness; wait for the LB to notice; finish in-flight requests within a deadline; exit. Skipping step 2 means the LB keeps sending new requests to a server that has stopped accepting them, so they fail. (4) So the LB always closes idle connections first and never sends a request on a connection the backend is closing (the 502 race). (5) Trust it only from known proxy addresses, and use the right-most entry added by your own trusted proxy.

Ch 58 (1) It isn't assigned to any interface. It exists only as DNAT rules (iptables/IPVS/nftables) or eBPF programs on each node that rewrite it to a ready pod IP. (2) Names with fewer than 5 dots try every search domain first: api.github.com costs three NXDOMAIN lookups (each for A and AAAA) before the real one. (3) When you need the client's source IP or want to avoid the extra hop; the cost is uneven balance and only nodes running pods receiving traffic. (4) A policy with podSelector: {}, policyTypes: [Egress], and a single egress rule allowing UDP/TCP 53 to the kube-dns pods.

Ch 59 (1) 500 Mb/s × 0.08 s = 40 Mb = 5 MB. (2) 300 × 0.04 = 12 concurrent connections (plus headroom). (3) Each connection is limited per-connection (window, buffers, or loss), not by the path's capacity. (4) Setting it pins the buffer and disables Linux's autotuning, which would usually grow it much larger.

Ch 60 (1) IC (doesn't debug), operations (doesn't do external comms), communications (doesn't speculate on cause), scribe (doesn't filter). (2) A rollback changes state and often destroys the evidence (connections, counters, logs in memory) needed to find the root cause. (3) For example: "Since 14:02 UTC, orders-service in eu-west cannot open TCP connections to db-1:5432 (SYNs time out); other services reach db-1; a security-group change was applied at 14:00; need the DB team to check SG and host firewall counters." (4) It has an owner, a date, and addresses prevention, detection, or mitigation of the class of failure.

Ch 61 (1) Address plans constrain every future connection, acquisition, and cloud expansion for a decade or more, and fixing overlaps costs quarters of engineering time. (2) Flow logs or counters showing zero traffic on the old path for an agreed period. (3) Keep all allocations in a file in git, and have CI run an overlap check (subnet overlap) on every change, failing the build on any overlap. (4) Policy tests from the subnet's new location, netcheck to key dependencies, a large-payload transfer (MTU), and a real business transaction.

End of guide.

What to do right now: pick a route from §0.3, open notes.md, and start Chapter 1. Read one chapter, explain it out loud, run the commands, and answer the check-yourself questions from memory.

The tools and the fashions change. The four layers do not.