Appendix A — Glossary (plain language)

ACK — Acknowledgement. "I received everything up to byte N."

Anycast — The same IP address announced from many locations; routing sends you to the nearest.

ARP — Address Resolution Protocol. Finds the MAC address for an IP address on your local network, by broadcasting a question.

Bandwidth — How much data per second a link can carry. Not the same as speed (see latency).

BGP — Border Gateway Protocol. How independent networks tell each other which addresses they can reach. Runs the internet's routing.

Broadcast — A message to everyone on the local network. 255.255.255.255 or the all-ones host address.

Broadcast domain — The set of devices that receive each other's broadcasts. A router (or VLAN) breaks it up; a switch does not.

Bufferbloat — Excessive latency caused by oversized buffers filling up at the bottleneck. Test it: ping while downloading.

CDN — Content Delivery Network. Copies of content in many locations so users connect to something nearby.

CIDR — The /24 notation. Counts how many bits of the address are the network part.

Congestion control — TCP's mechanism for finding a safe sending rate by speeding up until loss occurs. Protects the network.

Default gateway — The router your machine sends everything it doesn't recognise to.

DHCP — The protocol that automatically gives your device an address, gateway, and DNS servers. Four messages: DISCOVER, OFFER, REQUEST, ACK.

DNS — Turns names (example.com) into addresses. Hierarchical and heavily cached.

Encapsulation — Each layer wrapping the layer above's data in its own header.

Ephemeral port — A temporary, high-numbered port your machine picks when it starts an outbound connection.

Ethernet — The dominant wired link-layer technology. Frames, MAC addresses, 1500-byte MTU.

FIN — The TCP flag meaning "I've finished sending."

Firewall — Decides which packets to allow. Stateful ones track connections and auto-allow return traffic.

Flow control — TCP's sliding window; stops a fast sender overwhelming a slow receiver.

Frame — A chunk of data at the link layer (has MAC addresses).

Handshake — The three-packet exchange (SYN, SYN-ACK, ACK) that opens a TCP connection.

HTTP — The protocol of the web. Text-based request/response.

HTTPS — HTTP inside TLS encryption.

ICMP — The internet's error and diagnostics messenger. ping and traceroute are built on it.

IP address — A number identifying a machine's location on the network. IPv4 is 32 bits (192.168.1.50), IPv6 is 128 bits.

Jitter — Variation in latency. Shown as mdev/stddev in ping output.

Latency — Time for data to travel there and back. Dominated by distance.

Load balancer — Spreads requests across multiple servers. L4 uses IP/port; L7 reads the HTTP request.

Loopback — 127.0.0.1 / ::1. Traffic to yourself that never leaves the machine.

MAC address — A 48-bit hardware address on a network card. Only meaningful on the local network.

MSS — Maximum Segment Size. The biggest chunk of data in a TCP packet. Usually 1460.

MTU — Maximum Transmission Unit. The biggest packet a link will carry. Usually 1500.

Multicast — A message to a group of interested devices (not everyone).

NAT — Network Address Translation. Rewrites private addresses to a shared public one. How your whole house shares one internet address.

Packet — A chunk of data at the internet layer (has IP addresses).

Ping — Sends an ICMP echo request and measures the round trip.

Port — A 16-bit number identifying which program on a machine a packet is for.

Private address — 10.x, 172.16-31.x, 192.168.x. Usable internally, never routed on the internet.

Protocol — An agreed format and set of rules for a conversation.

QUIC — A modern transport protocol built on UDP; the foundation of HTTP/3.

RST — TCP's abrupt "reset" — connection aborted immediately.

Round-trip time (RTT) — How long a packet takes to get there and back.

Router — Forwards packets between different networks, using IP addresses.

Routing table — The list of "to reach this range, send it that way" rules.

Segment — A chunk of data at the TCP layer.

Socket — One end of a connection: an IP address plus a port.

Subnet mask — Marks where the network part of an address ends. /24 or 255.255.255.0.

Switch — Forwards frames between devices on the same network, using MAC addresses.

SYN — The TCP flag that starts a connection.

TCP — Reliable, ordered, connection-based transport. Retransmits lost data.

TIME_WAIT — A state a closed connection sits in for ~60 s to catch late packets.

TLS — Encrypts and authenticates a connection. The "S" in HTTPS.

Traceroute — Discovers the routers along a path by sending packets with increasing TTL.

TTL — Time To Live. A hop counter; decremented by each router. At zero the packet is dropped.

UDP — Fast, connectionless, unreliable transport. Ports and a checksum, nothing more.

VLAN — Virtual LAN. Splits one physical switch into separate broadcast domains.

VPN — An encrypted tunnel; your packets wrapped inside other packets.

Window — How many bytes the receiver will accept before waiting for acknowledgement.

Appendix B — Command cheat sheet

### WHAT AM I? ####################################################
ip -br addr / ip -br link          your addresses and interfaces (Linux)
ifconfig                            same (macOS/BSD)
ip route / netstat -rn              your routing table
cat /etc/resolv.conf                your DNS servers
curl ifconfig.me                    your PUBLIC address
ip neigh / arp -a                   your ARP cache (local neighbours)

### CAN I REACH IT? ###############################################
ping -c 5 <host>                    basic reachability + latency + loss
ping -M do -s 1472 <host>           MTU test (Linux; -D on macOS)
traceroute -n <host>                the path, hop by hop
traceroute -T -p 443 <host>         TCP traceroute (works when ICMP is filtered)
mtr -rwzbc 100 <host>               ** best tool: loss + latency per hop **
nc -zv <host> <port>                is this port open? refused? timeout?

### DNS ###########################################################
dig <name>                          full answer
dig <name> +short                   just the address
dig +trace <name>                   ** watch the whole delegation chain **
dig @1.1.1.1 <name>                 ask a specific server (bypass cache)
dig -x <ip>                         reverse lookup
dig <name> A / AAAA / MX / NS / TXT  specific record types

### WHAT'S ON MY MACHINE? #########################################
ss -tuln                            what's LISTENING
ss -tulnp                           ... with the process (sudo for others')
ss -tan                             all TCP sockets and their states
ss -tin                             ** detailed TCP health per connection **
ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn    state histogram
lsof -i :8080                       what's using this port (macOS/Linux)
nstat -az | grep -i retrans         kernel TCP counters (Linux)
netstat -s -p tcp                   TCP stats (macOS)

### HTTP ##########################################################
curl -v https://host                verbose: DNS, TCP, TLS, headers
curl -sI https://host               headers only
curl -s -o /dev/null -w '%{http_code}\n' https://host
curl -w 'dns %{time_namelookup} tcp %{time_connect} tls %{time_appconnect} ttfb %{time_starttransfer} total %{time_total}\n' -o /dev/null -s https://host
nc host 80                          type HTTP by hand

### TLS ###########################################################
openssl s_client -connect host:443 -servername host </dev/null
echo | openssl s_client -connect host:443 -servername host 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

### PACKETS #######################################################
sudo tcpdump -i any -n -c 20                          quick look
sudo tcpdump -i any -n 'host X and port Y'            filtered
sudo tcpdump -i any -n -e arp                         watch ARP
sudo tcpdump -i any -n -A 'tcp port 80'               readable HTTP
sudo tcpdump -i any -n 'tcp[tcpflags] & tcp-syn != 0'  connection attempts
sudo tcpdump -i any -n 'tcp[tcpflags] & tcp-rst != 0'  resets
sudo tcpdump -i any -n -s0 -w file.pcap 'host X'      save for Wireshark
sudo tcpdump -r file.pcap -n                          read it back

### SIMULATE PROBLEMS (Linux; ALWAYS UNDO) ########################
sudo tc qdisc add dev eth0 root netem delay 200ms
sudo tc qdisc add dev eth0 root netem loss 5%
sudo tc qdisc add dev eth0 root netem delay 150ms 50ms loss 2%
sudo tc qdisc del dev eth0 root                       <-- UNDO

Appendix C — Subnetting cheat sheet and answers