Computer Networks & the Internet

1. What a Network Really Is

The handful of ideas everything else builds on

• Address — every device needs one so data can find it. On the Internet that's an IP address, like 142.250.183.14.
• Packet — data isn't sent in one big lump. It's cut into small pieces called packets, each with the address written on it.
• Protocol — a set of rules both sides agree on, like "say hello before you talk" or "number your pages". HTTP, TCP and IP are all protocols.
• Client and server — the client asks (your browser), the server answers (the computer hosting the website). A server is just a computer whose job is to wait for requests.

2. How the Internet Is Built

Packet switching vs circuit switching

Packet switching is "best effort": the network tries, but makes no promises. Making delivery reliable is a job pushed up to TCP (section 19).

Who's who

• Tier 1 ISPs own the backbone and swap traffic with each other for free (called peering).
• Regional and local ISPs pay bigger ones to carry their traffic (called transit).
• IXPs (Internet Exchange Points) are buildings where many networks plug into each other to swap traffic directly.
• Undersea cables carry over 95% of traffic between continents. Satellites are a tiny share.

3. Network Types & Topologies

Topologies in one line each

• Bus — everyone on one cable. Cheap, but one fault takes down all. Mostly history now.
• Star — every device plugs into a central switch. One cable breaking only affects one device. If the switch dies, everything stops.
• Ring — each device passes data to the next in a loop.
• Mesh — many links between devices. Full mesh means every pair is linked: with n devices that's n(n−1)/2 cables. Reliable but costly.
• Tree / hybrid — stars joined together. Most office networks look like this.

4. Network Devices

Your "Wi-Fi router" at home is really five devices in one box

Modem         → talks to your ISP over the fibre/cable line
Router        → joins your home network to the Internet
Switch        → the LAN ports on the back
Access point  → the Wi-Fi
DHCP + NAT + firewall → hands out addresses, shares one public IP, blocks junk

Default gateway

Your computer's default gateway is the router it sends anything to when the destination isn't on the local network. At home, it's usually 192.168.1.1 or 192.168.0.1. If the gateway is wrong, you can reach your printer but not Google.

5. Latency, Bandwidth & Throughput

Where latency comes from

• Propagation delay — the time for the signal to physically travel. Light in fibre goes about 200,000 km per second, so London to Mumbai (~7,200 km) takes at least ~36 ms one way. You can't fix physics; you can only move the server closer.
• Transmission delay — the time to push all the bits onto the wire. Bigger files, slower links → longer.
• Queuing delay — waiting in a router's queue behind other packets. This is what spikes when the network is busy.
• Processing delay — the time a router takes to read the header and decide where to send it. Tiny.

RTT — the number that matters most for web apps

RTT (round-trip time) is the time to send something and get a reply. Opening an HTTPS connection needs several round trips before any data arrives (TCP handshake, then TLS). With an RTT of 100 ms, that's a few hundred milliseconds of nothing.

Other words you'll hear

• Jitter — how much latency jumps around. Bad for video calls and games.
• Packet loss — the percentage of packets that never arrive. Even 1–2% makes TCP slow down sharply.
• Mbps vs MBps — megabits vs megabytes. 8 bits = 1 byte, so a 100 Mbps line downloads at about 12.5 MB per second at best.

6. Why Layers? The OSI Model

Each layer's job, in one line

1. Physical — send raw 1s and 0s as electrical signals, light or radio waves.
2. Data Link — get data to the next device on the same local network, using MAC addresses. Spots damaged data.
3. Network — get data across many networks to the right computer, using IP addresses. Picks the route.
4. Transport — get data to the right program on that computer, using port numbers. TCP also makes it reliable.
5. Session — open, keep and close a conversation between two programs.
6. Presentation — make the data readable: character encoding, compression, encryption.
7. Application — the protocol your app actually speaks: HTTP, DNS, SMTP.

Memorise bottom-up with "Please Do Not Throw Sausage Pizza Away" (Physical, Data Link, Network, Transport, Session, Presentation, Application).

7. OSI vs TCP/IP — the Full Table

* Some protocols don't fit neatly. TLS sits between TCP and HTTP, so people place it at 5, 6 or "4.5". ARP links IP (layer 3) to MAC (layer 2), so it's placed at either. If an interviewer pushes, say exactly that — it shows you understand the models are simplifications.

PDU names — a common quick-fire question

Application  → data / message
Transport    → segment (TCP)  or  datagram (UDP)
Network      → packet
Data Link    → frame
Physical     → bits

8. Encapsulation

What each header carries

9. MAC Addresses, Ethernet & ARP

MAC vs IP

The first half of a MAC address (24 bits) identifies the maker — the OUI. ff:ff:ff:ff:ff:ff is the broadcast address: "everyone on this network".

An Ethernet frame

| Preamble | Dest MAC | Source MAC | Type  | Payload (the IP packet) | FCS     |
|  8 bytes | 6 bytes  | 6 bytes    | 2 B   | 46 – 1500 bytes         | 4 bytes |

• Type says what's inside — for example IPv4 or IPv6.
• The payload can be at most 1500 bytes. That limit is the MTU (Maximum Transmission Unit). Bigger IP packets must be split up.
• FCS (Frame Check Sequence) holds a CRC — a checksum.

Error detection with CRC

The sender runs the frame through a maths formula and attaches the result (the CRC). The receiver runs the same formula. If the answers don't match, a bit got flipped on the way, and the frame is thrown away. Ethernet detects errors; it doesn't fix them. Re-sending is TCP's job, higher up.

Simpler checks you may be asked about: a parity bit (one extra bit making the count of 1s even or odd — catches single-bit errors only) and a checksum (add the data up; IP, TCP and UDP headers each use one).

How a switch learns

1. A frame arrives on port 3 from MAC AA. The switch writes down "AA is on port 3" in its MAC table.
2. It looks up the destination MAC. If it knows the port, it sends the frame out of that port only.
3. If it doesn't know yet, it floods the frame out of every port. When the reply comes back, it learns that MAC too.

ARP — finding the MAC for an IP

Your laptop wants to send to 192.168.1.1 (the router) but needs its MAC.

1. Broadcast to everyone:  "Who has 192.168.1.1? Tell 192.168.1.10"
2. The router replies:     "192.168.1.1 is at 3c:22:fb:9a:10:4e"
3. Laptop saves it in its ARP cache for a few minutes.

$ arp -a        # see your ARP cache

Your computer only ever ARPs for devices on its own network. To reach Google, it ARPs for the router's MAC and hands the packet to the router.

VLANs, briefly

A VLAN (Virtual LAN) splits one physical switch into several separate networks. Guests, staff and printers can share the same hardware but can't see each other's traffic. Traffic between VLANs must go through a router or firewall.

10. IPv4 Addresses & Classes

192      .168      .1        .10
11000000 .10101000 .00000001 .00001010     ← the same thing in binary

32 bits → 2^32 ≈ 4.3 billion possible addresses (not enough — hence NAT and IPv6)

Classes — the old system (still asked)

127 is missing from class A on purpose: 127.0.0.0/8 is loopback. 127.0.0.1 (localhost) always means "this same computer" — that's how your dev server on localhost:3000 works without any network at all.

Classes wasted addresses badly — a company needing 300 addresses had to take a whole class B (65,536). Since 1993 the Internet uses CIDR instead (next section). Learn classes for interviews, but say they're obsolete.

Special addresses to recognise

11. CIDR & Subnetting

The only formula you need

host bits         = 32 − prefix
total addresses   = 2^(host bits)
usable hosts      = 2^(host bits) − 2     (first = network address, last = broadcast)

A subnet mask is the same idea as the prefix, written as an address: 1s for network bits, 0s for host bits. /26 = 26 ones = 11111111.11111111.11111111.11000000 = 255.255.255.192.

Worked example — split 192.168.10.0/24 into 4 subnets

Need 4 subnets  → borrow 2 bits (2² = 4)        → /24 + 2 = /26
Host bits left  → 32 − 26 = 6                   → 2⁶ = 64 addresses each
Usable hosts    → 64 − 2 = 62 per subnet
Mask            → 255.255.255.192               (128 + 64 = 192)
Block size      → 256 − 192 = 64

Question style: "Which subnet is 192.168.10.150/26 in?"

1. Block size for /26 is 64. Multiples: 0, 64, 128, 192.
2. 150 sits between 128 and 191 → network address is 192.168.10.128.
3. Broadcast is the last one in the block: 192.168.10.191.
4. Usable hosts: .129 to .190.

Question style: "I need 50 hosts per subnet. What prefix?"

Find the smallest power of 2 where 2^n − 2 ≥ 50. 2⁵ − 2 = 30 (too small), 2⁶ − 2 = 62 (enough). So 6 host bits → /26.

Two computers, same subnet?

AND each IP with the mask; if the results match, they're on the same subnet and can talk directly. If not, traffic goes via the router. With /26, 192.168.10.70 (block .64) and 192.168.10.130 (block .128) are on different subnets, even though they look close.

12. Private IPs & NAT

Private ranges (memorise these)

Thousands of homes all use 192.168.1.10 at the same time. That's fine — routers on the Internet refuse to carry private addresses, so they never clash.

What NAT costs you

• Nobody outside can start a connection to you. The router has no table entry for an unknown incoming request, so it drops it. That's accidental security — and why hosting a game server at home needs port forwarding.
• Peer-to-peer gets hard. Video calls (WebRTC) use tricks called STUN and TURN to get two NAT-ed devices talking.
• It breaks the original idea that every device has its own reachable address. IPv6 restores that.

13. IPv6

Full:        2001:0db8:0000:0000:0000:ff00:0042:8329
Shortened:   2001:db8::ff00:42:8329

Rule 1: drop leading zeros in each group     (0db8 → db8, 0042 → 42)
Rule 2: replace ONE run of all-zero groups with ::   (only once per address)

::1          → loopback (IPv6's 127.0.0.1)
fe80::/10    → link-local (only valid on this network)

IPv4 vs IPv6

The switch-over is slow because IPv4 and IPv6 can't talk to each other directly. Most networks run both side by side — called dual stack.

14. Routing

A routing table

Destination       Next hop        Interface
192.168.1.0/24    (direct)        eth0          ← my own local network
10.20.0.0/16      192.168.1.254   eth0          ← office network via another router
0.0.0.0/0         203.0.113.1     wan0          ← default route: everything else → ISP

If several entries match, the router picks the most specific one — the longest prefix. This is called longest prefix match. 0.0.0.0/0 matches everything, so it's used only when nothing better does.

Static vs dynamic routing

The two families of dynamic routing

• Distance vector — each router tells its neighbours "here's how far I am from everything". Simple, but slow to notice failures. Called "routing by rumour". Example: RIP, which counts hops and gives up after 15.
• Link state — each router tells everyone about its own direct links. Every router builds a full map and runs Dijkstra's shortest-path algorithm on it. Faster and smarter, but uses more memory. Example: OSPF.

RIP, OSPF and BGP at a glance

The Internet is made of tens of thousands of Autonomous Systems (ASes) — each is one organisation's network (an ISP, Google, Cloudflare). BGP is how ASes tell each other "I can reach these addresses". It's the glue of the Internet. When a company publishes a wrong BGP route, whole services disappear — that's what took Facebook offline for six hours in 2021.

15. ICMP, TTL, Ping & Traceroute

Ping

$ ping google.com
64 bytes from 142.250.183.14: icmp_seq=1 ttl=117 time=12.4 ms
64 bytes from 142.250.183.14: icmp_seq=2 ttl=117 time=11.9 ms

ping sends an ICMP Echo Request; the target replies with an Echo Reply. It tells you: is the host reachable, and what's the round-trip time? A ping failing doesn't always mean the host is down — many servers and firewalls simply block ICMP.

Traceroute — the clever use of TTL

Send a packet with TTL=1 → the 1st router drops it, replies "Time Exceeded"  → now you know hop 1
Send a packet with TTL=2 → the 2nd router drops it, replies                  → hop 2
…keep going until the destination itself replies.

$ traceroute google.com      (Windows: tracert google.com)
 1  192.168.1.1     1.2 ms     ← your home router
 2  10.45.0.1       8.7 ms     ← your ISP
 3  * * *                      ← this router doesn't answer; not necessarily a problem
 4  142.250.183.14  12.1 ms    ← arrived

Traceroute shows where on the path things slow down or stop. A big jump in time between two hops points to the slow link.

Common ICMP messages

• Echo Request / Reply — ping.
• Destination Unreachable — no route, or the port is closed.
• Time Exceeded — TTL hit zero (what traceroute relies on).

16. Ports & Sockets

Port ranges

Ports worth knowing by heart

How one server port handles thousands of users

Every connection is identified by five things together — the 5-tuple:

(protocol, source IP, source port, destination IP, destination port)

TCP, 49.36.10.5:52344   → 104.18.2.1:443
TCP, 49.36.10.5:52345   → 104.18.2.1:443     ← same user, second tab: different source port
TCP, 117.200.8.9:60111  → 104.18.2.1:443     ← different user

All three hit port 443, but each 5-tuple is unique, so the server keeps them apart. A port is not "used up" by one connection.

Sockets in code

// Server: create → bind to a port → listen → accept connections
const net = require("net");
net.createServer(socket => {
  socket.on("data", d => socket.write("echo: " + d));
}).listen(4000, "0.0.0.0");

// Client: create → connect to IP:port → send/receive
const client = net.connect(4000, "127.0.0.1", () => client.write("hi"));

Express, fetch, database drivers — they all sit on top of exactly this. app.listen(3000) is "open a socket on port 3000 and wait".

17. TCP vs UDP

Why would anyone want unreliable delivery?

Because for some data, late is as bad as lost. In a video call, a missing frame from half a second ago is useless — re-sending it would only freeze the call while it waits. Better to skip it and show the next one. Games, live audio and video all think this way.

DNS uses UDP because a lookup is one small question and one small answer. A handshake would triple the cost. If no answer comes back, the client simply asks again.

18. The 3-Way Handshake & 4-Way Teardown

Opening, step by step

1. SYN — client: "I want to connect. My bytes will start counting from 100."
2. SYN-ACK — server: "Got it, I expect 101 next. My bytes start from 300."
3. ACK — client: "Got it, I expect 301 next." Connection open.

Starting numbers are random, not 0 — that makes it hard for an attacker to guess them and inject fake packets.

Why three steps, not two?

Both sides must prove they can send and receive. After step 2, the client knows both directions work, but the server doesn't yet know the client received its reply. Step 3 confirms it. It also stops an old, delayed SYN from opening a ghost connection.

Closing

TCP is two one-way streams. FIN means "I've finished sending" — but I can still receive. So each side sends its own FIN and gets its own ACK. The side that closes first waits in TIME_WAIT (typically 30 seconds to 2 minutes) in case its final ACK got lost and the other side re-sends its FIN.

A connection can also be cut instantly with RST (reset) — what you get when you connect to a port nobody is listening on: "connection refused".

19. Reliability, Flow Control & Congestion Control

Reliability — sequence numbers and ACKs

• Every byte has a sequence number. The receiver uses them to put pieces back in order and spot gaps.
• The receiver sends an ACK (acknowledgement) saying "I've got everything up to byte N; send N+1 next".
• If no ACK comes back within a timeout, the sender assumes the data was lost and re-sends it (retransmission).
• If the sender gets three duplicate ACKs for the same byte, it doesn't wait for the timeout — the later packets are getting through, so one must be missing. It re-sends straight away (fast retransmit).
• Duplicates are spotted by sequence number and quietly dropped.

Flow control — the sliding window

Waiting for an ACK after every packet would be painfully slow. Instead the sender may have a window of data "in flight" — sent but not yet acknowledged. As ACKs arrive, the window slides forward and more can be sent.

bytes:  [ acked ][ sent, waiting for ACK ][ can send now ][ must wait ]
                 |<-------------- window ---------------->|
ACK arrives → the left edge moves right → the whole window slides →

The receiver tells the sender how big that window can be in every ACK (the receive window, rwnd). If the receiving app is slow to read, its buffer fills, it advertises a smaller window, and the sender slows down. Window 0 means "stop for now".

Congestion control — slow start and AIMD

The sender keeps a second limit, the congestion window (cwnd), guessing how much the network can take. It actually sends min(rwnd, cwnd).

1. Slow start — begin small (traditionally 1 segment, about 10 today) and double cwnd every round trip. Despite the name, this grows very fast.
2. Once it reaches a threshold (ssthresh), switch to congestion avoidance: grow by just 1 segment per round trip. This is the additive increase.
3. When a loss is detected, assume the network is congested and cut back hard:
   • Three duplicate ACKs (mild) → halve cwnd and continue. This is the multiplicative decrease.
   • A timeout (serious) → drop cwnd right back and start slow start again.

Together this pattern is called AIMD — Additive Increase, Multiplicative Decrease. The speed graph looks like a sawtooth: climb slowly, drop sharply, climb again. It's what lets millions of connections share the Internet fairly without anyone in charge.

20. DNS — the Internet's Phone Book

The full lookup order

1. Browser cache — visited recently? Done.
2. OS cache and the hosts file (/etc/hosts) — a manual override list.
3. Recursive resolver — usually your ISP's, or a public one like Cloudflare's 1.1.1.1 or Google's 8.8.8.8. Has a big shared cache.
4. Root servers — 13 named root server addresses, each copied to hundreds of machines worldwide. They only know where each top-level domain lives.
5. TLD servers — for .com, .org, .in… They know which name servers handle each domain.
6. Authoritative name server — the one that actually holds the domain's records (often at Cloudflare, Route 53 or your registrar). Gives the final answer.

Record types

Caching and TTL

Every record has a TTL (time to live) in seconds — how long others may cache it. A TTL of 3600 means "you can reuse this answer for an hour".

• Long TTL → fewer lookups, faster, but changes take longer to reach everyone.
• Short TTL → changes spread fast, but more lookups.

"DNS propagation takes up to 48 hours" really means: old answers are still sitting in caches until their TTL runs out. Before moving a site to a new server, lower the TTL a day ahead.

21. DHCP — Getting an Address Automatically

DORA — the four steps

1. Discover  client → everyone   "Is there a DHCP server? I need an address."
                                 (from 0.0.0.0 to 255.255.255.255 — it has no IP yet)
2. Offer     server → client     "You can have 192.168.1.23."
3. Request   client → everyone   "I'll take 192.168.1.23, please."
                                 (broadcast, so any other servers that offered know)
4. Ack       server → client     "Confirmed. It's yours for 24 hours."

What you get

• Your IP address
• The subnet mask (which addresses are local)
• The default gateway (the router to send everything else to)
• DNS servers to use
• A lease time — the address is borrowed, not owned. Devices renew at about halfway through.

DHCP runs over UDP — server port 67, client port 68. At home, your router is the DHCP server.

22. HTTP — Requests, Responses & Methods

Anatomy of a request

POST /api/orders?coupon=SAVE10 HTTP/1.1      ← method, path + query, version
Host: shop.example.com                       ← headers: extra information
Content-Type: application/json
Authorization: Bearer eyJhbGciOi...
Cookie: session=abc123
                                             ← blank line = headers are over
{"productId": 42, "qty": 2}                  ← body (optional)

Anatomy of a response

HTTP/1.1 201 Created                         ← version, status code, reason
Content-Type: application/json
Set-Cookie: cart=; Max-Age=0
Cache-Control: no-store

{"orderId": 9001, "status": "pending"}

Methods

• Safe = doesn't change anything on the server. Browsers and crawlers assume GET is safe, so never delete things on a GET link.
• Idempotent = doing it twice has the same effect as once. Deleting order 5 twice still leaves order 5 deleted. POSTing twice creates two orders — which is why a "retry" on a payment POST is dangerous and needs an idempotency key.

REST over HTTP, briefly

REST is a style for designing APIs on top of HTTP: URLs name things (nouns), and the HTTP method says what to do with them.

GET    /users          → list users
GET    /users/7        → one user
POST   /users          → create a user
PATCH  /users/7        → update part of user 7
DELETE /users/7        → delete user 7
GET    /users/7/orders → user 7's orders

✗  POST /getUser   ✗  GET /deleteUser?id=7     ← verbs in URLs, wrong methods

REST also means stateless requests (each carries everything needed, like an auth token) and using proper status codes — next section.

23. Status Codes, Headers, Cookies & Statelessness

Status code families

• 401 vs 403 — 401 means "I don't know who you are" (log in). 403 means "I know who you are, and you're not allowed".
• 502 vs 504 — both come from a proxy or load balancer in front of your app. 502: the app sent back garbage or refused the connection (often it crashed). 504: the app took too long to answer.
• 301 vs 302 — browsers and search engines remember a 301 for good. Use 302 while testing.

Headers worth knowing

HTTP is stateless

Stateless means the server doesn't remember anything between requests. Each request is handled as if it's the first one ever. That makes servers simple and easy to scale — any server can handle any request.

But apps need to know "this is still Ada, logged in". So state is carried by the request itself, using:

• Cookies holding a session ID, which the server looks up in its session store, or
• Tokens (like a JWT) in the Authorization header, which carry the user's identity inside them.

Cookies

Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=86400

24. HTTP/1.1 vs HTTP/2 vs HTTP/3

The key words explained

• Head-of-line blocking — when the item at the front of a queue is stuck, everything behind it waits. In HTTP/1.1, a slow response blocks the next one on that connection, so browsers open about 6 connections per site as a workaround.
• Multiplexing — HTTP/2 chops many requests into small numbered frames and mixes them on one connection. No need for 6 connections, or old hacks like sprite sheets and bundling everything into one file.
• Why HTTP/2 still blocks — TCP insists on delivering bytes in order. If one packet is lost, TCP holds back everything after it, even frames for other requests.
• QUIC — rebuilds reliability on top of UDP but tracks each stream separately. It also survives network changes (connection migration) — walk from Wi-Fi to mobile data and the download continues.

25. HTTPS & TLS

Symmetric vs asymmetric encryption

So TLS uses the slow, clever kind once, to safely set up the fast kind. Best of both.

The handshake, in steps

1. ClientHello — the browser says which TLS versions and ciphers it supports, and sends its half of the key exchange (a "key share").
2. ServerHello — the server picks a cipher, sends its own key share, and its certificate, signed to prove it owns the matching private key.
3. Both sides combine the two key shares and calculate the same session key. An eavesdropper who saw both shares still can't work it out — that's the maths of Diffie–Hellman.
4. The browser checks the certificate: right domain? not expired? signed by someone it trusts? If anything fails, you see the big red warning page.
5. Both send Finished. From now on, everything is encrypted with the fast symmetric session key.

Older TLS 1.2 needed two round trips, and sometimes encrypted the key with the server's RSA public key instead. TLS 1.3 dropped that because if the private key leaked later, old recorded traffic could be decrypted. With fresh keys per session (forward secrecy), it can't.

Certificates and the chain of trust

• A certificate says "this public key belongs to example.com", and is signed by a Certificate Authority (CA) like Let's Encrypt or DigiCert.
• Your browser and OS ship with a list of trusted root CAs. Roots sign intermediate CAs, which sign websites' certificates. The browser follows that chain back to a root it trusts.
• Anyone can make a certificate, but only a trusted CA's signature makes browsers accept it. That's what stops an attacker from pretending to be your bank.

26. Email, FTP & SSH

Email protocols

You (Gmail app) ──SMTP──▶ Gmail server ──SMTP──▶ Outlook's server ◀──IMAP── Your friend's phone
                                         (found via the MX record in DNS)

When your app sends a password-reset email through a service like SendGrid or SES, it's speaking SMTP (port 587) or that service's HTTP API.

FTP and friends

• FTP (ports 20/21) — old file transfer. Uses two connections: one for commands, one for data. Sends passwords in plain text. Avoid it.
• SFTP — file transfer over SSH (port 22). Encrypted. What you should use.
• FTPS — FTP wrapped in TLS. Works, but less common.

SSH

SSH (Secure Shell, port 22) gives you an encrypted command line on another computer — how you log into a cloud server. It replaced Telnet, which sent everything, passwords included, unencrypted.

ssh-keygen -t ed25519                  # make a key pair
ssh-copy-id ubuntu@203.0.113.10        # put the PUBLIC key on the server
ssh ubuntu@203.0.113.10                # log in — no password needed
ssh -L 5432:localhost:5432 ubuntu@host # tunnel: reach the server's database locally

SSH keys use asymmetric encryption: the server holds your public key and challenges you to prove you have the private one. That's also how GitHub knows it's you on git push.

27. Real-Time: Polling, Long Polling, SSE & WebSockets

SSE in a few lines

// Browser
const es = new EventSource("/events");
es.onmessage = e => console.log(JSON.parse(e.data));   // auto-reconnects if dropped

// Server response
Content-Type: text/event-stream

data: {"score": "2-1"}

data: {"score": "3-1"}

WebSockets — how the upgrade works

GET /chat HTTP/1.1
Host: example.com
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==

HTTP/1.1 101 Switching Protocols          ← from here on, it's no longer HTTP
Upgrade: websocket
Connection: Upgrade

// Browser
const ws = new WebSocket("wss://example.com/chat");   // wss = WebSocket over TLS
ws.onmessage = e => render(e.data);
ws.send(JSON.stringify({ text: "hi" }));

Choosing

• Only the server needs to push? SSE — simpler, plain HTTP, reconnects by itself, works with normal load balancers.
• Both sides talk often and fast? WebSockets.
• Updates are rare and a few seconds' delay is fine? Plain polling is honestly fine.

28. What Happens When You Type a URL and Press Enter

The answer, step by step

1. Parse the URL. The browser splits https://shop.example.com/cart into scheme (https), host and path. If you typed words, not a URL, it becomes a search instead. If the site is on the HSTS list, the browser goes straight to HTTPS. It also checks whether a fresh copy is already in its cache.
2. DNS lookup. Browser cache → OS cache → hosts file → resolver → root → TLD → authoritative server. Result: an IP address (section 20).
3. TCP connection. The OS picks a random source port and does the 3-way handshake with the server's IP on port 443 (section 18). With HTTP/3, this and the next step are combined into QUIC over UDP.
4. TLS handshake. Agree a cipher, check the certificate, derive the session key (section 25).
5. Send the HTTP request. GET /cart with headers — Host, cookies, Accept, User-Agent. Underneath, it's wrapped into TCP segments, IP packets and Ethernet/Wi-Fi frames, and routed hop by hop across the Internet (sections 8, 14).
6. The server works. Often it first hits a CDN or load balancer, then a reverse proxy like Nginx, then your app (Express, Django…), which may query a database or cache, and builds the response.
7. The response comes back. Status code, headers (Content-Type, Cache-Control, Set-Cookie), and the HTML body.
8. The browser renders. Parse HTML into the DOM, find <link>, <script> and <img> tags and fetch them too (more requests, usually on the same connection), parse CSS into the CSSOM, combine them into a render tree, work out the layout (sizes and positions), then paint pixels. JavaScript runs and may fetch more data.

29. CDNs, Proxies & Load Balancers

Forward vs reverse proxy

Forward:   [You] → [Proxy] → Internet → [Server]      server sees the proxy, not you
Reverse:   [You] → Internet → [Nginx]  → [App 1 | App 2 | App 3]   you see Nginx, not the apps

Load balancers — L4 vs L7

Ways to pick a server

• Round robin — take turns: 1, 2, 3, 1, 2, 3.
• Least connections — send to whoever is least busy.
• IP hash — the same client always goes to the same server ("sticky").
• Health checks — the balancer pings each server regularly and stops sending traffic to any that fail.

CDNs

A CDN (Content Delivery Network — Cloudflare, Akamai, CloudFront) has servers called edge servers in hundreds of cities. A user in Chennai gets your images from a server in Chennai, not from your origin server in Virginia. That cuts latency from ~250 ms to ~10 ms.

• Best for static files — images, CSS, JS, videos. Many CDNs can also cache API responses and run code at the edge.
• You control caching with headers: Cache-Control: public, max-age=31536000, immutable for files with a hash in their name (app.3f9a2c.js).
• Bonus: the CDN absorbs traffic spikes and DDoS attacks before they reach your server.

30. CORS

What counts as the same origin

An origin is scheme + host + port. All three must match.

https://app.example.com           ← our page

https://app.example.com/api       ✓ same origin (path doesn't matter)
http://app.example.com            ✗ different scheme
https://api.example.com           ✗ different host (even a subdomain)
https://app.example.com:8443      ✗ different port
http://localhost:5173 → http://localhost:3000   ✗ different port — the classic dev error

Simple requests vs preflight

For "simple" requests (GET, or a POST with a form-type body), the browser just sends it and checks the answer's headers. For anything else — PUT, DELETE, JSON bodies, custom headers like Authorization — it first sends a preflight OPTIONS request to ask permission.

OPTIONS /api/orders
Origin: https://app.example.com
Access-Control-Request-Method: DELETE
Access-Control-Request-Headers: Authorization

← 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, DELETE
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Max-Age: 600                    ← cache this permission for 10 minutes

Only if the preflight says yes does the browser send the real request.

Cookies across origins

To send cookies cross-origin, the frontend must use credentials: "include" and the server must reply Access-Control-Allow-Credentials: true with a specific origin — * is not allowed with credentials.

// Express
app.use(cors({ origin: "https://app.example.com", credentials: true }));

31. Network Security

Firewalls

A firewall checks traffic against rules like "allow port 443 from anywhere, allow port 22 only from the office IP, block everything else".

• Packet filter — looks at each packet's IPs and ports alone.
• Stateful firewall — remembers connections, so replies to things you started are let back in automatically. Most firewalls (and cloud security groups) work this way.
• WAF (Web Application Firewall) — layer 7. Reads HTTP requests and blocks things like SQL injection patterns.

VPN

A VPN (Virtual Private Network) builds an encrypted tunnel from your device to another network. Everything goes through the tunnel, so the café Wi-Fi only sees scrambled data heading to the VPN server. Companies use VPNs to let staff reach internal systems as if they were in the office. A VPN hides your traffic from the local network — it doesn't make you anonymous to the VPN provider.

Common attacks

A developer's checklist

• HTTPS only, with HSTS. Redirect HTTP to HTTPS.
• Expose as few ports as possible. Databases should never be open to the Internet — keep them on a private network.
• Rate-limit login and other expensive endpoints (respond 429).
• SSH with keys, not passwords.
• Secure, HttpOnly, SameSite cookies.

32. Useful Commands

Examples you'll actually use

# DNS
dig example.com                 # A record and its TTL
dig example.com MX +short       # mail servers only
dig @8.8.8.8 example.com        # ask Google's resolver directly (bypass your own)
dig +trace example.com          # walk root → TLD → authoritative yourself

# HTTP
curl -I https://example.com                     # headers only (HEAD)
curl -v https://example.com                     # everything: DNS, TCP, TLS, headers
curl -X POST -H "Content-Type: application/json" \
     -d '{"name":"Ada"}' http://localhost:3000/users
curl -w "dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} total:%{time_total}\n" \
     -o /dev/null -s https://example.com        # where does the time go?

# Ports and processes
lsof -i :3000                   # who's using my port?
ss -tulpn                       # all listening TCP/UDP ports (Linux)
netstat -ano | findstr :3000    # Windows equivalent

A debugging order that works

1. ping 8.8.8.8 works? Then your connection to the Internet is fine.
2. ping google.com fails but the line above worked? It's DNS.
3. Host pings, but the site won't load? Check the port with nc -zv or curl -v — firewall, or the app isn't running.
4. Connects but errors? Read the status code and headers in curl -v or the browser's Network tab.

Interview Q&A — quick answers

Foundations and layers

• What is the Internet? A network of networks — many independent networks (ISPs, companies, clouds) that agree to carry each other's traffic using IP.
• Packet switching vs circuit switching? Packet switching cuts data into packets that share links and are routed separately (the Internet). Circuit switching reserves a whole path for the call (old phones).
• Hub vs switch vs router? Hub repeats everything to every port (L1). Switch sends frames only to the right port using MAC addresses (L2). Router connects different networks using IP addresses (L3).
• Name the OSI layers. Physical, Data Link, Network, Transport, Session, Presentation, Application — "Please Do Not Throw Sausage Pizza Away".
• OSI vs TCP/IP? OSI is a 7-layer teaching model; TCP/IP is the 4-layer model the Internet actually uses (Application, Transport, Internet, Link).
• PDU at each layer? Data → segment/datagram → packet → frame → bits.
• What is encapsulation? Each layer wraps the data from above with its own header on the way down; the receiver strips them on the way up.
• Latency vs bandwidth vs throughput? Delay per trip / maximum capacity / what you actually get.

Addressing and routing

• MAC vs IP address? MAC is a 48-bit hardware ID used on the local network (L2). IP is a logical address used across networks (L3) and changes when you move networks.
• What does ARP do? Finds the MAC address for an IP on the local network by broadcasting "who has this IP?"
• How many usable hosts in a /27? 2⁵ − 2 = 30.
• What subnet is 10.1.1.200/26 in? Block size 64 → 10.1.1.192/26, broadcast 10.1.1.255, hosts .193–.254.
• Private IP ranges? 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
• What is NAT, and why does it exist? The router swaps many private addresses for one public address and tracks the mappings. It exists because IPv4 ran out of addresses.
• Why IPv6? 128-bit addresses — effectively unlimited, no NAT needed, simpler headers, no broadcast.
• Static vs dynamic routing? Routes typed by hand vs routes learned automatically from other routers.
• Distance vector vs link state? Share your distances with neighbours (RIP) vs share your links with everyone and compute the shortest path yourself (OSPF).
• What is BGP? The protocol that routes between Autonomous Systems — how the networks that make up the Internet tell each other what they can reach.
• How does traceroute work? Sends packets with TTL 1, 2, 3… Each router that drops one at TTL 0 replies "Time Exceeded", revealing itself.

Transport

• TCP vs UDP? TCP: connection, reliable, ordered, flow and congestion control, more overhead. UDP: no connection, no guarantees, fast and light.
• When would you use UDP? When late data is useless — video calls, games, live streams — or for tiny exchanges like DNS. Also as the base for QUIC.
• Explain the 3-way handshake. SYN (here's my starting number) → SYN-ACK (got it, here's mine) → ACK (got yours). Both sides confirm they can send and receive.
• Why 4 steps to close? Each direction closes separately: FIN/ACK from each side. The server may still send data between its ACK and its FIN.
• What is TIME_WAIT? The side that closes first waits a while in case its final ACK was lost and the other side resends its FIN.
• Flow vs congestion control? Flow control protects the receiver (receive window). Congestion control protects the network (congestion window, slow start, AIMD).
• What is a socket? One endpoint of a connection — an IP address plus a port. A connection is identified by the 5-tuple.
• How can one server port serve thousands of clients? Each connection has a different source IP/port, so every 5-tuple is unique.

Application layer and the web

• How does DNS resolution work? Browser/OS cache → recursive resolver → root → TLD → authoritative, with answers cached for their TTL.
• A vs CNAME? A maps a name to an IPv4 address; CNAME maps a name to another name.
• What is DHCP / DORA? Automatic IP configuration: Discover, Offer, Request, Acknowledge. Gives IP, mask, gateway, DNS, lease.
• GET vs POST? GET reads, has no body, is safe and idempotent and can be cached. POST sends a body to create or act, and isn't idempotent.
• PUT vs PATCH? PUT replaces the whole resource (idempotent); PATCH changes part of it.
• 401 vs 403? Not logged in vs logged in but not allowed.
• 502 vs 504? Proxy got a bad/no response from the app vs proxy waited too long for the app.
• Why is HTTP stateless and how do apps keep you logged in? Each request stands alone, which makes scaling easy. State travels in cookies (session ID) or tokens (JWT) with every request.
• HTTP/1.1 vs 2 vs 3? 1.1: text, one request at a time per connection. 2: binary, multiplexed on one TCP connection. 3: over QUIC/UDP, no TCP head-of-line blocking, faster setup.
• How does HTTPS work? TLS handshake: asymmetric crypto proves the server's identity (certificate) and agrees a shared key; symmetric encryption protects the actual data.
• Why not use asymmetric encryption for everything? It's far too slow; symmetric is fast once both sides share a key.
• SMTP vs POP3 vs IMAP? Send mail / download and remove from the server / sync and keep on the server.
• WebSockets vs SSE vs long polling? Two-way persistent connection / one-way server push over HTTP / repeated held-open requests.
• What happens when you type a URL? Parse → DNS → TCP → TLS → HTTP request → server work → response → render (DOM, CSSOM, layout, paint).

Infrastructure and security

• Forward vs reverse proxy? Forward acts for clients and hides them; reverse acts for servers and hides them.
• L4 vs L7 load balancer? L4 routes by IP and port only; L7 reads HTTP and can route by path, header or cookie.
• What does a CDN do? Caches content on servers near users to cut latency and offload the origin.
• What is CORS? A browser rule letting a server allow specific other origins to read its responses. It doesn't protect the server itself.
• What is a preflight request? An OPTIONS request the browser sends first, for non-simple requests, to ask the server's permission.
• What is a MITM attack and how do you stop it? An attacker relaying and reading your traffic; HTTPS with certificate checks and HSTS.
• What is a DDoS? A flood of traffic from many machines to overwhelm a service; defended with CDNs, rate limits and scrubbing services.
• What does a VPN do? Encrypts all your traffic in a tunnel to another network.

Learning Path

1. The big picture — clients, servers, IP addresses, packets. Run ipconfig/ifconfig and find your private IP, then search "what is my IP" for the public one.
2. Layers — learn the OSI names and the TCP/IP mapping until you can draw the table from memory.
3. Watch real traffic — open the browser's Network tab on any site. Look at methods, status codes, headers, cookies and the Timing breakdown.
4. DNS hands-on — dig a few domains, look at A, CNAME, MX and TTLs. Try dig +trace.
5. Subnetting drills — do ten "which subnet / how many hosts" questions until the block-size method is automatic.
6. TCP — draw the handshake and teardown from memory. Run curl -v and match what you see to the steps.
7. Build with sockets — a tiny TCP echo server in Node, then an HTTP server without Express, so you see HTTP is just text over TCP.
8. HTTPS — set up a site with a free Let's Encrypt certificate. Inspect the certificate chain in the browser.
9. Real-time — build a small chat with WebSockets and a notification feed with SSE.
10. Deployment networking — put an app behind Nginx as a reverse proxy, then a CDN. Fix the CORS error you'll certainly hit.
11. Practise the classic answer — explain "what happens when you type a URL" out loud in under three minutes.
12. Then — Wireshark to see packets for real, cloud networking (VPCs, subnets, security groups), and HTTP/3 and QUIC in more depth.