Networks §

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail server), TXT (text, e.g., SPF, DKIM), NS (name server), SOA (Start of Authority).

DNSSEC: signs DNS records to prevent spoofing. The root zone is signed; each zone signs its records. The client verifies the chain of signatures.

DNS over HTTPS (DoH) / DNS over TLS (DoT): encrypts the DNS query to prevent eavesdropping and tampering by the local resolver.

DNS queries use UDP port 53 (falling back to TCP for large responses). See UDP below.

DHCP lease: the IP address is leased for a period (e.g., 24 hours). The client must renew before the lease expires. If the server is unreachable, the client keeps using the address until the lease expires.

DHCP uses UDP ports 67 (server) and 68 (client). The initial Discover is a broadcast (255.255.255.255) because the client does not yet have an IP address.

ARP (Address Resolution Protocol): maps an IP address to a MAC address on the local network. ARP request: "Who has 192.168.1.1?" → ARP reply: "192.168.1.1 is at AA:BB:CC:DD:EE:FF".

ICMP (Internet Control Message Protocol): error messages and diagnostics. ping uses ICMP Echo Request/Reply. traceroute uses ICMP Time Exceeded (each router decrements the TTL; when it hits 0, it sends a Time Exceeded).

BGP: each autonomous system (AS) runs a BGP speaker. BGP exchanges prefixes (e.g., 192.168.0.0/16) and paths (the sequence of ASes). BGP is a path-vector protocol: it detects loops by checking the AS path. Convergence: $\approx 1$–$5$ minutes after a topology change. BFD (Bidirectional Forwarding Detection) can reduce failover to approximately 1 second or less, which is the standard in modern data centers.

IPv6: 128-bit addresses. Eliminates NAT (every device has a globally unique address). SLAAC (Stateless Address Autoconfiguration): a device generates its own address from its MAC (or a random interface ID) and the router’s prefix.

The IP header includes a checksum field for error detection (a 16-bit one’s complement sum), a simpler mechanism than the CRC used at the link layer.

Sequence numbers: each byte is numbered. The receiver acknowledges the next expected byte. Retransmission: if an ACK is not received within the RTO (Retransmission Timeout), the sender retransmits. The RTO is estimated from RTT samples (Jacobson’s algorithm: $RTO = SRTT + 4 \times RTTVAR$).

Flow control: the receiver advertises a window (the number of bytes it can buffer). The sender does not send more than the window. Prevents the sender from overwhelming the receiver.

Congestion control: the sender limits its rate to avoid overloading the network. TCP Reno/Cubic: slow start (exponential growth until the window reaches the slow-start threshold), congestion avoidance (linear growth), fast retransmit (3 duplicate ACKs → halve the window), fast recovery (continue without slow start).

TCP state machine:

Non-blocking I/O and event loops: a socket can be set to non-blocking mode so that recv() returns immediately with EWOULDBLOCK instead of sleeping. An event loop (e.g., epoll, kqueue, io_uring) multiplexes many sockets in a single thread, enabling concurrent connections without one thread per connection.

UDP is the transport for DNS, QUIC/HTTP 3, VoIP (RTP), and real-time multiplayer gaming. In each case, the application implements its own reliability (or deliberately accepts loss) because the per-packet overhead of TCP’s retransmission and ordering is unacceptable for latency-sensitive traffic.

QUIC (RFC 9000) builds a reliable, ordered stream on top of UDP, combining transport and encryption in a single protocol. See HTTP below.

Handshake (TLS 1.3):

1. Client → Server: ClientHello (supported ciphers, key share, SNI).
2. Server → Client: ServerHello (chosen cipher, key share), {EncryptedExtensions, Certificate, CertificateVerify, Finished}.
3. Client → Server: Finished.

The EncryptedExtensions message (carried in the server’s flight, encrypted with the handshake keys) carries ALPN (Application-Layer Protocol Negotiation, e.g., selecting h2 or http/1.1), key usage, and other negotiated parameters.

The shared secret is derived from the ECDHE key exchange. The certificate is signed by a CA (Certificate Authority); the client verifies the chain of trust.

Certificate: contains the server’s public key, domain name, validity period, and the CA’s signature. The client checks: (1) the certificate is signed by a trusted CA, (2) the domain name matches, (3) the certificate is not expired.

Forward secrecy: the ECDHE keys are ephemeral. Even if the server’s private key is compromised later, past sessions cannot be decrypted.

TLS 1.3 handshake sequence:

After step 4, both sides switch to application data keys. The entire handshake is 1 RTT (steps 1–2 are the RTT; steps 3–4 can be pipelined).

REST: a set of constraints on HTTP: resources identified by URIs, operations by methods (GET = read, POST = create, PUT = update, DELETE = remove), stateless (no session state on the server), uniform interface.

Body formats: application/json, application/x-www-form-urlencoded (query string), multipart/form-data (file uploads), application/octet-stream (binary).

Query string: ?key=value&key2=value2. Parsed into a map. Form data: POST with Content-Type: application/x-www-form-urlencoded.

Caching: Cache-Control: max-age=3600 (cache for 1 hour). ETag / If-None-Match: the server returns 304 Not Modified if the resource is unchanged. Last-Modified / If-Modified-Since: time-based revalidation. See Scaling Strategies for CDN and application-level caching.

Chunked transfer encoding: the response body is sent in chunks, each prefixed with its size in hex. Used when the total length is unknown (e.g., streaming).

SSE (Server-Sent Events): the server pushes events to the client over a single HTTP connection. Content-Type: text/event-stream. Unidirectional (server → client). Used for live updates, notifications.

WebSockets: a full-duplex, bidirectional protocol over a single TCP connection. Upgraded from HTTP (Upgrade: websocket). Used for chat, collaborative editing, real-time gaming.

HTTP/2: multiplexes multiple requests and responses over a single TCP connection using binary framing and stream IDs. Eliminates head-of-line blocking at the application layer (though TCP-level retransmission can still stall all streams). Negotiated via ALPN (h2) during the TLS handshake.

HTTP/3 (QUIC): replaces TCP+TLS with a single UDP-based protocol (RFC 9000). QUIC integrates transport and encryption, performs its own 0-RTT/1-RTT handshake, and multiplexes streams independently—eliminating head-of-line blocking entirely (a lost packet in one stream does not stall others). Negotiated via ALPN (h3). See UDP for the transport layer.

1. DNS: The client sends a DNS query for example.com to its resolver (e.g., 8.8.8.8) over UDP port 53. The resolver queries the root → .com TLD → example.com authoritative server. The answer: 93.184.216.34 (A record). Cached for the TTL.

2. TCP: The client calls socket(), connect() to 93.184.216.34:443. 3-way handshake: SYN → SYN-ACK → ACK.

3. TLS: The client sends a ClientHello (supported ciphers, ECDHE key share, SNI = example.com). The server responds with ServerHello, then the encrypted flight: EncryptedExtensions (ALPN: h2), Certificate (signed by Let’s Encrypt), CertificateVerify, Finished. The client verifies the certificate chain and sends Finished. The shared secret is derived from the ECDHE exchange.

4. HTTP: The client sends GET /api/data as an HTTP/2 stream over the TLS-encrypted connection. The server responds with 200 OK, Content-Type: application/json, and the JSON body.

5. Teardown: The client sends a FIN; the server responds with FIN-ACK. The TCP connection is closed.

Total RTTs: 1 (DNS, if not cached) + 1 (TCP) + 1 (TLS 1.3) + 1 (HTTP) = 4 RTTs. With TLS session resumption (0-RTT): 3 RTTs. With QUIC (HTTP/3): the TCP and TLS handshakes are merged, reducing to 1 (DNS) + 1 (QUIC) + 1 (HTTP) = 3 RTTs, or 2 with 0-RTT resumption.