Networking Glossary

TL;DR

• A lookup page, not a lesson. Each entry gives the term, its expansion, a definition short enough to say aloud, and a link to the one page that owns the explanation.
• Every term has an anchor. Link straight to an entry with glossary#rtt, glossary#mss and so on; the anchor is the term in lower case with hyphens.
• Where the standards define a term, these definitions follow them: RFC 9293 for TCP, RFC 9499 for DNS and RFC 4949 for security.
• Some abbreviations mean two things. MAC, ACK, port, gateway, RTO and TTL each have two meanings here; the table after the glossary says how to tell them apart.

Glossary

Jump to a letter: 0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Z

0-9

• 4-tuple (source IP, source port, destination IP, destination port) - The four fields that identify one TCP connection, and the key the kernel uses to find its socket. Ports, sockets and demultiplexing.
• 5-tuple (protocol plus the 4-tuple) - Protocol, source and destination address, source and destination port. Firewalls and load balancers match and hash flows on it. Firewalls and segmentation.

A

• A and AAAA records - DNS record types that map a name to an IPv4 address (A) or an IPv6 address (AAAA). DNS records and routing.
• ACK flag (acknowledgment flag) - The TCP header bit that says the acknowledgment number is valid. Set on nearly every segment after the first SYN. TCP segment header.
• ACK (message) (acknowledgment) - A segment or message confirming receipt, such as a pure TCP ACK or the DHCP Acknowledge. Distinct from the ACK flag bit. TCP connection.
• ACME (Automatic Certificate Management Environment) - The protocol (RFC 8555) a client uses to prove control of a name and get a certificate issued automatically. Certificates and PKI.
• AEAD (Authenticated Encryption with Associated Data) - A cipher mode (AES-GCM, ChaCha20-Poly1305) that encrypts and detects tampering in one call. Never repeat a nonce under one key. Symmetric crypto and hashing.
• AIMD (additive increase, multiplicative decrease) - TCP's congestion rule: grow cwnd by about 1 MSS per RTT, halve it on loss. It converges to a fair share. Congestion control.
• ALB (Application Load Balancer) - AWS's L7 load balancer. It does not preserve the client IP (read X-Forwarded-For) and idles out at 60 seconds by default. Cloud load balancers.
• ALPN (Application-Layer Protocol Negotiation) - A TLS extension where client and server agree on the protocol inside the tunnel, such as h2 or http/1.1, with no extra round trip. TLS.
• Anycast - One IP address announced from many sites; routing delivers each packet to one of them. It follows BGP policy, not geography. Global traffic steering.
• AP (access point) - The Wi-Fi base station that advertises an SSID and connects wireless stations to the wired network. Wi-Fi.
• API gateway - A reverse proxy plus API policy: authentication, rate limits, routing and aggregation. Proxies and gateways.
• ARP (Address Resolution Protocol) - Broadcasts "who has this IPv4 address?" on the local link and gets the owner's MAC address back, which the host caches. ARP and MAC addresses.
• AS (autonomous system) - A set of routers under one administrative control, identified by an ASN. OSPF runs inside one; BGP runs between them. Autonomous systems.
• ASN (Autonomous System Number) - The globally unique number that identifies an autonomous system in BGP. Autonomous systems.
• AS-PATH - The BGP attribute listing every AS a route has crossed. A router that sees its own ASN in it rejects the route. BGP.
• Availability zone (AZ) - A separate data centre within a cloud region. Subnets live in one AZ on AWS and span the region on GCP and Azure. Cloud network model.

B

• Backoff (exponential backoff) - Waiting longer after each failed attempt, usually doubling, so retries do not pile onto a struggling service. Pair it with jitter. Timeouts, retries and backoff.
• Bandwidth - The capacity of a link: how much data fits per second. More bandwidth does not shorten the trip. Delay and latency.
• BBR (Bottleneck Bandwidth and Round-trip propagation time) - A congestion control algorithm that models bottleneck bandwidth and minimum RTT instead of reacting to loss. Congestion control.
• BCP 38 (ingress filtering) - The practice of dropping packets whose source address could not come from the sender's network. It fixes spoofing only where deployed. DDoS.
• BDP (bandwidth-delay product) - Rate times RTT: the data that must be in flight to fill a path. 1 Gbps at 80 ms is 10 MB. Loss, throughput and BDP.
• Bellman-Ford - The shortest-path algorithm behind distance-vector routing: each router learns costs only from its neighbours' advertisements. Link-state vs distance-vector.
• BGP (Border Gateway Protocol) - The path-vector protocol that exchanges reachability between autonomous systems and applies business policy on top. BGP.
• BPF (Berkeley Packet Filter) - The filter language of tcpdump capture filters, such as host 192.0.2.10 and tcp port 443. It decides what is recorded. tcpdump and Wireshark.
• Broadcast domain - The set of ports a layer 2 broadcast reaches. A plain switch is one; each VLAN is its own. VLANs.

C

• CA (certificate authority) - A party that signs certificates binding a public key to a name. Clients trust a fixed set of root CAs. Certificates and PKI.
• CDN (content delivery network) - A geo-distributed, tiered HTTP cache and reverse proxy in front of an origin, so most requests are answered at a nearby PoP. CDN.
• Certificate Transparency (CT) - Public append-only logs that make mis-issued certificates detectable. Browsers demand proof a certificate was logged. Certificates and PKI.
• CGNAT (carrier-grade NAT) - NAT run by an ISP across many subscribers, using the shared range 100.64.0.0/10 (RFC 6598). IP addressing.
• CIDR (Classless Inter-Domain Routing) - Addressing where the network and host split falls on any bit, written as a prefix length such as /27. IP addressing.
• Circuit breaker - Stops calling a dependency that is failing so callers fail fast. It trips on error rate and volume, not one error. Timeouts, retries and backoff.
• CLOSE_WAIT - The TCP state where the peer has closed but your application has not called close(). A pile of them is an application bug. TCP state machine.
• CNI (Container Network Interface) - The plugin that gives each Kubernetes pod its IP address and connects pods across nodes. NetworkPolicy takes effect only if it enforces it. Kubernetes networking.
• conntrack (connection tracking) - The Linux kernel table of flows that stateful firewalls and NAT use to match replies to the connections that opened them. Firewalls and segmentation.
• Cookie - A value the server sets with Set-Cookie and the browser returns on later requests, giving stateless HTTP a login. Cookies, sessions and CORS.
• CORS (Cross-Origin Resource Sharing) - The browser relaxing the same-origin policy when the other server opts in with Access-Control-Allow-Origin. Cookies, sessions and CORS.
• CRC (cyclic redundancy check) - A polynomial checksum, stronger than parity or the Internet checksum, used for the Ethernet frame check sequence. Error detection.
• CSMA/CA (carrier-sense multiple access with collision avoidance) - How Wi-Fi shares the air: listen, back off a random time, then send. Collisions cannot be detected, so it avoids them. Wi-Fi.
• CSMA/CD (carrier-sense multiple access with collision detection) - The original shared-medium Ethernet rule, using binary exponential backoff after a collision. Switched full-duplex links no longer need it. Switches and MAC learning.
• CSR (certificate signing request) - What you send a CA to get a certificate: your public key and names. The private key never leaves you. Certificates and PKI.
• CSRF (cross-site request forgery) - Tricking a logged-in browser into sending an authenticated request to another site. SameSite cookies and CSRF tokens defend against it. Cookies, sessions and CORS.
• CUBIC - The congestion control algorithm Linux uses by default, rather than Reno. Congestion control.
• cwnd (congestion window) - The sender's estimate of what the network can carry. At most min(rwnd, cwnd) bytes may be in flight. Congestion control.

D

• DDoS (distributed denial of service) - Exhausting a target's bandwidth, connection state or application work from many sources, so blocking by IP fails. DDoS.
• Default gateway - The router a host sends to when the destination is not on its own subnet, reached by the 0.0.0.0/0 route. Host forwarding decision.
• Delayed ACK - A receiver waiting briefly to piggyback the ACK on data or acknowledge two segments at once. Linux uses 40 ms at minimum. Nagle and delayed ACK.
• DF (Don't Fragment) - The IPv4 header flag forbidding fragmentation. A packet too big for the next link is dropped with an ICMP error. MTU, MSS and fragmentation.
• DHCP (Dynamic Host Configuration Protocol) - Hands a host an address, mask, gateway, DNS servers and a lease in four UDP messages: Discover, Offer, Request, Acknowledge. DHCP.
• dig - A tool that sends one DNS query to a server you choose and prints the raw reply, bypassing the OS resolver. dig.
• Distance-vector routing - Routers share their distance to each destination with neighbours only and compute paths with Bellman-Ford. RIP is the classic example. Link-state vs distance-vector.
• DNAT (destination NAT) - Rewriting the destination address of arriving packets. Port forwarding and kube-proxy's Service load balancing both use it. NAT.
• DNS (Domain Name System) - A distributed, hierarchical, heavily cached database mapping names to records, mostly IP addresses. Runs on UDP and TCP port 53. DNS resolution.
• DNSSEC (DNS Security Extensions) - Signs DNS answers so their integrity can be verified. It does not encrypt, so it gives no privacy. DNS records and routing.
• DoH (DNS over HTTPS) - DNS queries carried in HTTPS. Like DoT it encrypts only the stub-to-resolver hop and does not hide the destination IP. DNS records and routing.
• DORA (Discover, Offer, Request, Acknowledge) - The four-message DHCP exchange. The Request is broadcast so losing servers see whose offer won and release theirs. DHCP.
• DoT (DNS over TLS) - DNS queries carried over TLS on TCP port 853. It encrypts the stub-to-resolver hop only. DNS records and routing.

E

• eBPF (extended Berkeley Packet Filter) - Lets sandboxed programs run inside the Linux kernel. Tools such as bpftrace and Cilium Hubble use it to observe sockets and packets. Debugging by layer.
• ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) - Key agreement using a fresh elliptic-curve key pair per connection, which gives forward secrecy. Key exchange and public-key crypto.
• ECMP (equal-cost multipath) - Several equal-cost routes to one prefix. A hash of the flow keeps each flow on one path. Forwarding and longest prefix.
• ECN (Explicit Congestion Notification) - A router marks packets with CE instead of dropping them when it is filling up. The receiver echoes it with the TCP ECE flag. Congestion control.
• ECS (EDNS Client Subnet) - A DNS option (RFC 7871) passing part of the client's address to the authoritative server so it can tailor the answer to location. DNS records and routing.
• Encapsulation - Each layer wrapping what the layer above hands it in its own header. The receiver unwraps in reverse. Layers and models.
• ENI (elastic network interface) - The virtual network card in your subnet. An AWS interface endpoint is an ENI with a private IP. Private service endpoints.
• Ephemeral port - The temporary source port the OS gives a client. Linux defaults to 32768-60999; macOS and Windows use 49152-65535. Port exhaustion and TIME_WAIT.
• ETag - A validator for a cached response. The client sends it in If-None-Match, and the server may answer 304 Not Modified with no body. HTTP caching.

F

• FIN (finish) - The TCP flag that politely closes one direction of a connection. It consumes one sequence number. TCP connection.
• Firewall - An ordered ruleset matched against a packet's 5-tuple and often its connection state. The first matching rule wins. Firewalls and segmentation.
• Flow control - Protecting the receiver: the sender may not have more unacknowledged bytes in flight than the advertised receive window. Flow control.
• Forwarding - The per-packet data plane job: look up the destination, decrement TTL, fix the checksum, queue and send. Forwarding and longest prefix.
• Forward proxy - A proxy acting for clients: egress control, filtering and caching. HTTPS passes through it as a CONNECT tunnel. Proxies and gateways.
• Fragmentation - Splitting an IPv4 packet that exceeds the next link's MTU. Lose one fragment and the whole datagram is lost. MTU, MSS and fragmentation.

G

• Goodput - The useful application bytes delivered per second, after headers and retransmissions are subtracted. Loss, throughput and BDP.
• gRPC (gRPC Remote Procedure Calls) - Calls a named function through a generated stub, with protobuf messages over HTTP/2. Always set a deadline; it has none by default. RPC and APIs.

H

• Happy Eyeballs - Racing IPv6 and IPv4 connection attempts so a broken family costs the user almost nothing. Part of the dual-stack transition. IPv6.
• HMAC (hash-based message authentication code) - A MAC built from a hash and a key. It exists because SHA-256 of key followed by message is length-extendable. Symmetric crypto and hashing.
• HoL blocking (head-of-line blocking) - One lost or slow item stalling everything queued behind it, such as a lost TCP segment stalling every HTTP/2 stream. HTTP/1.1 and HTTP/2.
• Hop limit - The IPv6 header's 8-bit TTL equivalent, decremented by each router. Neighbor Discovery sends 255 so receivers can confirm on-link senders. IPv6.
• HPACK - HTTP/2's header compression scheme. HTTP/1.1 and HTTP/2.
• HSTS (HTTP Strict Transport Security) - A response header telling the browser to use HTTPS only for a host, which defeats HTTP downgrade and SSL stripping. TLS.
• HTTP (Hypertext Transfer Protocol) - A stateless, text-based request and response protocol. A start line, headers, a blank line, then an optional body. HTTP basics.
• HTTP/2 - HTTP over binary frames, with many streams multiplexed on one TCP connection and HPACK header compression (RFC 9113). HTTP/1.1 and HTTP/2.
• HTTP/3 - HTTP carried over QUIC instead of TCP (RFC 9114), so a lost packet stalls only the streams it carried. QUIC and HTTP/3.

I

• ICMP (Internet Control Message Protocol) - IP's error and diagnostic messenger: echo request and reply for ping, time exceeded for traceroute, destination unreachable. ICMP, ping, TTL and PMTUD.
• Idempotent - Repeating the request has the same effect as doing it once, so retrying is safe. GET, PUT and DELETE are; POST is not. HTTP status and semantics.
• IGP (interior gateway protocol) - A routing protocol that runs inside one AS, such as OSPF, IS-IS or RIP. IGP versus EGP.
• IGW (internet gateway) - The VPC component that gives a subnet a route to the internet and does 1:1 NAT between private and public IPv4 addresses. VPC routing.
• IKE (Internet Key Exchange) - The IPsec protocol, on UDP 500 or 4500, that negotiates keys and Security Associations before ESP carries data. VPN, IPsec and WireGuard.
• Interface endpoint - An AWS PrivateLink endpoint: an ENI with a private IP in your subnet, reached by the service's normal DNS name. Private service endpoints.
• IPsec - A VPN suite where IKE negotiates keys and ESP (IP protocol 50) carries the encrypted packets. VPN, IPsec and WireGuard.
• IPv6 (Internet Protocol version 6) - The same IP model with a 128-bit address and a fixed 40-byte header. No broadcast and no ARP. IPv6.
• ISN (initial sequence number) - The random starting sequence number each side picks in its SYN. The other side acknowledges ISN plus 1. TCP connection.
• IXP (Internet exchange point) - A shared facility where many ISPs and content providers interconnect and peer directly. ISPs, peering and IXPs.

J

• Jitter - Variation in delay. It, not the average, breaks voice and games. In retries, jitter is randomness added to the backoff. Delay and latency.
• JWT (JSON Web Token) - A signed, self-contained token any server holding the key can verify. It is signed, not encrypted, and cannot be revoked before exp. Authentication in practice.

K

• kube-proxy - Programs kernel rules (iptables, IPVS or nftables) that DNAT a Service IP to a pod IP. It does not carry traffic itself. Kubernetes networking.
• Kubernetes Service - A stable virtual IP and DNS name for a changing set of pods that pass their readiness probe. Service discovery.

L

• L2 (layer 2, the link layer) - The layer of MAC addresses and switches. Delivers a frame one hop. Layers and models.
• L3 (layer 3, the network layer) - The layer of IP addresses and routers. Delivers a packet host to host. Layers and models.
• L4 (layer 4, the transport layer) - The layer of TCP, UDP and ports. As a load balancer it sees only IP and port, so it is fast and protocol-agnostic. Load balancing.
• L7 (layer 7, the application layer) - The layer of HTTP and DNS. An L7 load balancer terminates the client connection and routes on host, path, header or cookie. Load balancing.
• LB (load balancer) - Gives clients one address (the VIP) and spreads their traffic over many identical backends, skipping any that fail health checks. Load balancing.
• Link-local address - A self-assigned address valid only on one link: 169.254.0.0/16 in IPv4, fe80::/10 in IPv6. In IPv4 it usually means DHCP failed. IP addressing.
• Link-state routing - Every router floods its link costs, builds the same map, and runs Dijkstra locally. OSPF is the standard example. Link-state vs distance-vector.
• LPM (longest-prefix match) - Of all table entries matching a destination, the router picks the most specific. 0.0.0.0/0 wins only when nothing else matches. Forwarding and longest prefix.

M

• MAC address (media access control address) - A 48-bit hardware address that identifies an interface on the local link. It is rewritten at every router hop. Ethernet frames and MAC addresses.
• MAC (message) (message authentication code) - A tag only holders of the key can compute, proving a message is intact and authentic. Unrelated to the MAC address. Symmetric crypto and hashing.
• mDNS (multicast DNS) - Name resolution on the local link without a server (RFC 6762). dig bypasses it; the OS resolver may use it. dig.
• MSS (maximum segment size) - The largest TCP payload per segment: the MTU minus 40 bytes of IPv4 and TCP headers, so 1460 on Ethernet. MTU, MSS and fragmentation.
• MSS clamping - Rewriting the MSS in SYNs at a tunnel or edge so segments fit the path MTU. The standard cure for PMTUD black holes. MTU, MSS and fragmentation.
• mTLS (mutual TLS) - TLS where the client also presents a certificate, so both ends authenticate. Common between machines and in service meshes. Authentication in practice.
• MTU (maximum transmission unit) - The largest IP packet a link carries: 1500 on Ethernet, counting the IP header but not the layer 2 header. MTU, MSS and fragmentation.
• Multicast - One sender to a group of receivers that joined it. IPv4 group membership is managed with IGMP. The IP packet.

N

• NACL (network access control list) - A stateless, numbered subnet-edge filter in AWS with allow and deny rules. Both directions need rules, including ephemeral ports. Security groups vs NACLs.
• Nagle's algorithm - Send a small segment now only if nothing sent is unacknowledged, otherwise buffer. With delayed ACK it stalls write, write, read. Nagle and delayed ACK.
• NAT (network address translation) - A router rewriting addresses as packets cross it, using a per-flow table. Not a security boundary. NAT.
• NDP (Neighbor Discovery Protocol) - IPv6's replacement for ARP, using ICMPv6 Neighbor Solicitation and Advertisement (RFC 4861). IPv6.
• NGW (NAT gateway) - The managed cloud appliance that lets private subnets reach out and refuses inbound. AWS bills it per hour and per GB processed. NAT gateways and egress.
• NLB (Network Load Balancer) - AWS's L4 load balancer: static IPs, very high connection counts, and it preserves the client IP for instance targets. Cloud load balancers.
• NXDOMAIN - The DNS status meaning the name does not exist. It is cached too, and differs from SERVFAIL, a resolver failure. dig.

O

• OAuth 2.0 - A delegated authorization framework (RFC 6749): a valet key for an API. OpenID Connect adds the login layer. Authentication in practice.
• OCSP (Online Certificate Status Protocol) - The client asks the CA's responder whether a certificate is revoked. Stapling lets the server send the answer instead. Certificates and PKI.
• OSPF (Open Shortest Path First) - The most widely deployed link-state IGP. Routers flood LSAs, share one database and run Dijkstra. OSPF and autonomous systems.
• OUI (organizationally unique identifier) - The first 3 bytes of a MAC address, identifying the manufacturer that was assigned it. Ethernet frames and MAC addresses.

P

• P2C (power of two choices) - Pick two backends at random and send to the less loaded. Far better than round robin when request costs differ. Load balancing.
• p99 (99th percentile) - The latency below which 99 percent of requests fall. Tail latency, not the mean, is what request-response users feel. Delay and latency.
• PAT (port address translation) - NAT that also rewrites the port so many private hosts share one public IP. Also called NAPT or masquerade. NAT.
• pcap - A recording of the packets that crossed one interface, made by tcpdump and opened in Wireshark. tcpdump and Wireshark.
• Peering - Two networks exchanging traffic directly. Between ISPs it is a business arrangement; between VPCs it is point-to-point and non-transitive. ISPs, peering and IXPs.
• PFS (perfect forward secrecy) - Fresh keys per connection, discarded afterwards, so a stolen long-term key cannot decrypt recorded traffic. TLS 1.3 requires it. Key exchange and public-key crypto.
• PMTUD (Path MTU Discovery) - Sending with DF set and shrinking on each ICMP too-big reply until the packet fits. The result is the smallest MTU on the path. MTU, MSS and fragmentation.
• PMTUD black hole - Large packets vanish because a firewall drops the ICMP too-big message, while small packets still work. Fix with MSS clamping. MTU, MSS and fragmentation.
• PoP (point of presence) - A site where a CDN or provider keeps servers close to users, often 5 to 20 ms from them. CDN.
• Port (logical) - A 16-bit number naming a socket on a host. A port is not a process: one process can own many sockets. Ports, sockets and demultiplexing.
• Port (physical) - A jack or interface on a switch or network card where a cable connects. Unrelated to TCP and UDP port numbers. Switches and MAC learning.
• PrivateLink - Exposes one service, one way, from provider to consumer through an endpoint in your VPC. Works with overlapping CIDRs. Private service endpoints.
• PROXY protocol - A small header a proxy prepends to the connection to carry the real client address to the backend. Proxies and gateways.

Q

• QUIC - A transport protocol on UDP in user space that bundles TCP, TLS and stream multiplexing (RFC 9000). Not an acronym. QUIC and HTTP/3.

R

• Rate limiting - Protecting a service from its clients. A token bucket allows a burst of b and a sustained rate r. Rate limiting and load shedding.
• Reverse proxy - A proxy acting for servers: ingress, hiding the backends. Clients think it is the app. Proxies and gateways.
• RPO (recovery point objective) - How much data you can afford to lose in a failure, measured in time. Global traffic steering.
• RST (reset) - The TCP flag that aborts a connection with no wait and no ACK. A closed port answers a SYN with one. TCP connection.
• RTO (recovery) (recovery time objective) - How long you may be down after a failure. Unrelated to TCP's retransmission timeout. Global traffic steering.
• RTO (TCP) (retransmission timeout) - How long TCP waits for an ACK before resending: SRTT plus four times RTTVAR, floored at 200 ms on Linux (RFC 6298). Retransmission and timers.
• RTT (round-trip time) - The there-and-back time of a message. ping reports it, and most request protocols pay it several times before data flows. Delay and latency.
• rwnd (receive window) - The free space in the receiver's buffer, carried in every ACK. Zero stops the sender until a window update. Flow control.

S

• SACK (selective acknowledgment) - A TCP option (RFC 2018) where the receiver reports which out-of-order ranges it holds, so only the gaps are resent. Retransmission and timers.
• Service mesh - A proxy beside every service instance, run by a control plane. It adds mTLS, retries and routing without touching app code. Proxies and gateways.
• SG (security group) - A stateful, allow-only filter on a network interface. Write rules for the opening direction; replies return automatically. Security groups vs NACLs.
• Sidecar - A proxy container deployed beside the application in the same pod, intercepting its traffic for the mesh. Proxies and gateways.
• SLA (service level agreement) - A contractual availability or performance promise to a customer, usually with remedies. Usually looser than the internal SLO. The system request path.
• SLAAC (stateless address autoconfiguration) - A host builds its own IPv6 address from the prefix a router advertises, with no DHCP server. IPv6.
• SLO (service level objective) - An internal target for a service level indicator, such as 99.9 percent of requests succeed over 30 days. The system request path.
• Slow start - TCP doubling cwnd every RTT from an initial window of 10 segments until loss or ssthresh. Congestion control.
• SNAT (source NAT) - Rewriting the source address of outgoing packets. PAT and cloud NAT gateways are SNAT with port translation. NAT.
• SNI (Server Name Indication) - A TLS extension carrying the hostname in the ClientHello so one IP can serve many certificates. TLS.
• SPAN (Switched Port Analyzer) - A switch feature that copies frames from chosen ports to a monitor port. Also called port mirroring. tcpdump and Wireshark.
• SRTT (smoothed round-trip time) - TCP's running average of RTT samples, the base of the RTO calculation (RFC 6298). Retransmission and timers.
• ss - Linux tool that dumps the kernel socket table. On macOS use lsof and netstat instead. ss, nc, lsof and ip.
• SSE (Server-Sent Events) - A one-way, plain HTTP stream from server to client with built-in reconnect and Last-Event-ID resume. Real-time patterns.
• SSH (Secure Shell) - Encrypted remote login on TCP port 22. Ports and protocols.
• ssthresh (slow start threshold) - The cwnd at which slow start gives way to congestion avoidance. After 3 duplicate ACKs it becomes max(FlightSize/2, 2 MSS). Congestion control.
• STP (Spanning Tree Protocol) - IEEE 802.1D loop prevention for switched LANs: it blocks redundant links so frames cannot circulate forever. STP and loops.
• Stub resolver - The OS component that sends one recursive query to a recursive resolver instead of walking the tree itself (RFC 9499). DNS resolution.
• Subnet - A CIDR slice of an address space. Two hosts are on one subnet if applying the mask gives the same network. IP addressing.
• SYN (synchronize) - The TCP flag that opens a connection and carries the initial sequence number. It consumes one sequence number. TCP connection.
• SYN cookie - Encoding connection state in the ISN so a server stores nothing until the real ACK returns. The defence against SYN floods. TCP connection.
• SYN flood - Spoofed SYNs filling the half-open connection queue so real clients are refused. SYN cookies defeat it. DDoS.

T

• TCP (Transmission Control Protocol) - A reliable, ordered, flow-controlled, congestion-controlled byte stream between two endpoints (RFC 9293). Transport overview.
• TGW (transit gateway) - A cloud hub that connects many VPCs and networks with one attachment each, instead of a full mesh of peerings. Private connectivity.
• Three-way handshake (SYN, SYN-ACK, ACK) - How TCP opens a connection: each side sends a SYN with its initial sequence number and has it acknowledged. TCP connection.
• TIME_WAIT - The state the active closer holds for 60 seconds on Linux. It is normal, and the cause of port exhaustion at high connection rates. Port exhaustion and TIME_WAIT.
• TLD (top-level domain) - The last label of a name, such as com. The root refers a resolver to the TLD servers, which refer to the zone. DNS resolution.
• TLS (Transport Layer Security) - Encryption, tamper detection and server authentication for a TCP stream. TLS 1.3 costs one extra round trip. TLS.
• Token bucket - The default rate-limit algorithm: refill at rate r, hold at most b, spend one token per request. Rate limiting and load shedding.
• Transit - Paying an upstream network to carry your traffic to the rest of the Internet. Tier-1 networks pay nobody for it. ISPs, peering and IXPs.
• Trunk port - A switch port carrying many VLANs at once, with each frame tagged by 802.1Q. VLANs.
• TTL (time to live) - The IPv4 header field each router decrements; at zero the packet is dropped with ICMP time exceeded. It counts hops, not seconds. The IP packet.
• TTL (DNS) (time to live) - How long a resolver may cache a DNS answer, set by the zone owner. Propagation is old caches expiring. DNS resolution.

U

• UDP (User Datagram Protocol) - IP plus ports and a checksum: independent datagrams with no handshake, ordering or retransmission (RFC 768). UDP.
• Unicast - One sender to one receiver, the default IP delivery model. The IP packet.
• URL (uniform resource locator) - Names a resource and how to reach it: the host goes to DNS, the port to TCP, the path to the request. HTTP basics.

V

• VIP (virtual IP) - The single address a load balancer presents to clients while many backends sit behind it. Load balancing.
• VLAN (virtual LAN) - Partitions one switch into separate broadcast domains. Traffic between VLANs must cross a router. VLANs.
• VPC (virtual private cloud) - Your own isolated layer 3 network on a provider's shared hardware, with your choice of CIDR, subnets, routes and firewalls. Cloud network model.
• VPN (virtual private network) - Each packet is carried inside an encrypted outer packet to a gateway. It hides contents from the path and moves trust to the operator. VPN, IPsec and WireGuard.
• VRRP (Virtual Router Redundancy Protocol) - A pair of devices sharing one virtual IP so a failure of one box is not a single point of failure. Load balancing.
• VXLAN (Virtual Extensible LAN) - A tunnel carrying layer 2 frames inside UDP (RFC 7348). It costs 50 bytes of MTU. MTU, MSS and fragmentation.

W

• WAF (web application firewall) - A firewall that reads HTTP rather than headers alone, blocking malicious requests. It complements, not replaces, network filters. Firewalls and segmentation.
• WebSocket - A full-duplex connection that starts as an HTTP GET answered with 101 Switching Protocols. Client frames are always masked. Real-time patterns.
• Window scaling - A TCP option (RFC 7323) that extends the 16-bit window field. Without it the window is at most 65,535 bytes. Flow control.
• WireGuard - A lean VPN over UDP with one fixed crypto suite, where a peer is a public key plus the IPs it may use. VPN, IPsec and WireGuard.

X

• X-Forwarded-For - The header a proxy uses to pass the client IP to the backend. Trust only the hop you added. Proxies and gateways.
• XSS (cross-site scripting) - Injecting script into a page so it runs with that site's privileges. HttpOnly cookies limit what it can steal. Cookies, sessions and CORS.

Z

• Zone - A list of typed DNS records under one administrative authority. The apex holds SOA and NS, so it cannot hold a CNAME. DNS records and routing.

Ambiguous terms

The same letters, two different ideas. The table gives the quickest way to tell which one is meant. Each meaning has its own glossary entry above.

Term	First meaning	Second meaning	How to tell
MAC	MAC address: a 48-bit hardware address on a link	MAC (message): a keyed tag proving a message is authentic	Layer 2 and frames mean the address; crypto, TLS and HMAC mean the tag.
ACK	ACK flag: a bit in the TCP header	ACK (message): a segment or message that confirms receipt	The flag is a field you read in a header; the message is the thing that travels.
Port	Port (logical): a 16-bit TCP or UDP number naming a socket	Port (physical): the jack or interface on a switch or NIC	Numbers like 443 are logical; switch ports are counted by interface name.
Gateway	Default gateway: the router a host sends off-subnet traffic to	NAT gateway and API gateway: a managed egress appliance, or a reverse proxy with API policy	Ask which job it does: routing off the subnet, translating addresses, or applying API policy.
RTO	RTO (TCP): the retransmission timeout, in milliseconds	RTO (recovery): the recovery time objective, in minutes or hours	Sockets and packet captures mean the timer; disaster recovery and failover mean the objective.
TTL	TTL: the IP hop counter, decremented per router	TTL (DNS): how long a resolver may cache an answer	A packet carries the first; a DNS record carries the second.

Interview questions

INTERVIEWWhat is the difference between MTU and MSS?junior

Show answer

MTU is the largest IP packet a link will carry, 1500 bytes on Ethernet, counting the IP header. MSS is the largest TCP payload in one segment. On plain IPv4 with TCP it is the MTU minus 40 bytes of headers (20 IP plus 20 TCP), so 1460. Each side announces its MSS as an option in the SYN.

Follow-ups:

• What is the MSS on plain IPv6? 1440: the 40-byte IPv6 header plus the 20-byte TCP header leaves 1500 - 60.
• Why do tunnels need MSS clamping? The tunnel header spends MTU, so segments sized for 1500 no longer fit the path.

INTERVIEWExplain the bandwidth-delay product in one sentence.mid

Show answer

BDP is the link rate times the round-trip time: the number of bytes that must be in flight to keep the pipe full, so 1 Gbps at 80 ms is 10 MB, and a window smaller than that caps throughput at window divided by RTT.

Follow-ups:

• What does a 64 KB window fill on that path? About 0.65 percent of it.
• How does a sender get a window larger than 65,535 bytes? Window scaling, negotiated in the SYN.

INTERVIEWHow do anycast, multicast and unicast differ?mid

Show answer

Unicast sends to one specific receiver. Multicast sends one stream to every receiver that joined a group. Anycast gives the same address to many servers and routing delivers each packet to one of them, usually the closest by routing policy, which is not always the closest by geography.

Follow-ups:

• Can an anycast route change mid-connection? Yes, a routing change can move a user to another site, which is why long-lived TCP over anycast needs care.
• Who uses anycast? CDNs and public DNS resolvers announce one IP from every site.

INTERVIEWWhat is a 5-tuple, and what uses it?junior

Show answer

It is the protocol plus the source address, source port, destination address and destination port. Together they identify one flow. Firewalls match rules on it, connection tracking keys its state table by it, and ECMP and load balancers hash on it so a flow stays on one path or backend.

Follow-ups:

• How does it relate to the 4-tuple? The 4-tuple is the same without the protocol; it is what identifies one TCP connection to the kernel.
• What does NAT do to it? It rewrites part of the tuple, source address and port for outbound traffic, and remembers the mapping in a per-flow table.

Fun facts

FACTSGlossary trivia

• QUIC is not an acronym; RFC 9000 says it is a name.
• RFC 4949 is the Internet Security Glossary, and RFC 9499 (also BCP 219) is the DNS terminology document; it obsoletes RFC 8499.
• TTL means hops in an IP header and seconds in DNS. Two layers, one name, no connection between them.
• CIDR dates from 1993 and replaced the classful A, B and C split of the address space.