Computer Networks: Protocols, Routing, and Security

The core follows the 2013 Computer Networks syllabus from undergraduate Computer Engineering at Kırıkkale University: OSI and TCP/IP models, Ethernet, IPv4, subnetting, switching, routing and basic network services. IPv6, QUIC, modern Ethernet and Wi-Fi, network security, data-centre fabrics, cloud networking and model-driven automation are presented in their later standards context; 2024-2026 specifications are not attributed to the historical course material.

Unit 1: The Basic Network Model

What is a network?

A computer network is a communication system in which endpoints exchange data under common rules. A cable or radio link alone is not a network; addressing, protocols, media, and intermediate devices must work together.

Three groups are enough for the basic model:

• Endpoints: computers, servers, phones, cameras, sensors, virtual machines, containers.
• Intermediate devices: switches, routers, access points, firewalls, load balancers.
• Media: copper, fiber, radio.

A network function does not have to be a physical appliance. Routing, firewalling, and load balancing can run on hardware, virtual machines, containers, or cloud services.

Network performance

Link speed alone does not describe network quality.

• Bandwidth: theoretical link capacity.
• **Throughput:** data rate actually achieved.
• Goodput: useful application data after protocol overhead and retransmissions.
• **Latency:** end-to-end delay.
• Jitter: variation in delay.
• Loss: fraction of packets not delivered.
• Availability: fraction of time the service remains usable.

A useful delay model is:

total delay =
transmission + propagation + processing + queueing

More bandwidth can reduce serialization time. It cannot remove propagation delay caused by distance.

The application determines which metric matters. Backup traffic mainly cares about completion time. Interactive systems care about latency. Voice and live video care about latency, jitter, and loss together.

Topology

Physical topology is the actual placement of devices and links. Logical topology is the path traffic follows.

Classical forms:

• Bus: shared medium; historically important for Ethernet.
• Ring: nodes form a loop.
• Star: endpoints connect to a central switch.
• Mesh: multiple paths exist between nodes.

A full mesh with n nodes needs:

n(n - 1) / 2

links, so cost grows quickly.

Enterprise campuses often use access, distribution, and core layers. Data centers commonly use leaf-spine fabrics. Each leaf connects to every spine, making east-west path length more predictable.

Layered communication

Layering divides communication into smaller responsibilities. A layer can change internally while the interface to adjacent layers stays stable.

The OSI model has seven layers:

| Layer | Main responsibility | | --- | --- | | 7 Application | Network service to applications | | 6 Presentation | Encoding, format, encryption | | 5 Session | Session lifecycle | | 4 Transport | End-to-end communication, ports | | 3 Network | IP addressing and routing | | 2 Data Link | Local delivery and framing | | 1 Physical | Carrying bits over media |

Operational Internet systems are usually described with the TCP/IP model:

Application   HTTP, DNS, DHCP, SSH, SMTP
Transport     TCP, UDP, QUIC over UDP
Internet      IPv4, IPv6, ICMP, ICMPv6
Access        Ethernet, Wi-Fi, PPP

Layer boundaries are useful abstractions, not laws. QUIC runs over UDP but implements reliability, flow control, and congestion control itself.

Encapsulation

At the sender, each lower layer adds control information:

application data
      |
TCP segment / UDP datagram
      |
IP packet
      |
Ethernet or Wi-Fi frame
      |
bits / symbols

The receiver removes them in reverse order.

In ordinary routing, the destination IP identifies the final Layer 3 endpoint. The destination MAC identifies only the next Layer 2 hop. Every router builds a new Layer 2 frame. NAT and tunneling are explicit exceptions to the simple end-to-end model.

LAN and WAN

A LAN covers a limited area and usually one administrative domain. A WAN connects geographically separate networks through carrier infrastructure.

PAN, campus, and metropolitan networks are useful intermediate terms. In cloud and data-center design, administrative boundaries and latency budgets often matter more than physical distance.

Unit 2: Physical Transmission and Ethernet

Copper

Twisted pairs reduce electromagnetic interference and crosstalk. UTP has no shield. Shielded cable is useful in noisy environments only when grounding is correct.

Common categories:

Cat5e    1 Gbit/s     100 m
Cat6     1 Gbit/s     100 m
Cat6A    10 Gbit/s    100 m
Cat8     25/40 Gbit/s short data-center links

10GBASE-T can run over Cat6 at shorter distances. Channel length includes permanent cable, connection points, and patch cords.

T568A and T568B provide the same electrical purpose with different color ordering. Consistency inside a facility matters more than choosing one over the other.

Crossover cables were once required for some similar-device connections. Auto MDI/MDIX removed most of that requirement.

Structured cabling and testing

Structured cabling is more than cable category. The permanent link, patch panel, outlet, patch cords, and full channel must be considered together.

Common copper measurements include:

• continuity and pin mapping,
• insertion loss,
• return loss,
• NEXT and other crosstalk measurements,
• propagation delay and delay skew.

A link light proves electrical connectivity. It does not prove that the channel meets the target category or data rate. Certification testing measures that.

Fiber

Fiber carries light instead of electrical signaling and is immune to electromagnetic interference.

Single-mode fiber is used for long distance and backbone links. Multimode fiber is common for shorter building and data-center links.

Common connector and module families include:

LC, SC, MPO/MTP
SFP, SFP+, SFP28
QSFP+, QSFP28
QSFP-DD, OSFP

An optic is not selected by speed alone. Wavelength, fiber type, reach, connector, FEC requirements, and peer compatibility must match.

Fiber loss, dispersion, and link budget

Two basic limits are:

• Attenuation: optical power decreases with distance and connections.
• Dispersion: a pulse spreads in time until adjacent bits become hard to distinguish.

Modal dispersion is especially important in multimode fiber. Single-mode fiber supports longer reach, but chromatic dispersion and optical power budget still matter.

A simple budget is:

receiver power =
transmitter power
- fiber loss
- connector loss
- splice loss
- engineering margin

The result must be above receiver sensitivity and below the overload limit.

An OTDR locates reflections and loss events by distance. An optical power meter measures end-to-end power. They answer different questions.

Ethernet speeds

Ethernet keeps a common MAC frame model across different physical layers:

100BASE-TX    100 Mbit/s
1000BASE-T    1 Gbit/s
10GBASE-T     10 Gbit/s
25G / 40G     data center
100G / 400G   fabric and backbone
800G          high-speed fabric

IEEE 802.3df-2024 defines physical-layer and management parameters for 400 and 800 Gb/s Ethernet. IEEE P802.3dj includes 1.6 Tb/s work; its second Standards Association recirculation ballot closed on 15 August 2026, but as of 22 August 2026 it is still a draft project.

At high rates, nominal bandwidth is not enough. SerDes rate, FEC latency, optical budget, cable reach, switch radix, and total fabric capacity matter.

IEEE 802.3dg-2026 moves in another direction: 100 Mb/s long-reach single-pair Ethernet, with optional power-distribution work in the project scope. Its value is not peak speed; it extends Ethernet deeper into industrial, building, sensor, and actuator networks with fewer conductors.

PoE

Power over Ethernet carries power over the data cabling.

Approximate source power classes:

802.3af       15.4 W
802.3at       30 W
802.3bt Type 3   60 W
802.3bt Type 4   90 W

The endpoint receives less because the cable dissipates power. A switch must be sized for both per-port demand and total PoE budget.

Ethernet frame

A basic Ethernet frame contains:

Preamble + SFD   8 bytes
Destination MAC  6 bytes
Source MAC       6 bytes
Type/Length      2 bytes
Payload          46-1500 bytes
FCS              4 bytes

FCS uses CRC to detect transmission errors. It does not correct them.

The common IP MTU on Ethernet is 1500 bytes. There is no single IEEE-defined "9000-byte jumbo frame" size; around 9000 bytes is a common implementation choice.

IPv4 fragmentation depends on protocol and DF conditions. IPv6 routers do not fragment packets in transit. The source must react to Path MTU Discovery information.

Tunnels add headers and reduce effective MTU. A small ping working through GRE, IPsec, or VXLAN does not prove that full-size application traffic works.

MAC address

A traditional Ethernet MAC address is 48 bits:

00:1A:2B:3C:4D:5E

Address bits indicate unicast/multicast and universal/local administration. Vendor-assigned addresses use an OUI.

For a destination on the same LAN, the frame targets the host MAC. For a remote IP network, the frame targets the default gateway MAC.

IP destination  = final Layer 3 target
MAC destination = target on the current Layer 2 hop

Unicast, multicast, and broadcast

Unicast targets one endpoint. Multicast targets a group. Broadcast targets the local Layer 2 broadcast domain.

Ethernet broadcast is:

FF:FF:FF:FF:FF:FF

IPv6 has no broadcast; defined multicast groups provide the required functions.

Unit 3: Switching and the Local Network

How a switch learns

A switch learns the source MAC address of an incoming frame and associates it with the ingress port.

For the destination MAC:

• if it is known, the frame is sent only to the matching port,
• if it is unknown, the frame is flooded to eligible ports in the VLAN,
• if it is broadcast, it is flooded within the VLAN.

The MAC table is a dynamic cache. Entries age out. A host move is learned when a new source frame appears on another port.

CAM, TCAM, and BUM

MAC tables are commonly implemented with CAM-like hardware. TCAM is widely used for masked Layer 3 prefix, ACL, and policy lookups.

BUM means:

Broadcast
Unknown unicast
Multicast

Uncontrolled BUM traffic consumes bandwidth and forwarding resources. Smaller Layer 2 failure domains, multicast snooping, and overlay control planes reduce unnecessary flooding.

Store-and-forward and cut-through

Store-and-forward receives the complete frame and checks FCS before forwarding.

Cut-through can start forwarding after enough header bytes are received. It reduces latency but may forward a frame before the final FCS is known.

Duplex

Full-duplex Ethernet can transmit and receive at the same time. There is no collision domain and no CSMA/CD.

Autonegotiation should normally remain enabled on both ends. Manual speed or duplex settings must be changed consistently. Duplex mismatch can produce low throughput, FCS errors, and late-collision symptoms instead of a complete link failure.

VLAN

A VLAN creates a separate Layer 2 broadcast domain over shared switching infrastructure.

VLAN 10 -> users
VLAN 20 -> voice
VLAN 30 -> servers

A VLAN and an IP subnet are different concepts: Layer 2 versus Layer 3. Enterprise designs often map one VLAN to one IP subnet.

An access port normally carries one VLAN. A trunk carries multiple VLANs.

802.1Q

802.1Q adds VLAN information to the Ethernet frame. The VLAN ID field is 12 bits, leaving roughly 4094 usable values.

The tag also carries priority and drop-eligibility information. PCP bits are used for Layer 2 QoS marking.

A native VLAN can carry selected trunk traffic untagged. Native VLAN mismatch can cause incorrect delivery and security problems. Production trunks should be explicit and carry only required VLANs.

Inter-VLAN routing

Traffic between VLANs needs Layer 3 routing.

Common methods:

• separate physical router interfaces,
• router-on-a-stick,
• switch virtual interfaces on a Layer 3 switch.

Router-on-a-stick uses subinterfaces:

interface g0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

A Layer 3 switch with SVIs scales better in larger LANs and can forward in hardware.

Layer 2 loops

Ethernet frames do not have a general TTL equivalent. Redundant Layer 2 links without loop control can cause broadcast storms, MAC-table instability, and frame duplication.

Spanning Tree blocks redundant paths that would otherwise loop.

STP, RSTP, and MSTP

Basic process:

1. elect the root bridge,
2. find the best path to the root,
3. assign port roles,
4. prevent loop-forming paths from forwarding.

Classic STP converges slowly. RSTP converges faster. PVST+, Rapid PVST+, and MST are implementation choices for different VLAN and scale requirements.

802.1D, 802.1w, and 802.1s are historically useful identifiers; much modern bridge behavior is consolidated in the IEEE 802.1Q family.

MSTP maps many VLANs to a smaller number of spanning-tree instances. Devices in one MST region must agree on region name, revision, and VLAN-to-instance mapping.

RSTP commonly uses root, designated, and alternate port roles. Role is the topology function; discarding, learning, and forwarding are data states.

Important protections:

• PortFast/edge: quickly forwards on host-facing ports.
• BPDU Guard: protects an edge port when unexpected BPDUs appear.
• Root Guard: stops an unwanted superior BPDU from changing the root.
• Loop Guard: protects against certain unidirectional-failure cases.

Link aggregation

Several physical links can act as one logical link. The current standard is IEEE 802.1AX; 802.3ad is the historical name.

LACP negotiates and selects members. Cisco PAgP is vendor-specific.

Members must be compatible in speed, duplex, VLAN mode, native VLAN, and allowed VLANs.

Load distribution is usually flow-hash based. Four 10G members do not guarantee 40 Gbit/s to one TCP flow. Aggregate capacity appears across many flows.

Hash inputs can include source/destination MAC, IP, and port values. Keeping one flow on one member prevents packet reordering.

First-hop redundancy

Hosts should not depend on one physical default gateway.

• HSRP: Cisco-specific.
• VRRP: open standard; RFC 9568 is the current base specification.
• GLBP: Cisco-specific and can also distribute gateway load.

Redundancy must track more than an inside interface. A gateway that stays "up" after losing its uplink is not useful.

802.1X and MACsec

IEEE 802.1X authenticates a user or endpoint before normal network access.

supplicant -> switch/AP -> RADIUS

Roles:

supplicant              endpoint
authenticator           switch or AP
authentication server   usually RADIUS

MAB can be a fallback for printers or IoT devices without an 802.1X supplicant. It is not strong authentication.

IEEE 802.1AE MACsec provides confidentiality, integrity, and source authentication on Ethernet links.

Unit 4: IPv4 and Subnet Design

IPv4

IPv4 addresses are 32 bits:

192.168.10.25/24

/24 means:

255.255.255.0

Class A/B/C addressing was replaced by CIDR. Classes are historical knowledge; real routing and address planning use prefix length.

Network address

Apply a bitwise AND between the address and mask:

IP       192.168.10.25
Mask     255.255.255.0
Network  192.168.10.0

If the destination is inside the local prefix, the host resolves it directly at Layer 2. Otherwise it sends the packet to the default gateway.

Private and special ranges

10.0.0.0/8         RFC 1918 private
172.16.0.0/12      RFC 1918 private
192.168.0.0/16     RFC 1918 private
127.0.0.0/8        loopback
169.254.0.0/16     link-local
100.64.0.0/10      shared address space / CGNAT
224.0.0.0/4        multicast

100.64.0.0/10 is not RFC 1918 private space. It is shared address space for carrier-grade NAT use.

Subnetting

With h host bits, total addresses are:

2^h

In a conventional unicast subnet:

usable hosts = 2^h - 2

because network and broadcast addresses are not assigned to hosts.

Important exceptions:

• /31: two usable addresses on point-to-point IPv4 links.
• /32: a single host route or loopback.

Example:

192.168.1.0/26
Mask:       255.255.255.192
Block:      64

Network     192.168.1.0
First host  192.168.1.1
Last host   192.168.1.62
Broadcast   192.168.1.63

A quick octet method is:

block = 256 - mask_value

Common prefix sizes:

/24  256 addresses
/25  128
/26   64
/27   32
/28   16
/29    8
/30    4
/31    2, point-to-point
/32    1, host route

Each additional prefix bit halves the address count.

VLSM and summarization

VLSM assigns different prefix lengths to different subnets, reducing waste. Allocate from the largest host requirement to the smallest.

Route summarization does the reverse: contiguous prefixes become one shorter prefix. Summarization reduces routing-table size, but an overly broad summary can create a black hole.

ARP

ARP resolves a known IPv4 address to a MAC address on the local Layer 2 segment.

ARP Request  -> broadcast
ARP Reply    -> usually unicast

For a remote IP destination, the host does not resolve the remote host MAC. It resolves the default gateway MAC.

Gratuitous ARP is used for duplicate-address signaling and to refresh neighbor state after failover. The same trust model enables ARP spoofing.

IPv6 does not use ARP.

NAT and PAT

NAT rewrites addresses. PAT maps many internal flows to fewer public IPv4 addresses using addresses and ports.

192.168.1.10:53124
       |
203.0.113.10:41001

NAT is not a firewall. Reduced inbound reachability is a side effect, not an access-control policy.

NAT also breaks simple end-to-end address transparency and can require protocol-aware handling.

Unit 5: IPv6

Address structure

IPv6 uses 128-bit addresses. Eight 16-bit hextets are written in hexadecimal:

2001:0db8:0000:0000:0211:22ff:fe33:4455

Leading zeroes can be omitted:

2001:db8:0:0:211:22ff:fe33:4455

One consecutive zero run can be compressed once with :::

2001:db8::211:22ff:fe33:4455

Address types

2000::/3    global unicast
fc00::/7    unique local
fe80::/10   link-local
ff00::/8    multicast
::1/128     loopback
::/128      unspecified

IPv6 has no broadcast.

Anycast is not a separate address format. The same unicast address is announced from several nodes; routing selects an appropriate instance.

/64 is the normal LAN prefix and is fundamental to several IPv6 mechanisms. IPv6 planning should not imitate IPv4 scarcity by carving tiny host subnets everywhere.

Link-local

An IPv6-enabled interface uses a link-local address for communication on its own link. Neighbor Discovery, Router Advertisement, and many routing protocols rely on it.

Link-local addresses are not routed. The outgoing interface may be required when a link-local address is used as a next hop.

Interface identifiers and privacy

EUI-64 is a historical way to derive an interface identifier from a MAC address. Embedding stable hardware identity creates tracking concerns.

Modern clients commonly use stable but opaque identifiers and temporary privacy addresses. RFC 7217 and RFC 8981 are important references.

SLAAC and DHCPv6

SLAAC:

Router Solicitation
        |
Router Advertisement
        |
prefix + network information
        |
host creates address
        |
Duplicate Address Detection

DHCPv6 can be stateless or stateful. M and O flags in Router Advertisements signal expected configuration behavior, but actual client behavior also depends on operating-system and network policy.

Neighbor Discovery

ICMPv6 is part of normal IPv6 operation.

Neighbor Discovery messages include:

RS  Router Solicitation
RA  Router Advertisement
NS  Neighbor Solicitation
NA  Neighbor Advertisement
Redirect

They support:

• router discovery,
• prefix discovery,
• address resolution,
• Duplicate Address Detection,
• neighbor reachability detection.

Blocking all ICMPv6 can break IPv6. Filtering must distinguish message type and purpose.

IPv6 header and fragmentation

The IPv6 base header is simpler than the IPv4 header. Optional functions are carried in extension headers.

Routers do not fragment IPv6 packets in transit. If a packet is too large for the path, the source is informed with ICMPv6 Packet Too Big and must select an appropriate size.

Transition methods

IPv4 and IPv6 coexist.

Common models:

• Dual stack: both protocols are available.
• NAT64/DNS64: an IPv6 client reaches an IPv4 service.
• 464XLAT: common in IPv6-only mobile networks for IPv4-only applications.
• Tunnels: carry IPv6 across another network in specific transition or overlay cases.

IPv6 does not require NAT for security. Stateful firewall policy remains a separate concern.

Unit 6: Transport and Application Protocols

Ports and sockets

The transport layer separates applications on the same host by port number.

A socket endpoint can be viewed as:

IP address + port

A TCP connection is identified by source and destination IP/port pairs.

IANA port ranges:

0-1023        well-known
1024-49151    registered
49152-65535   dynamic/private

Common ports:

22    SSH
25    SMTP
53    DNS
67/68 DHCPv4
80    HTTP
123   NTP
143   IMAP
161   SNMP
443   HTTPS
445   SMB

A port number does not prove the application or its security. Port 443 is usually HTTPS, but a device cannot identify an application with certainty from the port alone.

TCP

TCP provides a connection-oriented, ordered byte stream.

Core mechanisms:

• sequence numbers,
• acknowledgments,
• retransmission,
• flow control,
• congestion control,
• checksum.

Connection setup:

Client -> SYN
Server -> SYN, ACK
Client -> ACK

Normal close uses FIN/ACK independently in each direction. RST aborts the connection.

A TCP header carries source/destination ports, sequence and acknowledgment numbers, flags, receive window, and checksum.

MSS is the maximum TCP payload announced for a segment; it is not the same as MTU. Window scaling supports large bandwidth-delay products. SACK tells the sender which blocks arrived so recovery can avoid unnecessary retransmission.

Flow control and congestion control

These solve different problems.

Flow control protects the receiver. The advertised receive window limits how much data can remain unacknowledged.

Congestion control protects the network. The sender changes the amount of in-flight data based on loss, ECN, and delivery measurements.

Reno and related algorithms are classical loss-based designs. CUBIC is widely deployed. BBR uses a bandwidth/RTT model. The key lesson is not the algorithm name: loss and queueing change both application latency and sender behavior.

UDP

UDP is connectionless and small. Its header is eight bytes:

source port
destination port
length
checksum

UDP itself provides no delivery guarantee, retransmission, ordering, or connection state.

Common uses include:

• DNS,
• DHCP,
• some SNMP operations,
• real-time media,
• QUIC.

An application over UDP can add its own reliability. QUIC is the important example.

QUIC and HTTP/3

QUIC is a secure transport protocol over UDP. It integrates TLS 1.3 key establishment and supports independent streams inside one connection.

HTTP/3 carries HTTP semantics over QUIC.

Important properties:

• transport and cryptographic setup are integrated,
• streams are independently ordered,
• connection identity is not tied only to the IP/port tuple,
• user-space protocol evolution is easier.

HTTP/2 multiplexes application streams over one TCP connection. A lost TCP segment can stall later bytes for all HTTP/2 streams. QUIC isolates ordering between streams, so loss normally blocks only the affected stream.

Connection IDs also make path migration, such as Wi-Fi to cellular, more natural than with classic TCP.

DNS

DNS is a distributed hierarchical database for names and resource records.

A normal recursive lookup follows:

client
  |
recursive resolver
  |
root
  |
TLD
  |
authoritative server

Common records:

A       IPv4
AAAA    IPv6
CNAME   alias
MX      mail exchanger
NS      authoritative server
PTR     reverse lookup
TXT     text/policy
SRV     service location
CAA     certificate authority policy

TTL controls cache lifetime. A planned DNS change can remain hidden behind old cached data if TTL is not reduced before the change.

DNSSEC and encrypted DNS

DNSSEC signs DNS data so a resolver can validate origin and integrity. It does not encrypt the query.

Encrypted transports include:

• DoT: DNS over TLS.
• DoH: DNS over HTTPS.
• DoQ: DNS over QUIC.

They protect the client-to-resolver transport. They do not replace DNSSEC and do not automatically encrypt every hop of the authoritative hierarchy.

Enterprise networks must also govern resolver choice. An unmanaged external DoH/DoQ resolver can bypass central DNS policy.

HTTP and TLS

HTTP versions differ in transport and framing:

• HTTP/1.1: textual message syntax over TCP.
• HTTP/2: binary framing and multiplexing, usually TLS/TCP.
• HTTP/3: QUIC.

TLS 1.3 removed many legacy cipher-suite choices and simplified the handshake. Forward secrecy depends on the negotiated key-establishment method; it should not be assumed merely from the version string.

Post-quantum TLS

NIST published ML-KEM, ML-DSA, and SLH-DSA standards in 2024.

RFC 10024, published in August 2026, standardizes three post-quantum/traditional hybrid TLS 1.3 groups:

X25519MLKEM768
SecP256r1MLKEM768
SecP384r1MLKEM1024

Each combines ML-KEM with an ECDHE exchange. The purpose is transition security under both classical and post-quantum assumptions.

This does not mean that present-day quantum computers already break TLS. The concern includes "harvest now, decrypt later" for data that must remain confidential for years.

Other application protocols

SSH is the normal secure choice for remote administration. Telnet does not protect credentials or session data.

FTP is not encrypted by itself. SFTP or an appropriate TLS-protected transfer mechanism should be used when confidentiality is required.

NTP synchronizes time. Clock error can break log correlation, certificate validation, Kerberos-like authentication, and distributed incident analysis.

Syslog centralizes events. Classic UDP/514 is simple but does not guarantee delivery; critical environments should prefer reliable and protected transport where supported.

Unit 7: Routing

Router data plane

A router receives a packet, looks up the destination prefix, selects a next hop, and forwards.

A simplified IPv4 path is:

1. remove the incoming Layer 2 header,
2. perform a FIB lookup,
3. decrement TTL,
4. update required header fields,
5. build a new Layer 2 frame,
6. transmit.

RIB and FIB are not the same thing. The RIB holds routes learned from protocols and static configuration. The FIB holds the selected forwarding results.

The control plane builds topology and routes. The data plane forwards packets.

A Cisco CEF-style view is:

RIB -> FIB
ARP/ND + next-hop state -> adjacency
FIB + adjacency -> fast forwarding

Hardware platforms often use TCAM for prefix and policy lookup. A high-speed router does not normally ask the CPU to perform a software route lookup for every packet.

Longest prefix match

The first routing rule is longest prefix match.

10.0.0.0/8
10.1.0.0/16
10.1.20.0/24

For destination 10.1.20.5, /24 wins.

Route source preference and metric are considered among candidates for the same prefix.

In a Cisco-style mental model:

1. longest prefix,
2. administrative distance among different route sources,
3. metric within the protocol.

Static routes

A static route is explicit and predictable.

ip route 10.20.0.0 255.255.0.0 192.168.1.2

It works well in small stub networks. Manual management becomes expensive in large topologies.

Default routes are:

IPv4  0.0.0.0/0
IPv6  ::/0

A floating static route uses a less-preferred administrative distance and becomes useful when the primary route disappears.

Static routes can be thought of as:

• recursive next-hop routes,
• exit-interface routes,
• fully specified routes with both next hop and interface.

On multi-access Ethernet, an exit-interface-only route can create unnecessary address-resolution behavior; platform behavior must be understood.

ECMP, PBR, and VRF

ECMP installs multiple equal-cost paths and distributes flows across them. Per-packet distribution can reorder packets, so flow hashing is common.

Policy-Based Routing can choose a next hop using source or policy criteria instead of only the destination prefix. It is a controlled exception, not a replacement for ordinary routing.

A VRF creates an independent Layer 3 routing table on the same device. The same IP prefixes can exist in different VRFs. VRFs are fundamental to tenant separation, management networks, MPLS VPNs, and EVPN fabrics.

BFD

BFD performs fast forwarding-path liveness detection between two endpoints. OSPF, BGP, and static-route tracking can react to BFD instead of waiting for slower native timers.

BFD does not compute routes. It reports reachability.

Dynamic routing families

Distance vector: learns route and metric information from neighbors. RIP is the classic example. EIGRP is an advanced distance-vector protocol.

Link state: distributes topology information and calculates a shortest-path tree from a link-state database. OSPF and IS-IS are examples.

Path vector: carries path and policy attributes. BGP is the example.

RIP

RIPv2 uses hop count. Fifteen is the largest reachable value; sixteen means unreachable.

Periodic full updates and slow convergence make RIP unsuitable for most large modern networks. Split horizon, route poisoning, and hold-down mechanisms exist to reduce distance-vector loops.

Its main value today is teaching convergence and routing-loop concepts.

EIGRP

EIGRP originated at Cisco and is described in informational RFC 7868; that RFC is not an IETF Standards Track specification.

DUAL uses:

• successor: best path,
• feasible successor: loop-free backup that meets the feasibility condition.

A feasible successor allows fast failover without a full recomputation.

The default composite metric mainly uses bandwidth and delay. Dynamic load/reliability terms are normally avoided because they can destabilize routing.

OSPF

OSPF is a link-state IGP.

Hello
  |
neighbor adjacency
  |
LSDB synchronization
  |
SPF / Dijkstra
  |
shortest-path tree
  |
routing table

OSPFv2 is used for IPv4. OSPFv3 was designed for IPv6 and later gained broader address-family support.

Neighbor formation depends on parameters such as area, timers, authentication, and network type. MTU mismatch can stall adjacency in EXSTART/EXCHANGE on some platforms.

Router ID

The router ID is a logical 32-bit identity. Explicit configuration is safer than letting a physical interface change determine protocol identity.

DR and BDR

On a broadcast multi-access segment, full adjacency between every router scales poorly. OSPF elects a Designated Router and Backup Designated Router.

Selection uses:

1. interface priority,
2. router ID.

Priority 0 means ineligible.

Election is normally non-preemptive. A higher-priority router that appears later does not replace the existing DR merely because it has a better priority.

Point-to-point links do not need DR/BDR.

OSPF areas and cost

Large LSDBs increase computation and failure propagation. OSPF areas limit scope.

Area 0 is the backbone. ABRs connect areas. ASBRs inject routes from other routing domains.

Classic Cisco cost is:

cost = reference_bandwidth / interface_bandwidth

The historical 100 Mbit/s reference cannot distinguish modern 1G, 10G, and 100G links. A modern reference bandwidth should be chosen consistently.

OSPF LSAs and route classes

A compact LSA memory aid:

Type 1  Router LSA        inside an area
Type 2  Network LSA       generated by DR
Type 3  Summary LSA       inter-area through ABR
Type 4  ASBR Summary      reachability to ASBR
Type 5  AS External       external route
Type 7  NSSA External     external inside NSSA

OSPF prefers intra-area, then inter-area, then external route classes according to its route-selection rules.

LSA flooding distributes topology state. SPF calculates paths from that state. Flooding and forwarding are different operations.

Summarization can reduce LSDB and route count. An over-broad summary can advertise reachability that does not exist; discard/null routing at the summary boundary is therefore important.

Redistribution

Route redistribution between routing domains must be controlled.

Bidirectional redistribution can create:

• route feedback,
• suboptimal paths,
• metric-translation errors,
• routing loops.

Route tagging and explicit filters preserve route origin and stop feedback.

BGP

BGP is the policy-routing protocol used between autonomous systems and inside large routing domains.

• eBGP: between autonomous systems.
• iBGP: inside one autonomous system.

BGP sessions normally use TCP port 179.

BGP does not simply choose the shortest physical path. Policy and attributes shape the result.

Neighbor states are:

Idle
Connect
Active
OpenSent
OpenConfirm
Established

Persistent route exchange begins in Established.

Classic iBGP requires a full mesh because routes learned from one iBGP peer are not normally advertised to another iBGP peer. A route reflector removes much of that scaling burden. A confederation divides a large AS internally into sub-ASes.

Common attributes:

• LOCAL_PREF: preference inside an AS; higher is generally preferred.
• AS_PATH: traversed AS sequence and loop-prevention information.
• ORIGIN: how the prefix entered BGP.
• MED: hint to a neighboring AS about preferred entry.
• NEXT_HOP: Layer 3 next hop.
• COMMUNITY: policy tag.

Exact best-path order depends on implementation. The safe mental model is: policy first, then attributes. "BGP always chooses the shortest AS_PATH" is false.

Prefix lists, AS-path filters, and route maps/policy statements define what is accepted, modified, and advertised.

BGP security

A false prefix announcement can divert traffic. RPKI Route Origin Validation helps validate which AS is authorized to originate a prefix.

ROV is not full path validation. It validates origin authorization, not every relationship in AS_PATH.

A route leak is different: a legitimately learned route is advertised to the wrong neighbor. RFC 9234 defines BGP Roles and the Only-to-Customer attribute to reduce this class of error.

Secure BGP operations combine prefix filtering, max-prefix limits, RPKI/ROV, session protection, and correct neighbor policy.

Segment Routing

Segment Routing lets an ingress or source encode an ordered list of logical segments.

Two main data planes are:

• SR-MPLS: segments are MPLS labels.
• SRv6: segments are IPv6 SIDs.

The design moves policy expression toward the ingress instead of maintaining per-flow signaling state throughout the core.

Uses include traffic engineering, fast reroute, service chaining, and centrally controlled paths.

SRv6 does not replace IPv6 routing; it adds programmable segment behaviors to the IPv6 data plane.

Unit 8: Multicast, IP Services, and QoS

Multicast

Multicast sends one source stream to a receiver group without creating one independent unicast copy per receiver.

IPv4 multicast uses 224.0.0.0/4. Ethernet maps multicast groups to multicast MAC addresses.

Flooding every multicast frame to every switch port does not scale.

IGMP and IGMP snooping

IGMP lets an IPv4 host report group membership to routers. IGMPv2 provides basic join/leave behavior. IGMPv3 adds source-specific membership capabilities.

IGMP snooping lets a switch observe IGMP control messages and learn which ports have receivers.

IGMP is a Layer 3 membership protocol. Snooping is a Layer 2 optimization.

IPv6 uses MLD for similar membership functions.

PIM, RPF, and distribution trees

PIM builds multicast routing state between routers.

• PIM Dense Mode: assumes receivers are widespread and uses flood-and-prune.
• PIM Sparse Mode: assumes receivers are sparse and uses explicit joins.

PIM-SM can begin with a shared tree around a Rendezvous Point (RP) and then move to a source-based shortest-path tree.

Reverse Path Forwarding (RPF) checks whether multicast arrived on the interface expected by the best unicast path back to the source. Failed RPF traffic is dropped.

Memory aid:

IGMP/MLD        receiver membership
IGMP snooping   Layer 2 receiver ports
PIM             multicast tree between routers
RPF             reverse-path check
RP              PIM-SM rendezvous point

DHCP

DHCPv4 automatically supplies network configuration.

DORA:

Discover
Offer
Request
Ack

Typical options include:

• IPv4 address,
• subnet mask,
• default gateway,
• DNS server,
• lease time.

If client and server are in different broadcast domains, a DHCP relay forwards the request to the server.

DHCP is trust-based. A rogue server can distribute a false gateway or DNS server. DHCP snooping distinguishes trusted uplinks from client ports and can create bindings used by other security features.

DNS, DHCP, and ARP

DNS   name -> resource record/IP
ARP   IPv4 -> MAC
DHCP  client -> network configuration

Keeping these roles separate makes troubleshooting faster.

NTP

Time affects log ordering, certificate validation, incident correlation, and many authentication systems.

NTP distributes time in a stratum hierarchy. Enterprise devices should normally use controlled internal time sources instead of arbitrary Internet servers.

PTP

NTP is suitable for general system time. Precision Time Protocol (PTP / IEEE 1588) targets much tighter phase/time accuracy for industrial, telecom, financial, and similar environments.

Grandmaster, boundary clock, and transparent clock roles reduce accumulated timing error.

PTP and NTP do not target the same precision.

SNMP

SNMP remains widely used for counters, status, and notifications.

Core components:

• manager/NMS,
• agent,
• MIB,
• OID.

SNMPv1 and v2c depend on community strings and are weak for secure management. SNMPv3 adds authentication and privacy.

Polling is not the same as model-driven streaming telemetry.

Syslog and event management

Central logs provide:

• failure timelines,
• security correlation,
• capacity and change evidence.

Time synchronization and logging must be designed together; an incorrect clock can invalidate a multi-device timeline.

QoS

QoS does not create bandwidth. It decides how scarce capacity is used.

A common pipeline is:

classify
  |
mark
  |
queue
  |
schedule
  |
shape or police when needed

Layer 3 uses DSCP. Layer 2 can use PCP/CoS.

• Classification: identify the traffic class.
• Marking: encode class information.
• Queuing/scheduling: choose service order under contention.
• Shaping: buffer excess traffic and send it at a controlled rate.
• Policing: drop or remark traffic beyond a configured rate.

Four common QoS symptoms are:

bandwidth shortage
latency
jitter
packet loss

Delay has components:

propagation
serialization
processing
queueing

Propagation follows distance. Serialization follows packet size and link rate. Queueing changes with load and is a major source of tail latency.

A **token bucket** models rate and burst tolerance. Token rate controls the long-term rate; bucket size permits short bursts.

Strict priority is useful for real-time traffic but can starve other classes if unbounded. WFQ/CBWFQ-like schedulers divide capacity among classes. WRED/AQM-like methods try to signal congestion before a queue is completely full.

Trust boundary

If any endpoint can mark itself as high priority, every application can claim to be voice.

Mark as close to the source as practical, but trust markings only from controlled endpoints. Untrusted edge ports can be reclassified by the switch.

ECN

Explicit Congestion Notification lets supporting endpoints and network devices signal congestion without first dropping the packet.

ECN is valuable in low-latency data centers, but it does not solve queueing by itself. AQM behavior, endpoint congestion control, and switch thresholds must agree.

DetNet, TSN, and RAW

Traditional QoS prioritizes traffic under contention. Deterministic networking aims for tighter bounds.

IETF DetNet can use reserved resources, explicit paths, and replication/elimination inside a controlled domain to target very low loss and bounded latency.

IEEE TSN addresses related deterministic requirements at Layer 2 Ethernet.

Typical domains include industrial control, professional media, in-vehicle networks, and critical real-time systems.

DetNet is not a general Internet latency guarantee.

RFC 9912, published in 2026 as an Informational RFC, defines the Reliable and Available Wireless (RAW) architecture. RAW extends DetNet reliability concepts to variable wireless segments by using path diversity, local repair, and a control loop instead of pretending that radio links are lossless.

Unit 9: Wireless Networks

Why the medium is different

A switched Ethernet port is usually a dedicated full-duplex link. Wi-Fi shares radio airtime.

Therefore:

high PHY rate != equal application throughput

Airtime contention, retransmissions, channel width, client count, modulation, interference, and scheduling determine the result.

Wi-Fi uses CSMA/CA rather than collision detection.

RF measurements

dB expresses a ratio. dBm expresses absolute power relative to 1 mW.

Useful approximations:

+3 dB   about 2x power
-3 dB   about half power
+10 dB  10x power

RSSI represents received signal strength. Noise floor represents background noise. **SNR** is the signal margin above noise:

SNR(dB) = signal(dBm) - noise(dBm)

Higher modulation and coding rates need higher SNR. Strong RSSI alone does not prove a good link if noise is also high.

Free-space path loss grows with distance and frequency. Transmit power, antenna gain, cable loss, and receiver sensitivity belong in one RF link budget.

Bands and channel planning

Enterprise WLANs mainly use:

• 2.4 GHz: longer practical reach, few non-overlapping channels, heavy interference.
• 5 GHz: more channels and common enterprise use.
• 6 GHz: wide clean spectrum for Wi-Fi 6E and Wi-Fi 7, subject to local regulation and propagation limits.

Wider channels increase peak rate for one client but reduce the number of independent channels. Dense environments often perform better with narrower channels.

Co-channel interference means cells share airtime on the same channel. Adjacent-channel interference means partially overlapping transmissions interfere without clean coordination.

Antenna gain, beamwidth, and polarization shape coverage. An omnidirectional antenna does not create a perfect sphere; the real radiation pattern depends on antenna and installation.

802.11 generations

A compact progression:

Wi-Fi 4   802.11n    MIMO
Wi-Fi 5   802.11ac   wider 5 GHz channels, MU-MIMO
Wi-Fi 6   802.11ax   OFDMA, dense-client efficiency
Wi-Fi 6E             802.11ax in 6 GHz
Wi-Fi 7   802.11be   EHT, 320 MHz, MLO, higher capacity

IEEE 802.11be-2024 is an active standard for Extremely High Throughput.

Multi-Link Operation (MLO) lets capable devices use several links more flexibly. The goal is not only peak rate but also latency and resilience.

MIMO uses multiple radio chains. Spatial multiplexing carries independent data streams over the same time/frequency resource. Beamforming attempts to focus useful energy toward the receiver. OFDMA divides a channel into smaller resource units so airtime can be scheduled among many clients.

Wi-Fi 8 and newer work

IEEE P802.11bn is the Ultra High Reliability project. As of 22 August 2026, draft D2.0 is in an initial working-group ballot and the project is not a completed standard.

Its targets include, in defined scenarios:

• higher throughput,
• lower 95th-percentile latency,
• lower MPDU loss, especially during BSS transitions,
• improved AP power behavior.

The theme is reliability and predictable performance, not simply another peak-rate number.

IEEE work also includes enhanced privacy, ambient-power communication, integrated millimeter-wave operation, light communication, and post-quantum security projects. They are at different maturity levels and should not be treated as completed features.

IEEE 802.11bf-2025 WLAN Sensing is a published standard. It allows WLAN measurements to support sensing applications in addition to communication. Privacy is therefore part of the engineering problem.

WLAN components

Core terms:

• STA: client station.
• AP: access point.
• BSS: one basic service set.
• ESS: several BSSs providing one extended service.
• SSID: logical WLAN name.
• BSSID: identifier of a specific BSS/radio context.

A simplified client path is:

discovery
  |
authentication
  |
association
  |
key establishment
  |
IP configuration

Hiding the SSID is not strong security. MAC filtering is not strong authentication.

AP architectures

Autonomous AP: policy and configuration live on each AP.

Controller-based AP: a WLC centralizes WLAN and radio policy.

Cloud-managed AP: the management plane is hosted as a service; user traffic may still be local or centralized depending on the design.

CAPWAP is a standard protocol used by controller-based architectures for AP control/tunneling models.

Centralization is useful because channel, power, roaming, security, and firmware policies can be applied consistently.

Roaming

A client should move between APs with minimal application disruption.

802.11k, 802.11v, and 802.11r address different parts of the problem:

• neighbor information,
• network-assisted steering,
• fast BSS transition.

The client still owns much of the roaming decision.

Layer 2 roaming can remain inside one IP subnet. Layer 3 roaming crosses an IP boundary and may require mobility tunnels or state transfer.

Roaming delay includes both RF transition and authentication/key-establishment time. 802.11r targets the latter.

WPA2 and WPA3

WEP and original WPA should be considered obsolete.

WPA2 with AES-CCMP remains a secure baseline when configured correctly. WPA3 strengthens password authentication with SAE, requires stronger management-frame protection behavior, and provides stronger enterprise profiles.

Enterprise WLANs commonly use 802.1X/EAP and RADIUS rather than one shared PSK.

Rogue APs, evil twins, weak onboarding, disabled server-certificate validation, and incorrect VLAN policy can be more serious than the nominal WPA version.

Unit 10: Network Security

Security goals

Network security covers more than encryption.

Main goals are:

• confidentiality,
• integrity,
• availability,
• authentication,
• authorization,
• accountability.

"Inside the network" is not a trust decision. Compromised identities, configuration errors, and lateral movement require identity and policy independent of physical location.

Attack surface

Common risk areas include:

• management interfaces,
• weak authentication,
• legacy protocols,
• unnecessary services,
• Layer 2 trust assumptions,
• DNS and routing manipulation,
• software vulnerabilities,
• cloud-policy errors,
• endpoints.

The first defense is reducing exposed surface. Disable unused services, ports, and management protocols.

Layer 2 attacks

MAC flooding attempts to exhaust MAC-table resources.

ARP spoofing associates an attacker's MAC with another IPv4 address.

DHCP spoofing distributes a false gateway or DNS server.

VLAN hopping abuses trunk negotiation or tagging mistakes.

Defenses include:

• port security,
• DHCP snooping,
• Dynamic ARP Inspection,
• IP Source Guard,
• BPDU Guard,
• explicit access/trunk configuration,
• disabling unused ports.

These features work together. DAI often depends on DHCP-snooping bindings.

Control-plane and management-plane security

The data plane carries user packets. The control plane runs routing and adjacency protocols. The management plane changes and observes device state.

Traffic that reaches the router CPU without control can damage routing and management even when forwarding ASICs are healthy.

Control Plane Policing (CoPP) classifies and rate-limits traffic sent to the control-plane CPU.

Management-plane controls include:

• SSH/HTTPS,
• AAA,
• management ACLs,
• management VRF or out-of-band network,
• central logging,
• controlled time sources.

ACL

An ACL matches traffic on Layer 3/4 fields and applies permit/deny policy.

A useful principle is:

minimum required allow
+
implicit/default deny where appropriate

Direction and placement matter. A correct rule on the wrong interface or direction can be ineffective or destructive.

The old rule "extended ACL near source, standard ACL near destination" is a useful classroom starting point, not a universal production rule. Asymmetric paths and processing location must be considered.

Stateful firewall

A stateful firewall tracks connection state as well as packet fields.

It can evaluate:

• who initiated a connection,
• which policy allowed it,
• whether return traffic belongs to an existing session.

A next-generation firewall may add application identity, user identity, TLS inspection, IPS, and threat intelligence. Combining features also concentrates performance cost and failure impact.

IDS and IPS

An IDS detects and reports suspicious behavior. An IPS is inline and can block it.

Common techniques:

• signatures,
• protocol anomaly detection,
• behavior analysis.

False positives and false negatives must be balanced. "Block everything unusual" is not a sustainable production policy.

DoS, DDoS, and source validation

DoS consumes service capacity or state. DDoS distributes the load across many sources.

Reflection/amplification attacks send small requests with a spoofed victim source address and cause larger replies to the victim. DNS and NTP have historical examples.

BCP 38 ingress filtering and appropriate use of uRPF reduce spoofed-source traffic. DDoS defense can also require upstream filtering, rate limits, anycast, scrubbing, and capacity.

AAA

AAA means:

Authentication   who are you?
Authorization    what may you do?
Accounting       what did you do?

RADIUS is common for network access, VPN, and 802.1X. TACACS+ is common for network-device administration because command authorization can be handled in detail.

RADIUS commonly uses UDP 1812/1813. TACACS+ uses TCP 49 and separates AAA functions more explicitly.

Central AAA improves privilege lifecycle and auditability. A controlled local break-glass account may remain for loss of the AAA service.

Encryption

Symmetric encryption protects bulk data efficiently. AES is the common example.

Public-key cryptography supports authentication, signatures, and key establishment.

A hash produces a fixed-size digest. New security designs should use modern collision-resistant families such as SHA-256 or stronger. MD5 and SHA-1 are not suitable for collision-resistant signature designs.

PKI and certificates

PKI binds public keys to identities through a trust chain.

Certificate validation must check:

• signature chain,
• hostname/SAN,
• validity period,
• revocation policy where applicable,
• allowed algorithms.

Encryption without peer authentication is not sufficient. A TLS client that ignores certificate validation can create an encrypted session to an attacker.

Zero Trust and segmentation

NIST SP 800-207 does not treat network location as automatic trust. Each access decision can consider identity, device posture, context, and policy.

Practical consequences include:

• least privilege,
• strong identity,
• continuous verification,
• microsegmentation,
• detailed telemetry.

Zero Trust is an architectural approach rather than a product name: access decisions are based on identity, device state, context and policy instead of treating network location as sufficient trust.

Segmentation reduces failure and attack domains. VLANs and VRFs segment networks; security groups and workload identity can provide finer policy.

Microsegmentation limits east-west access between workloads even when they share a subnet or fabric.

ZTNA and SASE

ZTNA tries to authorize a user to a specific application rather than grant broad remote-network access. It can reduce the scope of traditional VPN access but does not eliminate every VPN use case.

SASE combines WAN and security services under a common policy model, potentially including SD-WAN, secure web gateway, firewall-as-a-service, CASB, and ZTNA.

The architectural point is consistent policy independent of user or workload location.

MACsec, IPsec, and TLS

Encryption layer follows the threat boundary:

MACsec   Layer 2 link
IPsec    Layer 3 network/tunnel
TLS      application session

They are not mutually exclusive. One system can use all three at different boundaries.

Unit 11: WAN, VPN, and Programmable Paths

WAN choices

WAN design compares:

• latency,
• bandwidth,
• SLA,
• redundancy,
• cost,
• cloud egress,
• security.

Common transports include:

leased circuit
Metro Ethernet
MPLS service
public Internet
fiber access
4G/5G
LEO satellite

MPLS itself is not an encryption protocol. It forwards by labels and can carry L2VPN or L3VPN services.

An MPLS label switched path carries packets through provider infrastructure. Provider-edge devices can separate customer routes with VRFs, and MP-BGP can carry VPN routes. Encryption, if required, must be provided separately.

WAN topology

Hub-and-spoke is simple but centralizes failure and bandwidth pressure.

Partial mesh adds direct paths between important sites.

Full mesh is resilient but grows quickly in links and policy.

Cloud applications make forced backhaul through one data center expensive in latency. Local Internet egress, security policy, SD-WAN, and SASE must be designed together.

IPsec

IPsec protects IP traffic.

Core elements are:

• IKE for authentication and key agreement,
• ESP for confidentiality/integrity,
• Security Associations.

Modes:

• Transport: mainly protects the payload of the original IP packet.
• Tunnel: encapsulates the original packet inside a new IP packet.

Tunnel mode is common for site-to-site VPNs.

IPsec adds overhead and changes effective MTU. PMTUD and TCP MSS should be checked when small traffic works but full-size traffic fails.

GRE and WireGuard

GRE tunnels Layer 3 protocols and can carry multicast. It does not provide confidentiality by itself. GRE can be protected with IPsec.

Tunnels can be nested:

inner packet
  -> GRE
  -> IPsec
  -> outer IP

Each layer costs MTU, observability, and troubleshooting complexity.

WireGuard is a compact VPN protocol with a fixed modern cryptographic design. Key distribution, identity lifecycle, and access policy remain separate operational responsibilities.

SD-WAN

SD-WAN manages several WAN transports under one policy plane.

management/orchestration
        |
control policy
        |
branch edge
        |
MPLS + Internet + mobile

Path policy can follow application requirements:

voice       -> low-latency path
backup      -> cheap high-capacity path
critical    -> redundancy / fast failover

The core benefit is not a "faster link"; it is measurable policy across heterogeneous transports.

Segment Routing for traffic engineering

An IGP normally computes shortest paths. Traffic engineering may require a path that:

• has lower latency,
• avoids selected links,
• is redundant,
• crosses a service chain.

Segment Routing expresses this as a segment list. SR-MPLS uses MPLS labels. SRv6 uses IPv6 SIDs.

It can reduce the amount of per-path signaling state required in the core compared with older RSVP-TE designs, while increasing the importance of SID planning, controllers, and telemetry.

Unit 12: Data Center, Overlay, Cloud, and High-Performance Fabrics

Traffic direction

Traditional campus traffic was largely north-south. Microservices, distributed storage, and AI clusters produce heavy east-west traffic.

A leaf-spine fabric provides many equal-cost paths:

       Spine1  Spine2
       /  |    |  ╲
   Leaf1 Leaf2 Leaf3 Leaf4

A Layer 3 underlay with ECMP avoids large spanning-tree domains.

Underlay and overlay

The underlay provides IP reachability between tunnel endpoints.

The overlay carries tenant or logical networks over that underlay.

Troubleshooting order:

overlay failure
   |
is underlay reachable?
   |
is control plane / VNI / policy correct?

VXLAN

VXLAN carries an Ethernet frame over UDP/IP.

A VLAN ID is 12 bits. A VXLAN Network Identifier is 24 bits, allowing about 16 million segments.

inner Ethernet
     |
VXLAN
     |
UDP
     |
outer IP
     |
underlay Ethernet

A VXLAN tunnel endpoint is a VTEP.

Encapsulation adds overhead. Underlay MTU must carry the inner frame plus tunnel headers.

EVPN

VXLAN defines a data-plane encapsulation; it does not by itself define how MAC/IP reachability is distributed.

BGP EVPN provides a control plane for MAC and IP reachability.

Benefits include:

• less flood-and-learn traffic,
• control-plane host-mobility signaling,
• combined L2/L3 services,
• scalable multi-tenancy.

Common EVPN route types:

Type 2  MAC/IP Advertisement
Type 3  Inclusive Multicast Ethernet Tag
Type 5  IP Prefix

Type 2 is common for host reachability, Type 3 for BUM distribution, and Type 5 for prefix-based Layer 3 reachability.

Anycast gateway

An EVPN fabric can present the same default-gateway IP/MAC on many leaf switches. A host routes locally at its attached leaf, reducing central hairpinning and simplifying mobility.

Virtualization

Virtual machines and containers break the one-port-one-host mental model.

Traffic between two VMs can stay inside a virtual switch and never reach a physical switch. Monitoring only the physical network can miss this traffic.

NFV and fast data paths

Network Functions Virtualization runs router, firewall, or load-balancer functions as virtual/software functions on general-purpose compute.

At high packet rates, the bottleneck can be per-packet work rather than CPU clock:

• interrupts,
• context switches,
• memory copies,
• cache misses.

Common acceleration methods:

• OVS-DPDK: moves important packet processing into user space and can use polling.
• SR-IOV: exposes NIC virtual functions directly to VMs.
• PCI passthrough: assigns a physical device directly to one guest.
• NIC offload: moves checksum, segmentation, tunnel, or flow operations to hardware.

Less abstraction can improve throughput and latency while reducing migration flexibility, visibility, or portability. Benchmark and operations must be considered together.

Container networking

Kubernetes uses abstractions for pod addressing and service discovery. A CNI implementation provides the actual data path.

eBPF-based networking can implement packet processing, observability, and identity-aware policy inside the kernel and can reduce some large-scale iptables limitations.

"eBPF is faster" is not a universal rule. Performance depends on program design, kernel version, NIC offload, and workload.

Cloud networking

Cloud providers use different names for similar primitives:

• VPC/virtual network,
• subnet,
• route table,
• security group,
• network ACL,
• Internet gateway,
• NAT gateway,
• peering,
• transit gateway,
• private service endpoint,
• dedicated private circuit.

The network becomes an API-defined resource instead of a sequence of physical-switch commands.

A "private subnet" is not automatically secure. Routes, security groups, IAM, and endpoint policy must agree.

Load balancing and anycast

An L4 load balancer distributes IP/port flows.

An L7 load balancer/reverse proxy can make HTTP-aware decisions.

Anycast advertises the same IP prefix from several locations and lets routing choose a nearby instance.

CDNs, DNS platforms, and global edge services combine these techniques.

AI and HPC fabrics

Distributed accelerator clusters create synchronized east-west traffic.

Important design factors include:

• high radix,
• many ECMP paths,
• low oversubscription,
• fast telemetry,
• queue and congestion control,
• high-speed Ethernet.

800G Ethernet is standardized. P802.3dj work including 1.6T is still in draft status as of 22 August 2026.

Ethernet fabrics that target near-lossless behavior may use Priority Flow Control. Incorrect PFC design can create head-of-line blocking and congestion propagation.

RDMA reduces CPU and copy overhead for remote-memory access. RoCEv2 carries RDMA over UDP/IP. ECN, PFC, buffer sizing, and load balancing must be engineered together.

Enabling PFC alone does not create a lossless fabric. Pause propagation under poor thresholds can magnify congestion.

For critical low-latency systems, p95/p99 queueing delay matters more than the average.

Unit 13: Network Programming and the Operating System

A network device carries protocols. An application uses those protocols through socket APIs. This is the boundary between network engineering and systems programming.

Sockets

Berkeley sockets are the base model on Unix-like systems. Windows Winsock exposes the same core concepts with platform-specific details.

TCP server lifecycle:

socket
  |
bind
  |
listen
  |
accept
  |
recv / send
  |
shutdown / close

TCP client lifecycle:

socket -> connect -> send/recv -> close

UDP has no listen/accept connection establishment. sendto and recvfrom preserve datagram boundaries.

TCP is not a message protocol

TCP is an ordered byte stream. One send() call is not guaranteed to appear as one recv() call.

The application must define framing:

length prefix
delimiter
fixed-size record
self-describing format

Wrong assumption:

send(100 bytes) -> recv(100 bytes)

Valid behavior:

100 bytes enter the stream
receiver may observe 20 + 50 + 30

Partial I/O

send() may write fewer bytes than requested. recv() may return only part of one application message.

Production code must:

• track remaining bytes,
• distinguish interrupted/temporary errors,
• distinguish EOF from "no data yet",
• use explicit deadlines.

This is stream semantics, not an exceptional bug.

Blocking and non-blocking I/O

A blocking operation can park a thread until progress is possible.

A non-blocking socket returns immediately and is revisited when ready.

Common mechanisms:

select / poll
epoll       Linux
kqueue      BSD/macOS
IOCP        Windows completion model

select() is portable and useful for teaching, but repeatedly scanning large descriptor sets is expensive. epoll and kqueue scale readiness-driven designs. IOCP is closer to an asynchronous completion model.

Concurrency models

Common server architectures:

• process per connection,
• thread per connection,
• thread pool,
• event loop,
• event loop plus worker pool.

Thread-per-connection is simple. At very high concurrency, stack memory, scheduling, and context switching become expensive.

Event loops make idle connections cheap. CPU-heavy work on the same loop can destroy tail latency.

The goal is not "fewest threads." The goal is bounded queues and predictable service time.

Backpressure

When producers exceed consumers, queues grow somewhere:

application queue
socket buffer
kernel queue
NIC queue
switch queue

Infinite buffering does not create throughput. It creates memory use and latency.

Backpressure means slowing the producer to consumer capacity. TCP receive windows do this at transport layer. Applications need bounded queues, request limits, or explicit flow credits.

Nagle and delayed ACK

Nagle reduces tiny TCP segments by combining small writes. Delayed ACK reduces ACK traffic.

The interaction can add latency for small interactive exchanges. TCP_NODELAY should be a measured choice, not a universal performance switch.

Application-level batching can matter more than the socket option.

Timeouts and lifecycle

Indefinite network waits are unsafe in production.

Separate budgets may be needed for:

• connect,
• read,
• write,
• idle,
• overall request deadline.

A deadline caps the full operation. Large per-step timeouts can multiply into an unacceptable end-to-end delay.

After active TCP close, the endpoint can remain in TIME_WAIT to stop delayed old segments from being confused with a new connection.

TIME_WAIT alone is not a leak. SO_REUSEADDR changes address-reuse rules; it is not a safe "disable TIME_WAIT" switch.

Connection failure semantics

A successful connect() proves only that TCP establishment succeeded.

Later stages can still fail:

• TLS handshake,
• certificate validation,
• authentication,
• application processing,
• proxy/gateway behavior.

Likewise, a successful local send() does not prove the remote application processed the data. It usually proves that the local stack accepted bytes.

Distributed protocols must define what "success" means.

UDP programming

UDP preserves datagram boundaries.

If needed, the application implements its own:

• sequence numbers,
• acknowledgments,
• retransmission,
• deduplication,
• congestion control.

Low UDP header overhead does not make a poor protocol design fast. Loss, reordering, and MTU limits remain application concerns.

DNS and byte order

Multi-byte protocol fields use network byte order, which is big-endian.

Classic C helpers are:

htons / htonl
ntohs / ntohl

Normal applications should use getaddrinfo() for name resolution. Building raw DNS packets is appropriate when implementing a resolver, analyzer, or protocol exercise.

Raw sockets and packet capture

Raw sockets expose lower-level packet control and usually require elevated privilege.

For capture, libpcap/Npcap and tools such as tcpdump/Wireshark are normally better abstractions.

Capture location matters:

host capture
SPAN
RSPAN
ERSPAN
network TAP

NIC offloads can make a host-side capture look different from the actual segmentation/checksum behavior on the wire.

TLS and SSH programming

An encrypted socket is not simply "call encrypt."

A TLS client must:

1. establish transport,
2. perform the handshake,
3. validate certificate chain and hostname,
4. derive keys,
5. carry application data.

Disabling certificate validation can make encrypted transport useless against an active attacker.

SSH also needs server host-key validation. Blindly accepting an unknown host key transfers the man-in-the-middle decision to the user.

Copies and kernel crossings

At high packet rates, per-packet costs dominate:

• system calls,
• memory copies,
• allocations,
• context switches,
• cache misses,
• interrupts.

sendfile-style APIs can avoid an unnecessary user-space copy for file transfer. DPDK or AF_XDP are more advanced high-speed paths.

Kernel bypass is a trade-off. Mature kernel TCP, security, scheduling, and observability features may have to be rebuilt or re-integrated.

Latency and throughput

High throughput and low latency are different objectives.

Larger batches reduce syscall cost and increase throughput but can delay an individual request. Larger buffers absorb bursts but can increase queueing delay.

Useful measurements include:

throughput
median latency
p95 / p99 latency
queue depth
retransmission
drop
CPU
allocation

Average latency alone does not describe critical-system behavior.

Unit 14: Management, Automation, and Observability

Management plane

Three logical planes are useful:

• Data plane: forwards packets.
• Control plane: builds routes and protocol state.
• Management plane: configuration, monitoring, administration.

Management traffic should use a dedicated network, VRF, or out-of-band path where practical.

SDN

Software-Defined Networking logically separates policy/control from packet forwarding.

application / intent
       |
control plane
       |
programmable interface
       |
data plane

This does not mean every switch becomes "dumb." The data plane still performs high-speed forwarding.

OpenFlow was important in early SDN. Modern systems also use NETCONF, gNMI, BGP, PCEP, and vendor APIs.

The important change is that network state can be read and changed by software.

Cisco IOS/IOS XE CLI model

Classic CLI modes:

Switch>              user EXEC
Switch#              privileged EXEC
Switch(config)#      global configuration
Switch(config-if)#   interface configuration

Example:

enable
configure terminal
hostname SW1
interface gigabitEthernet 1/0/1
 description USER
 switchport mode access
 switchport access vlan 10
 no shutdown
end
copy running-config startup-config

Syntax varies by platform and release. The useful concept is hierarchical configuration, running state, and persistent state.

The old phrase "running-config in RAM, startup-config in NVRAM" remains a teaching model, not a guarantee about the internal file system of every modern platform.

Secure remote management

Use SSH instead of Telnet.

Basic controls:

• dedicated management path,
• AAA,
• management ACLs,
• strong keys and algorithms,
• central logs,
• time synchronization,
• no shared/default accounts.

If a web interface is required, use HTTPS with managed certificates.

Neighbor discovery

CDP is Cisco-specific. LLDP is the open IEEE 802.1AB approach.

Neighbor discovery helps with:

• physical-link validation,
• port mapping,
• device identity,
• PoE and capabilities.

It can also expose topology information. Disable unnecessary advertisements on untrusted edge ports.

Troubleshooting order

Random commands waste time. Work by layer:

1. Physical: link, optic power, cable, error counters.
2. Layer 2: VLAN, trunk, STP, MAC, LACP.
3. Layer 3: address, prefix, ARP/ND, gateway, route.
4. Transport: port reachability, TCP state, firewall.
5. Application: DNS, TLS, service behavior.

Do not jump upward before the lower assumption is proven.

Basic tools

Host:

ping
traceroute / tracert
ip addr
ip route
ip neigh
ss
dig
nslookup
arp -a
tcpdump / Wireshark

On Linux, ifconfig and netstat are historical tools; modern iproute2 equivalents are ip and ss.

Network device:

show interfaces
show interfaces counters
show mac address-table
show vlan
show interfaces trunk
show spanning-tree
show etherchannel summary
show ip interface brief
show ip route
show arp
show ipv6 neighbors
show logging

NetFlow, IPFIX, and flow visibility

Packet capture shows individual packets. Flow telemetry answers a cheaper question: who communicated with whom, when, and how much?

NetFlow/Flexible NetFlow and standardized IPFIX can export:

• source/destination,
• ports,
• protocol,
• bytes/packets,
• start/end times.

Flow records do not contain full payload. They are useful for capacity, anomaly detection, and traffic matrices.

SPAN, RSPAN, and ERSPAN

• SPAN: local switch-port/VLAN mirroring.
• RSPAN: carries mirrored traffic to a remote switch over Layer 2.
• ERSPAN: encapsulates mirrored traffic across a Layer 3 network.

Mirroring is not lossless. If the analyzer path is oversubscribed, copies can drop even when production traffic succeeds.

IP SLA and active measurement

Passive counters observe existing traffic. Active measurement sends probes to measure latency, jitter, loss, or service reachability.

IP SLA-like mechanisms can support:

• continuous path-quality measurement,
• object tracking,
• failover decisions,
• SLA verification.

Synthetic probes do not perfectly represent application traffic and should be combined with passive telemetry.

What ping proves

Ping proves that ICMP echo works on the tested path.

It does not prove:

• a TCP port is open,
• DNS works,
• the application is healthy,
• full-size packets pass,
• forward and return paths are identical.

"Ping works, therefore the network is fine" is an invalid conclusion.

Traceroute

Traceroute increases TTL/Hop Limit and uses ICMP Time Exceeded responses from intermediate routers.

Observed paths can be:

• asymmetric,
• incomplete because some routers do not respond,
• different between probes due to load balancing.

Traceroute is a measurement, not the routing table itself.

Packet capture

Packet analysis validates assumptions between layers.

Read from outer to inner:

Ethernet
  |
IP
  |
TCP/UDP/ICMP
  |
application protocol

For a suspected DNS problem, first verify that the query was actually sent, then whether a response arrived. Packet capture turns "the application is slow" into measurable events.

YANG

YANG is a data-modeling language for configuration and operational state.

A model can describe a tree such as:

interfaces
  interface[name]
    config
    state

Vendor models exist. OpenConfig provides common models for multi-vendor automation.

NETCONF and RESTCONF

NETCONF uses structured RPC operations over YANG-modeled datastores.

Its value is more than XML. running, candidate, and startup datastore concepts can support transaction-like change workflows. Where supported, validate, lock, and confirmed-commit provide safer configuration changes.

RESTCONF exposes YANG-defined data through an HTTP resource model.

They are different protocols:

NETCONF   RPC/datastore oriented
RESTCONF  HTTP resource model
YANG      data model

gNMI and OpenConfig

gNMI is a gRPC/Protocol Buffers network-management interface.

Core RPCs are:

• Capabilities,
• Get,
• Set,
• Subscribe.

OpenConfig provides vendor-neutral models used with gNMI and other transports.

The OpenConfig gNMI specification revision history lists v0.11.0 in March 2026. The useful concept is not the version number; it is the Subscribe model for long-lived telemetry.

Streaming telemetry

SNMP polling asks repeatedly:

NMS -> device: what is the value?

Streaming telemetry subscribes:

subscribe
   |
device -> updates

YANG-Push standardizes subscriptions to YANG datastore updates.

Benefits include:

• higher sampling frequency,
• fewer unnecessary polls,
• structured data,
• lower delay between state change and observation.

The collector side still needs capacity planning, retention limits, and cardinality control.

Automation

The purpose of network automation is not typing commands faster. It is applying intent repeatably.

Imperative:

enter interface
run VLAN command
change description

Declarative:

desired final state of this port = VLAN 10

Declarative models make idempotency and configuration-drift control easier.

Ansible is a common agentless example. Puppet, Chef, and Salt use different agent/state models. Tool choice comes after desired state, inventory/source-of-truth, and validation.

A safe automation system aims for:

same input -> same expected state

Git and validation

Network configuration can be managed like code:

change
  |
version control
  |
lint/schema validation
  |
lab/digital twin/test
  |
approval
  |
deployment
  |
telemetry verification

Automation can automate mistakes too. Use scope control, dry-run/diff, canary deployment, and rollback.

Intent-based networking

Intent-based networking raises the abstraction from device commands to desired outcome:

intent
  |
policy
  |
device configuration
  |
telemetry
  |
compliance check
  ^

Generating configuration alone is automation. Measuring whether the intended result exists creates a closed-loop system.

API security

A network API is a management surface and must be protected like the CLI.

Controls include:

• strong authentication,
• least-privilege tokens,
• TLS,
• secret management,
• audit logs,
• rate limits,
• certificate validation,
• no embedded secrets in source code.

A single automation account with unrestricted admin access can turn centralized control into a single attack point.

Relationships Between Topics

A web request uses the layers in sequence:

URL
 |
DNS
 |
local/remote destination decision
 |
ARP or Neighbor Discovery
 |
Ethernet/Wi-Fi
 |
routing
 |
ACL/NAT/policy
 |
TCP or QUIC
 |
TLS
 |
HTTP

When one layer fails, the upper layer also appears to fail. Troubleshooting means measuring this chain.

A modern network extends the same structure:

physical link
 |
IP underlay
 |
overlay / VRF
 |
identity + policy
 |
API / automation
 |
telemetry

The desired state of the network is managed, not only individual devices.

Conceptual Distinctions

Bandwidth is capacity; throughput is achieved transfer rate; goodput is useful application data.

Latency is delay; jitter is variation in delay.

Propagation depends on distance; serialization depends on packet size and link rate. Queueing depends on load.

OSI is a reference model; TCP/IP is an implemented protocol suite.

MAC identifies the local Layer 2 hop; IP identifies the Layer 3 destination. MAC addresses change across routed hops.

Ethernet FCS detects corruption; it does not correct it.

There is no single universal 9000-byte jumbo-frame standard.

A link light does not prove that the physical medium is certified for the target rate.

Attenuation is signal-power loss; dispersion is temporal spreading of a pulse.

OTDR locates fiber events; a power meter measures end-to-end optical power.

A switch learns from source MAC addresses and forwards by destination MAC address.

Unknown unicast is flooded inside the VLAN.

BUM means broadcast, unknown unicast, and multicast.

CAM is commonly used for MAC lookup; TCAM supports masked prefix and policy lookup.

CSMA/CD is not used on full-duplex Ethernet.

A VLAN is a Layer 2 concept; a subnet is a Layer 3 concept.

An access port carries one VLAN; a trunk carries multiple VLANs.

STP breaks Layer 2 loops; RSTP converges faster; MSTP maps VLANs to a smaller number of trees.

The current link-aggregation standard is IEEE 802.1AX; 802.3ad is the historical designation.

Link aggregation increases aggregate capacity; a single flow is not guaranteed to use all members.

VRRP provides first-hop redundancy; RFC 9568 is the current base specification.

802.1X controls access; MACsec encrypts Layer 2 traffic.

CIDR replaced classful IPv4 addressing.

/31 can be used on point-to-point IPv4 links; /32 identifies one IPv4 host route.

VLSM divides address space; summarization combines prefixes.

ARP maps IPv4 to MAC; DNS maps names to records; DHCP supplies network configuration to clients.

NAT translates addresses; it is not a firewall.

IPv6 addresses are 128 bits and IPv6 has no broadcast.

IPv6 uses Neighbor Discovery instead of ARP.

Blocking all ICMPv6 can break IPv6 operation.

SLAAC and DHCPv6 are different mechanisms.

TCP is an ordered byte stream; it does not preserve message boundaries.

UDP preserves datagram boundaries; it does not guarantee delivery or ordering.

TCP flow control protects the receiver; congestion control protects the network.

MSS limits TCP payload; MTU limits the Layer 3 packet carried by a link.

**One send() call does not have to correspond to one recv() call.**

Partial send and partial receive are normal socket behavior.

Backpressure means matching producer rate to consumer capacity, not merely enlarging queues.

Nagle reduces small segments; TCP_NODELAY is not universally faster.

TIME_WAIT is not an error; it prevents old segments from contaminating a later connection.

QUIC uses UDP but implements reliability, streams, and congestion control itself.

HTTP/3 runs over QUIC.

DNSSEC helps authenticate origin and integrity; it does not encrypt DNS queries.

DoT, DoH, and DoQ encrypt DNS transport.

RFC 10024, published in August 2026, standardizes PQ/T hybrid ML-KEM groups for TLS 1.3.

A router performs longest-prefix match first. Administrative distance and metric resolve candidates for the same prefix.

RIB stores route information; FIB stores the selected forwarding result.

CEF/FIB/adjacency structures provide fast forwarding; normal data-plane operation does not require the CPU to process every packet.

ECMP uses equal-cost paths; most implementations hash flows rather than packets.

VRF provides separate routing tables on the same device.

PBR selects a path by policy beyond destination prefix; it does not replace general routing.

BFD does not calculate routes; it detects forwarding-path reachability quickly.

RIP uses hop count; OSPF uses cost; EIGRP uses a composite metric. BGP is policy-oriented.

OSPF builds an LSDB and runs SPF. Flooding and forwarding are different operations.

DR/BDR matters on OSPF broadcast multi-access networks; it is unnecessary on point-to-point links.

A useful OSPF memory map is: Type 1 router, Type 2 network, Type 3 summary, Type 5 external, Type 7 NSSA external LSA.

BGP reaches route exchange in the Established state.

Route reflectors reduce the iBGP full-mesh requirement.

LOCAL_PREF expresses preference inside an AS; AS_PATH carries path and loop information; COMMUNITY is a policy tag.

BGP is not required to select the physically shortest path.

RPKI/ROV validates origin-AS authorization; it is not full AS_PATH validation.

RFC 9234 uses BGP Roles and OTC to reduce route leaks.

IGMP represents host membership; IGMP snooping maps membership to switch ports; PIM builds multicast trees between routers.

RPF checks whether multicast traffic arrived through the expected reverse-path interface.

PIM-SM can use an RP for a shared tree and later switch to an SPT.

QoS does not create bandwidth; it allocates scarce capacity among traffic classes.

Shaping buffers excess traffic; policing can drop or remark excess traffic.

Token bucket describes rate and burst tolerance.

Unbounded strict priority can starve other queues.

NTP is general time synchronization; PTP is used for tighter time and phase accuracy.

DetNet targets bounded latency and low loss inside a managed domain; it is not a guarantee across the public Internet.

RAW extends DetNet reliability concepts to variable wireless segments; RFC 9912 is Informational.

Wi-Fi shares airtime; PHY rate is not application throughput.

RSSI is received signal strength; SNR is the separation between signal and noise.

MIMO uses multiple antennas; spatial multiplexing carries parallel data streams.

OFDMA divides airtime into resource units.

Wi-Fi 7 is based on IEEE 802.11be; multi-link operation is one of its central changes.

IEEE P802.11bn is still a draft as of 22 August 2026; Ultra High Reliability is not only a peak-rate objective.

IEEE 802.11bf-2025 is the published WLAN sensing amendment.

SSID hiding and MAC filtering are not strong WLAN security controls.

802.11r reduces authentication/key-transition delay during roaming.

RADIUS is common for network access; TACACS+ is common for network-device administration.

CoPP limits traffic sent to the control-plane CPU.

Ingress filtering and uRPF can reduce spoofed-source traffic.

Zero Trust does not automatically trust traffic because it is inside the network; it is not a single product.

Segmentation creates network boundaries; microsegmentation can enforce policy at workload granularity.

MACsec protects Layer 2, IPsec protects Layer 3, and TLS protects application sessions.

GRE tunnels traffic; it does not encrypt by itself.

MPLS is label switching; an MPLS VPN is not inherently encrypted.

SD-WAN manages multiple WAN transports under centralized policy.

Segment Routing expresses a path as a sequence of segments/SIDs. SR-MPLS and SRv6 are the main data planes.

The underlay provides real IP reachability; the overlay is the logical network built over it.

VXLAN uses a 24-bit VNI; it is not a VLAN.

EVPN can be a control plane for VXLAN; Type 2 commonly carries MAC/IP, Type 3 BUM membership, and Type 5 IP prefixes.

800 GbE is standardized; IEEE P802.3dj, which includes 1.6 Tb/s work, is still a draft as of 22 August 2026.

NFV moves network functions into software; SR-IOV and PCI passthrough reduce abstraction overhead.

DPDK can lower packet-per-second processing cost; it also increases operational complexity.

RoCEv2 carries RDMA over UDP/IP; PFC alone does not create a lossless fabric.

Packet capture shows packet contents; flow telemetry summarizes communications.

SPAN is local capture, RSPAN carries capture across Layer 2, and ERSPAN carries it across Layer 3.

SNMP polling and streaming telemetry are different operating models.

YANG is a data model; NETCONF and RESTCONF are management protocols.

gNMI provides Capabilities, Get, Set, and Subscribe RPCs; OpenConfig provides common models.

The main value of automation is not speed but idempotency, consistency, and verifiability.

Ping proves only a form of ICMP reachability; it does not prove application health.

Traceroute is an observation of the path at measurement time, not a routing table.

Troubleshooting progresses by collecting evidence from the physical layer to the application.

Network Identity, Authorization and Trust Boundaries

Channel encryption, authentication and authorization are distinct mechanisms. Service-to-service trust, user identity and resource access belong to different protocol and policy layers.

The distinction becomes clearer when identity, authorization and transport trust are considered through these concepts.

The core runtime concepts include mTLS, Passkey, WebAuthn and Zero Trust.

For operation and diagnosis, OAuth 2.0, OpenID Connect, Role-Based Access Control and Attribute-Based Access Control.

MTU, queueing delay, and end-to-end performance

High bandwidth does not guarantee low latency. Oversized buffers can cause bufferbloat, producing long queueing delays even when packet loss is low.

Packet size also matters. Paths with smaller MTUs can fragment or drop oversized traffic, and broken Path MTU Discovery can create partial, difficult-to-diagnose failures.

End-to-end measurements should separate DNS, connection establishment, TLS, time to first byte, transfer time, and application queueing. A single ping value does not describe application latency.

Measuring network behavior by layer

A “slow” connection cannot be explained by one network metric. DNS resolution, connection setup, TLS/QUIC handshake, time to first byte, transfer, and application queueing can be measured separately. Ping covers only part of that path.

Packet-capture interpretation depends on observation point. NAT, offload, encryption, and virtual networking can change what is visible, so client- and server-side captures may differ.

Protocol standards, operating-system implementations, and device configuration are distinct evidence sources. Security recommendations should also be tied to a threat model; one ACL, timeout, or retry policy is not correct for every network.

Networks in Distributed AI Systems

In large AI systems, the network is more than a path between a client and a service. Dataset movement, distributed training, multi-accelerator synchronization, and remote inference can make communication latency and bandwidth part of the critical computation path.

In synchronous data-parallel training, workers compute gradients on different mini-batches and then exchange them:

local forward/backward
↓
gradient exchange / all-reduce
↓
parameter update
↓
next step

If the next step waits for collective communication, a faster accelerator cannot hide a slow fabric indefinitely. Bandwidth, latency, topology, and message size all matter.

Model and pipeline parallelism make the dependence even stronger. Intermediate activations can cross device or node boundaries every step. A partitioning scheme that ignores physical topology can create expensive traffic, so adding more accelerators does not imply linear scaling.

Remote inference has a different latency decomposition:

L_total = L_queue + L_network + L_pre + L_infer + L_post

When model execution is short, network and queue time may dominate. Average RTT is insufficient; tail latency, retransmission, connection setup, and load balancing affect user-visible behavior.

Batching can increase throughput while adding queue delay. Burst traffic can also create network queues. AI serving therefore requires an explicit throughput-latency tradeoff rather than an assumption that both can be maximized simultaneously.

RDMA and high-speed fabrics can reduce copy and communication overhead, but technology names are not performance guarantees. NIC and accelerator topology, NUMA placement, congestion control, and collective-library behavior must be measured together.

Security boundaries remain unchanged. Model inputs, embeddings, and intermediate representations are not automatically non-sensitive. Authentication, authorization, and encryption remain part of the service contract and their cost belongs in capacity planning.

Networking does not explain learning theory. It explains the communication cost that turns distributed computation and model serving into real end-to-end throughput and latency.

Read a packet path layer by layer

Network problems become easier when addressing, forwarding, and application semantics are separated. A MAC address identifies link-layer delivery on a local segment, an IP address participates in routing across networks, and a port identifies a transport endpoint on a host. These identifiers have different scopes and are not interchangeable.

TCP provides a reliable byte stream; it does not preserve application message boundaries. Two separate send operations can arrive in one recv, or one send can be observed through several receives. The application protocol therefore needs its own length, delimiter, or framing rule. UDP provides no built-in guarantee of delivery, order, or uniqueness; in return it does not carry TCP's connection establishment and stream-control machinery.

In subnetting, the prefix length determines how many address bits belong to the network. With an IPv4 /24, eight bits remain for host addresses. In a conventional subnet, excluding network and broadcast addresses gives 2^8 - 2 = 254 usable host addresses. This rule should not be generalised blindly to point-to-point cases or IPv6.

Latency is also composite. Propagation, transmission, processing, and queueing delays contribute to end-to-end time. A high-bandwidth link can still have high latency, and packet loss can arise from queue overflow or policy rather than a faulty physical medium.

Troubleshooting should therefore gather evidence across layers instead of guessing where a packet disappeared: did name resolution succeed, is the route correct, is link-layer neighbour resolution available, did the transport connection form, and did the application protocol produce the expected response? The same symptom can originate from very different layers.

References

• Andrew S. Tanenbaum, Nick Feamster, David J. Wetherall. Computer Networks, 6th Edition. Pearson, 2021.

• Brad Edgeworth, Ramiro Garza Rios, David Hucaby, Jason Gooley. CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide, 2nd Edition. Cisco Press, 2024.

• Cemal Taner. Ağ Yöneticiliğinin Temelleri, 7th Edition. 2025. ISBN 9786059129794. https://www.cemaltaner.com.tr/urun/ag-yoneticiliginin-temelleri-adiniza-imzali/

• Cilium Project. Cilium Documentation. https://docs.cilium.io/

• IEEE 802.1 Working Group. IEEE 802.1X Port-Based Network Access Control. https://1.ieee802.org/security/802-1x/

• IEEE 802.11 Working Group. P802.11bn Ultra High Reliability Task Group. https://www.ieee802.org/11/Reports/tgbn_update.htm

• IEEE 802.3 Working Group. IEEE P802.3dj: 200/400/800 Gb/s and 1.6 Tb/s Ethernet. https://www.ieee802.org/3/dj/

• IEEE 802.3 Working Group. IEEE Std 802.3dg-2026: 100 Mb/s Long-Reach Single Pair Ethernet. https://www.ieee802.org/3/dg/

• IEEE. IEEE Std 802.11-2024: Wireless LAN MAC and PHY Specifications. https://standards.ieee.org/ieee/802.11/10548/

• IEEE. IEEE Std 802.11be-2024: Extremely High Throughput. https://standards.ieee.org/ieee/802.11be/7516/

• IEEE. IEEE Std 802.11bf-2025: Enhancements for WLAN Sensing. https://standards.ieee.org/ieee/802.11bf/11574/

• IEEE. IEEE Std 802.1AE-2018: MAC Security. https://standards.ieee.org/ieee/802.1AE/7154/

• IEEE. IEEE Std 802.1AX-2020: Link Aggregation. https://standards.ieee.org/ieee/802.1AX/6768/

• IEEE. IEEE Std 802.3df-2024: 400 Gb/s and 800 Gb/s Ethernet. https://standards.ieee.org/ieee/802.3df/11107/

• IETF. RFC 10024: Post-Quantum Traditional Hybrid Key Agreement Mechanisms for TLS 1.3. https://www.rfc-editor.org/rfc/rfc10024.html

• IETF. RFC 1034 / RFC 1035: Domain Names. https://www.rfc-editor.org/

• IETF. RFC 2131: Dynamic Host Configuration Protocol. https://www.rfc-editor.org/rfc/rfc2131.html

• IETF. RFC 2328: OSPF Version 2. https://www.rfc-editor.org/rfc/rfc2328.html

• IETF. RFC 2474 / RFC 2475: Differentiated Services. https://www.rfc-editor.org/

• IETF. RFC 2827 / BCP 38: Network Ingress Filtering. https://www.rfc-editor.org/rfc/rfc2827.html

• IETF. RFC 3376: Internet Group Management Protocol, Version 3. https://www.rfc-editor.org/rfc/rfc3376.html

• IETF. RFC 4271: Border Gateway Protocol 4. https://www.rfc-editor.org/rfc/rfc4271.html

• IETF. RFC 4861: Neighbor Discovery for IP version 6. https://www.rfc-editor.org/rfc/rfc4861.html

• IETF. RFC 6241: Network Configuration Protocol (NETCONF). https://www.rfc-editor.org/rfc/rfc6241.html

• IETF. RFC 7217: Semantically Opaque Interface Identifiers. https://www.rfc-editor.org/rfc/rfc7217.html

• IETF. RFC 7348: Virtual eXtensible Local Area Network (VXLAN). https://www.rfc-editor.org/rfc/rfc7348.html

• IETF. RFC 768: User Datagram Protocol. https://www.rfc-editor.org/rfc/rfc768.html

• IETF. RFC 7761: Protocol Independent Multicast - Sparse Mode. https://www.rfc-editor.org/rfc/rfc7761.html

• IETF. RFC 7858: DNS over TLS. https://www.rfc-editor.org/rfc/rfc7858.html

• IETF. RFC 7868: Cisco's Enhanced Interior Gateway Routing Protocol (EIGRP). https://www.rfc-editor.org/rfc/rfc7868.html

• IETF. RFC 7950: The YANG 1.1 Data Modeling Language. https://www.rfc-editor.org/rfc/rfc7950.html

• IETF. RFC 8040: RESTCONF Protocol. https://www.rfc-editor.org/rfc/rfc8040.html

• IETF. RFC 8200: Internet Protocol, Version 6 (IPv6) Specification. https://www.rfc-editor.org/rfc/rfc8200.html

• IETF. RFC 8365: Network Virtualization Overlay Solution Using EVPN. https://www.rfc-editor.org/rfc/rfc8365.html

• IETF. RFC 8402: Segment Routing Architecture. https://www.rfc-editor.org/rfc/rfc8402.html

• IETF. RFC 8484: DNS Queries over HTTPS. https://www.rfc-editor.org/rfc/rfc8484.html

• IETF. RFC 8655: Deterministic Networking Architecture. https://www.rfc-editor.org/rfc/rfc8655.html

• IETF. RFC 8981: Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6. https://www.rfc-editor.org/rfc/rfc8981.html

• IETF. RFC 8986: Segment Routing over IPv6 Network Programming. https://www.rfc-editor.org/rfc/rfc8986.html

• IETF. RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport. https://www.rfc-editor.org/rfc/rfc9000.html

• IETF. RFC 9114: HTTP/3. https://www.rfc-editor.org/rfc/rfc9114.html

• IETF. RFC 9234: Route Leak Prevention and Detection Using Roles in UPDATE and OPEN Messages. https://www.rfc-editor.org/rfc/rfc9234.html

• IETF. RFC 9250: DNS over Dedicated QUIC Connections. https://www.rfc-editor.org/rfc/rfc9250.html

• IETF. RFC 9293: Transmission Control Protocol (TCP). https://www.rfc-editor.org/rfc/rfc9293.html

• IETF. RFC 9568: Virtual Router Redundancy Protocol Version 3. https://www.rfc-editor.org/rfc/rfc9568.html

• James F. Kurose, Keith W. Ross. Computer Networking: A Top-Down Approach, 8th Edition. Pearson, 2021.

• Jeffrey Dean et al. “Large Scale Distributed Deep Networks.” Advances in Neural Information Processing Systems, 25, 2012.

• Lewis Van Winkle. Hands-On Network Programming with C. Packt, 2019.

• NIST. FIPS 203, FIPS 204 and FIPS 205: Post-Quantum Cryptography Standards. https://csrc.nist.gov/

• NIST. SP 800-207: Zero Trust Architecture. https://csrc.nist.gov/pubs/sp/800/207/final

• OpenConfig. gRPC Network Management Interface (gNMI) Specification. https://openconfig.net/docs/gnmi/gnmi-specification/

• Wendell Odom. CCNA 200-301 Official Cert Guide, Volumes 1-2. Cisco Press.

• WireGuard. WireGuard Documentation. https://www.wireguard.com/