Computer Networking Cheat Sheet

“Symptom says X → think Y.” One line per need; click a row to open the lesson.

Fundamentals

"What happens when I press Enter?"->The ladder: URL → DNS → IP/route → TCP → TLS → HTTP → server → render Which layer does this header belong to?->Encapsulation: each layer wraps the one above in its own header "Is it OSI or TCP/IP?"->TCP/IP’s four/five layers describe the internet; OSI’s seven are a vocabulary Same subnet, packet never arrives->Link layer: ARP / Neighbor Discovery, wrong VLAN, MAC not learned "Does a MAC address identify a machine globally?"->No — it is link-local and rewritten at every router hop Two devices, one cable, who forwards by MAC vs by IP?->Switch forwards frames by MAC inside a LAN; router forwards packets by IP between networks

IP & routing

Small requests fine, large ones hang->MTU black hole: ICMP "fragmentation needed" dropped, PMTUD fails "Is 10.0.0.7 on my subnet?"->AND the address with the mask; same prefix → direct, else → default gateway Three routes match a destination->Longest-prefix match wins; `/32` beats `/24` beats `0.0.0.0/0`Works on IPv4, fails on IPv6 (or the reverse)->Two separate stacks: check `AAAA` vs `A`, firewall rules per family, Happy Eyeballs Many clients behind one public IP->NAT translation table keyed by (src IP, src port); ports are the identity Outbound connections start failing under load behind NAT->NAT / conntrack table exhaustion — ports or entries run out Traffic to one prefix goes out the wrong interface->Read the routing table: `ip route get <dst>` shows the chosen route Whole region unreachable, nothing changed on your side->BGP: a withdrawn or hijacked prefix upstream "Which port is it? Is a port a physical thing?"->A 16-bit demultiplexing key in the transport header; the kernel maps it to a socket

DNS

Works again after ~5 minutes / after a deploy->DNS TTL and resolver caches — old answer served until expiry `NXDOMAIN` vs `SERVFAIL`->NXDOMAIN: authoritative "no such name"; SERVFAIL: the resolver could not get an answer Site resolves for you, not for a colleague->Different resolvers, different caches: `dig @8.8.8.8` vs `dig @<authoritative>`Need a name to point at another name->`CNAME` (never at the zone apex); `A`/`AAAA` for addresses Changing an IP for a migration->Lower the TTL days ahead; cut over; raise it again Every request pays ~50 ms before connecting->Uncached DNS lookups — cache in the client, or keep connections alive

TCP/UDP

Connection refused->Nothing listening / RST — check `ss -tlnp` on the server Connection timed out->SYN dropped: firewall, missing route, host down — no RST ever came back Sporadic `ECONNRESET` on connection reuse->Keep-alive idle-timeout race: the server closed a moment before the client reused Thousands of sockets in `TIME_WAIT`->Active-close side holds 2×MSL; reuse connections instead of churning them Throughput collapses at 1% packet loss->Congestion control halves `cwnd` on loss; loss is not a linear tax Sender fast, receiver slow, transfer crawls->Flow control: `rwnd` shrinks to zero when the app does not `read()`One lost packet stalls every stream on the connection->TCP head-of-line blocking; per-stream loss recovery needs QUIC Can tolerate loss, cannot tolerate delay (voice, game state)->UDP — no retransmission, no ordering, no connection `SYN` backlog overflows, clients see slow connects->Accept queue full: `listen()` backlog, `ss -ltn` Recv-Q, app not calling `accept()`First bytes of a new connection are slow on a long link->Slow start plus one or two RTTs of handshake; reuse the connection

TLS

Site broke at midnight, nothing deployed->Certificate expired — `openssl s_client` shows `notAfter`Works by IP, fails by hostname (or vice versa)->SAN / hostname mismatch — the certificate does not name what you typed Works in the browser, fails from `curl` on a server->Missing intermediate certificate; browsers fetch it, most clients do not HTTPS adds a full round trip per new connection->TLS 1.3 handshake is 1-RTT; session resumption / 0-RTT and keep-alive remove it "Why is HTTP alone not enough?"->Confidentiality, integrity, and server identity — TCP gives none of them

HTTP

`502 Bad Gateway`->Proxy could not reach or parse the upstream — upstream down or refusing `504 Gateway Timeout`->Proxy reached the upstream, which did not answer within the proxy timeout `503 Service Unavailable`->Server or proxy is up but overloaded / draining / no healthy backends Six requests go, the seventh waits->HTTP/1.1 per-host connection limit in browsers; HTTP/2 multiplexes on one Server needs to push updates to a browser->SSE for one-way text; WebSockets for bidirectional; polling as the fallback Many small parallel requests on a lossy mobile link->HTTP/3: QUIC streams recover loss independently (still per-stream ordering)Every request opens a new TCP + TLS connection->Keep-alive and a connection pool sized to the backend Proxy strips the `Upgrade` handshake->WebSocket needs `Connection: Upgrade` forwarded end to end Where does the time go inside one request?->Lifecycle: DNS → connect → TLS → send → wait (TTFB) → receive

Infrastructure

Clients must not know how many backends exist->Reverse proxy / load balancer in front of the pool Route by URL path or header->L7 load balancer; L4 only sees IP and port Backend shows the LB’s IP as the client->L7 proxy terminates the connection; use `X-Forwarded-For` / PROXY protocol Users far away, static assets slow->CDN: DNS steers to a nearby edge with a cache `ping` fails but the HTTP service works->Firewall drops ICMP but allows TCP/443 — different rules per protocol Two containers both bind port 80 on one host->Each has its own network namespace and port space Pod IP changes, clients keep breaking->Kubernetes Service: a stable virtual IP over changing pod endpoints Reach a private network from outside->VPN tunnel: encrypted packets carrying the private addressing

Performance

Server idle, request still takes 800 ms->Round trips: DNS + TCP + TLS + request each cost one RTT Fast in one region, slow from another->Cross-region RTT (~150 ms transatlantic) multiplied by round trips Gigabit link, transfer still slow->Bandwidth-delay product: window too small for the RTT Throughput numbers do not match the link speed->Headers, retransmissions, ACK clocking, receive window — goodput < bandwidth

Debugging

Cannot connect — where do I start?->Layer by layer: DNS → route → reachability → port → handshake → TLS → HTTP Which tool answers which layer?->`dig` DNS, `ping` reachability, `traceroute` path, `ss` sockets, `tcpdump` packets, `curl -v` HTTP+TLS Latency jumps at one hop in `traceroute`->Compare later hops: if they are fine, that hop only deprioritises ICMP Need to see what actually left the NIC->`tcpdump -i any port 443` and read the SYN / SYN-ACK / RST Intermittent packet loss suspected->`ping -c 100` for loss %, `ss -ti` for retransmits