The Networking
Handbook
Everything you need to understand how computers talk to each other — from the physical wire to the HTTP request your browser makes. Clear, practical, and jargon-free where it counts.
What is a Network?
A computer network is two or more devices connected so they can exchange data. That's it. Everything else — TCP, DNS, firewalls, Wi-Fi — is infrastructure built on top of that simple idea.
Any device on the network — laptop, phone, server, printer, smart bulb. Identified by its address.
The medium connecting nodes — Ethernet cable, fiber optic, Wi-Fi radio waves, or even a satellite link.
Data is split into small chunks called packets. Each travels the network independently and is reassembled at the destination.
Network Types by Scale
| Type | Full Name | Scale | Example |
|---|---|---|---|
| PAN | Personal Area Network | ~1 m | Bluetooth headphones ↔ phone |
| LAN | Local Area Network | Room → Building | Home Wi-Fi, office network |
| MAN | Metropolitan Area Network | City | University campus network |
| WAN | Wide Area Network | Country → Global | The Internet |
How Data Actually Moves
Data doesn't travel as a single blob. It's broken into packets, each labeled with a source and destination address. Packets may take different paths and arrive out of order — the receiving device reassembles them. This is called packet switching, and it's what makes the internet resilient.
OSI & TCP/IP Models
Networking is complex. To manage that complexity, engineers divide functionality into layers. Each layer only communicates with the one directly above or below it. This means you can change Wi-Fi hardware without rewriting your web browser.
The OSI Model — 7 Layers
OSI (Open Systems Interconnection) is a conceptual reference model. You'll see it referenced constantly in documentation, exams, and job interviews.
TCP/IP Model — 4 Layers
TCP/IP is the actual model the internet uses. It maps roughly to OSI but collapses some layers:
| TCP/IP Layer | OSI Equivalent | Key Protocols |
|---|---|---|
| Application | Layers 7, 6, 5 | HTTP, HTTPS, DNS, FTP, SMTP, SSH |
| Transport | Layer 4 | TCP, UDP |
| Internet | Layer 3 | IP (IPv4/IPv6), ICMP, ARP |
| Link | Layers 2, 1 | Ethernet, Wi-Fi, PPP |
Encapsulation — How Layers Work Together
When you send data, each layer wraps it in its own header (and sometimes trailer). This is encapsulation. The receiver peels off layers in reverse.
Network Hardware
Connects devices within a LAN. Forwards frames based on MAC addresses. Learns which MAC is on which port. Smarter than a hub — only sends data to the intended recipient, not everyone.
Connects different networks. Forwards packets based on IP addresses. Your home router connects your LAN to your ISP's network. Makes routing decisions using routing tables.
Extends the network wirelessly. Bridges Wi-Fi clients to the wired LAN. Your home "router" is usually a router + switch + AP combined in one box.
Network Interface Card — the hardware in your device that connects it to the network. Every NIC has a unique MAC address burned in at the factory.
Modulates/demodulates signals to connect to your ISP over cable, DSL, or fiber. Translates the ISP's signal format into standard Ethernet for your router.
Filters traffic based on rules — blocks or allows packets based on IP, port, protocol. Can be hardware (a physical device) or software (Windows Firewall).
IP Addresses
An IP address is the logical address of a device on a network. Like a home address, it tells the network where to deliver packets.
IPv4
IPv4 addresses are 32-bit numbers written as four decimal octets separated by dots:
Public vs Private Addresses
Private addresses are reserved for use inside LANs — they're not routable on the public internet. Your home network almost certainly uses 192.168.x.x.
| Range | Type | Typical Use |
|---|---|---|
10.0.0.0/8 | Private | Large enterprise networks (16M hosts) |
172.16.0.0/12 | Private | Medium networks (1M hosts) |
192.168.0.0/16 | Private | Home and small office (65K hosts) |
127.0.0.0/8 | Loopback | 127.0.0.1 always refers to "this device" |
169.254.0.0/16 | Link-local (APIPA) | Auto-assigned when DHCP fails |
| Everything else | Public | Routable on the internet |
IPv6 — The Solution to IPv4 Exhaustion
IPv6 uses 128-bit addresses, providing 2¹²⁸ ≈ 340 undecillion addresses — effectively unlimited.
Subnetting
A subnet is a logical subdivision of an IP network. Subnetting lets you split a large network into smaller, isolated segments — improving security, performance, and organization.
CIDR Notation
CIDR (Classless Inter-Domain Routing) notation writes an address followed by a slash and the prefix length — the number of bits used for the network portion.
Common Subnet Masks
| CIDR | Subnet Mask | Hosts | Common Use |
|---|---|---|---|
/8 | 255.0.0.0 | 16,777,214 | Large enterprise (Class A) |
/16 | 255.255.0.0 | 65,534 | Large office (Class B) |
/24 | 255.255.255.0 | 254 | Home / small office |
/25 | 255.255.255.128 | 126 | Split a /24 in half |
/30 | 255.255.255.252 | 2 | Point-to-point links |
/32 | 255.255.255.255 | 1 | Single host route |
How to Calculate — Quick Method
Host bits = 32 − prefix length. For /26: 32−26 = 6 host bits.
2host bits. For 6 bits: 2⁶ = 64 addresses.
−1 for network address, −1 for broadcast. 64 − 2 = 62 usable hosts.
Block size = 64. Subnets: .0, .64, .128, .192. Each block hosts .1–.62, .65–.126, etc.
MAC Addresses & ARP
IP addresses are logical — they can change. MAC addresses are physical — burned into the NIC hardware (though they can be spoofed). When two devices communicate on the same LAN, they actually use MAC addresses at the data link layer.
ARP — Address Resolution Protocol
ARP bridges the gap between Layer 3 (IP) and Layer 2 (MAC). Before sending a frame, a device must know the MAC address of the destination. ARP finds it.
Device A wants to reach 192.168.1.20. It broadcasts: "Who has 192.168.1.20? Tell 192.168.1.10!"
Device B (192.168.1.20) replies directly: "I have 192.168.1.20. My MAC is AA:BB:CC:DD:EE:FF."
Device A stores this mapping in its ARP cache. Run arp -a to see it. Entries expire after a few minutes.
TCP vs UDP
- Connection-oriented — must establish connection first (3-way handshake)
- Reliable — guarantees delivery, detects lost packets and retransmits
- Ordered — data arrives in sequence
- Slower — overhead from acknowledgements, flow control
- Used for: HTTP, HTTPS, SSH, FTP, email
- Connectionless — fire and forget, no handshake
- Unreliable — no delivery guarantee, no retransmission
- Unordered — packets may arrive out of order
- Faster — very low overhead
- Used for: DNS, video streaming, VoIP, online games
The TCP 3-Way Handshake
Before TCP sends any application data, it establishes a connection using three messages:
Ports
Ports allow multiple services to run on one IP address. TCP/UDP use 16-bit port numbers (0–65535). A connection is identified by: source IP : source port → dest IP : dest port
DNS — Domain Name System
DNS translates human-readable names like google.com into IP addresses like 142.250.80.46. Without DNS, you'd have to memorize IP addresses for every website.
DNS Resolution — Step by Step
Your OS checks its DNS cache first. ipconfig /displaydns (Windows) or sudo resolvectl statistics (Linux) shows it.
Your configured DNS server (e.g., 8.8.8.8 — Google's resolver). This server does the heavy lifting on your behalf.
The resolver asks a Root server: "Who knows about .com?" Root refers it to the .com TLD server.
The TLD server says "ask google.com's authoritative server." That server returns the actual IP address.
The resolver caches the answer for the TTL (Time to Live) period and returns the IP to your browser.
DNS Record Types
| Record | Purpose | Example |
|---|---|---|
A | Hostname → IPv4 address | example.com → 93.184.216.34 |
AAAA | Hostname → IPv6 address | example.com → 2606:2800:220:1:248:1893:25c8:1946 |
CNAME | Alias → another hostname | www.example.com → example.com |
MX | Mail servers for domain | example.com → mail.example.com (priority 10) |
NS | Authoritative name servers | example.com → ns1.example.com |
TXT | Arbitrary text (SPF, DKIM, verification) | v=spf1 include:sendgrid.net ~all |
PTR | Reverse lookup (IP → hostname) | 34.216.184.93.in-addr.arpa → example.com |
SOA | Zone authority information | Start of Authority — serial, refresh timers |
DHCP
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to devices joining the network. Without it, you'd configure every device manually.
DORA — The 4-Step Process
What DHCP Provides
A dynamic IP address with a time-limited lease (e.g., 24h). The client must renew before expiry. Expired leases return to the pool.
Subnet mask, default gateway (router IP), DNS server addresses — everything needed to communicate on the network and internet.
HTTP & HTTPS
HTTP (HyperText Transfer Protocol) is the request-response protocol browsers use to fetch web pages. HTTPS adds TLS encryption on top, protecting data in transit.
HTTP Request & Response
HTTP Methods
| Method | Use | Idempotent? | Has Body? |
|---|---|---|---|
GET | Retrieve a resource | Yes | No |
POST | Create a resource | No | Yes |
PUT | Replace a resource entirely | Yes | Yes |
PATCH | Partially update a resource | No | Yes |
DELETE | Remove a resource | Yes | Optional |
HEAD | Like GET but headers only | Yes | No |
OPTIONS | What methods does server support? | Yes | No |
HTTP Status Codes
200 OK— Request succeeded201 Created— Resource created (POST)204 No Content— Success, nothing to return
301 Moved Permanently— URL has changed forever302 Found— Temporary redirect304 Not Modified— Use your cached copy
400 Bad Request— Malformed request401 Unauthorized— Authentication required403 Forbidden— Authenticated but no permission404 Not Found— Resource doesn't exist429 Too Many Requests— Rate limited
500 Internal Server Error— Server-side bug502 Bad Gateway— Upstream server failed503 Service Unavailable— Server overloaded/down504 Gateway Timeout— Upstream timeout
HTTPS & TLS Handshake
HTTPS = HTTP + TLS. TLS (Transport Layer Security) encrypts the connection before any data is exchanged. The TLS handshake:
Routing
A router decides where to send each packet. It consults a routing table — a list of network destinations and where to forward packets destined for them.
Routing Table Basics
Static vs Dynamic Routing
- Routes configured manually by an admin
- Simple, predictable, no overhead
- Doesn't adapt to failures automatically
- Good for: small networks, stub routes, default routes
- Routers share route info using protocols
- Adapts automatically to topology changes
- Requires CPU, bandwidth, and configuration
- Protocols: OSPF (interior), BGP (internet backbone)
Default Gateway
When your device needs to send a packet to an IP outside your subnet, it sends it to the default gateway — your router. The router then takes responsibility for forwarding it further.
NAT & PAT
NAT (Network Address Translation) lets many private-IP devices share a single public IP. Your home router does this for every device on your network.
VLANs
A VLAN (Virtual LAN) creates separate broadcast domains on the same physical switch. Devices on VLAN 10 cannot talk to devices on VLAN 20 without going through a router — even if they're on the same switch.
- Security — IoT devices can't reach your file servers
- Performance — reduces broadcast traffic
- Organization — logical grouping by department
- Compliance — isolate payment/cardholder data (PCI DSS)
On trunk links (between switches or router), frames are tagged with a VLAN ID (1–4094). The tag is a 4-byte header inserted into the Ethernet frame. Access ports (to end devices) are untagged.
Firewalls & ACLs
Firewall Types
Inspects each packet in isolation — source/dest IP, port, protocol. Fast but no awareness of connection state.
Tracks the state of connections. Knows that a packet is part of an established session, not a new rogue connection. Used in most modern firewalls.
Next-Generation Firewall. Inspects application-layer data (Layer 7). Can identify apps, detect malware, and enforce per-app policies.
ACL — Access Control List
ACLs are ordered lists of permit/deny rules evaluated top-to-bottom. The first match wins. Always ends with an implicit "deny all".
Wireless Networking
Wi-Fi Standards
| Standard | Generation | Max Speed | Frequency | Range |
|---|---|---|---|---|
| 802.11b | Wi-Fi 1 | 11 Mbps | 2.4 GHz | ~35m indoor |
| 802.11g | Wi-Fi 3 | 54 Mbps | 2.4 GHz | ~38m indoor |
| 802.11n | Wi-Fi 4 | 600 Mbps | 2.4 / 5 GHz | ~70m indoor |
| 802.11ac | Wi-Fi 5 | 3.5 Gbps | 5 GHz | ~35m indoor |
| 802.11ax | Wi-Fi 6/6E | 9.6 Gbps | 2.4 / 5 / 6 GHz | ~30m indoor |
| 802.11be | Wi-Fi 7 | 46 Gbps | 2.4 / 5 / 6 GHz | ~30m indoor |
2.4 GHz vs 5 GHz
- Longer range, better wall penetration
- More congested (microwaves, neighbors, Bluetooth)
- Only 3 non-overlapping channels (1, 6, 11)
- Good for: IoT devices, long distances
- Shorter range, more affected by walls
- Less congested, more channels available
- Faster speeds, lower latency
- Good for: streaming, gaming, high-bandwidth
Wi-Fi Security Standards
| Protocol | Status | Notes |
|---|---|---|
| WEP | ❌ Broken | Crackable in minutes. Never use. |
| WPA | ⚠️ Deprecated | Weak; TKIP encryption flawed. |
| WPA2-Personal | ✅ Acceptable | AES/CCMP encryption. Use strong passphrase. |
| WPA2-Enterprise | ✅ Good | 802.1X/RADIUS per-user auth. Corporate standard. |
| WPA3-Personal | ✅ Best | SAE handshake, forward secrecy. Use if all devices support it. |
Common Port Numbers
| Port | Protocol | Service | Description |
|---|---|---|---|
20 | TCP | FTP Data | File Transfer — data channel |
21 | TCP | FTP Control | File Transfer — control channel |
22 | TCP | SSH / SFTP / SCP | Secure Shell, secure file transfer |
23 | TCP | Telnet | Unencrypted remote access — never use |
25 | TCP | SMTP | Sending email (server-to-server) |
53 | UDP/TCP | DNS | Domain Name System |
67/68 | UDP | DHCP | Server (67), Client (68) |
80 | TCP | HTTP | Web traffic (unencrypted) |
110 | TCP | POP3 | Receive email (older) |
143 | TCP | IMAP | Receive email (modern) |
161/162 | UDP | SNMP | Network device monitoring |
443 | TCP | HTTPS | Web traffic (encrypted with TLS) |
445 | TCP | SMB | Windows file sharing |
3306 | TCP | MySQL | MySQL/MariaDB database |
3389 | TCP | RDP | Windows Remote Desktop |
5432 | TCP | PostgreSQL | PostgreSQL database |
6379 | TCP | Redis | Redis in-memory store |
8080 | TCP | HTTP-alt | Common dev/proxy HTTP alternate |
CLI Commands
Glossary
| Term | Definition |
|---|---|
| Bandwidth | Maximum data transfer rate of a link. Measured in Mbps/Gbps. Not the same as speed. |
| Latency | Time for a packet to travel from source to destination (one-way) or round-trip (RTT). Measured in ms. |
| Jitter | Variation in latency over time. High jitter degrades VoIP and video calls. |
| Throughput | Actual data transferred per second, which is often less than bandwidth due to overhead and congestion. |
| Broadcast Domain | The set of devices that receive a broadcast packet. Routers separate broadcast domains; switches do not. |
| Collision Domain | Network segment where packets can collide. Switches create separate collision domains per port. |
| MTU | Maximum Transmission Unit — largest packet size allowed on a link. Ethernet MTU = 1500 bytes. |
| QoS | Quality of Service — mechanism to prioritize certain traffic (e.g., voice over file downloads). |
| SSID | Service Set Identifier — the name of a Wi-Fi network. |
| Gateway | A router that provides access to another network; usually your router's IP on the LAN. |
| VPN | Virtual Private Network — encrypted tunnel over the public internet, creating a private connection. |
| CDN | Content Delivery Network — geographically distributed servers to serve content closer to users. |
| ISP | Internet Service Provider — company that provides your internet connection (Comcast, AT&T, etc.). |
| AS / ASN | Autonomous System / Number — a network under single administrative control on the internet (e.g., Google = AS15169). |
| BGP | Border Gateway Protocol — the routing protocol of the internet, used between autonomous systems. |
| OSPF | Open Shortest Path First — link-state routing protocol used within enterprise networks. |
| STP | Spanning Tree Protocol — prevents switching loops in networks with redundant links. |
| ICMP | Internet Control Message Protocol — used for diagnostics (ping, traceroute) and error reporting. |
| TTL | Time to Live — (1) packet hop limit, decremented by each router; (2) DNS record cache duration in seconds. |
| Half/Full Duplex | Half duplex = transmit OR receive at one time. Full duplex = both simultaneously. All modern Ethernet is full duplex. |