How Networks Work

Physical Layer: Signals

How bits become electrical signals, light pulses, or radio waves — and travel from one device to another.

📍

ARP — Address Resolution

How ARP maps IP addresses to MAC addresses on a local network, ARP caching, and what happens when the cache entry expires.

IP Address Types & Ranges

Public vs private, loopback, link-local, multicast, and broadcast addresses — what each range means and when packets using them can cross a router.

Prereq: ip-address

🖼️

Ethernet Frames

The structure of a Layer 2 Ethernet frame — preamble, MAC addresses, EtherType, payload, and FCS.

Prereq: physical-signals

🏷️

MAC Addresses & ARP

What MAC addresses are, how ARP discovers them, and what happens when two devices want to talk.

Prereq: ethernet-frames

📢

Broadcast, Multicast & Unicast

The three ways to address network traffic: one-to-one, one-to-group, and one-to-all.

Prereq: mac-addresses

How WiFi Works

802.11 association, channels, WPA2 authentication, and why WiFi is slower than wired.

Prereq: broadcast-domain

🪪

DHCP — Getting an IP Address

The DORA process: how your device automatically gets an IP, subnet mask, gateway, and DNS server.

Prereq: broadcast-domain

IP Routing: How Routers Forward Packets

How a router makes forwarding decisions — longest prefix match, routing table vs FIB, administrative distance between routing protocols, recursive next-hop resolution, and what happens at each hop across the internet.

TCP Connection Lifecycle: From SYN to FIN

The complete lifecycle of a TCP connection — the 3-way handshake with ISN selection, simultaneous opens, half-close sequences, RST injection, and why TIME_WAIT exists to prevent old packets from corrupting new connections.

📚

OSI Model Deep Dive: Where Protocols Live

A thorough exploration of all 7 OSI layers — what each layer adds to a packet, encapsulation/decapsulation as data moves through the stack, Protocol Data Units (PDUs) at each layer, and why the model matters for troubleshooting when something breaks.

Network Troubleshooting: OSI-Layer Methodology

A systematic approach to diagnosing network problems — starting from physical layer and working up, using ping/traceroute/nmap/ss/tcpdump at each layer, common failure patterns (no link, no IP, no route, DNS failure, port blocked), and building a troubleshooting mental model.

Static Routing

How manually configured static routes direct packets, why default routes matter, and how floating static routes provide automatic failover.

Prereq: ip-address, subnets

🗣️

HTTP Content Negotiation

How Accept, Accept-Language, and Accept-Encoding headers let clients request their preferred format, language, and compression from servers.

IPv4 Exhaustion & Address Conservation

How the Internet ran out of IPv4 addresses, how IANA and RIRs manage the remaining space, and the technical mechanisms (NAT, CGNAT, IPv6) that extended IPv4's lifespan.

OSI Encapsulation: Data Wrapping Layer by Layer

How data is wrapped with headers as it travels down the OSI stack — application data becomes a TCP segment, then an IP packet, then an Ethernet frame, then physical bits — and unwrapped in reverse at the receiver. Includes PDU naming, what each layer adds, and why encapsulation enables protocol independence.

Simple — Build on the basics

Ethernet Autonegotiation

How Ethernet autonegotiation (IEEE 802.3u) selects the best speed and duplex between two devices — and why duplex mismatches cause mysterious 50% throughput drops and late collision errors.

Power over Ethernet (PoE)

How PoE (IEEE 802.3af/at/bt) delivers DC power over Ethernet cables to IP cameras, access points, and VoIP phones — including power negotiation, budget management, and the difference between PoE standards.

How a Web Request Works

What happens when you type a URL and press Enter — from your browser to the server and back.

📍

IP Addresses Explained

Public vs private IPs, what they mean, and how NAT lets millions of devices share one public IP.

📖

DNS Resolution

How a domain name like 'example.com' gets translated into an IP address before connecting.

Prereq: http-request

🏓

Ping & ICMP

How ICMP works, what ping measures, TTL hop counting, and how traceroute maps a network path.

Prereq: ip-address

Switches & VLANs

How switches learn MAC addresses, and how VLANs segment a network into isolated broadcast domains.

Prereq: broadcast-domain

6️⃣

IPv6 Addresses

IPv6 address format, types (link-local, global, multicast), NDP replacing ARP, and dual-stack operation.

Prereq: ip-address, dhcp

☠️

ARP Spoofing Attack

How an attacker poisons ARP caches to intercept all traffic on a local network (Man-in-the-Middle).

Prereq: mac-addresses

Traceroute — Path Discovery

How traceroute reveals every router hop between you and a destination by exploiting IP TTL values.

Prereq: ping-icmp

TCP Connection Teardown

The TCP four-way FIN handshake: how connections are cleanly closed and why TIME_WAIT exists.

HTTP Caching & ETags

How browsers avoid redundant downloads using Cache-Control, ETags, and conditional requests.

Prereq: http-request

NTP Time Synchronization

How computers on the internet keep their clocks accurate using the Network Time Protocol hierarchy.

📁

FTP File Transfer

How FTP uses two separate TCP connections — one for commands, one for data — to transfer files.

DNS Caching & TTL

How DNS resolvers cache answers, when caches expire, and what negative caching means for failed lookups.

💓

TCP Keepalive

How TCP detects dead connections using keepalive probes, and why idle connections silently disappear without them.

🏢

Three-Tier Network Architecture

The access, distribution, and core layers of enterprise networks — how traffic flows from a laptop to the internet.

SNMP Monitoring

How network management systems poll routers and switches with SNMP to collect metrics, and how traps alert on failures.

🔬

Packet Capture & Analysis

How tcpdump and Wireshark capture network traffic, what promiscuous mode does, and how to read packet headers for debugging.

Reverse Proxy & Nginx

How a reverse proxy like Nginx sits in front of app servers to handle TLS termination, caching, compression, and request routing.

Prereq: http-request, tls-handshake, load-balancer

CDN Edge Caching

How CDN edge nodes cache content close to users, how cache invalidation works, and the difference between cache hit, miss, and revalidation.

HTTP Security Headers

How security headers like HSTS, CSP, CORS, and X-Frame-Options protect browsers from XSS, clickjacking, and protocol downgrade attacks.

Prereq: http-request, tls-handshake, cors

ICMP Message Types

The complete ICMP toolbox: echo request/reply (ping), destination unreachable, time exceeded (traceroute), redirect, and why blocking all ICMP is harmful.

✉️

Email Delivery Flow

The complete journey of an email: from sending client through SMTP relay chains to the recipient's IMAP mailbox, including MX records and TLS.

⚙️

Load Balancer Algorithms

Round-robin, least connections, IP hash, and weighted algorithms — how each distributes traffic and which to choose for stateful vs stateless apps.

WiFi Bands: 2.4 / 5 / 6 GHz

Why the 2.4 GHz band is congested, how 5 GHz and 6 GHz provide more channels and less interference, and how to choose the right band.

Captive Portal

How hotel and airport WiFi intercepts your HTTP traffic to show a login page before granting internet access, and the HTTPS chicken-and-egg problem.

802.11 Frame Types

The three classes of WiFi frames: management (beacons, probe, association), control (ACK, RTS/CTS), and data — and what happens during the join process.

WEP → WPA → WPA2 → WPA3

The evolution of WiFi security protocols: why WEP was broken, how WPA patched it, what WPA2 got right, and what WPA3 adds.

Prereq: wifi-basics

📞

SIP Call Setup

How a VoIP call is established using the Session Initiation Protocol: INVITE, 100 Trying, 180 Ringing, 200 OK, and the RTP audio stream.

🌡️

CoAP — IoT Protocol

How CoAP (Constrained Application Protocol) provides REST-like communication for microcontrollers and sensors over UDP with minimal overhead.

🛰️

LoRaWAN — Long-Range IoT

How LoRaWAN achieves 10km wireless range on a coin cell battery, and how star-of-stars topology routes sensor data to the cloud.

NetFlow Traffic Analysis

How Cisco NetFlow (and IPFIX) samples network traffic into flow records, enabling bandwidth analysis, anomaly detection, and capacity planning.

DNS-Based Failover

How Route 53 health checks and weighted/failover routing policies automatically redirect traffic away from failed servers using DNS TTL.

📬

PROXY Protocol

How the PROXY protocol header preserves the original client IP through load balancers so backend servers see real visitor addresses, not the proxy's IP.

🐢

Nagle's Algorithm & TCP_NODELAY

How Nagle's algorithm buffers small TCP writes to reduce chattiness, why it causes latency in interactive applications, and when to disable it.

HTTP Authentication

How Basic, Digest, Bearer token, and API key authentication work in HTTP — what each protects against and what it doesn't.

🔭

Network TAP & SPAN Ports

How network TAPs and SPAN ports create passive copies of traffic for IDS, monitoring, and forensics — without interrupting production flows.

API Rate Limiting

How token bucket, sliding window, and fixed window rate limiting algorithms protect APIs from abuse, and how to implement them without blocking legitimate users.

Prereq: http-request, load-balancer

🚨

SNMP Traps & Alerts

How network devices send unsolicited SNMP Trap messages to NMS when events occur — link down, CPU spike, temperature threshold — and v3 authentication.

↩️

ICMP Redirect & Router Discovery

How routers use ICMP Redirect to tell hosts about a better next-hop, and how ICMP Router Advertisement (IRDP) helps hosts discover gateways.

⏰

NTP Stratum Hierarchy

How the NTP stratum hierarchy distributes accurate time from atomic clocks to billions of devices, with clock selection, drift correction, and leap seconds.

🍪

HTTP Cookies & Sessions

How cookies maintain stateful sessions over stateless HTTP, the security attributes (HttpOnly, Secure, SameSite) that prevent theft and CSRF.

🗃️

IP Address Management (IPAM)

How IPAM systems track IP address allocation across subnets, integrate with DHCP and DNS to prevent conflicts, and enforce address policies.

HTTP Security Headers

How response headers like HSTS, CSP, X-Frame-Options, and CORS headers harden web apps against clickjacking, XSS, and protocol downgrade attacks.

Server-Sent Events (SSE)

How SSE enables real-time server-to-client push over plain HTTP/1.1 without WebSockets — automatic reconnect, event IDs, and why SSE is simpler than WebSockets for one-way streams.

💓

BFD: Bidirectional Forwarding Detection

How BFD detects link failures in milliseconds — far faster than routing protocol timers — enabling sub-second failover for BGP, OSPF, and static routes.

TCP Fast Open (TFO)

How TCP Fast Open allows sending application data in the SYN packet — eliminating the extra round-trip of the TCP handshake for repeat connections and reducing page load times.

📂

NFS: Network File System

How NFS mounts remote filesystems over TCP/UDP, the RPC/XDR protocol underneath, NFSv4 stateful sessions, and the difference from iSCSI block storage.

🏠

Zigbee & Matter: Smart Home Mesh

How Zigbee builds self-healing mesh networks for low-power IoT devices, and how Matter standardizes smart home interoperability across Apple, Google, and Amazon.

DNS over TLS (DoT) & DNS Privacy

How DoT (port 853) and DoH wrap DNS in TLS to prevent ISP surveillance and DNS tampering — and the difference between stub resolvers, forwarders, and encrypted recursive resolvers.

🪟

SMB/CIFS: Windows File Sharing

How SMB (Server Message Block) enables Windows file and printer sharing, how SMBv3 signing and encryption work, and the security vulnerabilities that made WannaCry possible.

📥

HTTP Range Requests & Resumable Downloads

How HTTP Range requests enable partial content downloads, parallel chunk fetching for video streaming, and resumable file downloads — the mechanism behind every video player's seek bar.

⏳

Long Polling & Real-Time HTTP

How long polling simulates push over HTTP/1.1 by holding requests open until data is available — and why it was the dominant real-time technique before WebSockets and SSE.

🌗

Split-Horizon DNS

How split-horizon DNS returns different answers to internal vs external queries for the same domain — keeping internal services private while exposing public endpoints.

🔨

ICMP Flood & Smurf Attack

How ICMP flood and Smurf attacks overwhelm targets using ping packets — the amplification mechanics of Smurf using broadcast addresses, and why RFC 2644 fixed it.

📁

FTP Active vs Passive Mode

Why FTP uses two TCP connections (control and data), the fundamental difference between active and passive mode, and why passive mode is required when clients are behind NAT/firewalls.

🚇

SSH Port Forwarding & Tunneling

How SSH local, remote, and dynamic port forwarding create encrypted tunnels — using them to access internal services, expose local servers, and create SOCKS proxies.

Prereq: ssh-connection, nat, socks-proxy

WebSocket Handshake Deep Dive

The exact bytes of the HTTP Upgrade handshake that establishes a WebSocket connection — the Sec-WebSocket-Key challenge, permessage-deflate compression, and how subprotocols work.

PXE Boot: Network Booting

How PXE (Preboot Execution Environment) boots a diskless machine over the network — DHCP discovers the TFTP server, downloads the bootloader, and starts the OS without any local storage.

HTTP vs WebSocket vs SSE: Choosing Real-Time

A practical comparison of the three real-time web patterns — HTTP polling, Server-Sent Events, and WebSockets — covering when to use each, their connection models, and performance characteristics.

TCP Half-Open & Half-Closed Connections

What happens when only one side of a TCP connection closes — half-closed connections via FIN, the FIN_WAIT and CLOSE_WAIT states, and how half-open connections from crashes cause RST responses.

📤

HTTP File Upload: Multipart & Streaming

How browsers upload files using multipart/form-data encoding, how large files stream with chunked transfer encoding, and the difference between form uploads, presigned URLs, and direct-to-S3 uploads.

DNS Privacy: DoH, DoT & Encrypted DNS

Why plain DNS leaks browsing history to ISPs and network observers, how DNS-over-HTTPS and DNS-over-TLS encrypt queries, and the enterprise security tradeoff when DNS is encrypted.

API Versioning & Backward Compatibility

URL versioning vs header versioning vs content negotiation, how to evolve APIs without breaking clients, and the network-level mechanics of version routing in API gateways.

HTTP Connection Management: Keep-Alive & Pipelining

How HTTP evolved from closing connections after every request to persistent connections, pipelining, and HTTP/2 multiplexing — the performance impact of connection overhead and the head-of-line blocking problem.

UDP: When to Use It and Why

Why UDP's simplicity makes it the right choice for DNS, video streaming, VoIP, and gaming — the tradeoffs between TCP reliability overhead and UDP's speed, plus how QUIC builds reliability on top of UDP.

⏰

NTP & Precision Time: How Clocks Stay Synchronized

How the Network Time Protocol synchronizes clocks across the internet — stratum hierarchy, clock offset calculation, the leap second problem, and why PTP (IEEE 1588) achieves nanosecond accuracy for trading and telecoms.

gRPC vs REST vs GraphQL: When to Use Which

How gRPC, REST, and GraphQL solve different API problems — Protobuf binary encoding vs JSON, HTTP/2 streaming vs request-response, schema-first vs URL-first design, and the N+1 query problem.

🌡️

IoT Protocol Comparison: MQTT vs CoAP vs AMQP

How IoT protocols balance constraint trade-offs — MQTT's publish-subscribe over TCP, CoAP's RESTful UDP for constrained devices, AMQP for enterprise IoT, and choosing the right protocol for power, bandwidth, and reliability needs.

🔧

TCP Socket Options: Tuning for Performance

Essential TCP socket options that every backend developer should understand — SO_REUSEADDR, TCP_NODELAY, SO_KEEPALIVE, SO_RCVBUF/SO_SNDBUF, TCP_CORK, and how the kernel handles the accept queue and SYN backlog.

✂️

IP Fragmentation & MTU: Why Large Packets Get Split

How IP fragmentation works when packets exceed the MTU — the DF bit, ICMP 'fragmentation needed' messages, why fragmentation is problematic in modern networks, and how PMTUD and TCP MSS prevent it.

↩️

HTTP Redirects: 301, 302, 307, 308 & HSTS

When and why servers redirect browsers — permanent vs temporary redirects, method-preserving 307/308, HSTS preloading to eliminate the first HTTP request, and how redirect chains affect SEO and performance.

🔁

Forward Proxy vs Reverse Proxy vs CONNECT Tunnel

The difference between forward proxies (Squid, corporate web filtering) and reverse proxies (nginx, Cloudflare) — HTTP CONNECT tunneling for HTTPS, transparent proxies, and how clients and servers see different IPs.

ICMP: The Network's Error and Diagnostic Protocol

How ICMP powers network diagnostics beyond ping — TTL exceeded for traceroute, ICMP unreachable messages, port/host/network unreachable codes, PMTUD reliance on ICMP, and why blocking ICMP breaks things.

HTTP/2 Server Push & Stream Multiplexing

How HTTP/2 multiplexes multiple requests on one TCP connection — stream IDs, HEADERS + DATA frames, flow control per-stream, PUSH_PROMISE for proactive resource delivery, and why server push was deprecated in HTTP/3.

📈

TCP CUBIC: The Default Congestion Algorithm

How TCP CUBIC replaced Reno/TAHOE as the Linux default — cubic window growth for high-bandwidth-delay-product networks, the W_max memory after loss, beta=0.7 multiplicative decrease, and how CUBIC differs from BBR's model-based approach.

WebSocket Reconnection & Backoff Strategies

How to build resilient WebSocket clients — detecting disconnections via ping/pong and close codes, exponential backoff with jitter to prevent thundering herds, state resync after reconnect, and the tradeoffs between WebSocket and SSE for server-push use cases.

DNS Load Balancing: Round Robin, Geo & Health

How DNS distributes traffic across servers — round-robin A records, TTL-based caching tradeoffs, weighted routing, latency-based routing for global users, and health-check-driven failover with AWS Route 53 routing policies.

🔢

IPv6 Addressing: Prefixes, Scopes & Address Types

How IPv6 addressing works beyond the basics — address format and compression rules, link-local vs global unicast vs ULA, prefix delegation (PD) from ISP to CPE, address scopes and their routing implications, and why every interface gets multiple IPv6 addresses.

Network Storage Protocols: NFS, SMB & Object Storage

How network storage works — NFS v4.1 pNFS for parallel access, SMB3 multichannel over multiple NICs, S3 object storage vs block/file semantics, and the network performance considerations for latency-sensitive storage workloads.

♻️

HTTP Conditional Requests: ETags, Last-Modified & 304

How HTTP conditional requests avoid retransmitting unchanged content — ETags for byte-accurate validation, Last-Modified for time-based checks, If-None-Match and If-Modified-Since headers, 304 Not Modified responses, and the interplay with CDN caching.

🖥️

Network Boot: PXE, iPXE & UEFI HTTP Boot

How machines boot over the network — PXE DHCP discovery and TFTP boot file download, iPXE scripting for chainloading, UEFI HTTP Boot replacing TFTP with HTTPS, and how data centers provision bare-metal servers automatically.

🌊

HTTP Streaming: Chunked Transfer & Response Streaming

How HTTP streams data progressively — Transfer-Encoding: chunked for unknown-length responses, streaming JSON with NDJSON, React/Next.js streaming server-side rendering, and the buffering behavior of proxies and browsers that can delay visible streaming.

Ethernet Switching: MAC Tables, Flooding & Port Security

How Layer 2 switches work in depth — MAC address table learning and aging, unknown unicast flooding, broadcast domain containment, MAC flooding attacks and port security, and why switches outperform legacy hubs.

Proxy ARP & Gratuitous ARP: Advanced ARP Patterns

How Proxy ARP extends ARP across subnets — a router responds to ARP requests on behalf of remote hosts, allowing hosts with misconfigured subnet masks to reach remote networks. Plus Gratuitous ARP for IP change notification and its use in VRRP failover.

HTTP Authentication: Basic, Bearer & API Keys

How HTTP authentication mechanisms work — WWW-Authenticate challenge/response, Basic auth encoding, Bearer token patterns, API key placement (header vs query vs body), and the security tradeoffs of each approach with recommendations.

🪪

OpenID Connect: Identity on Top of OAuth 2.0

How OIDC adds authentication to OAuth 2.0 — the discovery endpoint, authorization code flow with ID token, userinfo endpoint, ID token JWT structure (sub/iss/aud/exp/nonce), and OIDC vs OAuth2 scope differences.

WebTransport: Bidirectional Streams over HTTP/3

How WebTransport uses QUIC streams for real-time browser communication — bidirectional and unidirectional streams, unreliable datagrams, how it compares to WebSocket, and why low-latency game/media applications prefer it over TCP-based alternatives.

📬

IMAP vs POP3: Email Retrieval Protocols

How email clients fetch mail from servers — IMAP4 folder sync and server-side storage vs POP3 download-and-delete, IMAP IDLE push notifications, IMAP flags and UIDs, and why IMAP won for multi-device access.

HTTP Trailers: Headers After the Body

How HTTP trailers send metadata after the response body — chunked encoding trailer fields, HTTP/2 HEADERS frame after DATA frames, use cases (checksums, server timing, gRPC status), and why trailers solve the problem of metadata computed during body generation.

🔵

Bluetooth LE: Advertising, GATT & BLE Mesh

How Bluetooth Low Energy works — advertising channels vs data channels, GAP roles (peripheral/central), GATT service/characteristic hierarchy, ATT protocol for attribute reads/writes, connection intervals for power saving, and BLE Mesh for many-to-many IoT networks.

🏠

Thread & Matter: The Modern IoT Stack

How Thread provides an IPv6 mesh network for smart home devices using 802.15.4 radio, and how Matter (formerly Project CHIP) runs on top as the application layer — device commissioning, commissioner/joiner roles, Border Router bridging Thread to WiFi/Ethernet, and Matter's multi-admin model.

103 Early Hints: Preloading Before the Response

How HTTP 103 Early Hints lets servers send Link preload headers before the final response — eliminating the server think time gap, how CDNs like Cloudflare cache Early Hints separately, priority hints for critical CSS/fonts, and how Early Hints compares to HTTP/2 server push.

DANE & TLSA: DNS-Based TLS Authentication

How DANE (DNS-Based Authentication of Named Entities) uses DNSSEC-signed TLSA records to authenticate TLS certificates without relying on public CAs, defeating fraudulent CA issuances, and how SMTP DANE prevents downgrade attacks on email delivery.

📹

WebRTC vs WebSocket: Real-Time Communication Patterns

When to use WebRTC (peer-to-peer, media, sub-100ms latency) vs WebSocket (server-mediated, reliable, ordered messaging) — ICE candidates, STUN/TURN traversal, DataChannel vs TCP semantics, SFU architectures for group calls, and why video conferencing doesn't use WebSockets.

IP SLA & BFD: Active Path Monitoring

How Cisco IP SLA and BFD (Bidirectional Forwarding Detection) actively probe network paths to detect failures in milliseconds rather than waiting for routing protocol convergence — jitter probes, threshold alerts, track objects for PBR and static route failover, and when to use each.

GeoDNS vs Anycast: Geographic Traffic Steering

How GeoDNS returns different IP addresses based on where a DNS query originates, how Anycast routes users to the nearest data center at the BGP level, the latency differences between them, failover behavior, and why major CDNs use both together.

HTTP Server-Timing & Resource Timing: Measuring the Real Costs

How Server-Timing headers expose backend processing breakdown to browser DevTools, how the Resource Timing API measures DNS, TCP connect, TLS, TTFB, and download phases for every resource, what TTFB actually measures, and how Core Web Vitals (LCP, INP, CLS) connect to these measurements.

🕐

TCP Pacing & TSQ: Eliminating Bufferbloat

How TCP pacing spreads packet transmission evenly across an RTT instead of bursting, how TSQ (TCP Small Queues) limits in-flight bytes per socket, why bufferbloat happens and how it destroys latency, the FQ (Fair Queuing) scheduler, and why Netflix and Google enable pacing in production.

Medium — Go deeper

TCP 3-Way Handshake

How two computers establish a reliable connection before any data is sent.

Prereq: http-request

💻

DHCP Options & PXE Boot

How DHCP option 43, 66, 67 enable network booting via PXE — BIOS requests an IP and a boot server address in the same DHCP exchange.

🗂️

OSI Model — 7 Layers

The 7 layers of the OSI model: what each one does, and how data gets wrapped as it travels.

NAT — Network Address Translation

How your router lets multiple devices share one public IP address using port mapping.

Subnets & Routing

How networks are divided into subnets and how routers forward packets between them.

Multicast & IGMP

How multicast efficiently delivers one stream to many subscribers using IGMP join/leave and group addresses.

HTTP/2 & Multiplexing

How HTTP/2 eliminates head-of-line blocking with streams, HPACK header compression, and server push.

WebSockets

How WebSockets upgrade an HTTP connection to a full-duplex persistent channel for real-time apps.

How Email Works (SMTP)

The full email delivery chain: SMTP relay, MX records, SMTP commands, and SPF/DKIM authentication.

CDNs & Edge Caching

How Content Delivery Networks intercept DNS, cache content at edge nodes, and dramatically reduce latency.

DNS Record Types

The difference between A, AAAA, CNAME, MX, TXT, and SRV records — and when each is used.

Prereq: dns-resolution

📉

TCP Congestion Control

How TCP dynamically adjusts transmission speed to avoid overwhelming the network using slow start, AIMD, and congestion avoidance.

🪟

TCP Flow Control

How TCP's sliding window prevents senders from overwhelming slow receivers using receive buffer advertisements.

Port Scanning

How attackers and security teams discover open services using TCP SYN scanning, and how firewalls respond.

💻

SSH — Secure Shell

How SSH establishes an encrypted tunnel using key exchange, host authentication, and public-key login.

Prereq: tcp-handshake, tls-handshake

CORS — Cross-Origin Requests

Why browsers block cross-origin requests by default, how CORS preflight works, and how servers grant access.

Prereq: http-request

WPA2 — WiFi Authentication

How WPA2 authenticates devices to a WiFi network and derives unique per-session encryption keys via the 4-way handshake.

JWT — JSON Web Tokens

How JSON Web Tokens encode claims, get signed by the server, and verify identity without database lookups.

Prereq: http-request, tls-handshake

MFA — Time-Based One-Time Passwords

How TOTP generates 6-digit codes from a shared secret and current time, making stolen passwords alone useless.

🐋

Docker Networking

How Docker containers communicate using virtual bridges, veth pairs, and NAT to reach the outside world.

📧

SPF & DKIM Email Authentication

How SPF and DKIM prevent email spoofing by publishing authorized senders in DNS and signing messages cryptographically.

🍪

Session Hijacking

How attackers steal session cookies to impersonate logged-in users, and how HttpOnly, Secure, and SameSite flags protect them.

🧩

TCP SACK — Selective Acknowledgment

How TCP SACK lets receivers report gaps in received data so senders retransmit only missing segments, not everything after a loss.

🔏

DNS over HTTPS (DoH)

How DoH encrypts DNS queries inside HTTPS to prevent ISP snooping and censorship, and the privacy tradeoffs it introduces.

Anycast Routing

How the same IP address can be hosted in multiple locations simultaneously, routing users to the nearest instance via BGP.

⚙️

gRPC — Remote Procedure Calls

How gRPC uses HTTP/2 multiplexing and Protocol Buffers to enable efficient, strongly-typed service-to-service communication.

📢

WebSocket Scaling & Sticky Sessions

Why WebSockets require sticky sessions behind a load balancer, and how pub/sub backends enable horizontal scaling.

🌿

Spine-Leaf Data Center Topology

How modern data centers use a spine-leaf fabric to provide predictable latency, high bandwidth, and easy horizontal scaling.

🌡️

MQTT — IoT Messaging

How MQTT's publish/subscribe model connects millions of IoT devices efficiently using a message broker and QoS levels.

📏

RIP — Distance Vector Routing

How RIP routers share routing tables with neighbors, count hops to build a network map, and why RIP is limited to small networks.

🐲

WPA3 — SAE Handshake

How WPA3's Simultaneous Authentication of Equals (Dragonfly) eliminates offline dictionary attacks and provides forward secrecy.

🔢

IPv6 SLAAC — Auto-Configuration

How IPv6 devices configure their own addresses without DHCP using router advertisements and EUI-64 or random IIDs.

🚦

API Gateway Pattern

How an API gateway handles rate limiting, authentication, routing, and protocol translation for microservices behind a single entry point.

Path MTU Discovery

How TCP discovers the maximum packet size that fits through every link on a path, avoiding fragmentation for best performance.

🧱

Network Segmentation

How VLANs, DMZs, and firewall zones limit blast radius: why a compromised printer can't reach your database server.

🪪

802.1X / EAP — Port-Based Auth

How enterprise Wi-Fi and wired networks authenticate every device before granting network access using RADIUS and EAP.

⬡

GraphQL vs REST

How GraphQL eliminates over-fetching and under-fetching: single endpoint, client-defined queries, and N+1 problem solved with DataLoader.

Wi-Fi Roaming — 802.11r

How devices seamlessly hand off between access points as you walk through a building, and why 802.11r Fast BSS Transition eliminates the auth delay.

ECMP Load Balancing

How routers distribute traffic across multiple equal-cost paths using hashing, and the reordering problems that arise when paths change.

📧

DMARC — Email Authentication

How DMARC combines SPF and DKIM to stop email spoofing and domain impersonation, and how policies escalate from monitor to reject.

NAT64 — IPv6 to IPv4 Translation

How IPv6-only devices reach IPv4 servers through NAT64 translation and DNS64 synthetic records.

DHCP Relay & Snooping

How DHCP relay agents forward broadcasts across subnets, and how DHCP snooping prevents rogue DHCP servers from hijacking address assignment.

TLS 1.3 & 0-RTT Resumption

How TLS 1.3 reduced the handshake from 2 RTTs to 1 RTT, and how 0-RTT early data enables sending requests before the handshake completes.

TCP State Machine

The complete TCP connection lifecycle: LISTEN → ESTABLISHED → TIME_WAIT, what each state means, and why sockets pile up in CLOSE_WAIT or TIME_WAIT.

Prereq: tcp-handshake, tcp-time-wait

🏅

TLS Certificates & PKI

How X.509 certificates work, what a Certificate Authority chain looks like, and how browsers verify a certificate is legitimate.

WebSocket Protocol Deep Dive

The WebSocket upgrade handshake, framing format, ping/pong keepalives, and how WebSockets compare to Server-Sent Events and long polling.

🎚️

QoS — Traffic Prioritization

How routers use DSCP markings and queuing to guarantee voice quality while allowing bulk transfers — ensuring VoIP stays crystal clear even during downloads.

🐋

Container Networking (Docker)

How Docker creates virtual bridges and veth pairs, how containers talk to each other and to the internet, and how port publishing works.

📻

CSMA/CA — WiFi Collision Avoidance

How WiFi devices take turns sharing a radio channel using carrier sense, random backoff, and acknowledgments — and why WiFi can't detect collisions like Ethernet.

WiFi 6 — OFDMA & Target Wake Time

How WiFi 6 (802.11ax) uses OFDMA to serve multiple devices simultaneously, BSS coloring to reduce interference, and TWT to save battery life.

📌

WPS PIN Attack

How the WiFi Protected Setup PIN flaw allows cracking an 8-digit PIN in ~11,000 attempts instead of 100 million, and why WPS should be disabled.

MU-MIMO & Beamforming

How multiple antennas create directed signal beams to serve multiple clients simultaneously, and why this doubles throughput in real environments.

☎️

VoIP Behind NAT

Why SIP calls fail behind NAT: the private IP in SDP doesn't reach the internet, and how STUN, TURN, and ICE solve this.

🏛️

Public Key Infrastructure (PKI)

How certificate authorities, root stores, and the chain of trust enable browsers to automatically trust millions of websites without prior contact.

VPC Peering

How AWS VPC peering connects two isolated virtual networks privately, avoiding the public internet, and why non-transitive routing matters.

HTTP/3 Connection Migration

How QUIC's connection ID enables seamless handoff between WiFi and cellular without reconnecting, and the 0-RTT resumption mechanism.

IPv6 Transition Mechanisms

How dual-stack, tunneling (6in4, Teredo), and translation (NAT64/DNS64) help IPv6 and IPv4 coexist during the multi-decade transition period.

ARP Spoofing Defense

How Dynamic ARP Inspection (DAI) and static ARP entries protect against ARP poisoning attacks that enable man-in-the-middle on LAN.

🌉

GRE Tunneling

How Generic Routing Encapsulation wraps any network-layer packet inside IP to create overlay tunnels — the building block for site-to-site VPNs and SD-WAN.

🛤️

Multipath TCP (MPTCP)

How MPTCP uses multiple network paths simultaneously to increase throughput and provide seamless failover — used by Apple's Siri and iOS networking.

Linux Network Namespaces

How Linux network namespaces isolate network stacks per process — the foundation of container networking, Kubernetes pods, and network virtualization.

AWS ALB vs NLB vs CLB

How AWS Application Load Balancer, Network Load Balancer, and Classic Load Balancer differ — and when to use each for HTTP, TCP, and WebSocket workloads.

🌳

Spanning Tree Protocol

How STP eliminates loops in Ethernet networks by blocking redundant ports, electing a root bridge, and converging after a topology change.

Link Aggregation (LACP/802.3ad)

How LACP bonds multiple physical links into a single logical channel, distributing traffic across them for both redundancy and increased bandwidth.

DNS: CAA, PTR, SRV & TLSA Records

Advanced DNS record types beyond A/MX/CNAME: CAA for certificate authority restriction, PTR for reverse DNS, SRV for service discovery, and TLSA for DANE.

🌊

gRPC Streaming

How gRPC's four call types work: unary, server-streaming, client-streaming, and bidirectional streaming — all multiplexed over a single HTTP/2 connection.

iSCSI: Storage Over IP

How iSCSI encapsulates SCSI commands in TCP/IP to create storage area networks (SANs) over standard Ethernet, replacing expensive Fibre Channel.

6️⃣

DHCPv6 & IPv6 Address Assignment

How DHCPv6 assigns IPv6 addresses statefully, how it differs from SLAAC (stateless autoconfiguration), and how the M/O flags in Router Advertisements control which method hosts use.

Prometheus Metrics & Alerting

How Prometheus scrapes metrics from instrumented services, stores time-series data, evaluates alerting rules with PromQL, and routes alerts via Alertmanager.

Policy-Based Routing (PBR)

How policy-based routing overrides the normal destination-based forwarding table to send traffic based on source IP, DSCP marks, port, or application — enabling traffic engineering beyond static routes.

📜

Certificate Transparency (CT Logs)

How Certificate Transparency logs create a public, auditable record of every TLS certificate issued — and how browsers use SCTs to detect misissued certificates.

Network ACLs vs Security Groups

How AWS Network ACLs (stateless) and Security Groups (stateful) differ, when to use each, and how they interact to create layered cloud network security.

WebSocket Load Balancing

The challenges of load balancing persistent WebSocket connections — sticky sessions, connection draining during deploys, and how to use Redis pub/sub for horizontal scaling.

🔔

GraphQL Subscriptions

How GraphQL subscriptions enable real-time push from server to client — the WebSocket transport protocol, subscription lifecycle, and how they differ from queries and mutations.

🔺

NAT Types: Full Cone, Symmetric, and Hairpinning

The four types of NAT (Full Cone, Restricted Cone, Port Restricted, Symmetric) and how they affect peer-to-peer connectivity — plus NAT hairpinning for same-network communication.

RADIUS & TACACS+: Network Authentication

How RADIUS and TACACS+ centralize authentication for network devices and VPN users — AAA (Authentication, Authorization, Accounting), and why enterprises use RADIUS for WiFi/VPN and TACACS+ for device management.

🎯

IP Anycast: Routing to the Nearest Instance

How anycast assigns the same IP address to multiple servers worldwide, using BGP to route each user to the geographically nearest instance — the technology behind DNS root servers and CDNs.

ICMPv6 & Neighbor Discovery Protocol

How NDP replaces ARP in IPv6 — Neighbor Solicitation/Advertisement for address resolution, Router Solicitation/Advertisement for default gateway discovery, and Duplicate Address Detection.

📈

TCP Window Scaling & High-BDP Networks

How TCP's receive window limits throughput on high-latency, high-bandwidth links — the Bandwidth-Delay Product, window scaling option, and why a transatlantic fiber link needs 125MB buffers.

OAuth 2.0 PKCE Flow

How PKCE (Proof Key for Code Exchange) makes OAuth 2.0 safe for public clients like mobile apps and SPAs — preventing authorization code interception attacks without a client secret.

CDN Origin Shield & Cache Hierarchy

How CDN origin shields protect origin servers from cache miss thundering herds, multi-tier cache hierarchies reduce origin load, and cache fill strategies like request collapsing.

🔬

Network Forensics with Wireshark

How to use Wireshark capture filters, display filters, and protocol dissectors to investigate network incidents — reconstructing TCP streams, identifying anomalies, and following attack paths.

PTP: Precision Time Protocol

How PTP (IEEE 1588) achieves nanosecond-precision time synchronization across networks — enabling 5G, financial trading, and power grid synchronization where NTP's millisecond accuracy is insufficient.

AWS Direct Connect & Private Connectivity

How AWS Direct Connect establishes dedicated private connections from on-premises to AWS — bypassing the public internet for lower latency, consistent bandwidth, and data transfer cost savings.

Apache Kafka: Distributed Messaging

How Kafka brokers, topics, partitions, and consumer groups enable high-throughput event streaming — including producer acknowledgments, consumer lag, and exactly-once semantics.

DNS Anycast Resilience: Root Servers

How the 13 DNS root server addresses serve thousands of physical servers globally via BGP anycast — and why the internet doesn't break when a root server location goes offline.

QoS Deep Dive: DSCP Marking and Queuing

How DSCP markings classify traffic at the IP layer, how routers queue packets into priority lanes, and why VoIP needs strict priority queuing while video needs bandwidth guarantees.

Container Networking: Bridges, Overlays & CNI

How container networking works from the Linux primitives up — veth pairs, Linux bridges, and iptables masquerade — through to CNI plugins and multi-host overlay networks.

WireGuard: Modern VPN Protocol

How WireGuard establishes encrypted tunnels with a minimal codebase — Curve25519 key exchange, ChaCha20 encryption, no handshake state machine, and why it outperforms OpenVPN and IPsec.

🏠

WebSocket Rooms: Socket.IO Internals

How Socket.IO implements rooms, namespaces, and event routing on top of WebSockets — including the adapter pattern for horizontal scaling and the fallback to long-polling.

🔁

TCP Retransmission: RTO, Fast Retransmit & RACK

How TCP detects and recovers from packet loss — the retransmission timer (RTO), fast retransmit via duplicate ACKs, selective ACKs, and the modern RACK loss detection algorithm.

Service Discovery: Consul, etcd & DNS

How microservices find each other dynamically — Consul health checks and KV store, client-side load balancing, and how service mesh sidecars replace DNS-based discovery with connection-level intelligence.

IPv6 Extension Headers

How IPv6 replaces IPv4's fixed option fields with a flexible chain of extension headers — Hop-by-Hop, Routing, Fragment, and Destination options — and why most are filtered at network boundaries.

🤖

Network Automation: NETCONF, YANG & Ansible

How modern network automation replaces CLI scripting with structured data — NETCONF operations over SSH, YANG data models, and Ansible's network modules for idempotent configuration management.

XSS, CSRF & Browser Security Model

How browsers enforce the Same-Origin Policy, how XSS bypasses it, how CSRF exploits cross-site state changes, and how modern defenses (CSP, SameSite, CORS) work together.

🏗️

Data Center Network Topologies

How modern data center networks evolved from three-tier (core/distribution/access) to spine-leaf and fat-tree — the bandwidth, fault tolerance, and east-west traffic tradeoffs of each design.

NAT Traversal: STUN, TURN & ICE

How WebRTC and VoIP establish peer-to-peer connections through NATs — STUN server reflexive address discovery, TURN relay fallback, and ICE candidate gathering and connectivity checks.

📌

TLS Certificate Pinning

How mobile apps and security-critical clients use certificate pinning to prevent MITM attacks even when a CA is compromised — including HPKP, TOFU, and how corporate proxies break pinning.

DHCP Snooping & Dynamic ARP Inspection

How DHCP snooping prevents rogue DHCP servers from hijacking client IP assignments, and how Dynamic ARP Inspection (DAI) uses the snooping table to block ARP spoofing attacks.

Routing Algorithms: Link State vs Distance Vector

How link-state (OSPF) and distance-vector (RIP) algorithms discover topology and compute paths — Dijkstra's SPF, the Bellman-Ford equation, count-to-infinity, and why IS-IS and OSPF dominate modern networks.

AWS Transit Gateway: Hub-and-Spoke VPC Connectivity

How AWS Transit Gateway connects multiple VPCs and on-premises networks through a central hub — replacing N×(N-1)/2 VPC peering connections with a single attachment point per network.

📈

TCP Congestion Control: CUBIC vs BBR

How CUBIC dominates today's internet with a cubic growth function, and how BBR's model-based approach measures bottleneck bandwidth and RTT to fill the pipe without queue buildup.

📧

Email Authentication: SPF, DKIM & DMARC Together

How SPF, DKIM, and DMARC work as a layered system to prove email legitimacy — what each verifies, what each misses, and how DMARC's alignment policy ties them together to stop phishing.

🔭

Passive Reconnaissance: OSINT Network Mapping

How attackers and penetration testers gather network intelligence without sending a single packet — DNS enumeration, BGP route data, certificate transparency, WHOIS, and Shodan searches.

📹

WebRTC Internals: P2P Media Negotiation

How WebRTC establishes peer-to-peer audio/video — SDP offer/answer, ICE candidate gathering, DTLS-SRTP for encryption, and what happens when a direct connection isn't possible.

🏢

LDAP & Active Directory: Enterprise Identity

How Active Directory uses LDAP for directory queries, Kerberos for authentication, and LDAPS/SASL for security — the flow from user login to domain controller lookup to group membership resolution.

DNS Rebinding Attack

How attackers bypass the Same-Origin Policy by manipulating DNS TTLs — the browser thinks it's talking to the attacker's site but is actually sending requests to internal network services.

NAT Deep Dive: Tables, Timeouts, and Hairpinning

The mechanics inside a NAT gateway — connection tracking tables, timeout tuning, hairpin NAT for internal servers, NAT64 for IPv4/IPv6 translation, and why UDP NAT breaks without keepalives.

CDN Caching Deep Dive: Edge, Vary, and Purge

How CDN shared caches differ from browser caches — Cache-Control s-maxage, Vary headers causing cache fragmentation, surrogate keys for targeted purge, stale-while-revalidate for zero-latency deploys.

OAuth 2.0 Device Authorization & Token Exchange

OAuth 2.0 flows beyond authorization code — device flow for CLIs and smart TVs, client credentials for machine-to-machine auth, token introspection for opaque tokens, and JWT vs opaque token tradeoffs.

🎭

SSRF: Server-Side Request Forgery

How SSRF attacks exploit server-side HTTP fetching — forcing servers to make requests to internal services, cloud metadata endpoints, and internal APIs that are normally unreachable from the internet.

WiFi Mesh & Fast Roaming: 802.11r/k/v

How mesh networking handles multi-AP coverage — 802.11r fast BSS transition (sub-50ms handoff), 802.11k neighbor reports, 802.11v BSS transition management, and the difference between mesh backhaul and traditional WLAN.

Distributed Tracing: Spans, Traces & OpenTelemetry

How distributed tracing tracks requests across microservices — trace IDs propagated in HTTP headers, parent/child span relationships, sampling strategies, and how Jaeger/Zipkin/Tempo reconstruct the full request timeline.

Anycast Routing: How Cloudflare Routes to Nearest Server

How anycast assigns the same IP to hundreds of servers worldwide — BGP announces the same prefix from every PoP, routing naturally delivers users to the nearest location, and how this enables global DDoS absorption.

HTTP/3 Migration: Connection Establishment & Fallback

How browsers discover and upgrade to HTTP/3 — Alt-Svc headers, HTTPS DNS records, 0-RTT resumption, the QUIC handshake combining TLS 1.3, and the HTTP/2 fallback when UDP is blocked.

FIDO2 & Passkeys: Passwordless Authentication

How FIDO2/WebAuthn works — credential creation with a hardware key or biometric, the challenge-response authentication flow, resident credentials (passkeys) stored on the authenticator, and why FIDO2 is phishing-proof.

AWS VPC Networking: Subnets, Routing & Security

How AWS VPC creates isolated virtual networks — public vs private subnets, Internet Gateway, NAT Gateway, route tables, Security Groups vs NACLs, and the flow of traffic from EC2 to the internet and back.

🏥

Load Balancer Health Checks & Failover

How load balancers detect unhealthy backends and reroute traffic — passive vs active health checks, connection draining during deploys, circuit breakers, and the thundering herd problem when a backend recovers.

Network Convergence: How Routes Propagate After Failure

What happens in the seconds after a network link fails — IGP convergence with OSPF LSA flooding, BGP withdrawal propagation, the role of timers, and why convergence time determines how long users see an outage.

🐇

AMQP & RabbitMQ: Message Brokers

How AMQP exchanges, queues, and routing keys enable flexible message routing patterns — direct, topic, fanout — and how RabbitMQ delivers guaranteed messaging with acknowledgments and dead letter queues.

AWS PrivateLink: Private Service Access

How AWS PrivateLink lets you access AWS services and partner SaaS without traffic leaving the AWS network — using VPC Interface Endpoints backed by Network Load Balancers and PrivateLink service endpoints.

🚦

Rate Limiting: Token Bucket, Sliding Window & Leaky Bucket

How rate limiting algorithms work — token bucket allows bursting, fixed window has edge-case spikes, sliding window is accurate, and leaky bucket enforces constant rate. Plus distributed rate limiting with Redis.

SMTP Security: STARTTLS, MTA-STS & DANE

How email transmission is secured — STARTTLS opportunistic encryption, the downgrade attack problem, MTA-STS enforcing strict TLS, DANE for certificate validation via DNS, and how these combine to prevent email interception.

🌳

STP vs RSTP: Spanning Tree Loop Prevention

How Spanning Tree Protocol prevents broadcast storms by blocking redundant paths — root bridge election, port roles, the slow STP convergence problem, and how RSTP achieves sub-second convergence with proposal/agreement.

Serverless Networking: Cold Starts, VPC, and Timeouts

How Lambda and serverless functions handle networking — cold start latency from TCP connection establishment, VPC networking trade-offs, NAT Gateway costs for outbound traffic, and connection pooling strategies.

SSH Tunneling: Local, Remote & Dynamic Forwarding

How SSH port forwarding works — local forwarding to reach services behind firewalls, remote forwarding to expose local services, dynamic SOCKS5 proxy for arbitrary traffic, and jump hosts for multi-hop access.

Network Time Synchronization: Clock Skew & Distributed Systems

Why clock synchronization matters in distributed systems — NTP accuracy limits, clock skew causing authentication failures and log correlation problems, vector clocks for ordering events, and how TrueTime (Spanner) achieves external consistency.

🕷️

XSS & CSRF: Browser-Based Network Attacks

How XSS and CSRF exploit the browser's trust model — stored XSS exfiltrating cookies via network requests, CSRF exploiting implicit credential sending, SameSite cookies as defense, and the Same-Origin Policy that contains the damage.

Cloud NAT & Egress: Outbound Traffic Patterns

How outbound internet traffic flows from private cloud instances — NAT Gateway SNAT, Elastic IPs, egress bandwidth pricing, private API calls via VPC endpoints, and strategies to minimize expensive NAT Gateway data transfer costs.

Azure VNet: Subnets, NSGs, Peering & ExpressRoute

How Azure virtual networking works — VNet address spaces, NSG stateful rules at NIC/subnet, VNet peering (non-transitive), Azure Firewall for hub-spoke inspection, and ExpressRoute private connectivity vs VPN Gateway tradeoffs.

🌏

GCP VPC: Global Network, Shared VPC & Cloud Interconnect

How Google Cloud networking differs from AWS/Azure — GCP VPCs are global (subnets per region, not per VPC), Shared VPC for multi-project networking, VPC Service Controls for data exfiltration prevention, and Cloud Interconnect vs Partner Interconnect tradeoffs.

WiFi 7 (802.11be): MLO, 320 MHz & 4K-QAM

How WiFi 7 achieves up to 46 Gbps — Multi-Link Operation (MLO) aggregating 2.4+5+6 GHz simultaneously, 320 MHz channels doubling WiFi 6E bandwidth, 4096-QAM for denser encoding, multi-RU puncturing to work around interference, and the WiFi generation speed timeline from 802.11b to 802.11be.

Route Redistribution: Connecting Different Routing Protocols

How routers redistribute routes between OSPF, BGP, and static routes — administrative distance deciding which source wins, seed metrics when redistributing into RIP/OSPF, redistribution loops and how route maps prevent them, and the typical enterprise boundary where OSPF meets eBGP.

🎬

Video Streaming: HLS, DASH & Adaptive Bitrate

How Netflix, YouTube and Twitch deliver video — HLS and MPEG-DASH segmented streaming, adaptive bitrate (ABR) switching algorithms, CDN edge caching for segments, manifest files, low-latency live streaming with chunked transfer, and why buffering happens.

Kubernetes NetworkPolicy: Pod-Level Firewall

How Kubernetes NetworkPolicy objects define ingress and egress rules between pods, how CNI plugins (Cilium, Calico) enforce them at the kernel level, the default-deny posture, namespace isolation, and why NetworkPolicy alone isn't enough for zero-trust clusters.

Cellular Handoff: LTE/5G Handover Mechanics

How a phone seamlessly transfers between cell towers during movement — LTE X2/S1 handover procedures, measurement reports and A3 events, 5G NR Xn handover, make-before-break vs break-before-make, and why handoffs cause brief throughput drops even when they feel seamless.

LACP & Link Bonding: Aggregated Link Internals

How LACP (802.3ad) negotiates link aggregation between switches, LAG hashing algorithms that determine which link each flow uses, active vs passive LACP modes, LACP PDU exchange and port priority, bonding modes in Linux, and why LAG doesn't double throughput for a single TCP flow.

Edge Computing: Workers & Lambda@Edge

How Cloudflare Workers, Lambda@Edge, and Fastly Compute run code at CDN edge nodes, why they eliminate origin round-trips for personalization and auth, the V8 isolate model vs container cold starts, limitations (no filesystem, short CPU time), and the difference from traditional CDN caching.

OpenTelemetry Tracing

How distributed traces follow a request across microservices using trace IDs, span context propagation, and OTLP export to observability backends.

TLS Session Resumption: Tickets & PSK

How TLS avoids full handshake overhead on reconnects — TLS 1.2 session IDs vs session tickets, TLS 1.3 pre-shared keys (0-RTT), the forward secrecy tradeoff with session tickets, and replay attack risks with 0-RTT data.

📜

HTTPS Certificate Lifecycle: Issue, Renew & Revoke

The full lifecycle of an HTTPS certificate — ACME protocol for automated issuance (Let's Encrypt), DV vs OV vs EV validation levels, OCSP stapling for revocation without privacy leaks, and what happens when a certificate expires or is revoked.

🔓

API Security: OWASP API Top 10

The most critical API security vulnerabilities — broken object-level authorization (BOLA/IDOR), mass assignment, lack of resource limiting, security misconfiguration, and how API gateways and proper design prevent them.

CDN Edge Computing: Workers, Functions & Personalization

How CDN edge computing moves logic to the network edge — Cloudflare Workers / Fastly Compute@Edge executing JavaScript/Wasm at PoPs, A/B testing without origin round trips, edge authentication, and the latency vs consistency tradeoff of edge state.

💬

Socket.IO: Rooms, Namespaces & Scaling

How Socket.IO abstracts real-time communication — WebSocket with HTTP long-polling fallback, rooms for group messaging, namespaces for app separation, sticky sessions behind a load balancer, and Redis pub/sub adapter for multi-server broadcasting.

WireGuard: Modern VPN with Minimal Attack Surface

How WireGuard redesigns VPN — cryptokey routing replacing IP/user auth, Noise protocol for handshake, UDP-based tunneling that handles roaming, silence on unauthenticated packets, and WireGuard vs OpenVPN vs IPsec tradeoffs.

Network Access Control: 802.1X & NAC Policies

How enterprise networks authenticate endpoints before granting access — 802.1X EAP authentication via RADIUS, posture assessment (is the device compliant?), VLAN assignment based on identity and posture, quarantine VLANs for non-compliant devices, and MAC Authentication Bypass (MAB) for non-802.1X devices.

Complex — Advanced concepts

TCP BBR Congestion Control

How Google's BBR algorithm achieves higher throughput by measuring actual bottleneck bandwidth instead of reacting to packet loss.

Mutual TLS (mTLS)

How mTLS extends TLS to authenticate both client and server with certificates — used in zero-trust networks, service meshes, and API security.

eBPF Networking

How eBPF programs run in the Linux kernel to implement packet filtering, load balancing, and network observability at wire speed — replacing iptables.

BGP Anycast for Global Services

How Cloudflare, DNS root servers, and CDNs use BGP anycast to advertise the same IP from 200+ locations — routing users to the nearest node automatically.

🔓

WebSocket Security

WebSocket-specific vulnerabilities: cross-site WebSocket hijacking, authentication gaps, and how to secure WebSocket endpoints.

VPN Tunnel

How a VPN encrypts your traffic and hides your real IP address from websites and ISPs.

HTTPS & TLS Handshake

How HTTPS encrypts your connection: certificates, key exchange, and why the padlock appears.

Firewall Rules

How firewalls inspect traffic and block or allow connections based on rules.

Load Balancer

How load balancers distribute traffic across multiple servers to handle massive scale.

🏛️

TLS Certificate Chains

How the chain of trust works: Root CA → Intermediate CA → Leaf certificate, and why browsers trust it.

QUIC & HTTP/3

Why QUIC was built on UDP, how it combines transport + TLS in one handshake, and 0-RTT reconnection.

BGP & Internet Routing

How BGP connects autonomous systems, routes packets across the internet, and what happens when it goes wrong.

💥

DDoS Attacks & Defense

How Distributed Denial of Service attacks work: SYN floods, amplification attacks, botnets, and how scrubbing centers defend against them.

Zero Trust Networking

How Zero Trust replaces the perimeter model: identity-aware proxy, mTLS, policy engine, and why 'never trust, always verify' prevents lateral movement.

OAuth 2.0 Authorization

How OAuth 2.0 lets users grant third-party apps access to their data without sharing passwords.

🕵️

Man-in-the-Middle Attack

How an attacker intercepts and reads traffic between two parties using ARP spoofing, and how TLS prevents it.

🗂️

OSPF — Link State Routing

How OSPF routers discover neighbors, flood link state advertisements, and compute shortest paths with Dijkstra's algorithm.

🪤

SSL Stripping Attack

How attackers downgrade HTTPS connections to plaintext HTTP, and how HSTS and preloading prevent it.

☸️

Kubernetes Service Discovery

How Kubernetes Services give stable virtual IPs to ephemeral pods using kube-proxy iptables rules and CoreDNS.

🕸️

Service Mesh & mTLS

How a service mesh (like Istio) injects sidecar proxies to add mutual TLS, observability, and traffic control between microservices.

🧅

VXLAN — Overlay Networking

How VXLAN encapsulates Layer 2 frames inside UDP to stretch virtual networks across physical boundaries in data centers.

🐕

Kerberos Authentication

How Kerberos uses a trusted third-party KDC to authenticate users to services using tickets, without sending passwords over the network.

🕳️

DNS Tunneling

How attackers exfiltrate data and establish covert C2 channels by encoding payloads in DNS queries that firewalls rarely block.

🔏

DNSSEC — Signed DNS

How DNSSEC uses cryptographic signatures to prevent cache poisoning and authenticate DNS responses from root to leaf.

SAML 2.0 — Single Sign-On

How SAML federates identity across organizations: SP-initiated login, IdP assertions, and how SSO eliminates per-app passwords.

🏷️

MPLS — Label Switching

How MPLS forwards packets at wire speed using labels instead of IP lookups, enabling traffic engineering and VPNs across carrier networks.

🧠

SDN & OpenFlow

How Software-Defined Networking separates the control plane from the data plane, letting a centralized controller program forwarding rules across the entire network.

☠️

BGP Hijacking Attack

How rogue ASes announce more-specific prefixes to intercept or black-hole internet traffic, and real-world incidents like the 2008 Pakistan Telecom attack.

☸️

Kubernetes Ingress & Service

How Kubernetes routes external HTTP traffic through Ingress controllers to Services and Pods, including path-based routing and TLS termination.

ZTNA — Zero Trust Network Access

How ZTNA replaces VPN: verify every device and identity on every request with posture checks, MFA, and per-app micro-segmentation.

WiFi Deauth Attack

How attackers send forged 802.11 deauthentication frames to disconnect clients, capture WPA handshakes, and how Management Frame Protection (PMF) stops it.

👿

Evil Twin AP Attack

How attackers create a rogue access point with the same SSID to intercept traffic, and why HTTPS and VPNs protect against it.

🏷️

BGP Communities

How BGP community attributes tag routes to signal routing policy across ASes — controlling traffic engineering, blackholing, and regional routing preferences.

🌊

TCP SYN Flood & SYN Cookies

How a SYN flood attack exhausts server connection tables, and how SYN cookies allow servers to handle millions of SYNs without allocating memory.

💉

SQL Injection via HTTP

How SQL injection attacks travel over HTTP from attacker to web server to database, what a WAF sees in the request, and how prepared statements stop it.

🗼

IS-IS Routing Protocol

How IS-IS (Intermediate System to Intermediate System) works as a link-state IGP — why ISPs prefer it over OSPF for large-scale networks, its level hierarchy, and TLV extensibility.

SD-WAN: Software-Defined WAN

How SD-WAN intelligently routes enterprise traffic across multiple WAN links — MPLS, broadband, LTE — using centralized policy, real-time path quality monitoring, and application-aware routing.

MACsec: Layer 2 Encryption

How MACsec (IEEE 802.1AE) encrypts Ethernet frames at the MAC layer — providing hop-by-hop authentication and encryption between switches, routers, and servers on the same LAN segment.

📻

IP Multicast Routing: PIM Sparse Mode

How PIM Sparse Mode builds multicast distribution trees — the rendezvous point, shared trees vs source trees, and how video streaming and financial feeds use multicast at scale.

🔏

RPKI: Route Origin Validation

How RPKI (Resource Public Key Infrastructure) prevents BGP hijacking by cryptographically binding IP prefixes to their legitimate ASNs — defeating accidental misconfigurations and malicious route hijacks.

🛤️

Segment Routing (SR-MPLS / SRv6)

How Segment Routing encodes the entire forwarding path in the packet header — eliminating per-flow state from network core routers and enabling traffic engineering without RSVP-TE signaling.

Zero-Copy Networking: sendfile & io_uring

How zero-copy techniques (sendfile, splice, io_uring, DPDK) eliminate CPU-to-memory copies in data transfer — enabling 10-100 Gbps network throughput from a single server.

TLS 1.3: The Modern Handshake

How TLS 1.3 reduces connection latency to 1-RTT (vs 2-RTT in TLS 1.2) — eliminating cipher negotiation, mandating forward secrecy, and enabling 0-RTT resumption for returning clients.

🗄️

Ceph Distributed Storage Networking

How Ceph separates client-facing and cluster-internal traffic across two networks — the public network for client I/O and the cluster network for OSD replication, recovery, and heartbeats.

🖥️

Network Virtualization: NSX & Open vSwitch

How software-defined networking virtualizes the network inside hypervisors — Open vSwitch flow tables, NSX distributed logical switches, and microsegmentation enforced at the hypervisor, not the physical switch.

♻️

BGP Graceful Restart & High Availability

How BGP Graceful Restart preserves forwarding during control-plane failures — NSF, GR helper mode, BFD for sub-second detection, and route convergence timers that prevent traffic black holes.

📮

TCP SACK, DSACK & RACK: Modern Loss Recovery

How TCP's modern loss recovery mechanisms work together — Selective ACK (SACK) avoids retransmitting received data, DSACK detects spurious retransmissions, and RACK uses packet timing to detect loss faster than dupACK counting.

☸️

Kubernetes Networking: Pods, Services & Network Policies

How Kubernetes networking actually works — pod-to-pod across nodes via CNI overlay, kube-proxy iptables/IPVS for Service VIPs, CoreDNS service discovery, and Network Policies as cluster-level firewall rules.

🚨

Network IDS/IPS: Snort, Suricata & Detection

How network intrusion detection systems identify attacks — signature-based vs anomaly detection, Snort/Suricata rule syntax, inline IPS blocking vs passive IDS, and evading detection with fragmentation.

BGP Policy: Route Maps, Filters & Traffic Engineering

How ISPs and enterprises control BGP routing with route maps, prefix lists, MED, local preference, and AS path prepending — the tools that determine which path internet traffic actually takes.

Zero Trust Architecture: Never Trust, Always Verify

How Zero Trust replaces VPN perimeter security — identity-based access (not network location), continuous verification for every request, micro-segmentation preventing lateral movement, and device posture checks before granting access.

eBGP vs iBGP: Inter-AS and Intra-AS Routing

How BGP operates within and between autonomous systems — eBGP between different ASes, iBGP full-mesh requirement inside an AS, route reflectors to scale iBGP, next-hop handling differences, and why TTL=1 for eBGP sessions.

⚙️

TCP Offloading: TSO, GRO, RSS & Kernel Bypass

How modern NICs and kernels handle high-speed networking — TCP Segmentation Offload moving packet splitting to hardware, Generic Receive Offload reassembling before the kernel, Receive Side Scaling for multi-core, and DPDK/XDP kernel bypass for ultra-low latency.

Service Mesh mTLS: Automatic Mutual TLS Between Services

How service meshes like Istio and Linkerd implement automatic mTLS — sidecar proxies intercepting all traffic, SPIFFE/SVID workload identity certificates, mTLS authentication without application changes, and the performance overhead of the data plane.

Multi-Cloud Networking: Connecting AWS, Azure & GCP

How organizations connect multiple cloud providers — Megaport or Equinix Fabric for cloud-neutral exchange, SD-WAN overlay between clouds, BGP with each provider, latency and cost considerations, and patterns for workload portability.

GraphQL Federation: Composing Multiple Subgraphs

How Apollo Federation combines multiple GraphQL APIs — the Gateway routing queries to subgraphs, entity references across service boundaries, the @key directive for cross-service joins, query planning, and the network performance implications of N+1 and dataloader batching.

☠️

DNS Attack Patterns: Cache Poisoning & Amplification

How DNS is exploited — Kaminsky cache poisoning via predictable transaction IDs, DNS amplification for DDoS using ANY queries, DNS over HTTPS/TLS to prevent snooping, and DNSSEC validation to prevent poisoning.

OSPF Areas & LSA Types: Scaling Link-State Routing

How OSPF uses areas to limit flooding scope — area 0 backbone, stub/NSSA/totally stubby area types, ABR and ASBR roles, LSA types 1–7, and why area design prevents the O(n²) LSDB problem in large networks.

5G NR: gNB, UPF and the Service-Based Core

How 5G New Radio separates user plane from control plane — gNB radio access, AMF/SMF/UPF core functions, N2/N3 interfaces, user plane function anchoring for low latency, network slicing with S-NSSAI, and how 5G SA differs from NSA (4G anchor).

🕸️

EVPN/VXLAN: BGP Control Plane for Overlay Networks

How EVPN (Ethernet VPN, RFC 7432) uses BGP to distribute MAC/IP bindings across a VXLAN fabric — Type-2 MAC/IP advertisement routes, Type-5 IP prefix routes, symmetric IRB for inter-VLAN routing, ARP suppression, and how EVPN replaces flood-and-learn in datacenter overlays.

NVMe-oF: NVMe Storage Over the Network

How NVMe-over-Fabrics extends the NVMe protocol across networks — NVMe/TCP vs NVMe/RDMA (RoCEv2) tradeoffs, queue pair model, namespace sharing, discovery service, and why NVMe-oF achieves near-local NVMe latency at network scale versus iSCSI.

SR-IOV & DPDK: Kernel-Bypass Networking

How SR-IOV virtualizes a single NIC into dozens of VFs for VMs, how DPDK bypasses the kernel entirely using poll-mode drivers, why both are essential in 5G, NFV, and high-frequency trading environments, and the tradeoffs versus standard virtio networking.

🌲