Glossary

Access port

A switch port belonging to exactly one VLAN, sending untagged frames to the device attached. 04

Air-gap

Physical separation with no network path at all. The strongest segmentation and the most expensive to operate. 09

Airtime

The finite resource on a wireless channel: one radio transmits to one client at a time, so clients divide time rather than bandwidth. 08

Anycast

One address announced from many locations, so each client reaches the nearest. Used by DNS, CDNs and DDoS mitigation. 05

ARP

Address Resolution Protocol: broadcasts "who has this IP" and caches the MAC that answers. IPv6 does the same job with Neighbor Discovery. 04

AS path

The list of autonomous systems a BGP route has traversed; the mechanism that prevents routing loops between networks. 05

Autonomous system (AS)

A network under one administrative policy with its own number, exchanging routes with neighbours via BGP. 05

BGP

The protocol that exchanges routes between autonomous systems. Policy-driven, TCP port 179, and trusting by default. 05

Block size

256 minus the mask octet; the distance between network boundaries in subnetting arithmetic. 03

Broadcast domain

The set of devices reached by a broadcast frame — normally one VLAN. 04

CIDR

Classless inter-domain routing: prefix notation such as /27 that replaced fixed address classes. 03

Certificate

A signed statement binding a public key to a name for a validity period. Proves identity, not honesty. 07

ClientHello

The first TLS message: supported versions, cipher suites, key share and the server name (SNI), all in cleartext. 07

Conntrack

The kernel's connection tracking table on Linux; NAT and stateful firewalls both depend on it and both fail when it fills. 09

Convergence

The time for every router to agree on the topology after a change. The number that decides how long an outage lasts. 05

DHCP

Automatic address assignment in four messages (discover, offer, request, acknowledge), with a lease time. 06

Decapsulation

Removing headers as data moves up the stack at the receiver. 02

Default route

0.0.0.0/0: the entry that matches everything and loses to every more specific prefix. 05

DNS

A hierarchical, cached name-to-address system. Most "the internet is down" reports are a DNS failure. 06

DORA

The four DHCP messages: Discover, Offer, Request, Acknowledge. 06

East-west traffic

Traffic between services inside a network, as opposed to north-south traffic entering or leaving it. The traffic segmentation is really about. 09

Encapsulation

Wrapping a packet in another header so it can cross a network that does not understand it. 02

Ephemeral port

The temporary source port the operating system picks for an outbound connection; exhaustion is a real failure mode under high connection churn. 06

Frame

The layer-2 unit: MAC addresses, type, payload and checksum. Discarded on error, never retransmitted by Ethernet. 02

Gateway

The router address a host uses for destinations outside its own prefix. It must be inside the host's subnet. 03

Hairpin NAT

Translating an internal client's request to a public address back inside the network. Often unsupported by default, which is why internal users cannot reach a service by its public name. 09

Hop

One router-to-router step. TTL counts hops down; traceroute reveals them one at a time. 05

HTTP/2

Multiplexed requests over one TCP connection, with header compression. One lost packet still stalls every stream. 07

HTTP/3

HTTP over QUIC (UDP 443): per-stream recovery, faster handshakes and connections that survive an address change. 07

IGP / EGP

Interior protocols (OSPF, IS-IS) route inside one organization; exterior protocols (BGP) route between them. 05

Interface

The thing an IP address is actually assigned to. One machine can have many, which is why "its address" is ambiguous. 03

Link-local

169.254.0.0/16 in IPv4: self-assigned when DHCP fails, and therefore a diagnosis rather than a configuration. 06

Longest prefix match

The rule that decides routing: the most specific matching prefix wins, before metrics or administrative distance. 05

MAC address

A hardware identifier used only within a link. Rewritten at every hop; the IP address is not. 02

MSS

Maximum segment size: what TCP may put in one segment, normally MTU minus 40 bytes. 02

MTU

Maximum transmission unit: the largest payload a link will carry, 1,500 bytes on standard Ethernet. 02

MTU black hole

A path where large packets are dropped and the ICMP notice that would fix it is filtered. Small pings pass; transfers hang. 02

NAT

Rewriting addresses in transit, usually many private hosts to one public address. Translation, not protection. 09

Next hop

The adjacent device a router hands a packet to. Routers know neighbours, not destinations. 05

OSPF

Link-state interior routing: every router builds the same map and computes shortest paths. IP protocol 89. 05

Overlay

A logical network built on top of an underlay, e.g. VXLAN across an IP fabric. 02

Packet

The layer-3 unit: IP addresses plus payload, routed independently and best-effort. 02

PAT

Port address translation: many hosts share one public address, distinguished by rewritten source port. 09

Port

A 16-bit number naming a service (destination) or a conversation (source). 06

Prefix hijack

Announcing an address range you do not own; other networks may believe it and send traffic to the wrong place. 05

Private address

RFC 1918 space (10/8, 172.16/12, 192.168/16) that is never routed on the internet, which is exactly why it overlaps. 03

QUIC

A transport built on UDP with per-stream reliability and integrated TLS 1.3, used by HTTP/3. 07

Retransmission

Resending unacknowledged data. On wireless, every retry consumes airtime twice. 07

Roaming

A wireless client moving between access points. The client decides when, which is why 802.11k/v/r exist. 08

Route leak

Re-announcing routes you learned from a provider, pulling traffic through a network that cannot carry it. 05

Routing table

The set of destination prefixes, next hops and interfaces a device will use. 05

RTT

Round-trip time. The metric that governs interactive performance, and the one bandwidth cannot fix. 07

Segmentation

Dividing a network so a compromise has a bounded blast radius. VLANs alone are not segmentation; policy is. 09

SNI

Server Name Indication: the hostname sent in cleartext during the TLS handshake, letting one address serve many sites. 07

Spanning tree (STP)

The protocol that blocks redundant switch paths to prevent loops. Without it, a loop is a broadcast storm, not a slow link. 04

Stateful firewall

A device that remembers flows and permits replies automatically. Breaks under asymmetric routing. 09

Stateless ACL

A rule set evaluated per packet with no memory, so the return direction needs its own rule. 09

Subnet

The set of addresses sharing a prefix. Whether a destination is inside it decides local delivery versus the gateway. 03

TCP

Connection-oriented transport: sequence numbers, acknowledgements, retransmission, flow and congestion control. 07

Three-way handshake

SYN, SYN-ACK, ACK: the three packets that open a TCP connection and cost one round trip. 07

TLS

Encryption, integrity and server authentication for a connection. 1.3 needs one round trip; resumption can be zero. 07

Trunk

A link carrying several VLANs, each frame tagged with a 4-byte 802.1Q header. 04

TTL

Time to live: a hop counter that stops packets circulating forever, and the mechanism behind traceroute. 05

UDP

Connectionless transport with an 8-byte header: no handshake, no ordering, no retransmission. Used by DNS, DHCP, QUIC. 07

Underlay

The physical or provider network that carries overlay traffic between tunnel endpoints. 02

VLAN

A broadcast domain inside a switch. Isolation only exists if routing between VLANs is also controlled. 04

VXLAN

A layer-2-over-UDP tunnel with a 24-bit segment ID; the standard data-center overlay. 02

Zero trust

Authorizing every request on identity and context rather than network location. 09

No term matches that search.