Network Terminology
Terms defined the way they are used in practice, ordered so that each one only depends on terms above it. This is the vocabulary spine for teaching: if a learner can say these in their own words, the rest of the discipline is detail.
Addresses and identity
| Term | Definition | The distinction that matters |
|---|---|---|
| Host | Any device with an IP address | A host is not necessarily a computer |
| IP address | A logical identifier for an interface | Identifies an interface, not a machine; one machine can have many |
| MAC address | A hardware identifier used within a link | Changes at every hop; IP does not |
| Subnet | A block of addresses sharing a prefix | The boundary is arithmetic, not physical |
| Prefix / CIDR | The number of leading network bits (/24) |
Determines the mask, block size and host count |
| Gateway | The next hop for destinations outside the subnet | Must be inside the host's subnet, or nothing works |
| Loopback | An address that refers to the host itself (127.0.0.1, ::1) |
Always up, even with no network |
| Private address | RFC 1918 space, not routable on the internet | Reusable everywhere, which is exactly why it overlaps |
| Public address | Globally routable address | Scarce; usually shared via NAT |
| Anycast | The same address announced from many places | Traffic goes to the nearest; used by DNS and DDoS mitigation |
Layers and units
| Term | Definition | Note |
|---|---|---|
| PDU | Protocol data unit — the name of the data at a layer | Data → segment → packet → frame → bits |
| Frame | Layer 2 unit, with MAC addresses | Discarded on CRC error, never retransmitted by Ethernet |
| Packet | Layer 3 unit, with IP addresses | Routed independently |
| Segment | Layer 4 TCP unit | Ordered and acknowledged |
| Datagram | Layer 4 UDP unit, or an IP packet | Unreliable by design |
| MTU | Maximum transmission unit, default 1,500 on Ethernet | The number behind most "works then hangs" bugs |
| MSS | Maximum segment size, usually MTU − 40 | What TCP actually negotiates |
| Encapsulation | Wrapping a packet in another header | Every tunnel is encapsulation |
Transport
| Term | Definition | Note |
|---|---|---|
| Port | 16-bit identifier for a service or conversation | Destination port names the service |
| Ephemeral port | Temporary source port chosen by the OS | Exhaustion is a real failure mode |
| Handshake | The three packets that open a TCP connection | SYN, SYN-ACK, ACK |
| RTT | Round-trip time | The metric that governs interactive performance |
| Window | How much data may be in flight before acknowledgement | Flow control, not congestion control |
| Congestion control | How TCP infers and reacts to loss | Slow start, AIMD, and modern variants |
| Retransmission | Resending unacknowledged data | The visible symptom of loss |
| TIME_WAIT | The waiting state after closing a connection | Holds a port; the usual cause of port exhaustion |
Switching and local networks
| Term | Definition | Note |
|---|---|---|
| Broadcast domain | The set of devices reached by a broadcast | One VLAN, normally |
| VLAN | A logical LAN inside a physical switch | Isolation is a configuration claim |
| Trunk | A link carrying multiple VLANs, tagged | 802.1Q, 4-byte tag |
| Access port | A port in exactly one VLAN, untagged | Where end devices connect |
| ARP | Resolves an IP to a MAC on the local link | Broadcast request, unicast reply |
| STP | Prevents layer-2 loops by blocking ports | Ethernet has no TTL, so loops are fatal |
| Root bridge | The reference switch for the spanning tree | Elected by priority then MAC |
| Flooding | Sending unknown/broadcast frames out every port | Normal, and the mechanism a loop amplifies |
Routing
| Term | Definition | Note |
|---|---|---|
| Routing table | The set of known destinations and next hops | Longest prefix match wins |
| Next hop | The adjacent device a packet is handed to | Never the final destination |
| Default route | 0.0.0.0/0, the route of last resort |
Two defaults without metrics do not fail over |
| Metric | Cost within one routing protocol | Not comparable across protocols |
| Administrative distance | Preference between protocols | Static (1) beats OSPF (110) |
| Convergence | Time for all routers to agree after a change | The number that matters in an outage |
| IGP / EGP | Interior vs exterior routing protocols | OSPF/IS-IS vs BGP |
| Autonomous system | A network under one routing policy, with an ASN | The unit of internet routing |
| Policy | Rules that override metrics | Powerful, invisible, usually undocumented |
Services and security
| Term | Definition | Note |
|---|---|---|
| DNS | Name → address resolution | The most common cause of "the internet is down" |
| DHCP | Automatic address configuration (DORA) | Scope exhaustion looks like a broken network |
| NAT / PAT | Address translation, many-to-one | Breaks end-to-end addressing |
| ACL | Ordered permit/deny rules, implicit deny | Order is the whole policy |
| Stateful firewall | Remembers flows, allows replies | Asymmetric routing breaks it |
| Security group / NACL | Cloud instance policy / subnet policy | Stateful vs stateless — the classic mix-up |
| TLS | Encryption and authentication for a connection | Certificates, not just encryption |
| mTLS | Both ends present certificates | Workload identity, not user identity |
| Zero trust | Authorise every request on evidence, not location | Replaces "inside = safe" |
| Segmentation | Bounded blast radius by policy | VLANs without policy are not segmentation |
Operations
| Term | Definition | Note |
|---|---|---|
| Telemetry | Measurements pushed from devices | Seconds, not five-minute polls |
| Flow record | Metadata about a conversation (NetFlow, IPFIX) | Answers who talked to whom |
| SLA | The availability and latency you promised | Design to it, measure it |
| Blast radius | What fails when one component fails | The real design metric |
| Single point of failure | Anything whose failure stops the service | If undocumented, assume present |
| Drift | Reality diverging from intended config | Automation's reason to exist |
| Runbook | The documented response to a known failure | Written before the incident |
How to use this in teaching
- Introduce at most seven terms per module, and never a term before the thing it names is visible.
- Every term gets an example in the same sentence ("a /24 has 254 usable hosts").
- Ask for the distinction, not the definition: "what is the difference between a metric and an administrative distance?"
- Reuse the same running example (one office, one website) so new terms attach to a picture the learner already has.
Related Notes
- OSI TCPIP Models — where the layer terms live
- Teaching Sequence And Analogies — the order to introduce them
- Where It Goes Wrong — the confusions these terms prevent