# Network Terminology

Terms defined the way they are used in practice, ordered so that each one only depends on terms above it. This is the vocabulary spine for teaching: if a learner can say these in their own words, the rest of the discipline is detail.

## Addresses and identity

| Term | Definition | The distinction that matters |
|---|---|---|
| **Host** | Any device with an IP address | A host is not necessarily a computer |
| **IP address** | A logical identifier for an interface | Identifies an interface, not a machine; one machine can have many |
| **MAC address** | A hardware identifier used within a link | Changes at every hop; IP does not |
| **Subnet** | A block of addresses sharing a prefix | The boundary is arithmetic, not physical |
| **Prefix / CIDR** | The number of leading network bits (`/24`) | Determines the mask, block size and host count |
| **Gateway** | The next hop for destinations outside the subnet | Must be inside the host's subnet, or nothing works |
| **Loopback** | An address that refers to the host itself (`127.0.0.1`, `::1`) | Always up, even with no network |
| **Private address** | RFC 1918 space, not routable on the internet | Reusable everywhere, which is exactly why it overlaps |
| **Public address** | Globally routable address | Scarce; usually shared via NAT |
| **Anycast** | The same address announced from many places | Traffic goes to the nearest; used by DNS and DDoS mitigation |

## Layers and units

| Term | Definition | Note |
|---|---|---|
| **PDU** | Protocol data unit — the name of the data at a layer | Data → segment → packet → frame → bits |
| **Frame** | Layer 2 unit, with MAC addresses | Discarded on CRC error, never retransmitted by Ethernet |
| **Packet** | Layer 3 unit, with IP addresses | Routed independently |
| **Segment** | Layer 4 TCP unit | Ordered and acknowledged |
| **Datagram** | Layer 4 UDP unit, or an IP packet | Unreliable by design |
| **MTU** | Maximum transmission unit, default 1,500 on Ethernet | The number behind most "works then hangs" bugs |
| **MSS** | Maximum segment size, usually MTU − 40 | What TCP actually negotiates |
| **Encapsulation** | Wrapping a packet in another header | Every tunnel is encapsulation |

## Transport

| Term | Definition | Note |
|---|---|---|
| **Port** | 16-bit identifier for a service or conversation | Destination port names the service |
| **Ephemeral port** | Temporary source port chosen by the OS | Exhaustion is a real failure mode |
| **Handshake** | The three packets that open a TCP connection | SYN, SYN-ACK, ACK |
| **RTT** | Round-trip time | The metric that governs interactive performance |
| **Window** | How much data may be in flight before acknowledgement | Flow control, not congestion control |
| **Congestion control** | How TCP infers and reacts to loss | Slow start, AIMD, and modern variants |
| **Retransmission** | Resending unacknowledged data | The visible symptom of loss |
| **TIME_WAIT** | The waiting state after closing a connection | Holds a port; the usual cause of port exhaustion |

## Switching and local networks

| Term | Definition | Note |
|---|---|---|
| **Broadcast domain** | The set of devices reached by a broadcast | One VLAN, normally |
| **VLAN** | A logical LAN inside a physical switch | Isolation is a configuration claim |
| **Trunk** | A link carrying multiple VLANs, tagged | 802.1Q, 4-byte tag |
| **Access port** | A port in exactly one VLAN, untagged | Where end devices connect |
| **ARP** | Resolves an IP to a MAC on the local link | Broadcast request, unicast reply |
| **STP** | Prevents layer-2 loops by blocking ports | Ethernet has no TTL, so loops are fatal |
| **Root bridge** | The reference switch for the spanning tree | Elected by priority then MAC |
| **Flooding** | Sending unknown/broadcast frames out every port | Normal, and the mechanism a loop amplifies |

## Routing

| Term | Definition | Note |
|---|---|---|
| **Routing table** | The set of known destinations and next hops | Longest prefix match wins |
| **Next hop** | The adjacent device a packet is handed to | Never the final destination |
| **Default route** | `0.0.0.0/0`, the route of last resort | Two defaults without metrics do not fail over |
| **Metric** | Cost within one routing protocol | Not comparable across protocols |
| **Administrative distance** | Preference between protocols | Static (1) beats OSPF (110) |
| **Convergence** | Time for all routers to agree after a change | The number that matters in an outage |
| **IGP / EGP** | Interior vs exterior routing protocols | OSPF/IS-IS vs BGP |
| **Autonomous system** | A network under one routing policy, with an ASN | The unit of internet routing |
| **Policy** | Rules that override metrics | Powerful, invisible, usually undocumented |

## Services and security

| Term | Definition | Note |
|---|---|---|
| **DNS** | Name → address resolution | The most common cause of "the internet is down" |
| **DHCP** | Automatic address configuration (DORA) | Scope exhaustion looks like a broken network |
| **NAT / PAT** | Address translation, many-to-one | Breaks end-to-end addressing |
| **ACL** | Ordered permit/deny rules, implicit deny | Order is the whole policy |
| **Stateful firewall** | Remembers flows, allows replies | Asymmetric routing breaks it |
| **Security group / NACL** | Cloud instance policy / subnet policy | Stateful vs stateless — the classic mix-up |
| **TLS** | Encryption and authentication for a connection | Certificates, not just encryption |
| **mTLS** | Both ends present certificates | Workload identity, not user identity |
| **Zero trust** | Authorise every request on evidence, not location | Replaces "inside = safe" |
| **Segmentation** | Bounded blast radius by policy | VLANs without policy are not segmentation |

## Operations

| Term | Definition | Note |
|---|---|---|
| **Telemetry** | Measurements pushed from devices | Seconds, not five-minute polls |
| **Flow record** | Metadata about a conversation (NetFlow, IPFIX) | Answers who talked to whom |
| **SLA** | The availability and latency you promised | Design to it, measure it |
| **Blast radius** | What fails when one component fails | The real design metric |
| **Single point of failure** | Anything whose failure stops the service | If undocumented, assume present |
| **Drift** | Reality diverging from intended config | Automation's reason to exist |
| **Runbook** | The documented response to a known failure | Written before the incident |

## How to use this in teaching

1. Introduce at most **seven terms per module**, and never a term before the thing it names is visible.
2. Every term gets an **example in the same sentence** ("a /24 has 254 usable hosts").
3. Ask for the **distinction**, not the definition: "what is the difference between a metric and an administrative distance?"
4. Reuse the same running example (one office, one website) so new terms attach to a picture the learner already has.

## Related Notes

- [[Foundations/OSI-TCPIP-Models.md]] — where the layer terms live
- [[Pedagogy/Teaching-Sequence-And-Analogies.md]] — the order to introduce them
- [[Pedagogy/Where-It-Goes-Wrong.md]] — the confusions these terms prevent