🌐 Networking Fundamentals

The OSI & TCP/IP Models

The OSI model is a 7-layer conceptual framework. The TCP/IP model is the 4-layer version networks actually run on. Knowing how they map helps you reason about where a problem lives.

Encapsulation

As data travels down the stack, each layer wraps it with its own header. This is encapsulation; the receiver reverses it (decapsulation).

Application data
  → + TCP header      = Segment      (Layer 4)
    → + IP header     = Packet       (Layer 3)
      → + Frame header/trailer = Frame (Layer 2)
        → bits on the wire            (Layer 1)

TCP vs UDP

Handshake & Connection Lifecycle

TCP 3-way handshake (open):
  Client → SYN            → Server
  Client ← SYN, ACK       ← Server
  Client → ACK            → Server
  [connection established]

TCP 4-way teardown (close):
  Client → FIN → Server
  Client ← ACK ← Server
  Client ← FIN ← Server
  Client → ACK → Server

IP Addressing

A 32-bit IPv4 address written as 4 octets: 192.168.1.100. Each address has a network portion and a host portion, determined by the subnet mask.

Private IP Ranges (RFC 1918)

10.0.0.0/8        → 10.0.0.0    - 10.255.255.255   (common for AWS VPCs)
172.16.0.0/12     → 172.16.0.0  - 172.31.255.255   (AWS default VPC: 172.31.0.0/16)
192.168.0.0/16    → 192.168.0.0 - 192.168.255.255  (home networks)

CIDR & Subnetting

CIDR notation pairs an IP with a prefix length: 10.0.0.0/16. The prefix says how many leading bits are the network portion. Smaller prefix = bigger network.

# Total IPs in a block = 2^(32 - prefix)
/28 = 2^4  = 16 IPs   (11 usable in AWS)
/24 = 2^8  = 256 IPs  (251 usable in AWS)
/16 = 2^16 = 65,536 IPs
# VPC CIDR can be /16 (max) to /28 (min) in AWS

Subnetting: Worked Example

Split a VPC 10.0.0.0/16 into public and private subnets across two AZs:

IPv6 Basics

128-bit addresses written in hex, e.g. 2001:db8::1. Solves IPv4 exhaustion. In AWS, IPv6 addresses are globally unique and public by default - there is no NAT for IPv6.

::1                 # IPv6 loopback (like 127.0.0.1)
fe80::/10           # Link-local
2001:db8::/32       # Documentation range

Key Protocols & Ports

DNS Deep Dive

Record types

How a lookup works

Browser → Recursive resolver → Root (.) → TLD (.com) → Authoritative NS → Answer
                                (cached along the way, controlled by TTL)

Route 53 routing policies

DHCP & ARP

DHCP hands out IP configuration automatically via the DORA exchange:

Discover → Offer → Request → Acknowledge  (client gets IP, mask, gateway, DNS)

ARP (Address Resolution Protocol) maps an IP address to a MAC address on the local link, so frames can be delivered at Layer 2.

NAT Gateway vs NAT Instance

Routing & Route Tables

A route table is a set of rules matching destination CIDRs to targets. The most specific (longest prefix) match wins.

Load Balancers

Key features

• Health checks: unhealthy targets are removed from rotation automatically.
• Target groups: route to EC2, IPs, Lambda (ALB), or other resources.
• Cross-zone load balancing: spread traffic evenly across AZs (on by default for ALB).
• Sticky sessions: pin a client to one target (ALB cookies).
• ALB routing: by path (/api/*), host header, HTTP header, or query string.

Security Groups vs Network ACLs

TLS & Certificates

TLS encrypts traffic and authenticates the server via a certificate signed by a trusted CA. The handshake negotiates keys before any application data flows.

Client Hello → Server Hello (+ certificate)
  → key exchange → Finished → encrypted application data

• ACM (AWS Certificate Manager): free public certs, auto-renewed, integrates with ALB, CloudFront, API Gateway.
• TLS termination: the load balancer decrypts, so backends can serve HTTP internally.
• End-to-end encryption: re-encrypt from LB to target when compliance requires it.
• SNI: host multiple certs/domains on one listener.

AWS VPC Overview

A VPC (Virtual Private Cloud) is your logically isolated network in AWS.

• VPC - the network boundary; a CIDR block such as 10.0.0.0/16.
• Subnets - subdivide the VPC; each subnet lives in exactly one AZ.
• Internet Gateway (IGW) - enables internet access for public subnets.
• Route Tables - control where subnet traffic is directed.
• NAT Gateway - outbound-only internet for private subnets.
• Elastic Network Interface (ENI) - a virtual NIC attached to instances.
• Elastic IP (EIP) - a static public IPv4 you own.

flowchart TB
  Internet((Internet)) --- IGW[Internet Gateway]
  IGW --- ALB[Application Load Balancer]
  subgraph VPC["VPC 10.0.0.0/16"]
    subgraph AZA["AZ us-east-1a"]
      PubA[Public Subnet 10.0.0.0/24
NAT Gateway] --> WebA[EC2 Web Tier]
      WebA --> AppA[EC2 App Tier
Private Subnet]
      AppA --> DBA[(RDS Primary
DB Subnet)]
    end
    subgraph AZB["AZ us-east-1b"]
      PubB[Public Subnet 10.0.1.0/24
NAT Gateway] --> WebB[EC2 Web Tier]
      WebB --> AppB[EC2 App Tier
Private Subnet]
      AppB --> DBB[(RDS Standby
DB Subnet)]
    end
    ALB --- WebA
    ALB --- WebB
    DBA -. Multi-AZ replication .- DBB
  end

VPC Connectivity Options

Connectivity Troubleshooting Playbook