Run a mock round

TCP and UDP are transport-layer protocols with opposite trade-offs.

TCP is connection-oriented. It sets up a connection with a three-way handshake, numbers every segment, acknowledges delivery, retransmits lost data, orders bytes and applies flow and congestion control. It is used when correctness matters: HTTP, SMTP, SSH and database connections.

UDP is connectionless. It sends independent datagrams with no handshake, acknowledgements or ordering, so delivery is best-effort. It is used when low latency matters more than reliability: DNS, DHCP, VoIP, video streaming and online games. QUIC adds reliability and encryption on top of UDP in user space.

TCP: SYN, SYN-ACK, ACK -> ordered, reliable byte stream
UDP: datagram -> fire and forget

TCP's guarantees cost latency and header overhead; UDP is cheaper but application code must handle loss, duplication and reordering when required.

The OSI model is a seven-layer reference model: Physical, Data Link, Network, Transport, Session, Presentation and Application. The TCP/IP model as taught is four layers: Link, Internet, Transport and Application.

OSI                     TCP/IP
7 Application  }        Application (HTTP, DNS, TLS)
6 Presentation }   ->
5 Session      }        Transport (TCP, UDP)
4 Transport             Internet (IP, ICMP)
3 Network               Link (Ethernet, Wi-Fi, ARP)
2 Data Link
1 Physical

OSI is a conceptual framework that names what each layer should do and helps when reasoning about problems and protocols. TCP/IP is the model actually implemented by the Internet, and it merges the upper layers and leaves some OSI concerns, such as encryption, to the application or to TLS. In troubleshooting people still speak in OSI layers: a layer 2 problem means a switching or MAC issue, while layer 7 means the application payload.

Switching and routing both forward packets, but at different layers and scopes.

A switch works at layer 2 using MAC addresses within a single broadcast domain, the LAN. It learns which MAC is reachable on which port by inspecting source addresses and forwards frames only to the correct port, flooding unknown destinations. VLANs segment one physical switch into logical LANs.

A router works at layer 3 using IP addresses and moves packets between networks. It consults a routing table built from directly connected networks, static routes and dynamic protocols such as OSPF, EIGRP or BGP, and picks the longest matching prefix. It also decrements the TTL and can perform NAT.

host -> switch (MAC) -> router (IP) -> internet

Routers break broadcast domains and connect dissimilar networks; switches are faster and cheaper but confined to the local segment. Layer 3 switches combine both functions.

TLS provides confidentiality, integrity and authentication for a connection. In TLS 1.3 the handshake is one round trip before application data.

1. The client sends a ClientHello with supported versions, cipher suites, a key share for ECDHE and a random nonce.
2. The server replies with ServerHello, its own key share, selects parameters, and sends a certificate proving its identity.
3. The client verifies the certificate chain up to a trusted root CA, checks the hostname and validity, and both sides derive the shared session key from the ECDHE exchange.
4. The client sends Finished, the server confirms, and encrypted records flow.

ClientHello -> <- ServerHello + Cert; derive keys; Finished

Key points: ECDHE gives forward secrecy, so a stolen private key cannot decrypt recorded sessions; certificates bind a public key to a name; and session resumption or 0-RTT trades some security for latency. TLS 1.2 needed two round trips, one reason 1.3 is faster.

TCP opens a connection with a three-way handshake so both sides agree on initial sequence numbers and confirm they can send and receive.

1. Client sends SYN with its initial sequence number and options such as MSS and window scaling.
2. Server replies SYN-ACK: it acknowledges the client's sequence number and sends its own SYN.
3. Client sends ACK acknowledging the server's sequence number; the connection is established.

Client          Server
  SYN seq=x  ->
             <- SYN-ACK seq=y ack=x+1
  ACK ack=y+1 ->

Two steps would not be enough: each side needs to know the other received its SYN, and the exchange prevents stale duplicates from an old connection being mistaken for a new one. Sequence numbers are randomised to make blind spoofing hard.

Teardown takes four steps, FIN, ACK, FIN, ACK, because each direction closes independently, and the side that closes last waits in TIME_WAIT to absorb delayed segments.

Network troubleshooting is easier when you reason up the layers and use the right tool at each step.

• ping checks reachability and round-trip time using ICMP and reveals packet loss.
• traceroute shows the path and where latency or loss begins.
• dig or nslookup verifies DNS records and which server answered.
• ss or netstat lists listening sockets and established connections.
• curl -v inspects HTTP status, headers and TLS negotiation.
• tcpdump or Wireshark captures packets to confirm what is on the wire.
• ip addr and ip route verify local addressing and routing.

dig example.com +short
curl -v https://example.com
ss -tulpn

A sensible order is name resolution, then local interface and route, then reachability, then port and application. Check firewalls and security groups early too, since a silent timeout often means a dropped packet rather than a dead host.

Network Address Translation rewrites IP addresses and often ports as packets cross between a private network and the public Internet. It exists mainly because IPv4 addresses are scarce.

A home router has one public address and gives private addresses such as 192.168.1.x to devices. When an inside host opens a connection, the router replaces the source address and port with its public address and a chosen port, and records the mapping. Replies matching that mapping are translated back.

10.0.0.5:52000 -> 203.0.113.7:40001 -> server
mapping table keeps the reverse path

Types include static NAT, dynamic NAT and PAT or masquerading, which multiplexes many hosts over one address. NAT conserves addresses and hides internal topology, but it breaks end-to-end connectivity, complicates peer-to-peer and burdens the device with state. It also motivates STUN, TURN and hole punching. IPv6 removes the need.

An IP address is split into a network part and a host part by the subnet mask, which can be written as a CIDR prefix. /24 means the first 24 bits are the network, leaving 8 host bits.

192.168.1.0/24
mask  255.255.255.0
network 192.168.1.0   broadcast 192.168.1.255
usable hosts 192.168.1.1 - 192.168.1.254  (254 hosts)

The number of addresses is 2^(32-prefix), and usable hosts are that minus the network and broadcast addresses for IPv4. Borrowing bits creates subnets; splitting a /24 into four /26 gives 62 usable hosts each.

Longest-prefix match means a router forwarding a packet picks the most specific route. CIDR replaced classful addressing and allows route aggregation, so many contiguous networks are advertised as a single summary route. Private ranges such as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are not routed on the public Internet.

DNS maps names to records, most importantly A and AAAA addresses, plus CNAME, MX, TXT and NS. A lookup can walk several servers, but caching means most lookups stop early.

Resolution steps:

1. Check the local hosts file and OS resolver cache.
2. Query the configured recursive resolver, often via the ISP or a public service.
3. If not cached, the resolver asks a root server, which points to the top-level domain servers.
4. The TLD server points to the domain's authoritative name servers.
5. The authoritative server returns the record; the resolver caches it for its TTL and answers the client.

Queries use UDP port 53, falling back to TCP for large responses, and DoT or DoH when encryption is wanted.

client -> recursive resolver -> root -> .com -> ns.example.com

Caching and TTLs reduce load and latency. Debug with dig +trace or nslookup, and remember that propagation delays are really cache expiry.