Glossary

153 terms from Networking Basics, in plain words, each with the chapter that teaches it.

Search the glossary

#

/48: The usual IPv6 block an internet provider gives one site, such as Kettle & Crane's 2001:db8:4a2c::/48. The site picks the next 16 bits for each LAN, which leaves room for 65,536 /64 subnets.
/64: The standard size of one IPv6 LAN. The first 64 bits name the network and the last 64 bits, the interface ID, name the host, so hosts never run out of addresses.
802.1Q: The standard that defines the 4-byte VLAN tag that frames carry on a trunk.
::: In an IPv6 address, :: replaces one run of all-zero groups, so 2001:db8:4a2c:10:0:0:0:10 becomes 2001:db8:4a2c:10::10. It may appear only once in an address.

A

access: An ordinary switch port that carries a single VLAN and adds no tags, so a laptop plugged into it never notices that VLANs exist.
access point: The box that connects Wi-Fi devices to the wired network. It is a layer 2 device and is often powered over the cable by PoE, like the one on the packing-room ceiling.
AND: A bit-by-bit comparison in which each result bit is 1 only if both input bits are 1. ANDing an address with its subnet mask gives the network address; in Python the & operator does it.
application layer: The top layer, which holds what the program wants to say, such as an HTTP request. It is layer 4 in the TCP/IP model and layers 5 to 7 in the OSI model, where it is usually called layer 7.
ARP: Address Resolution Protocol: how a host finds the MAC address that belongs to an IP address on its own LAN. It broadcasts a request ("who has 192.168.20.1?"), and only the owner of that address replies ("is-at 02:00:00:00:00:01").
ARP cache: The list of recent ARP answers a host keeps, so it doesn't have to ask before every frame. `ip neigh` shows it.
auto-negotiation: When a cable is plugged in, the two ends agree on a speed and duplex between themselves. If one end is fixed and the other is on auto, the link can be very slow.

B

Bandwidth: How much data a link can carry each second, measured in bits per second. Kettle & Crane's internet plan is 500 Mbps. In the highway picture, bandwidth is the number of lanes.
binary: Writing numbers using only 0 and 1, where each place is worth twice the place to its right. You need it to see where an address splits into its network part and host part.
bit: The smallest unit of data, a single 0 or 1. Eight bits make a byte, and link speeds are counted in bits per second.
block size: The number of addresses in one subnet, such as 64 for a /26. Subnets always start at a multiple of it (.0, .64, .128, .192), which lets you place an address without doing binary.
borrowing bits: Making a prefix longer by turning host bits into network bits. Borrowing n bits splits a network into 2^n subnets; borrowing two bits cuts Kettle & Crane's /24 into four /26s.
bridge: Linux's software switch. It joins several connections and forwards frames between them, learning MACs just like a hardware switch. The labs call it br0.
broadcast: Sending one frame to every device on the LAN by using the MAC address ff:ff:ff:ff:ff:ff. ARP requests are broadcasts, which is why the printer heard the laptop asking for the server.
broadcast address: The IPv4 address in a subnet with all host bits set to 1, such as 192.168.20.63 for the office /26; it reaches every host in the subnet, so no host may use it. The special address 255.255.255.255 likewise reaches every host on the local network.
broadcast domain: All the hosts that receive each other's broadcasts: everything on the same switch (or the same VLAN). Routers don't forward broadcasts, so a router is where a broadcast domain ends.
byte: A group of 8 bits. Files are measured in bytes and link speeds in bits, so you multiply or divide by 8 to convert between them.

C

capture: A record of the frames that passed through a network connection. tcpdump can make one and save it to a file such as web.pcap so you can read it later.
categories: Grades of twisted-pair copper cable that say how fast they can go: Cat 5e runs 1 Gbps, Cat 6 runs 1 Gbps (10 Gbps up to 55 m), and Cat 6A runs 10 Gbps. All of them work up to 100 m.
checksum: A number worked out from a frame's contents and stored in the 4 bytes at its end. The receiver works it out again, and if the two numbers differ it drops the damaged frame and counts an error.
CIDR notation: Classless inter-domain routing: writing an address followed by a slash and its prefix length, like 192.168.20.10/24, which shows the address and how many of its bits are the network part.
client: The program that sends requests to a server, such as Priya's browser opening the online shop. The same computer can be a client and a server at different times.
curl: A command-line web client that fetches a page, as in `curl -s http://192.168.20.70/` for the order page. `-s` hides the progress meter and `-m 2` gives up after two seconds.

D

data link layer: OSI layer 2, where Ethernet, switches and MAC addresses work. Calling something "a layer 2 problem" means a problem at this level.
default gateway: The router a host sends every packet bound for outside its own subnet, usually the subnet's first usable address. Alex's laptop uses 192.168.20.1, and the shop devices use 192.168.20.65.
default route: A route with prefix length 0 that matches every address and points at the default gateway. Because it is the least specific route, it is used only when no other route matches.
Destination Host Unreachable: A ping message reporting that ARP got no answer, so no frame could be sent. When it comes from your own address, check the gateway setting, the cable and the other host.
DHCP: A service that hands out addresses to hosts automatically. A laptop with a 169.254.x.x address got no answer from it. The follow-up book covers it.
dictionary: In Python, pairs of a name and a value inside curly brackets, such as {"office": "192.168.20.0/26"}. `.items()` gives you the pairs one at a time.
DNS: The Domain Name System, an application-layer service that turns names such as shop.kettleandcrane.com into IP addresses. It lets people use easy-to-remember names instead of numeric addresses.
dotted decimal: The usual way to write an IPv4 address: four numbers from 0 to 255, each standing for 8 bits, separated by dots, like 192.168.20.10.
dual stack: A device or network that runs IPv4 and IPv6 side by side, with an address of each kind, and uses whichever one the other end supports.
Duplex: Whether both ends of a link can send at the same time (full duplex) or must take turns (half duplex). Modern wired links are full duplex.

E

encapsulation: Each layer wrapping the data from the layer above in its own header on the way down: data becomes a segment, then a packet, then a frame. The receiver unwraps them in reverse order.
Ethernet: The link-layer protocol of wired LANs; Wi-Fi works almost the same way. It wraps each packet in a frame that carries MAC addresses and a checksum.
ethertype: A number in the Ethernet header that says what the frame carries: 0x0800 for an IPv4 packet and 0x0806 for ARP.
ethtool: A tool that shows what a network card itself reports: its speed, its duplex and whether a link is detected.

F

FAILED: An ARP cache state meaning ARP got no answer, so nobody on this LAN has that address. You see it when a host's gateway is wrong or its prefix is wrong.
Fiber: Cable that carries pulses of light through thin glass strands. It ignores electrical noise and reaches much farther than copper.
filter: An expression that makes tcpdump keep only the frames that match it, such as `arp`, `icmp` or `greater 100`.
Firewall: A device that reads addresses and port numbers (layers 3 and 4) to decide what traffic to allow or block.
flat network: A large network with no routers dividing it, so it is one broadcast domain and broadcasts add up to noise.
floods: What a switch does with a frame whose destination MAC it hasn't learned, or with a broadcast: it sends the frame out of every port except the one it arrived on.
forwarding: A router reading a packet's destination IP address and sending the packet on, in a new frame, through the connection that leads closer to it.
frame: The unit of data at the link layer: a packet wrapped in an Ethernet header (with MAC addresses) and a checksum. Routers build a new frame at every hop.
Full duplex: Both ends of a link sending at the same time, like a phone call.
function: In a shell script, a named group of commands that takes arguments, such as kc-office.sh's host, switch and plug, so you can run them all with one word.

G

Global unicast: A public IPv6 address that can be reached across the internet. It starts with 2 or 3.
grep: A command that keeps only the lines containing some text. `-E "A|B"` matches A or B, and `-q` prints nothing and just succeeds or fails, which test.sh relies on.

H

Half duplex: The two ends of a link taking turns to send, like a walkie-talkie.
header: A few bytes of information, such as addresses, that a layer puts in front of the data. Only that layer reads it.
hexadecimal: Counting in sixteens, using the digits 0 to 9 and then a to f for ten to fifteen; two hex digits make one byte, so 4e is 4 × 16 + 14 = 78. MAC addresses and IPv6 addresses are written in hex.
hop: One router on a packet's path. Each hop lowers the TTL by 1, and traceroute lists the hops one by one.
host: Any device that sends or receives data on a network, such as a laptop, phone, printer or server.
HTTP: The application-layer protocol browsers use to fetch web pages, such as Priya's browser loading the shop.

I

ICMP: A helper protocol for test and error messages. ping sends ICMP echo requests and gets echo replies back, and routers send ICMP "time exceeded" messages.
interface ID: The last 64 bits of an IPv6 address, which name the host on its /64 LAN. With SLAAC, hosts make up their own.
internet: Many thousands of networks owned by different companies, including the providers' WANs, all joined by routers.
internet layer: TCP/IP layer 2, where IP moves packets across networks from address to address. It matches OSI layer 3, the network layer.
ip: The Linux command that shows and changes network settings, with a subcommand for each kind of thing: netns, link, addr, route and neigh. -n NAME runs it inside a namespace, -br prints short lines and -6 shows only IPv6.
ip addr: Shows, adds or removes a connection's IP addresses. `ip addr add 192.168.20.10/24 dev eth0` gives eth0 an address and a prefix.
IP address: The address that names both a network and a host on it, so packets can reach hosts on other networks. A MAC address only works within one LAN.
ip link: Shows and changes network connections. `link set eth0 up` switches a cable end on, `link show` shows its state and MTU, and `-s` adds counters.
ip neigh: Shows the ARP cache, with each IP address, its MAC (lladdr) and its state. `flush all` empties the cache, which helps after you replace a device.
ip netns: Manages network namespaces. add makes one, list shows them, del deletes one, and `ip -all netns delete` removes every namespace at once.
ip route: Shows the routing table and changes it. `ip route add default via 192.168.20.1` sets the gateway, `replace` swaps the route for another and `del default` removes it.
ip route get: Asks which route a given address would use. For 192.168.20.70 it shows `via 192.168.20.1`, and for the local printer address it shows no via.
ipaddress: A module built into Python for working with IPv4 and IPv6 addresses and networks. It can convert addresses, test whether an address is private, loopback or link-local, and check masks, subnet plans and IPv6 shortening.
IPv4: The version of the Internet Protocol that most networks still run. Its addresses are 32 bits, written in dotted decimal, which allows about 4.3 billion addresses.
IPv6: The successor to IPv4, with 128-bit addresses written as eight groups of hex digits. It was created because IPv4 addresses ran out.

L

LAN: Local area network: a network in one building or site, owned by the company, like the Kettle & Crane office's laptops and printers on one switch.
Latency: How long one packet takes to arrive, measured in milliseconds. It grows with distance and with every device on the way, and ping measures it as round-trip time.
layers: The separate jobs a network's work is split into. Each layer uses the one below it and serves the one above, so you troubleshoot from the bottom layer up.
link: The connection between two devices: a cable, or a radio signal such as Wi-Fi.
link layer: The bottom layer of the TCP/IP model, which carries frames to the next device on the same link using Ethernet or Wi-Fi. It matches OSI layers 1 and 2.
Link-local: An address that is valid only on one link. In IPv4, a 169.254.x.x address means nobody handed the host an address; in IPv6, every connection makes an fe80:: address for itself.
list: In Python, several values inside square brackets, kept in order, such as [192, 168, 20, 10].
longest prefix match: The rule for choosing between routes: when several routes match an address, the one with the longest prefix wins. So a /26 route beats the default route (/0), which is used only when nothing else matches.
loopback: A pretend connection every computer has for talking to itself: lo, with the address 127.0.0.1 in IPv4 or ::1 in IPv6.
LOWER_UP: A word in ip link output meaning a cable is connected and working at the other end. UP on its own only means this end is switched on.

M

MAC address: A network card's 48-bit hardware address, written as six hex bytes such as 3c:22:fb:7a:10:4e. Frames use it to reach the next device on the same LAN.
MAC table: A switch's record of which MAC address is behind which port, built from the source MAC of each frame it receives. Entries are forgotten after about five minutes without use.
MTU: Maximum transmission unit: the largest packet a link carries, normally 1,500 bytes. That's why the biggest ping data that fits is 1,472 bytes, since 8 bytes of ICMP header and 20 of IP header take up the rest.
multicast: Sending to a group address that only interested hosts listen to. IPv6 uses it instead of broadcast, and ff02::1 means all hosts on the link.
Multimode: Fiber for distances of a few hundred meters (about 300 to 400 m at 10 Gbps), used inside a building or across a campus.

N

NAT: A trick that lets the computers in an office with private addresses share the router's single public address to reach the internet. The follow-up book explains it.
Neighbor Discovery: IPv6's replacement for ARP. It uses multicast messages to find the MACs of other hosts on the LAN.
net.ipv4.ip_forward: The Linux setting that lets a machine forward packets between its connections, which is what makes it act as a router. When it is 0, as on the freshly replaced router, the subnets are cut off from each other.
network: A set of devices connected so they can send each other data.
network address: The address in a network with all host bits set to 0, such as 192.168.20.64 for the shop subnet. It names the network itself, so no host uses it.
Network is unreachable: An error meaning no route in the host's routing table matches the destination. It usually means a missing default route.
network layer: OSI layer 3, where IP addresses and routers work. It matches the internet layer of the TCP/IP model.
network namespaces: A Linux feature that splits one machine into separate network worlds, each with its own connections, addresses and routes. Because each namespace acts like a separate computer, namespaces such as `laptop`, `server` and `router` can be joined into practice networks on a single machine.
network part and host part: The two pieces of every IP address: the first bits (the network part) name the network, and the remaining bits (the host part) name one host on it. The prefix length says where the split falls.
NO-CARRIER: A word in ip link output meaning there is no signal from the other end: an unplugged or broken cable, or a switch port that is off.

O

octet: A group of 8 bits, which is one of the four numbers in an IPv4 address and ranges from 0 to 255.
OSI model: An older, seven-layer way of describing networking. Nobody builds networks from it, but its numbers are everyday language: 1 physical, 2 data link, 3 network, 4 transport, 7 application.

P

packet: A small, addressed piece of data, usually up to about 1,500 bytes. Strictly, it is the unit at the internet layer: an IP header plus a segment.
packet loss: The share of packets that got no reply, shown in ping's summary. 100% packet loss means nothing answered.
payload: The part of a frame that carries the packet itself, 46 to 1,500 bytes, with the MTU setting the limit.
physical layer: OSI layer 1: cables, radio and signals. Nothing above it works if it fails, so it is the first thing to check.
ping: Sends small ICMP test packets to an address and times the replies. -c sets how many to send, -W 1 waits at most one second, and -M do with -s tests the MTU.
pipe: The | between two commands, which sends the first command's output into the second instead of to the screen, as in `ethtool eth0 | grep Link`.
place value: What each bit position is worth in binary: 128, 64, 32, 16, 8, 4, 2, 1 from left to right in an octet. Add the place values under the 1s to get the number.
PoE: Power over Ethernet: a switch sending power down the network cable, so devices such as ceiling access points, desk phones and cameras need no separate power socket.
port: Either a number that picks a program on a host (80 for a web server), or a socket on a switch for one cable. The context tells you which meaning is meant.
prefix length: The number written after the slash that says how many of an address's bits are the network part. The rest of the bits pick the host.
Private addresses: IPv4 ranges that any LAN may use freely and that are never used on the internet: 10.x, 172.16.x to 172.31.x, and 192.168.x. Kettle & Crane's office uses 192.168.20.0/24.
prompt: The $ shown before a command, meaning "type what follows". You don't type the $ itself.
protocol: A set of rules two devices agree on for talking, like the agreed format of a letter.
public address: An address that is unique on the whole internet and handed out to providers and companies. Every IPv4 address outside the private and special ranges is public.

R

REACHABLE: An ARP cache state meaning the entry was confirmed recently and is used without question.
RJ45: The clear plastic plug on each end of an Ethernet cable, which clicks into a laptop, a switch or a wall socket.
root: Linux's administrator account, which network changes and captures need. You get its powers by putting sudo in front of a command.
route: One line in a routing table: a network, and how to reach it (directly through a connection, or via a router).
router: A device that joins networks and forwards packets between them. It has an address in each network it joins, like Kettle & Crane's router with .1 in the office subnet and .65 in the shop subnet.
router advertisement: A message an IPv6 router sends regularly to announce the LAN's /64 prefix, so hosts can build their own addresses with SLAAC.
routing table: The list of routes a host or router uses to decide where each packet goes. When several routes match, the most specific one (the longest prefix) wins.

S

segment: The unit of data at the transport layer: the program's data with a TCP header that carries port numbers.
server: A program, or the computer running it, that waits for requests and answers them, like Kettle & Crane's order server.
SFP: A small, swappable module that plugs fiber into a switch. You pick the module to match the kind of fiber.
shell script: A file of commands that bash runs in order, such as kc-office.sh. Its first line, #!/bin/bash, says which program runs it.
Single-mode: Fiber for long distances, 10 km and more, used between buildings and cities and by internet providers.
SLAAC: Stateless address autoconfiguration: an IPv6 host hears the router's /64 prefix and makes up its own interface ID, building a complete address without any server.
Speed: A link's bandwidth, such as 1 Gbps. ethtool shows it.
STALE: An ARP cache state meaning the entry hasn't been confirmed for a while. It is still used, but checked again next time, so seeing it is normal.
subnet: One of the smaller networks made by subnetting, such as Kettle & Crane's shop subnet, 192.168.20.64/26.
subnet mask: The network part of an address written as 32 bits: a 1 for each network bit and a 0 for each host bit, so a /26 becomes 255.255.255.192. Windows shows masks, and Linux shows prefixes.
subnetting: Cutting one network into smaller networks by borrowing host bits, usually one per VLAN or group, with a router joining them.
switch: A layer 2 device that connects the hosts in one LAN and sends each frame out of the right port, learning which MAC is behind each port on its own.

T

TCP: A transport-layer protocol for reliable delivery between programs. It adds port numbers to make a segment, and it sends small frames with no data to set up a conversation and confirm what arrived.
TCP/IP model: The four-layer model the internet is built on: application, transport, internet and link.
tcpdump: Captures the frames passing through a connection and prints them. -i picks the connection, -w saves to a file, -r reads a file back, -e shows MACs, -n shows numbers and -c stops after N frames.
time exceeded: The message a router sends back when it drops a packet whose TTL reached 0. traceroute uses these messages to learn each router's address.
traceroute: Lists every router on the path to a host by sending packets with TTL 1, then 2, and so on. A line of * * * means that hop didn't answer; on Windows the command is called tracert.
transport layer: The layer that carries data between programs, with TCP or UDP. It is layer 4 in OSI and layer 3 in the TCP/IP model.
trunk: A cable that carries several VLANs at once, with each frame tagged, such as the link from the switch to an access point offering both staff and guest Wi-Fi.
TTL: Time to live: a hop counter in every IP packet. The sender usually starts it at 64, and each router lowers it by 1, dropping the packet at 0, so a reply showing ttl=63 crossed one router.
twisted-pair: Copper cable with eight wires twisted into four pairs to cancel electrical noise. It is the usual office cable, with RJ45 plugs and a limit of 100 m.

U

UDP: The other transport-layer protocol next to TCP; it sends data between programs without TCP's setup and delivery checks. The follow-up book covers it.
Unique local: IPv6 addresses for use inside a company only, in practice starting with fd. They are like IPv4 private addresses.
usable hosts: The addresses in a subnet that hosts may use: with h host bits there are 2^h addresses, minus the network and broadcast addresses, so 2^h − 2 (62 for a /26). The router usually gets the first usable one.

V

veth pair: A virtual cable with one end in each of two network namespaces, so the two behave like computers connected by a cable.
via: In a route, via names the router to send packets through, as in `default via 192.168.20.1`. A route without via sends straight to the destination.
virtual machine: A whole computer simulated by a program running inside another computer. A VM such as `netlab` lets you experiment freely without risking your real computer or network.
VLAN: Virtual LAN: one switch split into separate LANs by giving each port a VLAN number, such as 10 for staff and 30 for guests. Each VLAN is its own broadcast domain, and only a router can pass traffic between them.
VLAN tag: 4 bytes added after the source MAC in a frame on a trunk, saying which VLAN the frame belongs to.

W

WAN: Wide area network: a network that spans cities, states or countries, such as an internet provider's network.
Wi-Fi: A radio link that works almost the same way as Ethernet. Devices join the wired network through an access point.