Glossary

149 terms from Networking Beyond the Basics, in plain words, each with the chapter that teaches it.

Search the glossary

#

/etc/resolv.conf: The Linux file that names the DNS resolver on a nameserver line. DHCP usually fills it in, and a typo in it was the cause of Priya's "order system is down" morning.
2.4 GHz: The Wi-Fi band that reaches farthest and passes through walls best, but is slow and crowded. In the US it has channels 1 to 11, and only 1, 6 and 11 do not overlap.
5 GHz: A Wi-Fi band with many more channels than 2.4 GHz. It is much faster but reaches less far.
6 GHz: The newest Wi-Fi band. It has wide, clean channels and the highest speeds but the shortest reach. Only newer devices can use it, and it requires WPA3.

A

A: A DNS record that maps a name to an IPv4 address, for example shop.kettleandcrane.com to 203.0.113.25. dig asks for this type unless you name another.
AAAA: A DNS record that maps a name to an IPv6 address, such as 2001:db8:4a2c:20::25 for the Kettle & Crane shop.
access point (AP): A box, usually on the ceiling, with a radio on one side and an Ethernet cable on the other. It connects Wi-Fi laptops and phones to the wired LAN.
ACK: The TCP flag that confirms data has arrived: "I've received everything up to this number." tcpdump shows it as a dot.
Ack (DHCP): The fourth DORA message: the DHCP server confirms the lease, and the laptop starts using the address. When a lease is renewed, only a Request and this Ack are sent.
ack number: The number in a TCP segment that means "the next byte I expect from you." When the server replies ack 82, it has received everything before byte 82.
Address already in use: The error a server gives when it tries to listen on a port that another program already holds. Run ss -tlnp to see which program has it.
all-in-one router box: The small box an internet provider installs, which does many jobs at once: modem, small switch, Wi-Fi access point, NAT router, DHCP server, DNS resolver and firewall. A busy office often switches it to bridge mode and uses separate devices for the other jobs.
ARP: Address Resolution Protocol, which a host uses to find the MAC address that belongs to an IP address on its own LAN. A DHCP client such as `dhcpcd` can also use it to check that no other host already uses an offered address.
ARP cache: The list of MAC addresses a host has learned for nearby IP addresses. ip neigh shows it. A laptop should normally know only the gateway's MAC for anything outside its subnet.
authoritative servers: The DNS servers that hold a domain's real records, such as Kettle & Crane's own server for kettleandcrane.com. They give the final answer when a resolver looks a name up.

B

band: One of the radio frequency ranges Wi-Fi uses: 2.4, 5 or 6 GHz. Lower bands reach farther, and higher bands are faster.
bottom-up troubleshooting: Alex's method of testing the layers in order: link, address, gateway, path, DNS, service. The first rung that fails is where the fault is.
bridge mode: A setting on the provider's router box that makes it act only as a modem. Alex's own router, switch and access points then do the other jobs.
broadcast: A message sent to every host on the LAN, such as one sent to the address 255.255.255.255. A new laptop broadcasts its DHCP Discover, and routers do not forward broadcasts.

C

caching: Keeping an answer for a while and reusing it. A DNS resolver caches each answer for its TTL, which is why an old address can keep coming back after a change.
capture (pcap file): A recording of packets. tcpdump -w saves one to a .pcap file such as fetch.pcap, tcpdump -r reads it back, and Wireshark can open it.
carrier-grade NAT: NAT done by the internet provider, which shares one public address among many customers. You can spot it by a 100.64.x.x address on your router's internet side. Port forwarding on your own router cannot work behind it.
certificate: A signed file in which a server proves who it is during the TLS handshake, saying in effect "this really is shop.kettleandcrane.com."
chain: In iptables, rules are grouped into tables, such as nat, and each table has chains: the moments when a rule applies. Examples are PREROUTING as a packet arrives and POSTROUTING just before it leaves.
channel: A numbered slice of a Wi-Fi band that all nearby devices share, taking turns. In 2.4 GHz, neighboring channels overlap, so APs that sit side by side use 1, 6 and 11.
CNAME: A DNS record that makes one name an alias for another. www.kettleandcrane.com points to shop.kettleandcrane.com, and the server adds shop's A record to the reply.
connection refused: An immediate rejection, sent as a TCP RST, because the host is up but nothing listens on that port. It points at the service, not the network.
conntrack: A tool that shows the kernel's connection-tracking table, which NAT uses as its translation table. conntrack -L -d 203.0.113.25 showed Alex which inside laptop made each connection to the shop.
curl: A tool that fetches a URL and so tests the service itself. -v shows every step, -I shows only the headers, -w prints the status code and timing, and -m sets a time limit. Its errors include 6 (could not resolve the name), 7 (refused) and 28 (timed out).

D

datagram: One UDP message. It is sent on its own, with no connection and no acknowledgment, such as the "Printer 3 out of labels" message.
default gateway: The router a host sends traffic to when the destination is outside its own subnet. At Kettle & Crane, the office laptops use 192.168.20.1, usually learned from DHCP.
DHCP: Dynamic Host Configuration Protocol. A server, usually the office router, uses it to hand each laptop an address and prefix, a default gateway, DNS servers and a lease time. It runs over UDP ports 67 and 68.
DHCP relay: A router feature that passes DHCP messages on to a central server in another subnet. It is needed because broadcasts do not cross routers.
dhcpcd: A DHCP client program for Linux. dhcpcd -4 -1 eth0 gets one IPv4 lease and then exits, and it writes the DNS server it receives into resolv.conf.
dig: A tool that sends a DNS question and prints the full answer: status, flags, records and which server answered. +short prints only the values, @SERVER asks one particular server, and dig never reads the hosts file.
Discover: The first DORA message. A laptop with no address broadcasts it from 0.0.0.0 to 255.255.255.255 to find a DHCP server.
DNAT: An iptables action that rewrites a packet's destination address and port. It is used in PREROUTING for port forwarding.
DNS: Domain Name System, the internet's directory: you ask for a name like shop.kettleandcrane.com and get back an address. It uses UDP port 53, and TCP port 53 for large answers.
dnsmasq: A small DNS and DHCP server that reads all its settings from one config file. It can serve as a domain's authoritative DNS server, as a caching resolver that forwards questions and remembers answers, or as an office DHCP server, as it does for Kettle & Crane.
domain: A name a company registers, such as kettleandcrane.com. The owner decides which names exist inside it.
don't fragment (DF) flag: A flag that forbids routers from splitting a packet into pieces on the way. If a link's MTU is too small, the router replies "Frag needed and DF set" and says what the limit is.
DORA: A memory aid for the four DHCP messages that create a lease: Discover, Offer, Request, Ack.

E

ephemeral port: A random high port that the client's operating system picks for one connection. Linux takes them from 32768 to 60999. It is how each of Priya's browser tabs gets its own replies.

F

FIN: The TCP flag meaning "I've finished sending." Each side sends one to close its direction of the connection.
firewall: A program or device that decides which packets may pass. Firewalls often drop unwanted packets silently, which causes a timeout rather than a refusal.
flags: One-bit switches in the TCP header that mark what a segment is for: SYN, ACK, FIN and RST. tcpdump shows them in square brackets, for example [S.] for SYN-ACK.

G

GET request: The HTTP request a client sends to ask a server for a page, such as GET / HTTP/1.1. curl -v shows it on a > line, followed by headers such as Host:.
getent: getent hosts NAME looks up a name the way programs do: the hosts file first, then DNS. It shows what a browser would see, which dig does not.
guest network: A separate Wi-Fi network for visitors, with its own SSID, VLAN and subnet. Guests can reach the internet but never the office laptops or the order server.

H

half duplex: Sending and receiving cannot happen at the same time. Wi-Fi devices on one channel take turns, so Wi-Fi is effectively half duplex.
hop: One router along a path. traceroute lists the hops, and stars mean that a hop did not answer.
Host addresses (127.0.0.1, 0.0.0.0): 127.0.0.1 is the loopback address, which a host uses to talk to itself: a service listening only there works on the server but can't be reached from Priya's laptop. As a listening address, 0.0.0.0 means "every address this host has"; it is also the source address of a DHCP Discover from a laptop that has no address yet.
Host header: The line in a web request that tells the server which site you want, since one server can host many sites.
hosts file: A local file of addresses and names that programs check before asking DNS. A forgotten entry is why printer.kettleandcrane.com worked only on Alex's laptop.
HTTP: The protocol for web pages, usually on TCP port 80. It is not encrypted.
HTTP headers: Lines of information sent before the page in a web request or reply, such as Server, Content-type or Location. curl -I shows only these.
http.server: Python's built-in web server. python3 -m http.server 8080 -d site serves the site folder on port 8080, and -b chooses which address it listens on.
HTTPS: HTTP inside an encrypted TLS channel, usually on TCP port 443. It is the padlock in the browser, and the shop uses it for logins and checkout.

I

ICMP: The protocol ping uses, which also carries error reports such as "Frag needed". Its header adds 8 bytes, which is why ping's data size plus 28 bytes of headers must fit the MTU.
ip: The Linux tool for the lowest layers: link state (-br link, look for LOWER_UP), addresses (-br addr), routes (route, route get ADDRESS) and the ARP cache (neigh).
ip netns: Linux network namespaces: separate, pretend computers on one machine. ip netns exec laptop CMD runs a command inside the laptop namespace, and ip -n laptop is a short form for ip commands.
ipconfig: The Windows tool that shows addresses, DNS servers and DHCP lease details. /flushdns empties the DNS cache, and /renew asks for a new lease.
iptables: The Linux command that sets packet-filtering and address-translation rules in the kernel, used to build firewalls that drop packets, turn on NAT and forward ports. `-A` appends a rule, `-D` deletes one, `-F` flushes all rules and `-L` lists them.
IPv6: The newer version of IP addresses, such as 2001:db8:4a2c:20::25, stored in AAAA records. Every device can have its own global IPv6 address, so IPv6 needs no NAT.

L

lease: An address that DHCP lends for a set time. The laptop must renew it or give it back.
lease time: How long a DHCP lease lasts, such as 12 hours. Clients try to renew at half the lease time and ask any server once 7/8 has passed.
leases file: dnsmasq's record of who has which address, one line per lease: end time, MAC, IP, host name and client ID.
link-local address: An address from 169.254.0.0/16 that a host gives itself when no DHCP server answers. Seeing one is a clear sign that DHCP failed.
LISTEN: A server program listens when it asks the operating system for a port and waits on it. ss shows such sockets with the state LISTEN.

M

MAC address: The hardware address of a network card, such as `02:00:00:00:00:10`, used to deliver frames on the local network. DHCP servers use it to recognize a device, for example to give it a reserved address.
managed switch: A switch you can configure, for example with VLANs. Alex's plan uses one instead of the switch built into the provider's box.
MASQUERADE: An iptables NAT action in POSTROUTING that replaces a packet's source address with the router's own address on the way out, so the whole office hides behind 203.0.113.10.
metric: A number that ranks routes when several match equally. The lower metric wins.
mixed mode: A Wi-Fi setting that accepts both WPA3 and WPA2 devices. Alex uses it while older devices, such as the scanners, remain.
modem: The part of the provider's box that turns its fiber or cable signal into Ethernet.
MTU: The largest packet a link carries, normally 1,500 bytes. When one link has a smaller MTU, small packets get through but big ones vanish. ping -M do -s finds the limit.
MX: A DNS record naming a domain's mail server, with a preference number where lower is tried first. Email to alex@kettleandcrane.com goes to mail.kettleandcrane.com.

N

NAT: Network address translation: the router rewrites the private source address of outgoing packets to its public address, then reverses the change for the replies. It lets the whole Kettle & Crane office share 203.0.113.10.
nc: Netcat, a small tool that opens TCP or UDP connections and passes text through them. -l listens, -u uses UDP, and -zv tests whether a TCP port succeeds, is refused or times out.
netstat: The Windows and macOS tool for listing sockets, like ss on Linux. On macOS, netstat -rn also shows routes.
nmcli: A Linux command. nmcli device wifi lists nearby Wi-Fi networks with their channels and signal strength.
NOERROR: The DNS status meaning the name exists. With ANSWER: 0, it means the name exists but has no record of the type you asked for.
NS: A DNS record type that names a domain's DNS servers. The small lab server has none, so asking for it returns NOERROR with no answers.
nslookup: A Windows tool that asks DNS like dig does. PowerShell's Resolve-DnsName does the same job.
NTP: The protocol for setting a computer's clock, on UDP port 123.
NXDOMAIN: The DNS status meaning the authoritative server says the name does not exist at all, as with the typo shpo.kettleandcrane.com.

O

Offer: The second DORA message: the DHCP server offers an address and the other settings to the laptop.

P

packet loss: The share of ping packets that got no reply. A few lost points to a bad cable or a crowded Wi-Fi channel, and 100% means no path or a host that is off or ignores ping.
ping: A tool that checks whether an address answers and how long the round trip takes. -c sets the count, -W the wait for each reply, -i the gap between packets and -q prints only a summary. -M do -s tests the MTU.
pktmon: Windows' built-in packet capture tool, the counterpart of tcpdump.
PoE: Power over Ethernet: the switch powers a device such as an access point through its network cable, so no separate power socket is needed.
pool: The range of addresses a DHCP server hands out, such as 192.168.20.20 to .49. Priya's laptop gets its address from it.
port: A number from 0 to 65535 that picks one program on a host. The order page listens on port 8080, written 192.168.20.20:8080.
port forwarding: A router rule that sends one public port to one inside device, such as public port 8080 to 192.168.20.10:8080. Every forwarded port exposes that device to the whole internet.
POSTROUTING: The iptables chain that runs just before a packet leaves the machine. The MASQUERADE rule goes here.
prefix length: The number after the slash in an address such as 192.168.20.10/26, which marks the size of the subnet. DHCP hands it out with the address.
PREROUTING: The iptables chain that runs as a packet arrives, before the routing decision. Port forwarding (DNAT) rules go here.
private address: An address such as 192.168.20.10 that thousands of offices reuse. Private addresses are never routed on the internet, so replies to them have nowhere to go without NAT.
public address: An address that is routed on the internet, such as the single 203.0.113.10 the provider gives Kettle & Crane's router.

R

RDP: Windows remote desktop, on TCP port 3389. It should never be opened to the internet with port forwarding.
record: One piece of a domain's DNS data. It has a name, a type (A, AAAA, CNAME, MX, TXT, NS), a TTL and a value. dig also shows the class, IN for internet.
recursion: The resolver's walk from a root server down to the authoritative server. dig's rd and ra flags show that recursion was wanted and is available.
Request: The third DORA message: the laptop asks for the offered address. It is still a broadcast, so any other DHCP servers learn which offer it took.
reservation: A DHCP setting that always gives one MAC address the same IP address, as Alex does for the label printer at .83. The printer still learns its gateway and DNS server from DHCP.
resolvectl: The Ubuntu tool for systemd-resolved. status shows the real DNS servers, and flush-caches empties the local cache.
resolver: The DNS server your laptop asks, usually the office router. It finds the answer for you and caches it. Its address comes from DHCP and is listed in /etc/resolv.conf.
roaming: Laptops moving from one access point to the next with the same SSID as people walk around a bigger office.
root server: A DNS server at the very top of the name tree, the root, which is written as the final dot. It only knows who runs each TLD, such as com.
round-trip time (RTT): The time a packet takes to reach a host plus the time for its reply to come back. ping prints it for each reply (time=) and as rtt min/avg/max in its summary.
RST: The TCP flag meaning "no; stop," sent at once when nothing listens on a port. Programs report it as "Connection refused."

S

segment: TCP's unit of data. Every segment carries flags and sequence numbers.
seq number: The number TCP gives to the bytes it sends, starting from a random point. seq 1:82 means bytes 1 up to but not including 82.
SERVFAIL: The DNS status meaning the resolver tried but could not get an answer, for example because the domain's own servers are down.
SMB: Windows file sharing, on TCP port 445. It should never be forwarded to the internet.
SMTP: The protocol for sending email, on TCP port 25. Port 587 is for email programs.
socket: An address and a port together, such as 192.168.20.20:8080. A connection is two sockets, one at each end.
SPF: A rule stored in a TXT record that tells other mail servers which servers may send the domain's email, which helps stop forged mail.
ss: Socket statistics: lists a host's sockets. -t is TCP, -u UDP, -l listening only, -n numbers, -p programs and -a all states. ss -tlnp answers "is the service listening, and on which address?"
SSH: Secure remote login to another computer, on TCP port 22.
SSID: A Wi-Fi network's name, such as KC-Staff. One AP can send several SSIDs, each tied to its own VLAN.
status code: The three-digit number in a web server's reply: 200 OK, 301 or 302 moved (the Location: header says where), 404 no such page, and 500 to 599 (5xx) the server itself failed. Any code at all proves the network path works; 4xx and 5xx are the application's problem.
subnet: A block of IP addresses that share a network prefix and form one LAN, such as Kettle & Crane's office subnet `192.168.20.0/26` or shop subnet `192.168.20.64/26`. Hosts in the same subnet reach each other directly, and traffic to other subnets goes through a router.
SYN: The TCP flag that starts a connection and gives the sender's starting byte number.
SYN-ACK: The server's reply to a SYN, with both the SYN and ACK flags set: "agreed; my numbers start here."
systemd-resolved: A small local resolver on Ubuntu, listed as nameserver 127.0.0.53. It caches answers and forwards questions to the real resolver from DHCP.

T

TCP: Transmission Control Protocol, the "tracked parcel." It sets up a connection, numbers every byte, acknowledges what arrives and resends what is lost. Web pages, email and SSH use it.
tcpdump: A command-line tool that captures and shows the packets crossing a network interface. Filters such as `host`, `port`, `tcp` and `udp`, combined with `and`, `or` and `not`, choose which packets to show; `-w` saves a capture to a file and `-r` reads one back. It is often the final judge when other tools disagree, because it shows what really crossed the wire.
three-way handshake: The three segments that open every TCP connection: SYN, SYN-ACK, ACK. Only after them is the request sent.
TIME-WAIT: The state in which the side that closed a TCP connection first keeps its details for about a minute, in case a late segment arrives. Thousands of these on a busy server is normal.
timeout: Nothing answered, so the program gave up after waiting. It points at a firewall dropping packets, a host that is down or a missing route, rather than at a missing service.
TLS: Transport Layer Security, the encrypted channel under HTTPS. After the TCP handshake, the server shows a certificate and both ends agree on secret keys.
top-level domain (TLD): The last part of a name, such as com, org or a country code like us. The root servers point resolvers to each TLD's servers.
traceroute: A tool that lists the routers (hops) on the path to an address. The point where the stars start and never stop is where packets stop. -w and -m keep it quick.
tracert: The Windows version of traceroute.
translation table: The router's record of which inside address and port each NAT connection belongs to, told apart by ports. conntrack -L shows it.
transport layer: The layer where TCP and UDP work and where ports live. It adds a header with the source and destination ports.
TTL: In DNS, the number of seconds an answer may be cached, set by the domain's owner. Alex lowers the shop's TTL to 300 a day before moving it, so the change spreads within five minutes.
ttl (in ping): In ping replies, ttl is a packet field that each router on the way lowers by one; Linux hosts start it at 64, so ttl=63 means one router is on the way. This is different from the DNS TTL.
TXT: A DNS record that holds free text, often used for email rules such as SPF and for ownership checks.

U

UDP: User Datagram Protocol, the "postcard." It sends single datagrams with no connection, no acknowledgment and no error if they are lost. DNS, DHCP, NTP and live calls use it.

V

VLAN: A separate virtual LAN on shared switches. Kettle & Crane's office, shop and guest networks each have their own VLAN and subnet.
VM: Virtual machine: a pretend computer running on your own. Every lab runs in a free Ubuntu VM called netlab, made with Multipass.
VPN: A virtual private network: an encrypted tunnel that carries traffic between a device or site and a remote network over the internet. The extra tunnel headers often give a VPN link a smaller MTU than the usual 1,500 bytes, so large packets may fail while small ones get through.

W

well-known ports: Ports 0 to 1023, used for standard services such as 22 for SSH, 53 for DNS, 80 for HTTP and 443 for HTTPS. On Linux, only root may listen on them.
Wi-Fi: A wireless LAN link over radio that replaces the cable and switch port. IP, DHCP, DNS and TCP work over it exactly as they do over a cable.
Wi-Fi standards (802.11): The IEEE 802.11 family of Wi-Fi versions, each with a simple name: Wi-Fi 5 (802.11ac, 5 GHz only), Wi-Fi 6 (802.11ax, copes better with many devices), Wi-Fi 6E (Wi-Fi 6 on the 6 GHz band), Wi-Fi 7 (802.11be, current, with channels up to 320 MHz and multi-link) and Wi-Fi 8 (802.11bn, still a draft, expected around 2028). A link runs at the newest standard both ends support.
Wireshark: A free program that shows packet captures in a window. It can open tcpdump's -w files.
WPA2: The older Wi-Fi security standard. Devices like the packing-room scanners only support WPA2.
WPA3: The current Wi-Fi security standard, which encrypts traffic and lets only devices that know the secret join. It is required for 6 GHz and for Wi-Fi 7's full features.