Glossary

148 terms from TCP/IP in Depth, Part 2, in plain words, each with the chapter that teaches it.

Search the glossary

A

A record: A DNS record type (number 1) that holds an IPv4 address. The laptop asks for one when it looks up shop.kettleandcrane.com, and the answer is 203.0.113.10.
AA: A DNS header flag meaning the answer comes from a server responsible for the name; tcpdump marks it with `*` and dig shows `aa`. An answer from a cache, such as the office router's, does not have it.
AAAA: A DNS record type (number 28) that holds an IPv6 address. Browsers usually ask for both A and AAAA.
ACK: The TCP flag with bit value 16, meaning the acknowledgment number is valid; tcpdump prints it as a dot. The word also means any segment that acknowledges data, including the handshake's third segment.
acknowledgment number: A 32-bit TCP field naming the next byte a side expects to receive. For example, `ack 87` means "I have bytes up to 86, send 87 next."
ARP: The protocol a machine uses to find the MAC address for an IP address on its own link, such as the laptop asking "who has 192.168.10.1?" (covered in Part 1). Routers use it to reach a next hop, and it makes up the first packets of a fresh page load.
authoritative servers: DNS servers that hold the real records for a domain. In the lab, 203.0.113.53 is the authoritative server for kettleandcrane.com, and its answers carry the AA flag.
autonomous system: A network that runs its own routing and has its own number, such as an internet provider or a cloud company. BGP connects autonomous systems to each other.

B

backoff: Doubling the wait before each new retry after a timeout, for example an RTO of 230 ms, then 460 ms, then 920 ms. It keeps a sender from flooding a path that isn't answering, and it explains the growing gaps between repeated SYNs when a firewall silently drops them.
bandwidth-delay product: Bandwidth multiplied by round-trip time: the amount of data that must be in flight to keep a link busy. Kettle & Crane's 300 Mbit/s line with a 60 ms round trip needs about 2.25 MB in flight.
BBR: A congestion control algorithm from Google that doesn't treat loss as its main signal. It measures the bottleneck's bandwidth and the smallest RTT, sends at that rate, and tries to keep queues empty.
BGP: The routing protocol that connects organizations on the internet. Its routers announce which prefixes their autonomous system can reach, and each network picks paths by its own policies.
bind: A socket call that claims an address and port, so data sent there reaches this program. stock_server.py uses it to claim UDP port 5005, and hold.py to claim TCP port 9000.
broadcast address: An address that reaches every machine on the local network. A new printer with no IP address yet sends its DHCP DISCOVER to 255.255.255.255.
bufferbloat: A queue too large for its line, so packets wait a long time at the bottleneck. In the 20 Mbit/s lab test, a nearly full 100 KB router queue pushed the round trip from under 0.1 ms to 30 to 40 ms.

C

CGNAT: A second layer of NAT that a provider short of IPv4 addresses shares among many customers. It means your own port forwards can't be reached from outside.
chain: In nftables, a list of rules. Each chain lives inside a table and hangs on a hook, like the forward chain Alex creates on the router.
checksum: A header field that lets the receiver detect damage. In UDP and TCP it covers the header, the data and a pseudo-header, so a router doing NAT must recompute it after changing an address.
CLOSE-WAIT: The TCP state of a side that has received the other side's FIN but whose own program hasn't closed yet. hold.py's server stays in it, and many CLOSE-WAIT entries point to a program bug.
CNAME: A DNS record type (number 5) that says one name is an alias for another.
congestion avoidance: The TCP phase after slow start, when cwnd grows slowly, by about one segment per round trip, and is cut after a loss. This "add slowly, cut quickly" pattern lets connections share a link fairly.
congestion window: The sender's own guess at how much data the network can carry in flight without losing packets. The sender may have in flight the smaller of cwnd and the receive window.
connection: An agreement between two TCP programs to exchange data, with starting numbers on both sides. It is named by four numbers: the client's address and port, and the server's address and port.
connection refused: What programs report when a SYN is answered with a RST, usually because nothing listens on that port. It proves the machine is reachable, unlike a silent drop, which shows as the same SYN resent until a timeout.
connection tracking: Linux's table of current connections, used by NAT and firewalls. Each entry records the packet as first sent and what a reply must look like, so the router can send each reply back to the right inside machine.
conntrack: A command that lists the router's connection tracking table (`conntrack -L`) or empties it (`conntrack -F`). If it is missing, install it with `sudo apt install conntrack`.
CUBIC: The default congestion control algorithm on Linux, Windows and macOS. After a loss it cuts cwnd to 70%, then regrows it along a cubic curve: fast at first, slowly near the size of the last loss, then fast again.
cumulative acknowledgment: An acknowledgment number that confirms every byte before it. The laptop's `ack 303` confirmed all 302 bytes of the server's answer at once, so losing an earlier ACK does no harm.

D

data in flight: Data a TCP sender has sent but that has not yet been acknowledged. The sender keeps at most the smaller of cwnd and the receive window in flight.
data offset: A 4-bit TCP field giving the header's length in 4-byte words. A value of 8 means a 32-byte header with 12 bytes of options, and 5 means a plain 20-byte header.
datagram: One UDP message, sent on its own with no connection. A datagram arrives once or not at all, and two datagrams can arrive out of order.
default route: The route 0.0.0.0/0, which contains every address and is used only when no longer prefix matches; its next hop is the default gateway. The roastery router's only way out is a default route to the office router.
delayed ACK: A receiver waiting briefly, up to about 40 ms on Linux, so that one ACK can cover two segments or ride along with data. Combined with Nagle's algorithm, it can make small requests slow.
DF flag: An IPv4 header flag that forbids routers from fragmenting the packet. A router must drop a too-big DF packet and should send back ICMP "fragmentation needed".
DHCP: A protocol over UDP that gives a machine its address, subnet mask, default gateway and DNS server. A client such as the new label printer sends from port 68 to server port 67.
DHCP message types: DHCP's messages: DISCOVER (1) looks for a server, OFFER (2) proposes an address, REQUEST (3) asks for it, and ACK (5) confirms it. discover.py sends a DISCOVER as the printer and prints the router's OFFER.
dig: A command-line DNS lookup tool. `+noall +answer` shows only the answer, `+comments` shows the header, and `@SERVER` asks one server directly, such as the authoritative server 203.0.113.53.
Distance vector: A routing protocol design in which each router tells its neighbors its whole table with distances, and each neighbor adds one hop and keeps the shortest route. It is simple but slow to notice failures; RIP is the old example.
dnat: An nftables NAT rule that rewrites a packet's destination address and port. Alex uses `dnat to 192.168.10.30:80` on the prerouting hook to forward port 8080 to the printer.
DNS: The system that turns names such as shop.kettleandcrane.com into addresses. A question and its answer are normally single UDP datagrams to and from port 53; big answers switch to TCP port 53.
DNS message sections: After its 12-byte header, every DNS message has four sections: question, answer, authority (records naming the responsible servers) and additional (extra helpful records). The header counts each, and tcpdump prints the last three counts as answer/authority/additional, such as 1/0/0.
DoH: Encrypted DNS carried inside web traffic on port 443, so it never shows up in a port 53 capture.
DoT: Encrypted DNS carried over TCP port 853, so it never shows up in a port 53 capture.
duplicate ACK: The same ACK number repeated because a segment is missing and later segments keep arriving. In loss.pcap the laptop sent `ack 54212` again and again until the lost segment was resent.

E

ECE and CWR: Two TCP flags (64 and 128) used for congestion signals. The receiver uses ECE to echo an ECN mark back to the sender, and the sender uses CWR to say it has slowed down.
ECN: A way for a busy router to mark a packet "congested" in its IP header instead of dropping it. The receiver echoes the mark with the ECE flag, and the sender slows down without losing a packet.
EDNS: A DNS extension; dig adds its option to questions to say it can accept UDP answers up to 1,232 bytes instead of the old 512. The option counts as one additional record, which tcpdump shows as [1au].
ephemeral port: A temporary port the system picks for a client, such as 54531 on the laptop. The answer comes back to this port, and a new socket usually gets a different one.
ESTAB: The TCP state of an open connection in which data flows both ways, as shown by ss.

F

fast retransmit: Resending a missing segment as soon as three duplicate ACKs arrive, without waiting for the retransmission timer.
FIN: The TCP flag (bit value 1) that means "I have no more data to send". It closes one direction of a connection and uses up one sequence number, like a SYN.
FIN-WAIT-1, FIN-WAIT-2: TCP states of the side that sent the first FIN. In FIN-WAIT-1 it waits for that FIN to be acknowledged; in FIN-WAIT-2 it has been, and the side waits for the other side's FIN.
flow control: The receiver limiting how much the sender may send, using the window it announces. It keeps a slow program such as slow_reader.py from being flooded with data.
fq_codel: A smarter queue manager that keeps queues short at a bottleneck. It is one remedy for bufferbloat.
fragmentation needed: An ICMP destination unreachable message a router sends when a packet is too big for the next link and its DF flag is set. It tells the sender to shrink its packets, and blocking it causes a PMTU black hole.

H

hairpin NAT: An inside machine using the router's public address to reach another inside machine. It fails on many home routers.
half-close: The state in which one side has sent its FIN but can still receive data until the other side sends its own FIN. A client can use it to signal the end of its request and keep reading the answer.
hook: In nftables, a point in a packet's path through the system where a chain runs, such as forward, prerouting, postrouting or output.

I

ICMP port unreachable: The ICMP error a machine sends back when a UDP datagram arrives for a port where nothing listens. A simple UDP client never sees it, so it just times out.
initial sequence number: The random first sequence number each TCP side picks when a connection opens. Random starting points make it unlikely that an old or forged segment fits into a new connection.
ip route: The Linux command that shows the routing table. With `add`, `del` or `replace` it changes routes, for example `ip route add 10.20.0.0/22 via 10.20.1.226`.
ip route get: A Linux command that asks the routing table which route, interface and source address it would use for a given address, without sending anything. It also shows learned details for that destination, such as a smaller path MTU a server has picked up from an ICMP "fragmentation needed" message.

L

label: One part of a DNS name, stored on the wire with its length byte in front and no dots. shop.kettleandcrane.com is sent as 04 shop 0e kettleandcrane 03 com 00, where the 0 byte ends the name.
LAST-ACK: The TCP state of a side that received the other side's FIN, then sent its own, and is waiting for the final ACK.
lease: How long a DHCP client may keep its address. The lab router offers 43,200 seconds (12 hours), and the client tries to renew after half that time.
link state: A routing protocol design in which each router floods a description of its own links to every router in the area. Each router then has a full map and computes the shortest paths itself; OSPF works this way.
LISTEN: The TCP state of a server socket waiting for SYNs. `ss -tln` lists these ports, and Python's `listen()` puts a socket into this state.
longest prefix match: The rule a router uses to pick a route: of all the routes containing the destination, use the one with the longest prefix. For 10.20.1.130, the /26 route beats the /22 and the default route.

M

masquerade: An nftables NAT action that rewrites a packet's source address to the outgoing interface's own address. On the office router it turns 192.168.10.20 into 203.0.113.1.
metric: A number on a route that breaks ties between routes with the same prefix length; Linux uses the lower one. A route added without a metric has metric 0.
MSS: A TCP option giving the most data a side accepts in one segment. On Ethernet it is 1,500 bytes of MTU minus 40 bytes of IP and TCP headers, which is 1,460.
MTU: The maximum transmission unit: the largest packet a link can carry, 1,500 bytes on Ethernet. A packet bigger than a link's MTU, with the DF flag set, can't pass, so a smaller MTU somewhere on the path (such as 1,400 on a router's LAN side) stops full-size TCP segments.

N

Nagle's algorithm: A TCP rule that holds back a small write while earlier data is still unacknowledged, then sends the waiting bytes together. Combined with delayed ACKs, it can add about 40 ms to each small exchange.
NAT: A router rewriting addresses in packets as they pass. The office router replaces the laptop's private 192.168.10.20 with its public 203.0.113.1, then swaps it back in the replies.
next hop: The neighbor router a route hands packets to, written `via` in `ip route`, such as `via 10.20.1.226`. It must be on a subnet the router is connected to.
nft: The command that configures nftables. `nft add` builds tables, chains and rules, `nft list ruleset` shows them all, and `nft flush ruleset` removes every rule.
nftables: Linux's firewall and NAT system. Rules live in chains, chains hang on hooks and sit inside tables, and you set them up with the nft command.
NXDOMAIN: DNS response code 3, meaning "no such name". dig shows it as `status: NXDOMAIN`, for example when asking for www.kettleandcrane.com in the lab.

O

OSPF: A link state routing protocol common inside companies. It gives each link a cost based on its speed and picks the path with the lowest total cost, not the fewest hops.

P

path MTU discovery: How a sender learns the smallest MTU along a path (the path MTU). A router that can't pass a DF packet sends back ICMP "fragmentation needed", and the sender shrinks its packets.
PMTU black hole: A failure in which big packets vanish because ICMP "fragmentation needed" messages are blocked, so the sender never learns to shrink its segments and keeps resending ones that can never pass. Small transfers work while large ones hang; for example, a shop's home page loads but its big `catalog.txt` never finishes.
pointer: A 2-byte DNS value whose first two bits are set and which points to a name earlier in the message, instead of repeating it. `c00c` means "the name at offset 12".
port: A 16-bit number in the UDP or TCP header that says which program the data is for. For example, port 5005 is the stock service and port 80 is HTTP.
port forward: A NAT rule that sends traffic arriving at the router's public address on one port to an inside machine. Alex forwards port 8080 to the printer's port 80 with dnat.
port translation: NAT changing source ports as well as addresses, so one public address can serve many machines. When the printer's port 40000 was already taken, the router gave it 25267.
postrouting: The nftables hook that runs just before a packet leaves, after the outgoing interface has been chosen. It is the right place for masquerade.
prerouting: The nftables hook that runs as a packet arrives, before the router chooses a route. dnat rules go here so the routing decision uses the new address.
private range: An address block such as 192.168.10.0/24 that many offices reuse and that internet routers don't carry routes for. Machines with these addresses need NAT to reach the internet.
pseudo-header: The IP source and destination addresses, the protocol number and the length, which are included in the UDP and TCP checksums. Because of it, a datagram delivered to the wrong machine fails the check.
PSH: The TCP flag (bit value 8) that says "this is the end of what the program wrote, hand it on now". tcpdump prints it as P.

Q

QR: The DNS header flag that is 0 in a question and 1 in an answer.
query ID: A 16-bit number in a DNS question that the answer repeats, so the asker can match each answer to its question. For example, a question with ID 24626 gets an answer that also carries 24626.
queueing delay: Time a packet spends waiting in a router's queue before the line can send it. In the 20 Mbit/s lab test it added 30 to 40 ms to the round trip; too much of it is bufferbloat.
QUIC: A transport that runs over UDP port 443 and does its own resending and encryption. HTTP/3 runs on top of it.

R

RA: The DNS header flag in which a server says it is willing to do recursion for the asker.
rcode: The last 4 bits of the DNS flags, giving the result. 0 means success (NOERROR) and 3 means NXDOMAIN.
RD: The DNS header flag the asker sets to say "please find the answer for me". tcpdump shows it as `+` after the ID.
receive buffer: The space where the system keeps arriving data until the program reads it. The window a side announces is the free space in this buffer.
record type: The kind of DNS record being asked for or given, such as A (1), NS name server (2), CNAME (5), MX mail (15) and AAAA (28). Class 1, IN, means internet.
recursive resolver: A DNS server that finds answers for its clients by asking other servers, then caches them for their TTL. In the lab, the office router's dnsmasq plays this role.
Recv-Q: An ss column showing bytes that have arrived but the program hasn't read yet. A large Recv-Q points at a slow receiving program.
recvfrom: A socket call that waits for incoming data. For UDP, `recvfrom` also returns the sender's address and port; `recv` reads from a TCP connection.
relative sequence numbers: The sequence numbers tcpdump shows by default: each side's real numbers minus its ISN, so they start near 1. Add `-S` to see the real (absolute) numbers.
retransmission: Sending the same data again because it wasn't acknowledged, like the repeated SYN to a dropped port or the resent segment 54212:55672 in loss.pcap.
retransmission timeout: The timer that triggers a resend when no ACK comes. It is the smoothed round trip plus four times its variation (that part at least 200 ms on Linux), and it doubles on each retry.
root server: The DNS server a recursive resolver asks first, to learn which servers handle a top-level domain such as .com.
routing protocol: A protocol routers use to tell each other what they can reach, so routes update by themselves. Examples are RIP, OSPF and BGP.
routing table: A machine's list of destination prefixes, each with where to send matching packets: a connected link (`dev`) or a next hop (`via`).
RST: The TCP flag (bit value 4) that aborts a connection at once. A SYN to a port where nothing listens gets a RST, which programs report as "connection refused".
RTT: The time for a packet to reach the other side and for its answer to come back. TCP measures it for its retransmission timer, and throughput is window ÷ RTT.

S

SACK: A TCP option in an ACK that lists byte ranges received after a gap, such as `{55672:57132}`. With it the sender can resend only the missing segments.
SACK permitted: A TCP option in the SYN that offers to use SACK. Both sides must offer it before either one uses SACK.
segment: One TCP packet. A full segment on Ethernet carries 1,460 bytes of data.
Send-Q: An ss column showing bytes the program has written that haven't been acknowledged yet, including bytes still waiting to be sent.
sendto: A socket call that sends data. For UDP, `sendto` sends a datagram to a given address and port; for TCP, `sendall` sends all the data on a connection.
sequence number: A 32-bit TCP field giving the number of a segment's first byte. `seq 1:87` covers bytes 1 to 86.
setsockopt: A call that changes a socket setting, such as SO_RCVBUF for the receive buffer size or TCP_NODELAY to turn off Nagle's algorithm.
slow start: The start of a TCP connection, when cwnd begins at 10 segments and doubles every round trip until a loss or ssthresh. Despite its name, it is fast.
socket: A program's handle on the network. You create one, then send and receive through it, as stock_server.py does.
ss: The Linux command that lists sockets. `-tln` shows listening TCP ports, `-tan` shows connections and their states, and `-tin` adds TCP internals such as cwnd and rtt.
ssthresh: The cwnd size, set at the last loss, at which slow start ends and congestion avoidance takes over.
static routes: Routes typed in by hand with `ip route add`. They are gone after a reboot unless saved, and they suit small sites like Kettle & Crane.
stub resolver: The DNS client on each machine, such as the laptop. It asks one server and takes whatever answer comes back.
SYN: The TCP flag (bit value 2) that opens a connection and carries the sender's ISN. It is the handshake's first segment and counts as one byte.
SYN flood: An attack that sends masses of SYNs to fill a server's connection table. It shows as many SYN-RECV entries in ss.
SYN-ACK: The handshake's second segment, from the server. It has SYN and ACK set, carries the server's ISN, and acknowledges the client's ISN + 1.
SYN-RECV: The server's TCP state after it has answered a SYN with a SYN-ACK and is waiting for the final ACK. Many of them point to a firewall problem or a SYN flood.
SYN-SENT: The client's TCP state after it has sent its SYN and is waiting for the SYN-ACK.
sysctl: A Linux command that shows or changes kernel settings. For example, `sysctl net.ipv4.tcp_congestion_control` shows the default congestion control algorithm.

T

table: In nftables, the container that holds chains, such as the `nat` table Alex creates on the router.
tbf: A tc queue type that sends at most a set rate and holds up to a set number of bytes. Alex uses it to make a lab link act like a 20 Mbit/s line.
TC: The DNS header flag meaning the answer didn't fit in one datagram, so the client should ask again over TCP.
tc: The Linux traffic control command, which sets up queues on an interface. `tc qdisc add ... tbf` slows a link down and `tc qdisc del` removes the limit.
TCP: The transport that turns IP's packets into a reliable, ordered stream of bytes, by numbering every byte, having the receiver confirm what arrived, and resending what is missing. Its IP protocol number is 6.
TCP_NODELAY: A socket option that turns off Nagle's algorithm. Interactive programs such as SSH and games use it so small messages go out at once.
tcpdump: A packet capture tool that prints packets as summary lines or saves them to a .pcap file. Options used here include -S, -ttttt, -i any, -w and filters such as `greater 1000`.
three-way handshake: How a TCP connection opens: SYN, SYN-ACK, ACK. It swaps the two sides' ISNs and costs one round trip before any data can be sent.
throughput: How much data a connection carries per second. It is limited to the window divided by the RTT, so a 64 KB window over 25 ms gives about 21 Mbit/s.
TIME-WAIT: The state the side that closed first keeps for 60 seconds on Linux. It lets that side re-acknowledge a resent FIN and stops late segments from confusing a new connection.
timestamps: A TCP option carrying two 4-byte clocks, used to measure the round trip. Real hosts usually send it, but the lab turns it off to keep captures simple.
traceroute: A tool that lists each router on the path to an address. From the scale it showed three hops: the roastery router, the office router and the server.
TTL: In a DNS record, how many seconds a cache may keep the answer, such as 300. A cache counts it down, which is why Priya still reached the old server after the move.

U

UDP: A simple transport that adds only port numbers and a checksum to IP, in an 8-byte header. It has no connection, ordering or resending; its IP protocol number is 17.

W

window: A 16-bit TCP field giving how many more bytes the sender of the segment can accept beyond the acknowledged byte. It is the free space in that side's receive buffer.
window probe: A tiny segment the sender sends now and then during a zero window, so the receiver repeats its current window and a lost update can't stall both sides forever.
window scaling: A TCP option, announced in the SYN, that multiplies every later window from that side by 2 to the power of `wscale`. With `wscale 10`, `win 63` means 64,512 bytes.
window update: An ACK with the same number but a bigger window, sent when the receiving program reads and frees buffer space. It restarts the data flow after a zero window.

Z

zero window: A window of 0, meaning "stop, my buffer is full". It points to a receiving program that reads too slowly, not to network loss.