Every packet that moves across the internet follows rules older than most developers. Understanding those rules — TCP/IP, routing, switching, DNS, firewalls — separates engineers who debug symptoms from engineers who fix root causes. This guide distills the architecture you actually touch daily.
The TCP/IP Stack in Practice
The four-layer model maps cleanly to modern tooling. Link layer handles Ethernet frames and MAC addresses. Internet layer owns IP addressing and routing decisions. Transport layer splits into TCP for reliability and UDP for speed. Application layer carries HTTP, DNS, TLS, and every protocol your services speak.
💡
TipUse `tcpreplay` to replay captures in staging. Reproduce latency spikes without production risk.
Routing: How Packets Choose Paths
Routers build forwarding tables via static config or dynamic protocols — OSPF for internal networks, BGP for internet exchange. Each hop decrements TTL. Asymmetric routing is normal; design firewalls and load balancers to handle return traffic on different interfaces.
| Protocol | Scope | Metric | Convergence |
|---|---|---|---|
| OSPF | Intra-AS | Cost (bandwidth) | Fast |
| BGP | Inter-AS | Policy/AS-path | Slow |
| RIP | Legacy | Hop count | Very slow |
Switching: Local Delivery
Switches learn MAC-to-port mappings via flooding and learning. VLANs segment broadcast domains. Trunk ports carry tagged frames (802.1Q). Spanning Tree prevents loops; modern fabrics use VXLAN and EVPN for overlay networks across data centers.
"The network is reliable because it assumes the underlying hardware is not.
— John Day, Patterns in Network Architecture
DNS: The Directory Service
DNS resolves names to IPs through a hierarchy: root, TLD, authoritative. Recursive resolvers cache with TTL. EDNS0 enables larger responses and DNSSEC validation. Split-horizon DNS serves different answers internally vs. externally — critical for zero-trust architectures.
⚠️
WarningShort TTLs (< 60s) increase resolver load and expose latency. Balance agility with cache efficiency.
Firewalls and Segmentation
Stateful firewalls track connection tuples (src/dst IP, port, protocol). Default-deny inbound; allow-list outbound. Micro-segmentation applies policy per workload using labels, not IP ranges. eBPF-based tools (Cilium, Calico) enforce L7 policy inside the kernel without sidecars.
✦
Put It Into Practice
Pick one service you own. Map its full network path: client → DNS → load balancer → ingress → pod → database. Capture a trace with `tcpdump` or Wireshark. Identify every hop, protocol, and timeout. Document the flow. Next incident, you'll know exactly where to look.
