Protocol
A set of rules and conventions governing communication between network entities. Defines format, timing, sequencing, and error control of data transmission.
Think: "Language of computers"
Bandwidth
The maximum data transfer rate of a network or channel, measured in bits per second (bps). In analog systems, it's the difference between highest and lowest frequencies of the signal.
Think: "Width of the data pipe"
Latency / Delay
The total time for data to travel from source to destination. Components: Propagation delay (distance/speed) + Transmission delay (size/bandwidth) + Queuing delay + Processing delay.
Think: "How long data takes to travel"
CRC (Cyclic Redundancy Check)
Error-detection technique using polynomial division over GF(2). Sender appends remainder (CRC bits) to data; receiver divides received frame and checks if remainder = 0 (no error).
Detects all burst errors ≤ r bits; r = degree of generator polynomial
Hamming Code
Single-error-correcting code that inserts parity bits at positions 2^k (1,2,4,8...). Formula: 2^r ≥ m+r+1 where m=data bits, r=parity bits. Can detect 2-bit errors with an extra overall parity bit.
Parity bits at positions 2^k; covers specific bit groups
Framing
Dividing continuous bit stream into discrete frames at the Data Link Layer. Methods: (1) Character count, (2) Flag bytes with byte stuffing, (3) Bit stuffing — insert 0 after five consecutive 1s, (4) Physical layer coding violations.
DLL wraps bits into addressable, manageable chunks
Piggybacking
Technique of attaching an ACK to outgoing data frame in opposite direction, rather than sending a separate ACK frame. Cuts number of frames in half for bidirectional traffic.
ACK rides piggyback on data — one frame, two purposes
CSMA/CD
Carrier Sense Multiple Access/Collision Detection. Wired Ethernet (802.3). Process: Sense medium → Transmit → If collision: send jam signal → Wait exponential backoff time → Retry. Minimum frame size = 2×Tp×Bandwidth (ensures sender is still transmitting when collision is detected).
Listen before speak, detect collision immediately, backoff
CSMA/CA
Carrier Sense Multiple Access/Collision Avoidance. Wi-Fi (802.11). Cannot detect collision while transmitting wirelessly. Uses DIFS wait + random backoff + RTS/CTS mechanism to prevent collisions proactively.
Wireless can't detect mid-transmission; must avoid beforehand
Routing
Process of selecting best path for packets from source to destination across interconnected networks. Performed at Layer 3 by routers. Static routing (manual) vs Dynamic routing (RIP, OSPF, BGP).
GPS of networking — finds best path
DVR (Distance Vector Routing)
Dynamic routing algorithm based on Bellman-Ford. Each router maintains table of distances to all destinations and shares it with directly connected neighbors periodically. Slow convergence; suffers count-to-infinity problem.
Share tables only with neighbors (not whole network) — RIP uses DVR
Link State Routing
Each router floods Link State Packets (LSPs) to entire network. All routers build identical complete topology map and independently run Dijkstra's SPF algorithm to compute shortest paths. Fast convergence.
Everyone knows everything — OSPF uses link state
ARP (Address Resolution Protocol)
Resolves IPv4 addresses to MAC addresses within same subnet. Sender broadcasts ARP Request: "Who has IP X? Tell IP Y." Device with IP X sends ARP Reply with its MAC. Result cached in ARP table (with TTL).
IP → MAC. Reverse: RARP (MAC → IP, now obsolete)
NAT (Network Address Translation)
Translates private IP addresses to public IP addresses in packet headers. PAT (Port Address Translation/Overloading) maps many private IPs to one public IP using unique port numbers. Essential for IPv4 conservation.
Many private IPs → one public IP; port numbers distinguish connections
TCP (Transmission Control Protocol)
Connection-oriented, reliable, full-duplex transport protocol. Features: error detection+recovery, flow control (sliding window), congestion control (slow start/AIMD), ordered delivery, 3-way handshake, 4-way close. Header minimum: 20 bytes.
Reliable delivery guaranteed — used for HTTP, FTP, SMTP
UDP (User Datagram Protocol)
Connectionless, best-effort transport protocol. No connection setup, no acknowledgments, no ordering, no flow/congestion control. Only 8-byte header: Source Port | Dest Port | Length | Checksum. Fast but unreliable.
Fire-and-forget — used for DNS, VoIP, streaming, gaming
Three-Way Handshake
TCP connection establishment: (1) Client → SYN(seq=x) → Server. (2) Server → SYN-ACK(seq=y, ack=x+1) → Client. (3) Client → ACK(ack=y+1) → Server. Establishes sequence numbers for both directions.
SYN → SYN-ACK → ACK = synchronized, connection open
Four-Way Handshake (TCP Close)
TCP connection termination: (1) Initiator → FIN. (2) Receiver → ACK. (3) Receiver → FIN (when ready). (4) Initiator → ACK. 2-minute TIME_WAIT state ensures all packets are flushed before socket reuse.
FIN → ACK → FIN → ACK = both directions closed
Flow Control
End-to-end mechanism preventing a fast sender from overwhelming a slow receiver. TCP receiver advertises Receive Window (RWND) in each ACK. Sender cannot have more unacknowledged data than min(CWND, RWND).
Receiver controls sender's speed via window advertisement
Congestion Control
Network-level mechanism preventing routers from being overwhelmed. TCP maintains Congestion Window (CWND). Algorithms: Slow Start (exponential growth), Congestion Avoidance (linear growth/AIMD), Fast Retransmit, Fast Recovery.
Network controls sender's speed via CWND adjustment
DNS (Domain Name System)
Globally distributed hierarchical database translating domain names to IP addresses. Hierarchy: Root (.) → TLD (.com, .in) → SLD (google.com) → Subdomain. Record types: A (IPv4), AAAA (IPv6), MX (mail), CNAME (alias), NS (nameserver).
Phone book of the internet — distributed + cached
SNMP (Simple Network Management Protocol)
Application-layer protocol (UDP 161/162) for monitoring and managing network devices. Manager sends GET/SET to Agents. Agent sends unsolicited TRAP to manager on events. MIB stores managed objects as OID tree. Versions: v1, v2c, v3 (secure).
GET=query agent, SET=configure agent, TRAP=agent alerts manager
FTP (File Transfer Protocol)
Application-layer protocol using TWO TCP connections: Control connection (port 21, commands) and Data connection (port 20 active / ephemeral passive). Active FTP: server initiates data. Passive FTP: client initiates data (firewall-friendly).
Two channels: commands on 21, data on 20 (active) or random (passive)
HTTP (HyperText Transfer Protocol)
Stateless application-layer protocol for the World Wide Web (port 80). Request-response model. Methods: GET, POST, PUT, DELETE, HEAD. HTTP/1.1 adds persistent connections. HTTP/2 adds multiplexing. HTTPS = HTTP over TLS (port 443).
Stateless client-server protocol for web pages
SMTP (Simple Mail Transfer Protocol)
Push protocol for sending email (port 25, 587). Used for: client to mail server and mail server to mail server. Commands: HELO, MAIL FROM, RCPT TO, DATA, QUIT. Contrast with POP3/IMAP which are pull (receiving) protocols.
SMTP = push outgoing mail; POP3/IMAP = pull incoming mail
Multiplexing
Sharing a single physical link among multiple signals/connections. FDM: each user gets frequency band. TDM: each user gets time slot. WDM: wavelength-division for optical fiber. CDMA: unique spreading codes. Statistical TDM: dynamic slot allocation.
Many inputs → one shared medium → demultiplex at receiver
Propagation Delay
Time for a signal bit to travel from sender to receiver through physical medium. Tp = Distance / Propagation Speed. In copper: ~2×10⁸ m/s (2/3 of c). In fiber: ~2×10⁸ m/s. Tp is fixed for a given link length.
Physical travel time of the signal — fixed for a given distance
Transmission Delay
Time to push all bits of a frame onto the link. Tt = Frame Size (bits) / Bandwidth (bps). For 1000-bit frame on 1 Mbps link: Tt = 1 ms. Different from propagation delay — Tt depends on bandwidth and frame size, not distance.
Time to pour all bits onto the wire — depends on bandwidth
Token Bucket
Traffic policing/shaping algorithm. Tokens generated at constant rate r (tokens/sec). Each packet consumes one token. Bucket capacity b = maximum burst size. Allows bursts up to b packets when tokens are saved. Output rate ≤ r over long term, but can burst to line rate short term.
Earn tokens → spend tokens to transmit → allows burst up to b
Leaky Bucket
Traffic shaping algorithm. Incoming bursty packets enter a FIFO queue (bucket). Packets leak out at constant rate r regardless of arrival pattern. If bucket overflows, packets are dropped. Completely smooths traffic — no bursts at output.
Bucket drains at constant rate — output always smooth, no bursts
Encapsulation
Process of adding headers (and sometimes trailers) at each layer as data passes down the OSI stack: Data → [TCP] Segment → [IP] Packet → [Ethernet] Frame → Bits. Decapsulation removes headers as data moves up at receiver.
Each layer wraps data in its own envelope before passing down
ICMP (Internet Control Message Protocol)
Network layer protocol for error reporting and diagnostics. Encapsulated in IP (Protocol=1). Key messages: Echo Request/Reply (ping), Destination Unreachable, Time Exceeded (traceroute), Redirect, Source Quench. Not for data transfer.
Error postcard of the internet — ping and traceroute use it
DHCP (Dynamic Host Config Protocol)
Automatically assigns network configuration to hosts. DORA process: Discover (broadcast) → Offer (server proposes IP) → Request (client accepts) → Acknowledge (server confirms). Assigns: IP, subnet mask, default gateway, DNS server, lease time.
DORA = Discover, Offer, Request, Acknowledge
Jitter
Variation in packet arrival times (delay variation). High jitter disrupts real-time applications (VoIP, video conferencing, gaming). Caused by variable queuing delays. Mitigated by playout buffers at receiver. Key QoS parameter.
Inconsistent delay — enemy of VoIP and video calls
MTU (Maximum Transmission Unit)
Maximum size of a packet/frame that can be transmitted over a network link. Ethernet MTU = 1500 bytes. If IP packet > MTU, it must be fragmented. Path MTU Discovery (PMTUD) finds smallest MTU along path to avoid fragmentation.
Largest data chunk the link can carry in one shot
Collision Domain
Network segment where all devices share the same physical medium and can cause collisions. Hubs extend collision domain. Switches and bridges break collision domains (each port = separate collision domain). Reduces with segmentation.
All devices in one collision domain compete for same medium
Broadcast Domain
Set of all devices that receive each other's broadcast frames. Switches do NOT break broadcast domains — all switch ports in same VLAN are in same broadcast domain. Routers DO break broadcast domains. Excessive broadcasts → broadcast storm.
Routers break it; switches extend it (unless VLANs used)
Store-and-Forward vs Cut-Through
Switch operation modes. Store-and-Forward: receives entire frame, checks CRC, then forwards — reliable but high latency. Cut-Through: starts forwarding after reading destination MAC (first 6 bytes) — low latency but may forward corrupt frames.
Store-forward = check then send; cut-through = send as you read
OSPF (Open Shortest Path First)
Interior Gateway Protocol using Link State algorithm (Dijkstra's SPF). Routers exchange LSAs (Link State Advertisements), build identical LSDB, compute shortest paths. Uses IP Protocol 89 (not TCP/UDP). Supports hierarchical routing with areas.
Link State protocol → complete topology map → Dijkstra's algorithm
RIP (Routing Information Protocol)
Distance Vector routing protocol. Metric = hop count (max 15 hops; 16 = infinity). Sends full routing table to neighbors every 30 seconds. Slow convergence. Suffers count-to-infinity. Simple and widely supported. Uses UDP port 520.
DVR protocol — max 15 hops, shares table every 30s
TELNET
Application layer protocol for remote terminal access over TCP port 23. All communication (including passwords) sent in plaintext — completely insecure. Uses NVT (Network Virtual Terminal) standard for character set. Replaced by SSH.
Remote terminal access — insecure (plaintext), use SSH instead
Count-to-Infinity Problem
DVR flaw: when a link fails, routers incrementally count up to infinity (by 1 each exchange) before concluding route is dead. Example: A-B-C, B-C fails. A tells B it can reach C via A (learned from B!) → loop. Fixes: split horizon, poison reverse, hold-down timers.
Routers keep counting higher thinking route exists — DVR's Achilles heel
Split Horizon
DVR loop-prevention rule: do NOT advertise a route back to the neighbor you learned it from. If router A learned "C is 3 hops via B," A should not tell B that it can reach C. Prevents routing loops and speeds up convergence.
Don't advertise a route back to where you learned it
Classful vs Classless Addressing
Classful: Fixed prefix lengths (A=/8, B=/16, C=/24). Wasteful (Class B gives 65534 hosts, often too many). Classless (CIDR): Variable-length subnet masks (VLSM), any prefix length. 192.168.10.0/26 gives 62 hosts. Classless is universal today.
Classful = rigid sizes; CIDR = flexible, efficient allocation
VPN (Virtual Private Network)
Extends private network over public network. Creates encrypted tunnel (IPSec, SSL/TLS) through internet. Types: Site-to-Site VPN (connects two offices), Remote Access VPN (employee connects to office network). Provides confidentiality, integrity, authentication.
Encrypted tunnel through public internet — acts like private link
RSA (Rivest-Shamir-Adleman)
Asymmetric public-key cryptosystem. Key generation: pick primes p,q → n=pq → φ(n)=(p-1)(q-1) → choose e coprime to φ(n) → d=e⁻¹ mod φ(n). Encrypt: C=Mᵉ mod n. Decrypt: M=Cᵈ mod n. Security: factoring large n is computationally infeasible.
Public key (e,n) encrypts; Private key (d,n) decrypts — asymmetric