Networking

From the bottom up, the seven layers are physical (cables and radio), data link (Ethernet and Wi-Fi between neighbouring devices), network (IP addresses and routing), transport (TCP and UDP), session, presentation and application (HTTP, DNS, SSH). Each layer relies only on the one below it, which is why a website works the same over Wi-Fi, fibre or a mobile network.

The internet actually runs on the simpler four-layer TCP/IP model, which merges the top three OSI layers into one application layer and the bottom two into a link layer. The OSI numbers survive as shorthand: a 'layer 2' switch moves Ethernet frames, a 'layer 4' load balancer routes by address and port, and a 'layer 7' firewall reads the requests themselves.

IPv4 addresses look like 203.0.113.7: four numbers from 0 to 255, about 4.3 billion addresses in total, which the world ran short of years ago. IPv6 addresses look like 2001:db8::1 and are 128 bits long, enough to give every device its own address many times over. Many networks now run both side by side.

A public address can be reached across the internet. Private ranges such as 192.168.x.x and 10.x.x.x are reused inside homes and offices, and the router shares one public address between them through NAT (network address translation). NAT is why a home server cannot be reached from outside without port forwarding, and why video calls need helpers such as STUN and TURN servers to connect.

Devices usually get their address automatically from the router through DHCP, and DNS turns names such as example.com into addresses. An address shows roughly where a device connects from, which is how websites guess a visitor's country, but it does not pinpoint a person.

Before any data moves, TCP opens a connection with a three-way handshake (SYN, SYN-ACK, ACK). It then numbers every byte, waits for acknowledgements, resends whatever goes missing and slows down when the network is congested. The app on each end simply sees a clean, ordered stream of data.

Web pages over HTTP/1.1 and HTTP/2, email, SSH and database connections all run on TCP. The price of reliability is delay: a single lost packet holds up everything behind it until it is resent (head-of-line blocking). That is why video calls and online games use UDP instead, and why HTTP/3 moved to QUIC, which rebuilds reliability on top of UDP.

UDP sends each packet (a datagram) on its own: no handshake, no acknowledgements, no resending and no ordering. A lost packet is simply gone, and the app decides whether that matters. Its header is only 8 bytes, against at least 20 for TCP, and there is no connection to keep track of.

That suits real-time traffic, where a late packet is as useless as a lost one. Video calls, online games and live streams run over UDP, and so do most DNS lookups. QUIC, the base of HTTP/3, builds its own reliability on top of it. Some office networks block UDP, which is one reason WebRTC can fall back to TURN relays over TCP or TLS.

A port is a number from 0 to 65535 attached to every TCP or UDP connection. Common services have agreed defaults: 80 for HTTP, 443 for HTTPS, 22 for SSH, 53 for DNS, 587 for sending email and 5432 for PostgreSQL. A server listens on its port, and a firewall decides which ports can be reached from outside.

Numbers below 1024 are the well-known range, and on Linux opening one needs admin rights. Port forwarding on a router sends traffic that arrives on a public port to a device inside the network. Leaving admin ports such as 22 (SSH) or 3389 (Windows Remote Desktop) open to the whole internet invites a constant stream of automated login attempts.

Devices on a LAN (local area network) reach each other directly through switches and Wi-Fi access points, and a router joins the LAN to other networks. The internet is a WAN (wide area network) on a global scale, and companies also build private WANs between offices with leased lines, SD-WAN services or site-to-site VPNs.

A subnet is a block of addresses written in CIDR notation: 192.168.1.0/24 fixes the first 24 bits, which leaves 256 addresses, 254 of them usable by devices. Subnets and VLANs (virtual LANs that share the same switches) keep groups of devices apart. Offices often give guests, printers and cameras their own VLANs, so a problem on one cannot spread to the rest of the network.

Latency is usually measured as round-trip time in milliseconds, the 'ping'. Bandwidth is capacity, in megabits per second: a wider pipe speeds up downloads but does nothing for delay. Jitter is the variation in delay from one packet to the next, and packet loss is the share of packets that never arrive at all.

Web pages feel slow mostly because of latency rather than bandwidth. A new connection spends round trips on the TCP and TLS handshakes before any data moves, and a page may fetch dozens of files. That is why CDNs serve content from servers near the visitor, and why HTTP/2 and HTTP/3 reuse connections and cut handshake round trips. Video calls and online games feel jitter and packet loss most, so apps keep a small buffer that trades a little extra delay for smooth playback.

A forward proxy sits in front of clients. Companies and schools use one to filter, log or cache web traffic, and websites see the proxy's address instead of each user's. Unlike a VPN, a proxy usually handles only web traffic or chosen apps, and it does not have to encrypt anything. Squid is a long-standing open-source example.

A reverse proxy sits in front of servers. Visitors connect to it, and it forwards each request to one of the app servers behind it, handling HTTPS certificates, caching, compression and load balancing on the way. Nginx, HAProxy, Caddy and Traefik are common self-hosted choices, while Cloudflare and other CDNs act as a reverse proxy for a whole site and filter attacks before they reach it.

A VPN client wraps each packet in an encrypted envelope and sends it to a VPN server, which unwraps it and passes it on. Others on the same café Wi-Fi, and the internet provider, see only scrambled traffic heading to that server. Common protocols are WireGuard (small, fast and built into Linux), IPsec (built into most business routers and firewalls) and OpenVPN (older and flexible, over TCP or UDP).

VPNs come in a few shapes. Site-to-site VPNs join office networks over the internet. Remote-access VPNs let staff reach internal systems from home. Consumer VPN services route browsing through their own servers to hide it from the local network or to appear in another country. Mesh VPNs such as Tailscale (built on WireGuard) connect devices directly to each other where they can, so there is no central VPN server to run.

A VPN moves trust rather than removing it: the VPN provider can now see what the local network used to see. It does not make anyone anonymous to websites, which still recognise logins and cookies, and it adds delay, most of all when traffic detours through a distant server. Zero trust access tools, which check each app login separately, are a common alternative to one office-wide VPN.

Rules are written in terms of addresses, ports and protocols: allow 443 from anywhere, allow 22 only from the office, block everything else. Most modern firewalls are stateful, which means they remember outgoing connections and let the replies back in automatically. Home routers do this by default, which is one reason devices at home cannot be reached directly from the internet.

Firewalls come in several forms: software on each machine (Windows Defender Firewall, the macOS firewall, ufw and nftables on Linux), cloud firewall rules and security groups on AWS, Google Cloud and Azure, and hardware appliances at the edge of an office network. Next-generation firewalls also recognise the apps inside the traffic, and a web application firewall (WAF) specialises in attacks on websites.

A sound starting point is to deny everything inbound and open only what each service needs: 80 and 443 for a website, and SSH only from known addresses or through a VPN. Databases should never be open to the whole internet; managed database services usually offer an IP allow list as an extra layer on top of passwords.

SSH encrypts everything between your terminal and the remote machine, which listens on port 22 by default. Passwords work, but key pairs are the norm: the private key stays on your computer and the public key sits on the server, so no secret crosses the network. The first connection records the server's fingerprint, so a machine that later pretends to be that server triggers a warning.

Beyond a remote shell, SSH copies files (scp and SFTP), carries Git pushes to services such as GitHub, and forwards ports, so a database that only listens locally on a server can be reached through the encrypted tunnel. OpenSSH is the standard implementation and comes with Linux, macOS and Windows. Servers open to the internet should switch off password logins and accept keys only.