Skip to content

Network basics#

flowchart LR
  APP[App layer<br/>HTTP / gRPC / DNS]
  TLS[TLS]
  L4[Transport<br/>TCP / UDP / QUIC]
  L3[Internet<br/>IP / ICMP]
  L2[Link<br/>Ethernet / Wi-Fi]
  APP --> TLS --> L4 --> L3 --> L2

  classDef s fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef e fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  class APP,TLS s;
  class L4,L3,L2 e;

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class APP edge;
    class TLS,L4,L3,L2 service;

The 4-ish layers of the internet stack you'll actually discuss in an interview: application (HTTP / gRPC / DNS) on top of TLS on top of transport (TCP / UDP / QUIC) on top of IP on top of the link layer.

OSI 7-layer network model from Physical at layer 1 to Application at layer 7
OSI 7-layer reference model. In practice, TCP/IP collapses layers 5-7 into one Application layer. Source: Wikimedia Commons (CC BY-SA)
Animated TCP three-way handshake showing SYN, SYN-ACK, ACK sequence between client and server
TCP three-way handshake: SYN (client initiates), SYN-ACK (server confirms + own SYN), ACK (client confirms). After this, data transfer begins. Source: Guojunzheng, Wikimedia Commons (CC BY-SA 3.0)

TCP vs UDP vs QUIC#

flowchart TB
  subgraph TCP[TCP - 1974]
    T1[Connection-oriented]
    T2[Reliable + ordered]
    T3[Congestion control]
    T4[3-way handshake]
    T5[HoL blocking under loss]
  end
  subgraph UDP[UDP - 1980]
    U1[Connectionless]
    U2[Unreliable, unordered]
    U3[Lowest overhead]
    U4[Picked by DNS, NTP, gaming, video]
  end
  subgraph QUIC[QUIC - 2021]
    Q1[UDP-based, app-layer reliability]
    Q2[Built-in TLS 1.3]
    Q3[Multiplexed streams, no HoL]
    Q4[Connection migration]
    Q5[0-RTT resumption]
  end

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class U4 edge;
    class T1,T2,T3,T4,T5,U1,U2,U3,Q1,Q2,Q3,Q4,Q5 service;

TCP three-way handshake#

sequenceDiagram
  participant C as Client
  participant S as Server
  C->>S: SYN  (seq=x)
  S-->>C: SYN+ACK (seq=y, ack=x+1)
  C->>S: ACK  (ack=y+1)
  Note over C,S: connection established, 1.5 RTT

Add TLS 1.3 and you pay 1 extra RTT (or 0 with session resumption).

IP routing - at a glance#

  • Subnet = network mask describing a range (e.g. 10.0.1.0/24 = 256 addresses).
  • Routing table decides next hop per destination prefix; longest-prefix match wins.
  • BGP is the protocol routers use to exchange reachability between autonomous systems (ASes); it's how the public internet figures out paths.
  • Anycast advertises the same IP from multiple POPs; BGP routes each client to the closest POP. Used by DNS roots, CDNs, big cloud edges.

NAT, ports, and connection identity#

  • A TCP connection is uniquely identified by the 5-tuple (src_ip, src_port, dst_ip, dst_port, proto).
  • NAT rewrites src_ip + src_port to map private addresses to a public one - many devices share one IP.
  • This makes incoming connections from outside hard → STUN / TURN / hole-punching for peer-to-peer (WebRTC).

Latency model#

total = transmission + propagation + queueing + processing
- Propagation: distance / speed_of_light (~5 ms per 1000 km in fibre). - Transmission: bytes / bandwidth. - Queueing at routers - worst at congestion. - Processing at each hop - tiny on modern routers.

Same-DC RTT ≈ 0.5 ms, cross-region 50-150 ms - see capacity-planning.

TCP congestion control (one line each)#

  • Reno - additive increase, multiplicative decrease (AIMD).
  • CUBIC - Linux default; better on high-bandwidth long-fat networks.
  • BBR - Google; models bottleneck bandwidth + RTT instead of using loss as a signal. Major bandwidth wins on lossy paths.

Multiplexing across the stack#

Layer Multiplexing primitive
IP source / dest IP
TCP / UDP / QUIC source / dest port
HTTP/2 / 3 streams within one connection
Application session tokens, user ids

Practical performance levers#

  • Keep-alive - reuse TCP connection across requests.
  • HTTP/3 (QUIC) on lossy / mobile networks.
  • Edge / CDN to cut propagation distance.
  • Anycast + BGP for global service announcements.
  • TCP window scaling + BBR for long-fat networks.

Glossary & fundamentals#

Tag Concept Page
HLD HTTP / TLS protocols http-protocols
HLD Load balancer (L4 vs L7) load-balancer
HLD CDN (anycast + edge) cdn
HLD Real-time protocols (TCP-based WS/SSE, UDP-based WebRTC) realtime-protocols
HLD Capacity planning (numbers + Little's Law) capacity-planning

Quick reference#

Numbers worth memorising#

  • Light in fibre: ~200,000 km/s → 5 ms per 1000 km.
  • 1 Gbps ≈ 125 MB/s.
  • TCP slow-start: 10 segments initial window (modern default).
  • TLS 1.3 handshake: 1 RTT (0-RTT for resumption).
  • Cross-continent RTT: 100-200 ms (real numbers).
  • TCP retransmit timer: starts ~200 ms, doubles.

Common pitfalls#

  • Confusing bytes vs bits (network speeds quote bits).
  • Forgetting TCP slow-start hurts short connections.
  • Assuming UDP "is faster" without considering app-layer reliability cost.
  • Long-distance app servers with synchronous serial writes - RTTs compound.

Useful command-line#

  • traceroute - see hops + latency to a host.
  • dig - DNS resolution path.
  • mtr - combines ping + traceroute.
  • ss -s / netstat - local socket state.
  • tcpdump / Wireshark - packet capture.

Refs#

  • "TCP/IP Illustrated" (Stevens) - the classic.
  • "High Performance Browser Networking" - Ilya Grigorik (free online).
  • Cloudflare blog series on QUIC, BBR, congestion control.
  • RFC 9293 (TCP), RFC 9000 (QUIC).

FAQ#

TCP vs UDP, when use which?#

TCP is reliable, ordered, congestion-controlled, and is the default for APIs and downloads. UDP is fire-and-forget, great for DNS, gaming, voice, and the base for QUIC.

What is QUIC?#

QUIC runs reliable, ordered, multiplexed streams over UDP with built-in TLS 1.3. It avoids TCP head-of-line blocking and underpins HTTP/3.

What latency numbers should every engineer know?#

RAM access is around 100 nanoseconds, SSD around 100 microseconds, intra-AZ network around 0.5 millisecond, cross-region around 70 milliseconds, disk seek around 10 milliseconds.

How does the TCP handshake work?#

Client sends SYN, server responds SYN-ACK, client replies ACK. Three packets and one round trip to establish a reliable connection before any application data flows.

What is MTU and why does it matter?#

MTU is the largest packet a link can carry, typically 1500 bytes on Ethernet. Exceed it and packets get fragmented or dropped, hurting throughput and adding tail latency.

  • HTTP Protocols: HTTP is the application-layer protocol built on the TCP/IP fundamentals covered in network basics
  • CDN: CDNs exploit network topology and BGP routing to deliver content from the closest edge node
  • Load Balancer: load balancers operate at L4 (TCP/UDP) and L7 (HTTP) of the network stack

Further reading#

Curated, high-credibility sources for going deeper on this topic.