home
›
cheatsheets
›
computer_science
›
networking_fundamentals
Free to read Every card and diagram, and Quiz me
2
Free account Star cards. Your Quiz me marks are kept, so next time you drill just what you missed
3
Pro All 51 answers on this sheet, My sheet across every topic, and PDFs
A free account keeps your stars and Quiz me marks. Pro adds all 51 answers on this sheet, My sheet across every topic, and PDFs.
/
Read
Quiz me
Comfortable
Compact
0
Click any code to copy it
Done 0 /0
To review 0
On this sheet
01 Layers, addresses & latency02 DNS lookups & records03 TCP & UDP04 TCP speed & port limits05 TLS & HTTPS06 HTTP methods & status codes07 Caching, cookies & sessions08 HTTP versions & WebSockets09 Pools, timeouts & retries
The model A request goes down a stack of layers . HTTP rides on TLS, TLS on TCP, and TCP on IP. The IP address finds the machine, and the port finds the process on it. Latency is the time one round trip takes, the RTT . Bandwidth is how many bits fit through per second. Most requests are small, so cutting round trips helps more than buying bandwidth.A new HTTPS connection waits for DNS, the TCP handshake and TLS before any data moves. Each costs a round trip. Reusing a warm connection skips all three. TCP delivers one reliable, ordered byte stream, so a lost packet stalls everything behind it. UDP sends single packets with no promise they arrive. QUIC builds reliable streams on top of it.HTTP is stateless . A cookie or token tells the server who you are. The method says whether a retry is safe, because a resend can repeat the action. Each pair of arrows is one round trip. A cold HTTPS request waits three round trips before GET can leave. A warm, reused connection starts at GET.
Layers, addresses & latency how a request finds the right program, and what slows it From URL to page List what happens after you hit Enter Look up the IP, connect, set up TLS, send the request, render the HTML.
Name the parts of a URL Scheme, host, port, path, query and fragment.
Tip The fragment after # never reaches the server. Only the browser reads it.
Trap A stray query string changes the cache key. Caches treat /app.js?v=2 as a different file.
Latency and bandwidth Tell latency from bandwidth Latency is how long one trip takes. Bandwidth is how much fits through per second.
Speed up a page that loads fifty small files Cut round trips. Each request pays the latency again.
Tip Distance sets a floor on latency. Light in fiber covers about 200 km per millisecond.
Layers, ports and sockets TCP/IP OSI examples Application 7, 6, 5 HTTP, DNS, SMTP Transport 4 TCP, UDP Internet 3 IP, ICMP Link 2, 1 Ethernet, Wi-Fi
Tell a layer 7 load balancer from a layer 4 one Layer 7 reads HTTP, so it can route by path. Layer 4 sees only IPs and ports.
Say what an IP address and a port each find The IP finds the host. The port finds the process on it.
Tell apart many clients on one port The OS uses the four-tuple, both IPs and both ports.
Say what a socket is Your program's handle on a connection, used like a file.
Find what holds a port when bind fails lsof -i :8080
Tip IP moves packets with no delivery guarantee. TCP adds reliability on top when an app needs it.
Trap A server bound to 127.0.0.1 only takes local connections. Bind 0.0.0.0 to accept outside ones.
DNS lookups & records turn a name into an IP, and change records safely How a DNS lookup works Look up a name that isn't cached Your resolver asks a root server, then .com, then the authoritative server.
Watch the walk from the root dig +trace example.com
Say why DNS uses UDP One packet each way, and no handshake to wait for.
Say when DNS switches to TCP When the answer won't fit. The server sets the TC bit, and the client retries on TCP.
Tip Zone transfers between DNS servers use TCP too, because they move the whole zone at once.
Trap A firewall that blocks DNS over TCP breaks only the big answers, like DNSSEC ones.
DNS record types Point a name at an IP address A holds an IPv4 address, and AAAA an IPv6 one.
Make one name an alias of another A CNAME. The alias takes on all of the target's records.
Name the records for mail, verification and delegation MX for mail, TXT for verification and SPF, NS for nameservers.
Trap A CNAME can't sit at the bare domain beside NS and SOA. Providers offer ALIAS or ANAME records instead.
TTL and changing a record Pick a TTL It's how long resolvers cache the answer. Lower means faster changes and more queries.
Move a site to a new IP Lower the TTL at least one old TTL ahead, then switch.
Trap You can't flush other resolvers' caches. Clients keep the old IP until their copy expires.
TCP & UDP pick a transport, and see how TCP keeps bytes in order TCP or UDP Send data that must arrive whole and in order TCP. Web pages, APIs, file transfers and databases use it.
Send data where late is as bad as lost UDP. No handshake, no resends. Live video, games and DNS use it.
Tip QUIC runs over UDP and adds its own resends and ordering. HTTP/3 uses it.
Trap TCP has no message boundaries. Frame each message with a length prefix or a delimiter.
Open and close a TCP connection Open, one round trip client -> SYN my seq is x server -> SYN-ACK my seq is y, got x client -> ACK got y, data can flow Close, a FIN from each side A -> FIN A has no more to send B -> ACK B may still send B -> FIN B is done too A -> ACK A waits in TIME_WAIT
Say why TCP shakes hands first Both sides agree on starting sequence numbers and prove the path works both ways.
Know what opening a connection costs One round trip before any data.
Say why closing takes four messages Each direction closes on its own, so each side sends a FIN.
Trap A missing FIN leaves a half-open connection. It lingers until a keepalive or a timeout reaps it.
Reliable, ordered delivery Say how TCP tracks every byte Each byte gets a sequence number. The receiver ACKs up to the first gap.
Say what happens when a segment is lost The sender resends it after a timeout or duplicate ACKs.
Stop a fast sender from swamping a slow reader Flow control. Each ACK says how much buffer is left.
Say what a zero window means The receiver's buffer is full, so the sender pauses.
Tip Flow control protects the receiver. Congestion control protects the network.
Trap A connection stuck at a zero window looks like a network fault. Usually the app just stopped reading.
TCP speed & port limits why fast links start slow, and how clients run out of ports Slow start and the bandwidth-delay product Say how a new connection ramps up Slow start. The window starts near 10 segments and doubles each round trip.
Say what a loss does to the window A timeout drops it to 1 segment. Duplicate ACKs halve it.
Work out how much data must be in flight Bandwidth times RTT. 1 Gbit/s at 100 ms is 12.5 MB.
Work out the throughput a window allows Window divided by RTT. 64 KB at 100 ms is about 5 Mbit/s.
Tip A short response often ends before the window opens up. Reuse warm connections.
Trap Buffers far above the bandwidth-delay product don't add speed. The extra data just queues and adds delay.
Small writes and big packets Say why a small request can stall Nagle waits for an ACK that delayed ACK holds back, for up to 200 ms.
Turn Nagle off on a socket setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof one)
Know the usual packet sizes Ethernet's MTU is 1500 bytes. The MSS, the TCP payload, is usually 1460.
Find the smallest MTU on a path Send don't-fragment packets and shrink them when ICMP says too big.
Tip Writing the header and body in one call also avoids the Nagle stall.
Trap A firewall that drops ICMP makes big packets vanish, and the connection hangs after the handshake. Clamp the MSS lower.
TIME_WAIT and running out of ports Say what TIME_WAIT is The side that closes first keeps the socket for twice the max segment lifetime, 60 s on Linux.
Say why TIME_WAIT exists So the last ACK can be resent, and stray old segments can't reach a new connection.
Count sockets in TIME_WAIT ss -tan state time-wait | wc -l
Say how a busy client runs out of ports Each connection takes one of about 28,000 source ports, and TIME_WAIT can hold it a minute.
Stop running out of ports Reuse connections. Or widen the range, set tcp_tw_reuse, or add destination IPs.
Tip Have the server close first. Then TIME_WAIT piles up on the server, not on busy clients.
Trap If connect fails with EADDRNOTAVAIL, the client ran out of source ports. The server may be fine.
TLS & HTTPS encrypt the connection and prove who the server is HTTPS and the TLS handshake Name the three things TLS does It hides the content, proves you reached the real server, and catches tampering.
Walk through a TLS handshake The hellos pick a cipher, the server sends its certificate, and Diffie-Hellman makes a shared key.
Say what encrypts the data afterwards Fast symmetric encryption. The cost is the round trips up front.
Trap Turning off certificate checks to silence an error lets anyone pose as the server.
Round trips to set up HTTPS Open a new HTTPS connection DNS, TCP and TLS 1.3 take a round trip each, so 300 ms on a 100 ms link.
Shake hands with TLS 1.2 Two round trips after TCP.
Shake hands with TLS 1.3 One round trip. It always uses ephemeral keys and drops RSA key exchange, RC4 and CBC.
Resume a session with 0-RTT The request rides in the first packet.
Tip Reuse connections, resume TLS sessions and use TLS 1.3. More bandwidth won't help.
Trap Attackers can replay 0-RTT data. Allow it only for idempotent reads, or a POST can run twice.
Certificate checks List what the client checks Every signature up to a trusted root, the validity dates and the hostname.
See the chain a server sends openssl s_client -connect <host>:443 -showcerts
Say how browsers check for revoked certificates Mostly from lists their vendor pushes, like Chrome's CRLSets, not live OCSP calls.
Trap A server that leaves out its intermediates works in some clients and fails in others.
HTTP methods & status codes say what you want, and read what came back Safe and idempotent methods Safe Retry
PUTReplace the whole resource
PATCHChange part of a resource
POSTCreate something or run an action
Tip Safe means the server changes nothing. Idempotent means a repeat leaves the same final state, so a retry is harmless.
Trap Never hide a state change behind a GET. Crawlers and prefetchers fire every link they find.
PUT, PATCH or POST Make a partial update safe to retry Send absolute values like {"credits": 20}, not changes to apply.
Create something when the server picks the id POST /orders. A repeat makes a second order.
Create something when the client picks the id PUT /orders/<id>. A repeat lands on the same order.
Trap A PATCH like {"add_credits": 5} is a delta. Every retry adds 5 more.
Status code families Read a 2xx It worked, like 200 OK or 201 Created.
Read a 3xx A redirect, or 304 saying your cached copy is still good.
Read a 4xx The client got it wrong. Resending the same request rarely helps.
Read a 5xx The server failed a valid request. A retry with backoff often works.
Tip 401 means you're not signed in. 403 means you are, but you're not allowed.
301 or 302 redirect Move a page for good 301. Browsers cache it, and search engines update their links.
Redirect for now, like through a login page 302. Clients ask for the original URL again next time.
Tip 301 and 302 let clients turn a POST into a GET. 307 and 308 keep the method.
Trap A 301 sent by mistake stays in browser caches after you revert it.
Caching, cookies & sessions skip the network, and remember who's signed in Browser caching Reuse a response with no request at all Cache-Control: max-age=3600 keeps it fresh for an hour.
Check a stale copy without downloading it again The browser sends its ETag in If-None-Match. A 304 says reuse it.
Store a response but check it before each use Cache-Control: no-cache. It still stores a copy.
Keep a response out of every cache Cache-Control: no-store.
See a response's cache headers curl -I https://example.com It sends HEAD, which returns the headers without the body.
Tip Put a content hash in each static file's name and cache it for a year. A deploy ships new names.
Trap A long max-age on HTML keeps users on old pages after you deploy. Keep HTML on no-cache.
Cookies and sessions Recognize a returning visitor Send Set-Cookie with a session id. The browser sends it back on every matching request.
Keep a cookie off plain HTTP Secure. Anyone sniffing the network never sees it.
Hide a cookie from JavaScript HttpOnly. Injected script can't steal the session.
Block cross-site request forgery SameSite. Pick Lax, since Strict drops the cookie on links from other sites.
Keep the session on the server The cookie holds a random id. Every server then needs the shared session store.
Keep the session in a signed token A JWT the server checks without a lookup. It's hard to revoke before it expires.
Tip Every cookie rides on every request to its domain. Keep cookies small, and sign anything the server trusts.
Trap HttpOnly doesn't fix an XSS bug. It only stops that bug from reading the cookie.
HTTP versions & WebSockets how each version uses its connections, and live updates Keep-alive and HTTP/1.1 Send many requests over one connection Keep-alive, the default in HTTP/1.1. Content-Length marks where each response ends.
Stream a body of unknown length Use Transfer-Encoding: chunked. Each chunk starts with its size in hex, and an empty one ends it.
Explain head-of-line blocking in HTTP/1.1 One request at a time per connection, so a slow response holds up the rest.
Work around it on HTTP/1.1 Browsers open about six connections per host, each with its own handshake.
Tip Pipelining sent requests without waiting, but responses still came back in order.
Trap A proxy that buffers the whole response undoes chunked streaming.
HTTP/2 Run many requests at once on one connection HTTP/2 streams interleave, so a slow response no longer holds up the fast ones.
Stop resending the same headers HPACK compresses them, cookies included.
Send files before the browser asks Server push is gone from Chrome. Use 103 Early Hints.
Tip HTTP/2's stream priorities are deprecated. The simpler Priority header replaces them.
TCP head-of-line blocking and HTTP/3 HTTP/2 A A waits A lost HTTP/2 B B waits B HTTP/3 A A waits A lost HTTP/3 B B time Streams A and B share one connection, and a packet of A is lost. The resend takes a round trip. On HTTP/2, B waits too. On HTTP/3, only A waits.
Say why HTTP/2 still stalls on a lost packet TCP is one ordered stream. Every stream waits for the resend, even data that already arrived.
Say how HTTP/3 avoids that stall QUIC orders each stream on its own, so only the stream that lost data waits.
Open an HTTP/3 connection One round trip, because QUIC folds in the TLS 1.3 handshake.
Keep a connection when a phone changes network QUIC's connection IDs survive a switch from Wi-Fi to cellular.
Trap Some networks block UDP, so clients must fall back to HTTP/2. QUIC also uses more CPU than kernel TCP.
WebSockets, SSE and long polling Upgrade a request to a WebSocket Send Upgrade: websocket on a GET. The server answers 101, then frames flow both ways.
Push updates with no special server support Long polling. The server holds each request until data arrives.
Stream events one way, server to client Server-Sent Events. They reconnect on their own but carry text only.
Push both ways at a high rate WebSockets, for chat, games and live editing.
Tip Each open connection holds a socket. Pin it at the load balancer, and size limits for the peak.
Trap Proxies with short idle timeouts cut long-lived connections. Send heartbeats and reconnect.
Pools, timeouts & retries call other services without falling over Connection pools Skip the handshakes on each request Borrow a warm connection from a pool. It saves round trips and the server's TLS work.
Size a pool Little's law. 200 requests a second that each hold a connection 50 ms need about 10.
Spot a saturated pool Callers queue to borrow, then acquire timeouts fire.
Avoid resets on idle pooled connections Make the client's idle timeout shorter than the server's.
Tip Cap the pool at what the backend accepts. A pool of 500 can't help a database that takes 100.
Trap A full pool looks like a slow database. Check how long callers wait to borrow before you blame the queries.
Connect and read timeouts Bound the wait to open a connection Set the connect timeout near your RTT plus a margin, often a few hundred ms.
Bound the wait for response bytes Set the read timeout per endpoint. One second for a lookup, thirty for a report.
Catch a server that sends one byte at a time Add an overall deadline. A read timeout only times the gaps between bytes.
Trap Generous timeouts let slow calls fill your pool, and the outage spreads.
Find the slow phase of a request curl -so /dev/null -w "%{time_namelookup} \ %{time_connect} %{time_appconnect} \ %{time_starttransfer}\n" <url> 0.30 0.35 0.48 1.90 DNS, TCP, TLS, first byte
Read curl's timings Each counts from the start. Here the server took 1.4 s after TLS.
Blame a slow DNS or connect phase Slow DNS points at the resolver. A slow connect points at latency or distance.
Blame a slow first byte after TLS Server work, like a slow query or a full connection pool.
Tip A warm keep-alive connection skips DNS, TCP and TLS. Time cold and warm requests separately.
Retries, backoff and idempotency keys Back off with full jitter Math.random() * Math.min(cap, base * 2 ** attempt)
Choose which failures to retry Timeouts, 5xx and 429, on idempotent requests only.
Pick which layer retries One layer only. Three layers that each try 3 times make 27 calls.
Make a POST safe to retry Send an idempotency key. The server answers a repeat with the stored result.
Stop two copies of a request both running Put a unique constraint on the key. The loser reads the winner's result.
Tip Without jitter, clients that failed together retry together and keep the server down.
Trap A timed-out write may have landed. Retry it without a key and you can charge a card twice.
Cache stampedes Say what a cache stampede is A hot key expires, and every request misses at once and hits the database.
Prevent a stampede Let one request refill the key while the rest wait, or serve the stale value.
Tip After a flush or deploy, warm the hottest keys before traffic arrives.
Nothing matches. Try a shorter word, or clear the search.
Practice Guided practice One question at a time, with the ones you miss coming back. Practice 51 interview questions Full answers, from beginner to expert.
Found this useful? Pass it on.
Share on LinkedIn
Share on X
Copy link
This sheet stays free. With Pro , you can:
Every answer on this sheet. Read the full answer to all 51 questions it links, not just the 7 free ones.My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.
