DevOps networking basics
Ethernet cable: a wired medium for connecting devices to a network for fast and stable data transfer
-
Ethernet cable types:
- Routers connect to landlines using DSL cables (RJ-11)
Any packet sent across the internet usually is tagged with an IP address (which can be used for activity tracking), this way the packet knows where its going and where to return the response. Each packet hops through multiple internet routers until it finds its destination and then hops back to the sender (each hop is a router)
- A hop is simply each router a packet passes through on its journey from source to destination. Every time a packet is handed off from one router to the next, that's one hop
Your laptop
→ your home router (hop 1 — your gateway to the internet)
→ your ISP's edge router (hop 2 — enters your ISP's network)
→ your ISP's core router (hop 3 — routed within ISP backbone)
→ a peering router (hop 4 — handed off to another network)
→ Cloudflare/AWS router (hop 5 — enters the CDN or hosting network)
→ example.com's server (destination)
Data packet structure
- Header contains source IP address, destination, port number, sequence, etc..
- Payload contains the actual data
- Trailer informs the destination that it has reached the end or its for error checking
TCP (Transmission Control Protocol) is a Layer 4 connection-oriented protocol that guarantees ordered, reliable delivery via a 3-way handshake (SYN, SYN-ACK, ACK) and acknowledgements for every packet, at the cost of latency
UDP (User Datagram Protocol) is a Layer 4 connectionless protocol that fires packets at the destination with no handshake, ordering, or delivery guarantees, making it faster and preferred for things like DNS, video streaming, and games where speed matters more than reliability
Subnet: separate networks (smaller network within a larger network) and created using routers. Any computer connected to a switch send out a broadcast, so if there are many computers in the same network it would cause slow down. Subnets break down the network to smaller networks so broadcast stays within the network, and helps with security applying each network its own security
-
Classless Inter-Domain Routing (CIDR): a method for allocating IP addresses for IP routing. Example you have IP Address:
10.0.0.0and a subnet mask length/16 -
Calculating the Subnet Mask:
- In binary, the first 16 bits are all 1s, followed by 16 bits of 0s:
11111111.11111111.00000000.00000000 - In dotted-decimal notation, this translates to
255.255.0.0
192 . 168 . 0 . 0 /32 => allows for 1 IP (2^0) → 192.168.0.0 192 . 168 . 0 . 0 /31 => allows for 2 IP (2^1) → 192.168.0.0 -> 192.168.0.1 192 . 168 . 0 . 0 /30 => allows for 4 IP (2^2) → 192.168.0.0 -> 192.168.0.3 192 . 168 . 0 . 0 /29 => allows for 8 IP (2^3) → 192.168.0.0 -> 192.168.0.7 192 . 168 . 0 . 0 /28 => allows for 16 IP (2^4) → 192.168.0.0 -> 192.168.0.15 192 . 168 . 0 . 0 /27 => allows for 32 IP (2^5) → 192.168.0.0 -> 192.168.0.31 192 . 168 . 0 . 0 /26 => allows for 64 IP (2^6) → 192.168.0.0 -> 192.168.0.63 192 . 168 . 0 . 0 /25 => allows for 128 IP (2^7) → 192.168.0.0 -> 192.168.0.127 192 . 168 . 0 . 0 /24 => allows for 256 IP (2^8) → 192.168.0.0 -> 192.168.0.255 ... 192 . 168 . 0 . 0 /16 => allows for 65,536 IP (2^16) → 192.168.0.0 -> 192.168.255.255 ... 192 . 168 . 0 . 0 /0 => allows for All IPs → 0.0.0.0 -> 255.255.255.255 Quick Memo Octets 1st 2nd 3rd 4th /32 – no octet can change /24 – last octet can change /16 – last 2 octets can change /8 – last 3 octets can change /0 – all octets can change - In binary, the first 16 bits are all 1s, followed by 16 bits of 0s:
-
Calculating the Range of IP Addresses:
- With a
/16subnet mask, there are 2^16 - 2 = 65,534 usable IP addresses - The range of IP addresses spans from
10.0.0.1to10.0.255.254, with10.0.0.0reserved as the network address and10.0.255.255reserved as the broadcast address, and that’s a subnet
- With a
-
Note that IP must begin with a network prefix for example
192.168as for host prefix ranges from 0 to 255, so meaning we can have from192.168.0.0all the way to192.168.255.255if the prefix is /16
IPv4 private ranges (RFC 1918):
- 10.0.0.0 – 10.255.255.255 (10.0.0.0/8)
- 172.16.0.0 – 172.31.255.255 (172.16/12)
- 192.168.0.0 – 192.168.255.255 (192.168/16)
Default Gateway: a device that forwards data from one network to another say the internet (its usually the first IP of the subnet assigned) also AKA the router. Default gateway is not needed if the devices can connect to each other through the same network, going outside the network uses the default gateway
Network Address Translation (NAT): service used in routers that translates a set of IP addresses to another set of IP addresses which enables multiple devices within a local network to share a single public IP address for accessing resources on the internet (as IPv4 addresses are finite resources)
- Local network devices are assigned private IP addresses typically assigned by a router or DHCP server
A public IP address is a unique address assigned directly to a single machine, making it individually identifiable on the internet
Routing: the process of directing data packets from a source to a destination across a network. Routers use routing tables and protocols to decide the path for data transmission
When assigning a static IP address in Linux (for example using Netplan), the CIDR suffix like /24 or /16 defines the network your host belongs to, not just the single address. For instance, 192.168.1.101/24 tells the system that your host is part of the 192.168.1.0–192.168.1.255 subnet, allowing it to communicate and route correctly within that network. Using /32 here would isolate the host, breaking normal LAN communication unless special routes are added. In contrast, when configuring firewall rules, /32 is used intentionally to match one exact IP address and nothing else, while broader masks like /24 would apply the rule to every address in that subnet
- Basically when assigning static IP using Netplan, if the host is in a /24 subnet, you’d still get
192.168.1.101but other hosts in the same subnet will be able to reach it. For firewalls, if you want to block only a single IP, you use /32, so don’t confuse between the two
Source Network Address Translation (SNAT): translates the source IP (and often source port) of outgoing packets so that internal hosts appear as a single public IP; it typically uses a pool or overloads one public address via port-address translation. SNAT is mostly used for outbound traffic and keeps a mapping table (IP + port) to track return packets
- A SNAT device (like a router, firewall, or NAT gateway) intercepts outgoing packets, and replaces the source IP (private) with a public IP address. It usually also changes the source port, so that many internal connections can map to that single (or a few) public IP addresses. When responses come back, the NAT device reverses the translation, so each internal sender gets its correct response
- SNAT is a subtype of NAT focused on translating source addresses, mainly used for outbound connections, whereas “NAT” by itself is a broader term covering many translation behaviors
- One of the most common problems for SNAT is port exhaustion, happens when a NAT device runs out of available ephemeral (source) ports. For example, too many outbound connections from many clients to the same destination so each new flow needs a new source port. Worry about SNAT port exhaustion if you make too many connections in little time
- A solution is to increase the port pool (e.g. use more public IPs or a NAT gateway), and/or reuse connections (via connection pooling) so you don’t open a fresh TCP/UDP session every time, reduce idle timeout in case there are connections that aren’t closed
- Video example for Azure: https://youtu.be/fcx0ytfC758?si=3GheqqkOWltUDDV7
- SNAT changes the source of the outbound IP or port
Destination Network Address Translation (DNAT): translates the destination IP (and optionally the destination port) of incoming packets to map external requests to internal servers (e.g., port-forwarding)
- example: A public web server is hosted behind a private network; incoming connections to a router’s public IP at port 80 are translated (DNAT) to the private IP of the internal web server (e.g. 192.168.1.10) and possibly to port 8080
- One of the most common problems with DNAT is port-conflicts and rule misconfiguration. For example, two services both trying to use the same external port, or overly broad DNAT rules that catch unintended traffic
- DNAT changes the destination of the inbound IP or port
Bandwidth: the maximum possible data transfer rate of a network or internet connection (the capacity at which a network can transmit data), if bandwidth is 40 Mbps, it implies that it cannot transfer data faster than 40 Mbps
- Formula: data transmit + data received
- How to calculate a website’s bandwidth requirement
- Another way to calculate bandwidth requirement
- Speed: the actual rate at which data is transmitted in a network, its not the same as bandwidth
Throughput: the actual data transferred successfully in a network, throughput is always less than or equal to bandwidth but can never exceed bandwidth
URI (Uniform Resource Identifier) is a generic term for identifying resources on the internet which encompasses both URLs and URNs, URN (uniform resource name) uniquely identifies a resource by its ISBN (international standard book number) which’s another type of URI, URL is a specific type of URI that provides the means to locate and retrieve a resource on the internet. It includes the protocol (e.g., HTTP, HTTPS), the domain name or IP address, and the specific path to the resource
Proxy server: an intermediate server (middle-man) that acts as a gateway between the user and the internet, used for anonymity, content filtering, access control, caching, load balancing, etc