NightFox

Networking Foundations

---

Every fancy networking topic on this site (BGP, VPNs, data-center fabrics) is built on the same handful of basics. When something gets weird, I almost always end up back here: what layer is this, what's the address, is it local or does it go to the gateway? If those feel solid, everything else gets a lot less scary.

The OSI model (and why I still use it)

Yes, the OSI model is a little academic, and real protocols don't fit it perfectly. TCP/IP is closer to how things actually work. But I still use OSI all the time for one reason: it gives you a great troubleshooting question. At which layer does it stop working?

OSI layer	What it does	Examples
7 — Application	The stuff users actually touch	HTTP, DNS, SMTP, SSH
6 — Presentation	Encoding, encryption, data format	TLS, JSON, character encoding
5 — Session	Setting up and keeping track of sessions	Application sessions, RPC
4 — Transport	End-to-end delivery and ports	TCP, UDP, QUIC
3 — Network	IP addressing and routing	IPv4, IPv6, ICMP
2 — Data Link	Local delivery and MAC addresses	Ethernet, VLANs, Wi-Fi
1 — Physical	Electricity, light, and radio	Copper, fiber, optics, RF

And don't skip layer 1. A surprising number of "network problems" are a bad cable, a dirty fiber, or an optic that's slowly dying.

Frames, packets, and segments

Data gets wrapped in layers on the way out, like nesting envelopes:

• TCP or UDP wraps the application data into a segment or datagram.
• IP wraps that into a packet.
• Ethernet or Wi-Fi wraps the packet into a frame for the local link.
• The wire, fiber, or radio sends the frame as signals.

The part that makes a lot of things click: a router throws away the Ethernet frame and builds a brand new one at every hop. The IP packet inside keeps going (with its TTL ticking down), but the MAC addresses only ever mean something on the local link.

MAC addresses, IPv4, and IPv6

A MAC address identifies an interface on the local network. An IP address identifies where that interface sits in the bigger routed address plan. To get from one to the other, devices use ARP (IPv4) or Neighbor Discovery (IPv6) to ask "who has this next-hop IP?"

IPv4

32-bit addresses. The prefix length, like /24, tells you how many bits are the network part. NAT has kept IPv4 alive way longer than anyone expected, but it adds state and complexity, and it's the reason a lot of things are harder than they need to be.

IPv6

128-bit addresses, built for real end-to-end addressing. A normal LAN gets a /64, which looks absurdly large the first time you see it. My advice: turn IPv6 on deliberately and monitor it. Plenty of networks are already running it by accident because the clients turned it on themselves.

Switching and routing

• Switching: moves Ethernet frames around inside a layer 2 network using a MAC address table.
• Routing: moves IP packets between networks using a routing table.
• VLAN: a separate layer 2 broadcast domain on the same hardware.
• Default gateway: the router a host sends anything that isn't local.

The decision every host makes, constantly: "Is this destination on my subnet?" It checks by comparing the destination against its own address and prefix. If yes, send it straight there. If no, send it to the gateway. A wrong subnet mask breaks this in some very confusing ways, so it's worth checking early.

TCP, UDP, and ports

• TCP: connections, ordering, acknowledgements, retransmission. Reliable, a bit chattier.
• UDP: just send it. Low overhead, no guarantees.
• QUIC: the newer encrypted transport that runs over UDP. It's what HTTP/3 uses, so you'll see a lot of UDP 443 these days.

The ports I end up typing into firewall rules over and over:

Service	Port	Transport
SSH	22	TCP
DNS	53	UDP and TCP (don't forget TCP)
DHCPv4	67/68	UDP
HTTP	80	TCP
HTTPS	443	TCP, plus UDP for HTTP/3
NTP	123	UDP
SNMP	161/162	UDP
BGP	179	TCP

The services everything depends on

• DNS: turns names into addresses. When it breaks, everything looks broken.
• DHCP: hands out addresses and settings.
• NTP: keeps clocks in sync. Bad time breaks logs, certificates, and authentication in ways that don't look time-related at all.
• Routing protocols: let routers tell each other what they can reach.
• Monitoring: so you know what normal looks like before something changes.

Tools I use constantly

• ping: is it reachable, and how fast?
• traceroute / tracepath: which way is the traffic going?
• dig: what does DNS actually say?
• ip: Linux addresses, routes, and neighbors, all in one tool.
• ss: what's listening, and what's connected?
• tcpdump and Wireshark: when you need proof instead of theories.
• iperf3: real throughput between two boxes you control.
• nmap: what hosts and services are out there. Only on networks you're allowed to scan.

If I were learning this from scratch

This is roughly the order I'd go in:

1. Binary, prefixes, and subnetting. Get this down cold; everything uses it.
2. Ethernet switching, VLANs, trunks, and spanning tree.
3. Routing tables, static routes, and default routes.
4. DNS, DHCP, NAT, and how stateful firewalls work.
5. Packet captures. Earlier than you think you need them.
6. Then OSPF, BGP, VPNs, monitoring, and automation as you need them.

Last Modified: October 12, 2026, 11:46 am