Kategori
Nätverk
Alla verktyg och artiklar i denna kategori, samlade på ett ställe.
Verktyg
BFD timer calculator
Enter both systems' BFD intervals and Detect Mult to get, for each direction, the agreed transmit interval, its jitter range, the detection time the receiver computes and whether Echo may run, every number explained with its RFC 5880 section; or paste a BFD Control packet in hex to decode it field by field.
Bits, bytes and throughput
A size in every unit of both conventions with the bit count written out (1.5 GB is 12 000 000 000 bits and 1.397 GiB; read the 1024 way it would be 7.37 % more), a rate in bits and bytes per second and per minute, hour and day, and any two of size, rate and time giving the third, with the protocol efficiency of TCP over Ethernet applied if you ask. The connection table answers for a modem, T1, E1 and every Ethernet speed at once. Exact arithmetic; nothing is rounded until it is printed.
Cable run planner
Speed, distance, environment, PoE in - every compliant cable and fiber option out, each citing the TIA-568 or 802.3 rule that governs it, with honest exclusions for the rest.
CGN port blocks and MAP port sets
Divide one public IPv4 address among subscribers: port blocks per address and per pool (RFC 7768), RFC 7422 deterministic mapping with its forward and reverse lookup, and the MAP-E and MAP-T port set of a PSID (RFC 7597), with the log volume that blocks remove.
CIDR-/subnätskalkylator
Dela upp ett valfritt IPv4-CIDR-block i nätverks- och broadcastadresser, användbart värdintervall, antal värdar och nätmask, och se vilket av IANA:s intervall för särskilda ändamål det hamnar i. De andra lägena delar ett överordnat block i subnät med variabel längd (VLSM), slår ihop prefix till ett supernät och hittar överlapp och luckor. Körs helt i din webbläsare.
DHCP option 43 generator
Build the vendor-specific option 43 value a wireless controller actually expects. One option number, four incompatible encodings.
dig command builder
Say what to look up, where to ask and how, and get one copy-pasteable dig command with every token explained, the combinations the manual calls redundant or contradictory flagged, and a summary of what the query will carry: transport, port, RD, DO, CD, EDNS and cookie. The inverse of the dig output explainer. Runs nothing; built in your browser from the BIND 9 manual and the DNS RFCs.
dig output explainer
Paste real dig output and get a decoded, explained breakdown: the header and flags, the EDNS OPT pseudo-section, every record in each section, and the query stats. Parsed entirely in your browser, nothing is resolved or sent anywhere.
HTTP methods comparison
Enter one to four HTTP methods (try "get vs query") to see each one's registry facts: safe, idempotent, cacheable, request-body semantics, CORS safelist membership, HTML-form support, and the defining RFC - plus exactly which properties differ. Includes QUERY, the RFC 10008 method registered in June 2026.
HTTP status code explainer
Paste status codes (404, 301 302 307) or families (5xx) and get each one decoded: family, registered name, documented meaning, and the operational notes - including the protocol's own fallback rule for codes it has never met.
IPv6-verktygslåda
Tolka en IPv6-adress eller ett prefix för att se dess kanoniska (RFC 5952) och fullt expanderade former, klassificering för specialanvändning, prefixaritmetik, en EUI-64-MAC om den finns och dess ip6.arpa-omvänd-DNS-namn. Körs helt i din webbläsare.
MTU / MSS calculator
Enter a link MTU and your encapsulation stack (vxlan, gre, pppoe, vlan, mpls, +N custom) to get the inner MTU and TCP MSS, the Ethernet frame sizes, the underlay MTU an overlay needs, and the wire efficiency of standard versus jumbo frames.
nslookup output explainer
Paste real nslookup output and get a decoded, explained breakdown: the resolver it used, whether the answer is authoritative, every record (with MX / SRV / SOA field breakdowns), and any failures. Parsed entirely in your browser, nothing is resolved or sent anywhere.
OUI / MAC vendor lookup
Look up the manufacturer behind a MAC address, and read whether it is unicast or multicast and universally or locally administered. All in your browser.
p0f passive TCP/IP signature explainer
Decode a p0f v3 SYN fingerprint into its eight fields and see what each reveals about the sender's OS, network path, and stack.
ZscalerPAC file explainer and validator
Paste a Proxy Auto-Config file and it reads back the proxy directives it returns, the PAC helper functions it uses (with the DNS-consulting ones flagged), structural and correctness lints, and whether it is a Netskope explicit-proxy steering file. Never runs the file.
NetskopeRegistered domain (eTLD+1)
Find the public suffix (eTLD) and registered domain (eTLD+1) for any hostname, using the Public Suffix List.
Route origin validation calculator
Paste a route (prefix and origin AS) and the VRPs you have, and get its RFC 6811 state (Valid, Invalid or NotFound) with the reason VRP by VRP: which VRPs cover it, which match, and why the others fail. AS 0 and maxLength are handled as the RFCs state them, IPv4 and IPv6 alike, and nothing is fetched.
Routing table explainer
Paste the output of ip route, netstat -rn or route print to read every route field by field, see which default route wins, and ask which route a destination would use, by longest prefix and then metric.
Syslog PRI decoder + encoder
Decode a syslog PRI such as 134 into its facility and severity, or encode them back, all in your browser.
Artiklar
How an Access Point Finds Its Controller
Dynamic Host Configuration Protocol (DHCP) option 43 carries vendor-specific information whose meaning the vendor named in option 60 defines, so the same option holds binary addresses for one access point and text for another, while a third reads its controller from option 138 instead. After reading, you can build and decode the value each documented vendor expects byte by byte, get the server to return it to the right vendor class, recognise the silent failure and the rogue-server risk, and read the value back from a capture or a DHCP server.
LäsHur IPv4-adresser fungerar
De 32 bitarna bakom varje punktquad-adress, och vad privata, loopback- och specialintervall betyder.
LäsThe Syslog PRI: One Number, Two Meanings
Every syslog message starts with a PRI, a number in angle brackets that packs a facility and a severity into a single value. The formula is small and the arithmetic is easy once you have seen it: PRI equals facility times eight plus severity.
LäsGrunderna i subnätsindelning
Hur man delar upp ett nätverk i mindre subnät, och varför att låna värdbitar är hela tricket.
LäsSyslog Facilities and Severities, Explained
Syslog defines 24 facilities and 8 severities. The severities are a clean urgency scale from emergency down to debug; the facilities are a mix of genuinely useful categories and historical Unix leftovers, plus eight local slots that network devices lean on heavily.
LäsCIDR-notation förklarad
Vad snedstrecket i 192.168.1.0/24 faktiskt betyder, och hur en prefixlängd definierar ett block av IP-adresser.
LäsSyslog on Network Devices: Which Facility Does What
Firewalls, load balancers, and switches almost all log to the local facilities, but each vendor picks a different default. Knowing that FortiGate defaults to local7, Cisco ASA to local4, and F5 BIG-IP to local0 turns a wall of PRI numbers into a map of which box said what.
LäsSyslog Message Formats: RFC 3164 vs RFC 5424
The PRI is the same everywhere, but what follows it is not. Legacy BSD syslog (RFC 3164) has a loose, year-less format, while the modern format (RFC 5424) is precise and structured. Knowing which one you are looking at explains missing timestamps, ambiguous fields, and why parsers disagree.
LäsVLSM: dela ett block i ojämna subnät
Hur man skär ett adressblock i subnät av olika storlek utan att slösa utrymme, och störst-först-regeln som håller allt prydligt.
LäsEn VLSM-tilldelning, löst från början till slut
En fullständig tilldelning av subnät med variabel längd för ett realistiskt nätverk: dimensionera varje segment, sortera från störst till minst, tilldela de verkliga adresserna och bokföra det utrymme som blir kvar.
LäsHow Syslog Travels: UDP, TCP, and TLS
Syslog can ride over plain UDP, over TCP, or over TLS, and the choice decides whether messages can be silently lost, reordered, or read in transit. This covers the three transports, the ports involved, and why anything you rely on for audit should not be sent over UDP.
LäsSupernätning och ruttaggregering
Hur sammanhängande prefix slås samman till ett kortare, justeringsregeln som avgör om två block kan smälta ihop, och skillnaden mellan exakt aggregering och ett enda supernät som täcker dem.
LäsThe First Hour: Hypothesis-Driven Fault Isolation
The difference between a two-hour incident and a two-day one is usually decided in the first hour, and it is rarely decided by tools. It is decided by method: aligning onset with change, isolating by scope, reading layer signatures, and treating every explanation as a hypothesis that evidence must support or weaken before anyone acts on it.
LäsChange Windows That Do Not Become Incidents
Most self-inflicted outages are changes that went wrong with no clean way back. The difference between a change and an incident is rarely the change itself; it is the runbook around it - what you verified before, how you sequenced it, what would make you stop, and whether the way back was written down and tested before you needed it.
LäsRuttsammanfattning
Varför en enda sammanfattande rutt kan ersätta många specifika, den sammanhängande och justerade tilldelningen den beror på, och risken för svart hål när man sammanfattar ett intervall man inte äger helt.
LäsCloudflare: giving the moat away
Akamai sold acceleration and DDoS protection to the Fortune 500; Cloudflare gave a version of both to anyone with a domain, and turned the free tier itself into the engine: more traffic meant better peering, better peering meant cheaper bandwidth, cheaper bandwidth paid for more free users. The reverse proxy that grew into a network, a resolver, an edge computer, and an uncomfortable amount of power.
LäsRoot Cause Is a Verb, Not a Noun
The phrase root cause invites a single villain and a tidy ending. Real incidents rarely have one; they have contributing factors, and the honest work is structuring the candidates and the evidence that would confirm or rule out each - not naming a culprit before the evidence is in.
LäsSubnätsöverlapp och -luckor
Vad det betyder att två prefix överlappar eller att det ena innehåller det andra, varför longest-prefix-match gör vissa överlapp avsiktliga, och hur man hittar de otilldelade luckorna i en adressplan.
LäsAkamai: the theorem that carried the web
A math problem set by Tim Berners-Lee, an algorithm called consistent hashing, and the company that turned both into the invisible layer under two decades of streaming, launches and breaking news. The deploy-deep overlay, the IPO that nearly killed it, the co-founder lost on September 11, and the long reinvention from cache to security to cloud.
LäsBlast-Radius Thinking Before You Change Anything
Before a change, the question is not only will this work but if it goes wrong, how far does the damage reach. Blast radius is the shape of that reach - target, neighbours, dependents, people - and thinking about it in tiers is how you decide what to contain before you touch anything.
LäsPrivat IPv4-adressutrymme och RFC 1918
De tre privata intervallen, varför de inte är dirigerbara på internet och de andra specialblock som CIDR-verktyget flaggar.
LäsAtt förstå IPv6-adressering
Hur en 128-bitars IPv6-adress är strukturerad och skriven, reglerna för att komprimera den kanoniskt, vad adresstyperna och omfattningarna betyder, och hur gränssnittsidentifierare och omvänd DNS fungerar.
LäsTAC Cases That Get Triaged Fast
The slowest support cases are rarely the hardest problems; they are the ones that opened without the diagnostic the vendor needs. A case that arrives complete - clear problem, exact error, the diagnostic bundle, the impact - skips the round trips and starts with an engineer actually working it.
LäsHur IPv6-värdar får adresser: SLAAC och DHCPv6
Hur en IPv6-värd konfigurerar sig från link-local och uppåt, vad router advertisements beslutar, och skillnaden mellan SLAAC, integritetsadresser, och DHCPv6.
LäsCapture Points Before Packets
The instinct under pressure is to start tcpdump somewhere convenient and stare at the flood. The senior habit is the opposite: decide where to observe, in what order, and what each observation would mean - before a single packet is collected. Evidence is designed, not fished for.
LäsIPv6-subnätsindelning och /64-gränsen
Varför IPv6-subnätsindelning handlar om struktur snarare än knapphet, varför ett enskilt subnät nästan alltid är ett /64, och hur prefixdelegering delar ut adressutrymme.
LäsPublic suffixes and the registered domain (eTLD+1)
What a public suffix (eTLD) and a registered domain (eTLD+1) are, why you cannot compute them by taking the last two labels, how the Public Suffix List algorithm resolves them, and where the boundary matters: certificate rate limits, cookies, and same-site.
LäsGrannupptäckt: hur IPv6 ersätter ARP
Hur IPv6 hittar grannar på en länk med ICMPv6 och multicast i stället för broadcast-ARP, de fem grannupptäcktsmeddelandena, och varför broadcast är borta.
LäsMap the Path Before You Troubleshoot
The most expensive troubleshooting sessions share one flaw: nobody actually knew the path. The senior habit is refusing to reason about a failure until the chain is modeled - resolution included, return leg separate, every rewrite and TLS boundary named, and every unknown left visibly unknown.
LäsAtt köra IPv6 och IPv4 tillsammans: dual-stack och översättning
Hur internet överbryggar två inkompatibla adressfamiljer: dual-stack, Happy Eyeballs, NAT64, och de IPv4-inbäddade adresser som får det att fungera.
LäsBaselines Before You Need Them
Every comparison is only as honest as its weaker side. The discipline is captured baselines before changes, declared confidence instead of remembered health, observation windows that let convergence speak, churn literacy for the counters that always move - and never calling a change successful on green components alone.
LäsWhat Is an OUI, and How MAC Addresses Are Assigned
How a MAC address is structured, what the OUI (the manufacturer prefix) is and who hands it out, the difference between universally and locally administered addresses, and why a randomized Wi-Fi MAC has no vendor at all.
LäsReading dig Output From Top to Bottom
dig prints every DNS answer in the same fixed shape: the version and options lines, the header line, the flags and counts line, the OPT pseudosection, the sections that have records, and four statistics lines. After reading, you can walk any dig answer block by block, name what each line reports, recognise NODATA, NXDOMAIN, SERVFAIL and a truncated answer from the shape alone, and choose the shorter forms a script needs.
LäsThe DNS Header: Opcode, Status, and Flags
Every DNS message opens with the same 12-byte header: a 16-bit ID, a flags word that holds the opcode, seven named flags, a reserved bit and the response code, and four section counts, which dig prints as its header and flags lines. After reading, you can decode a header from its hexadecimal bytes, say what each flag, opcode and status tells a diagnosis, recognise a truncated answer and test the TCP retry it needs, and explain why the ID and the source port must be unpredictable.
LäsReading the Records in a dig Answer
Every record dig prints is one resource record in five columns: owner name, TTL, class, type and the type-specific data, with the wire's length field left out. After reading, you can name each column, decode the data of A, AAAA, CNAME, NS, SOA, MX, TXT, PTR, SRV and CAA records, tell a counting-down cache TTL from a zone TTL, follow a CNAME chain to the name that owns the status code, and spot the aliases, timers and quoting mistakes that make a correct-looking answer fail.
LäsEDNS and the OPT Pseudo-Section
The OPT pseudo-section is not a record and not something you queried: it is EDNS(0) metadata that dig surfaces near the top of an answer. It carries the UDP payload size, the DO flag that requests DNSSEC, and options like COOKIE, and it quietly explains a whole class of resolution failures.
LäsDNSSEC Records in dig Output
Add +dnssec and a dig answer grows a new family of records: RRSIG, DNSKEY, DS, and the NSEC or NSEC3 denial records. This explains what each one is, how they chain from the root down to a zone, and what the ad flag really certifies.
LäsReading nslookup Output
nslookup prints a Server / Address header for the resolver it used, an optional Non-authoritative answer marker, and then the answer in a per-type prose format. Knowing that shape lets you read any result quickly and see at a glance whether it succeeded, where it came from, and what it means.
Läsnslookup vs dig: Which to Use
nslookup and dig both query DNS, but nslookup is terser and hides the header flags and TTLs that dig shows in full. This maps one output onto the other and gives a simple rule for which to reach for.
LäsHow nslookup Prints Each Record Type
Instead of dig's fixed columns, nslookup labels each record in prose: mail exchanger =, canonical name =, nameserver =, and a multi-line block for SOA. A short guide to reading each type's line.
LäsAuthoritative vs Non-Authoritative Answers
An answer is authoritative when the server that sent it holds the zone for the name you asked about, and it says so with one bit of the DNS header, the AA bit, which nslookup reports as the Non-authoritative answer marker and dig as the aa flag. After reading, you can tell a cached answer from a referral, explain why a recursive lookup is non-authoritative by design, ask a zone's own server with recursion turned off and read aa in the reply, and say what the bit still does not prove.
Läsnslookup Errors and What They Mean
When a lookup fails, nslookup prints a line like ** server can't find NAME: CODE. The code is the whole diagnosis. This covers NXDOMAIN, SERVFAIL, REFUSED, and timeouts, what each one tells you, and the first thing to check for each.
LäsReverse DNS Lookups with nslookup
Reverse DNS maps an IP address back to a name through PTR records that live under in-addr.arpa for IPv4 and ip6.arpa for IPv6. nslookup does this automatically when you hand it an address. This covers how the special reverse name is built, why mail servers care, and why the forward and reverse can legitimately disagree.
Läsnslookup Interactive Mode
Run nslookup with no arguments and it drops into an interactive prompt where you can switch resolvers, change the record type, turn on debug output, and look up many names in one session. This covers the handful of commands worth knowing and when interactive beats a one-shot query.
Läsdig Query Options and Output Control
dig's real power is its options: choosing the server to ask, the record type, and exactly how much of the answer to print. This covers the handful you will actually use every day, from @server and -t to +short and the +noall +answer combination that trims dig down to just the records.
LäsFollowing Delegation with dig +trace
dig +trace resolves a name the way the internet actually does it: starting at the root, following the delegation to the TLD, and then to the domain's own authoritative servers, printing each hop. It is the single best way to see where resolution breaks and to understand how DNS is stitched together.
LäsAnatomy of a dig command line: how dig reads what you type
dig takes a server after an @, options with a dash, a name, a type, a class and query options with a plus, in almost any order, and fills in a default for everything you leave out. This article walks the line from left to right: which words are positional and how dig tells a name from a type, why the plus options are order sensitive and two of them are global, how the transport is decided (UDP with a TCP retry, TCP for ANY and transfers, TLS and HTTPS on their own ports), which switches change header bits and which travel in the EDNS OPT record, what +trace and +nssearch do to recursion, and why the manual tells you to keep a TSIG secret in a file. Each statement is the BIND 9 manual's or an RFC's, cited.
LäsHow Networking Inherited Two Alphabets
Every engineer reads Greek letters and Roman numerals without ever being taught them: Ω on a terminator, μs on a latency graph, λ on a wavelength plan, Ethernet II in every packet decoder, a I or a II stamped on a repeater. None of it was chosen for networking. Each symbol arrived from a datable moment, and the dates are the story.
LäsLinux: the hobby kernel that ate the world
A student in Helsinki announced a project that was 'just a hobby, won't be big and professional like gnu', and it now runs the servers, the phones, the routers, the cars and every one of the world's fastest supercomputers. How the kernel actually got built, the licence decision that made it possible, the argument about its architecture that it lost on paper and won in practice, and the two fights that still define it.
LäsThe Linux distribution families: what actually separates them
Every distribution ships roughly the same kernel and roughly the same GNU tools, so the differences are not where beginners look. They are in the package manager, the release model, the packaging philosophy and, most consequentially, who gets to decide. A field guide to the families, described by what you feel when you administer them.
LäsWhat grew out of Linux: phones, routers, containers and the licence question each one answers
Android, ChromeOS, SteamOS, OpenWrt, the Yocto builds inside your car, and the entire container industry are all Linux, but they are Linux in very different ways. The interesting part is not the family tree. It is how each descendant answered the same question: how much do we have to give back, and how did they engineer their answer?
LäsReading a curl Command
A curl command is a shell command: the word curl, a set of options, and a URL. Reading it means seeing how the shell splits the line first (quotes, backslashes, line continuations) and then how curl reads short, long, and clustered flags.
Läscurl Data Flags and the Content-Type Trap
curl has several ways to attach a body, and they differ in encoding and default Content-Type. The big surprise is that -d defaults to form encoding, not JSON, so a JSON body can be mislabeled and rejected.
LäsTranslating curl to fetch()
The browser fetch API and curl describe the same request differently. Method, headers, and body map across cleanly, but a couple of differences (implicit form Content-Type, cookies, and TLS verification) need care.
LäsHeaders, Authentication, and Cookies in curl
Headers, auth, and cookies are how a request identifies and authorizes itself. -H adds headers, -u is HTTP Basic, a bearer token is just a header, and -b/-c handle cookies. All of them are sensitive.
LäsHow curl Infers the HTTP Method
curl does not always need -X to choose a method. Body data implies POST, -I implies HEAD, -G forces GET, and an explicit -X always wins. Knowing the rules tells you at a glance what a request will do.
Läscurl Flags That Change Security Posture
A few curl flags change how safe a request is: -k disables TLS verification, http sends everything in clear text, and credentials in the URL can leak. None make a request malicious, but each is worth reading before you run or share a command.
LäsThe TCP Proxy: What a Layer 4 Middlebox Does and Does Not See
A TCP proxy terminates the client's TCP connection and opens a separate one to the server, splicing two independent flows together at Layer 4. It rewrites addresses and ports, can pool and reuse connections, and sees nothing of the application payload above the transport header. This explains full-proxy versus packet-forwarding, why the source IP disappears, and how the Proxy Protocol puts it back.
LäsHTTP Proxies: Forward vs Reverse, Explicit vs Transparent
An HTTP proxy parses requests at Layer 7, so it can route by URL, rewrite headers, and enforce policy on content a TCP proxy cannot see. Two axes describe every deployment: forward vs reverse (which side it works for) and explicit vs transparent (whether the client knows it is there). This covers the CONNECT method, X-Forwarded-For and Via, and where each combination is used.
LäsThe 27 Protocols curl Speaks
curl is known as an HTTP tool, but the current tool speaks 27 URL schemes: file transfer over FTP, SFTP and SMB, mail over SMTP, POP3 and IMAP, MQTT publish-subscribe, LDAP lookups, and relics like Gopher, DICT and Telnet. Knowing the map, and which schemes start in cleartext, changes how you use it.
LäsHTTP/0.9 vs 1.0 vs 1.1 vs 2 vs 3: Five Versions of the Web's Protocol
From a one-line GET that could only fetch HTML to a multiplexed protocol riding QUIC: what each HTTP version added, why it was needed, and which RFC defines it today - including the 2022 reorganization that split HTTP semantics (RFC 9110) from the per-version wire syntax.
LäsThe chokepoints of the internet: a field guide to what could actually break
The internet has no off switch, but it has six places where a small number of people, organisations or objects carry a very large share of everyone else's assumptions. Naming, routing, cable, trust, concentration and authority: what each one is, how fast it fails, who could cause it, and the different kind of answer each one admits.
LäsWhat happens if the DNS root goes dark, or starts lying
Turn off all thirteen root server identities and the internet keeps working for about two days, then unravels one top-level domain at a time as cached delegations expire. The far more dangerous scenario is a root that stays up and answers differently, because DNSSEC will faithfully sign the new reality. Here is the actual failure timeline, what survives, what you can do about it today, and why every alternative root has failed.
LäsBGP: the trust fall the whole internet is standing on
BGP carries reachability between about 74,000 independently run networks and has no built-in way to check whether an announcement is authorised or a path is real. After reading, you can tell a hijack from a route leak as the standards define them, explain why a more specific route wins and why upstream filtering decides the damage, read the documented incidents in their owners' and regulators' records, and say which defence (filtering, signed route origins, peering roles, path signatures) answers which failure.
LäsRoute origin validation, worked by hand: Valid, Invalid, NotFound
Route origin validation compares a BGP route's prefix and origin AS with the Validated ROA Payloads a router holds and gives the route one of three states. After reading, you can work out any route's state by hand from the two tests RFC 6811 defines, say why an Invalid route is Invalid (another AS, or a prefix longer than maxLength), read AS 0 and maxLength the way the RFCs do, and check your answer with the calculator.
LäsSubmarine cables: the internet is a rope on the seabed
Virtually all intercontinental traffic runs through a few hundred fibre-optic cables lying on the ocean floor, most no thicker than a garden hose, and the great majority of breaks are caused by fishing gear and ship anchors rather than by anybody's intent. What actually happens when they cut, why some countries shrug and others go dark, how repairs really work, and why redundancy on a map is not redundancy in the ground.
LäsCloud and CDN monoculture: the chokepoint nobody chose
Nobody decided that a configuration error at one company should take a quarter of the web offline for an hour, and yet that is roughly the arrangement. Concentration in cloud regions, content delivery networks, DNS providers and identity services means unrelated organisations now fail at the same moment for the same reason. Why it happened, what actually fails, and why the obvious answer (multi-cloud) is mostly wrong.
LäsInternet shutdowns: the chokepoint that is a phone call
Every other chokepoint in this series requires an attack, an accident or an act of engineering. This one requires an instruction to a handful of companies that already hold licences. Shutdowns are now routine somewhere in the world most weeks (full blackouts, regional cuts, platform blocking, and the quieter option of throttling) and the technical picture is less interesting than who has to comply and what it costs.
LäsAltaVista: built to break a processor, and lost by becoming a portal
AltaVista started as a benchmark. A researcher wanted a workload chaotic enough to stress DEC's new Alpha chips, so he pointed a crawler at the entire web. The result led search for years and then was dismantled by its own owners, which makes it the clearest case study in the industry of losing a market you already have.
LäsCGNAT: what breaks when a thousand subscribers share one address
Carrier-grade NAT (CGN) is a NAT in the provider's network that shares one public IPv4 address among many subscribers, with the shared address space 100.64.0.0/10 numbering the link behind it. After reading, you can state what RFC 6888 requires of a CGN, name what the published tests found broken, explain why an address alone no longer identifies a subscriber, compute the log volume and a deterministic port block, place NAT444 among DS-Lite and the A+P designs, and check whether your own connection sits behind one.
LäsDijkstra: the twenty-minute algorithm your routers run every day
In 1956 Edsger W. Dijkstra designed a shortest-path algorithm on a café terrace in Amsterdam, without pencil and paper, to demonstrate a new computer; every router running Open Shortest Path First (OSPF) or Intermediate System to Intermediate System (IS-IS) computes the tree that algorithm produces. After reading, you can tell the story from his own words, run the algorithm by hand on six routers, explain why link costs must be positive and why equal costs give several next hops, and find the result and the SPF throttle on a router.
LäsPort blocks and port sets: the arithmetic of sharing one IPv4 address
When a carrier-grade NAT or a MAP domain shares one public IPv4 address, what it divides is the 16-bit port field, by blocks, by a deterministic formula or by bit fields. After reading, you can work out how many subscribers an address and a pool hold, what block logging saves, which subscriber held a given address, port and time under RFC 7422, and which ports a MAP PSID owns.
LäsLoad balancing: what actually decides where a request goes
Every load balancer answers the same four questions: which servers are alive, which one gets this request, does this client have to keep going to the same place, and what happens when the answer changes. The algorithms are the least interesting part. The health check, the persistence decision and the drain behaviour are where outages come from.
LäsNetwork segmentation: from broadcast domains to identity, and why it keeps failing at the same place
Segmentation began as a performance fix for collision domains, became a security control by accident, and is now sold as microsegmentation. The mechanisms (VLANs, VRFs, VXLAN, firewall zones, host agents, cloud security groups) each solved the previous one's limits and inherited a new failure mode. The history, the standards, the architectures, the vendor landscape, and the thing that defeats every generation: nobody knows what talks to what.
LäsWi-Fi: a shared medium pretending to be a cable, and everything that follows from that
Ethernet solved contention by giving every device its own wire. Wi-Fi cannot, so it borrows the 1970s radio protocol Ethernet abandoned, and every generation since has been an attempt to buy back the efficiency that sharing costs. The standards, the spectrum, the architectures, the vendor landscape, and why the most common deployment mistake is treating coverage and capacity as the same problem.
LäsGPON: How One Fiber Serves a Whole Neighborhood
A Gigabit Passive Optical Network runs one strand of glass from the exchange, splits it with unpowered prisms, and shares it among dozens of homes. How the light is divided, why upstream needs a schedule, and where the decibel budget goes.
LäsBridges and Switches: One Idea, Solved Twice
The bridge and the switch are the same idea a few years apart, and the story runs through two people who are rarely mentioned together. Radia Perlman solved the loop problem at Digital in a single night in the mid-1980s and wrote the answer as a twelve-line poem. Kalpana put the same function in silicon per port in 1990 and sold the result to Cisco four years later. Along the way: why Perlman says the whole thing grew out of an industry mistake, why the switch replaced the hub without anyone calling it a security improvement, and what happens to a layer that has been declared finished several times.
LäsJumbo frames: when 1500 bytes stops being enough
Why Ethernet settled on 1500 bytes, what 9000-byte jumbo frames actually buy, where they shine, and how an MTU mismatch turns into a silent black hole.
LäsBits, bytes and the two kinds of kilo: why a 56k file takes eight seconds on a 56k modem
The arithmetic every network conversation leans on and most get slightly wrong: a byte is eight bits, link speeds are in bits and file sizes in bytes, kilo means 1000 everywhere except where it means 1024, and the IEC gave the 1024 kind its own prefixes in 1998. Why a 1 TB disk shows 931 and nothing is missing, why a 100 Mbit/s link moves at most 11.87 MB/s of TCP payload (RFC 2544 and the header minima), and the worked example a calculator on this author's 2004 site already carried. With NIST, the GNU ls page, ITU-T V.90 and G.704, IEEE 802.3-2022 and the RFCs.
LäsHTTP QUERY: the read that finally carries a body
RFC 10008 (June 2026) gave HTTP its first new method since 2010: QUERY is safe, idempotent, and cacheable like GET, but carries a request body like POST. What it fixes, how its caching and discovery work, why 'safe' is not 'harmless', and what every layer of infrastructure must check before QUERY traffic arrives.
LäsThe Router: From Gateway to Commodity, and the Names Left Out
The router has been reinvented at least four times and its job has never changed once: read a destination, choose a next hop, forward. This is the family history - the IMPs of 1969, the first true IP router written at BBN by Virginia Strazisar in 1975 and 1976, the multiprotocol router invented twice independently in 1981 at Stanford and MIT, the blue box that became Cisco, and the long slide from specialist hardware to software on a general-purpose machine. Including why the two people who solved the hardest early problems in layers 2 and 3 are both rarely named.
LäsF5 Distributed Cloud: one request, end to end
Sixteen articles on F5 Distributed Cloud, read in the order a request meets them: how a site joins the fabric, where the request lands, which route it takes, where it is sent, how it is encrypted, whether it is allowed, how much of it is tolerated, what it may call, what it leaves behind, and what is silently wrong with the configuration that handled it.
LäsLoad Balancers and ADCs: Built Against the Market Sizing
In late 1995 a Netscape webmaster told a Cisco engineer there were probably ten customers in the world with a load balancing problem. They started building anyway, and shipped the industry's first load balancer four months later. This is the family history - LocalDirector in April 1996, F5's BIG/ip in July 1997 on 200,000 dollars of first-year revenue against a five-billion-dollar competitor, the rename to application delivery controller, and what happens to a box whose function has been absorbed into every platform that came after it.
LäsExtreme Fabric Connect: one service, edge to edge
Ten articles on Extreme's fabric, read in the order a service comes into existence: which operating system, what the words mean, what the fabric is, how the nodes know each other, how a service rides the backbone, why multicast needs no configuration, how the edge asks for what it needs, and how the edge is dual-homed without spanning tree. The organising fact is the one the fabric is built on - a service is provisioned at the edge, not trunked hop by hop.
LäsReading a DNS answer: the line you skipped is the diagnosis
A DNS answer printed by dig or nslookup is the whole reply message: a header with flags and a response code, the question, an OPT pseudo-record and up to three sections of records, of which the address is one line. After reading, you can tell who answered and with what authority, read the flags, the OPT line, the TTLs and the failure codes, ask the authoritative server directly, follow a delegation with +trace, and find the part of this series that goes deeper on each line.
LäsThe industry, from inside: six articles on how this business actually works
Who founds the companies, how a product travels from the people who build it to the people who depend on it, what the role in the middle of that path does all day, what a customer is really buying when they buy transformation, and what every appliance on the estate is running underneath. Six articles that are not about any vendor, read in the order a career meets them.
LäsTransceivers: The Ridiculed Paper, and the Part of the Network You Can Hold
In 1966 a 32-year-old engineer at a British lab published a paper arguing that the enormous losses in optical fibre were caused by impurities rather than by physics, and was widely ridiculed for it. Four years later Corning proved him right, and he received the Nobel Prize forty-three years after the paper. This is the family history of the transceiver - from Kao's paper to the multi-source agreement, the industry's most successful act of deliberate self-restraint, and why the smallest replaceable part of a network is the one that determines what the network can become.
LäsSoftware-Defined Networking: A Protest That Became a Product Category
The early work that became SDN - Ethane, RCP, 4D - arose as a protest against the ossification of networks. Within seven years the protest had a foundation with Cisco and Juniper among its founding members, and its author had sold his company to VMware for 1.26 billion dollars and become a venture capitalist. This is the family history: what the movement actually asked for, what the industry gave it instead, and why the idea succeeded completely while the protocol it was named after mostly did not.
LäsDNS: A File Maintained During Business Hours
Before 1983, getting an address on the network meant telephoning Elizabeth Feinler at SRI, who added you to a file that staff updated a couple of times a week, during business hours, holidays excepted, and that every host then fetched. Jon Postel handed the problem to a graduate student, who read the existing proposals, wrote his own, and single-authored the specification of the system that now resolves trillions of queries a day. This is the family history: the file, the design, the security that was left out, and how a naming system became the internet's most convenient point of control.
LäsVirtualisation: Solved in 1967, Forgotten, Then Proved Impossible, Then Done Anyway
IBM put a working hypervisor into production use in January 1967. The industry then spent fifteen years without one, because cheap personal hardware removed the reason to share a machine - and when the reason came back, a formal analysis said the dominant processor could not be virtualised at all. A Stanford group did it anyway. This is the family history of virtual machines and containers: two separate lineages, one from mainframes and one from a Unix command that was never meant for security, meeting in the infrastructure everything now runs on.
LäsWireless: The Islands Problem, and the Protocol Given Away
In 1968 a professor in Hawaii needed to connect computers across four islands and could not lay cable across the Pacific. The answer - let stations transmit whenever they have something to send, and deal with the collisions - became operational in June 1971, was placed in the public domain because no office existed to commercialise it, and is now underneath Wi-Fi, mobile networks, cable and Ethernet. This is the family history, including the regulatory decision that mattered more than any protocol and the encryption failure that taught the industry its most expensive lesson.
LäsObsolescence: What Actually Dies, What Refuses To, and How to Tell
This industry is wrong about obsolescence in both directions. It declares things finished that outlive the declaration by decades, and treats as permanent things that vanish inside a product cycle. Drawing on the family histories and company records in this catalogue, this is an attempt at something more useful than prediction: the specific mechanisms by which a technology actually dies, the specific reasons others cannot be killed, and what both imply for anyone deciding what is worth learning.
LäsObservability: The Temporary Protocol That Outlived Its Replacement
In 1988 a working group published a protocol it had been instructed to keep simple, intended as a stopgap, authenticated by a password sent in the clear. It became the way the world watched its networks and is still running. Its more secure successor collapsed under the complexity of its own security. This is the family history - from SGMP and RFC 1067 through the failure of version 2 to streaming telemetry - and what it says about why bad security survives.
LäsTime: The Dependency Nobody Lists
One man designed both the first modern software router and the protocol that keeps the internet's clocks, and fragments of the code written for it in 1985 are still running. Time appears in no architecture diagram and sits underneath certificates, tickets, logs, one-time codes and half the security controls in this catalogue. This is the family history of NTP - the Fuzzball, RFC 958, leap seconds specified from the very first document, and the debug command that became a weapon.
LäsThe OSI Model in Practice: Mapping Real Traffic to Seven Layers
The Open Systems Interconnection model earns its place not as trivia but as a shared address system for problems: a MAC address is Layer 2, an IP address Layer 3, a TCP or UDP port Layer 4, and the application on top. How to map real artifacts to layers, where the model bends against TCP/IP reality, and why troubleshooting conversations go faster when everyone points at the same floor.
LäsLocal, Wide and the Words That Stopped Meaning Distance
The distinction between a local and a wide area network was never really about geography. It was about who owned the link and what a byte cost to move, and every protocol written before about 1995 encodes an assumption about which side of that line it would run on. This is the family history of network scope - why the categories were invented, why VLANs and overlays broke them, and why an industry that spent thirty years insisting the perimeter was a place now uses the word local to mean trusted.
LäsSwitch, Router, Firewall: Who Does What on the Path
Three device roles carry most of every network diagram: switches forward frames inside a Layer 2 domain, routers move packets between networks, and firewalls decide what is allowed to pass. The function and purpose of each, how an application delivery controller relates to all three, and how to read a network diagram without getting lost.
LäsARP and MAC Addresses: How IP Finds Ethernet
Every packet on a local network is delivered by MAC address, and ARP is the directory service that maps an IP to one. The one-to-one mapping, reading ARP output to prove resolution worked, gratuitous ARP, and MAC masquerading - the failover trick that makes an address move without the switches noticing.
LäsRouting Tables and the Default Gateway: How a Packet Picks Its Next Hop
A routing table answers the one question every host and router asks of a packet: where does it go next. The host decides local or remote by its mask and hands the rest to a default gateway; the router prunes its table to one entry by basic match and longest match, with the default route of prefix length zero as the entry of last resort. After reading, you can run the longest-match decision by hand, read a Linux or Windows table line by line, say how a host learned its default (by hand, by DHCP, by Router Discovery or by an IPv6 Router Advertisement) and recognise a missing, dead or rogue default from its symptoms.
LäsTest and Measurement: The Family That Checks the Others
Every other family in this catalogue builds something. This one exists to find out whether the claims the others make are true - and it began as an internal engineering tool that somebody got the rights to in an acquisition. This is the history: TART at a subsidiary in 1982, the Sniffer selling nine hundred million dollars' worth, a standards document that opens by accusing vendors of smoke and mirrors, and a free analyser written because one company could only afford a single instrument.
LäsReading ip route, netstat and route print, field by field
A routing table printout is one decision written in three dialects: Linux iproute2 prints keyword and value pairs, net-tools and BSD netstat print columns with flag letters, and Windows route print prints a netmask table per address family. After reading, you can name every field in the three printouts, find the default routes and say which one wins, spot the routes that drop traffic or are never consulted, and work out by hand which line a destination uses.
LäsDHCP: the Lease Lifecycle Behind Automatic Addressing
A Dynamic Host Configuration Protocol (DHCP) lease is an IPv4 address lent to a host for a fixed time: granted in four messages, extended at T1 by the same server or at T2 by any server, and given up at expiry. After reading, you can say who sends each message to whom, compute T1, T2 and expiry for a real lease, explain DHCPNAK, DHCPDECLINE, DHCPRELEASE and DHCPINFORM, predict what a client does when its server disappears, and recognise a silent server, a 169.254 address, a rogue server and an exhausted pool.
LäsThe TCP Connection Lifecycle: Handshake, Teardown, and Why Connections Fail
Every TCP conversation has three acts: the SYN handshake that creates it, the data flow that justifies it, and the FIN or RST that ends it. The difference between polite close and abort, the possible reasons a connection terminates, and the short list of causes when one fails to establish at all - the literacy behind every capture you will ever read.
LäsVPN Fundamentals: What Tunnels Protect, and What They Don't
A virtual private network wraps traffic in an encrypted tunnel so it crosses untrusted networks as if it never left home. The rationale - privacy, encryption, and the limits of anonymity - the valid uses from site-to-site links to remote access, and the honest boundaries: what a tunnel genuinely protects, and the claims it cannot keep.
LäsThe Last Mile: From POTS to Always-On
The story of residential connectivity is the story of one stubborn stretch of infrastructure - the last mile - being reinvented four times: the plain old telephone service that carried voices, the ADSL trick that made the same copper pair carry data full-time, the cable plant's DOCSIS second life, and fiber to the home. Why 1999's 256 kbps mattered more than its speed, what always-on actually changed, and how one house can end up served by copper's ghost, coax, glass, and the sky at once.
LäsPagers and Paging Networks: Reachable Before Real-Time
Before the phone in your pocket, there was the bip on your belt: a one-way radio receiver on a simulcast broadcast network, fed - in its classic form - by a human operator who took your caller's words and typed them into the air. How paging networks actually worked, from two-tone beeps to POCSAG and FLEX, why the operator-relay model meant strangers read your life aloud, and why hospitals kept pagers long after everyone else moved on.
LäsLEO Constellations: Why the New Satellite Internet Is a Different Animal
Geostationary satellites solved coverage and lost latency: parked at 35,786 km, physics alone charges half a second round trip. Low Earth Orbit constellations invert the deal - satellites a few hundred kilometers up, latency in the tens of milliseconds, at the price of needing thousands of moving satellites, phased-array terminals that track them, and constant handoffs. The geometry, the engineering it forces, inter-satellite laser links, and the honest trade-offs.
LäsLoRa and LPWAN: Kilometers of Range on a Coin Cell
There is a corner of networking where the requirements invert everything broadband optimizes for: send a few bytes, a few times an hour, kilometers through a city, from a battery that must last years. LPWAN is that corner; LoRa is its best-known citizen - Semtech's chirp spread spectrum radio trading bitrate for astonishing link budgets, and LoRaWAN, the LoRa Alliance's network layer, organizing gateways, device classes, and the duty-cycle etiquette of shared spectrum.
LäsHTTP Methods: The Verbs of the Web
GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, CONNECT - and now QUERY. What each method promises, why 'safe' and 'idempotent' are the two properties that actually matter (to caches, retries, proxies, and crawlers), why HTML forms only ever learned two verbs, and how to read an API's soul from the methods it accepts.
LäsHTTP Status Codes: The Five Families
Three digits, and the first one does most of the work: 1xx continues, 2xx succeeds, 3xx redirects, 4xx blames the client, 5xx confesses for the server. The family logic, the codes an operator actually meets (200, 204, 301 vs 302 vs 307, 304's cache dance, 401 vs 403, 404 vs 410, 429, 500 vs 502 vs 503 vs 504), the famous curiosities, and why an unknown code's first digit is always enough to act on.
LäsHTTP Headers: The Anatomy of the Metadata
Everything HTTP knows about a message that isn't the message travels in headers: name-colon-value lines with case-insensitive names, folded into four working roles - request context, response context, representation metadata, and negotiation and conditionals. The end-to-end vs hop-by-hop split that proxies live by, the Host header that made virtual hosting possible, content negotiation, conditionals, and why header order became a fingerprint.
LäsHTTP Cookies: State Over a Stateless Protocol
HTTP forgets you after every request - by design. Cookies are the retrofit that lets it remember anyway: the server writes a note with Set-Cookie, the browser returns it with Cookie, and everything else - scope, lifetime, security - is rules about when that note travels. Domain and Path scoping, session vs persistent lifetimes, why the server never sees what the browser knows, and where the security flags article picks up.
LäsAJAX, XHR, and fetch: When Pages Learned to Talk Back
For its first decade the web had one move: click, blank screen, new page. XMLHttpRequest gave pages a second one - request data in the background, update in place - and 'AJAX' named the revolution (which promptly dropped the X for JSON). How XHR worked, what fetch fixed (promises, streams, a sane API), what stayed the same underneath (it is all still HTTP), and the boundary every background request answers to: same-origin, with CORS as the negotiated exception.
LäsHTML, CSS, and the DOM: The Page as a Living Tree
Three technologies, one division of labor: HTML declares structure, CSS declares presentation, and the DOM is what actually exists at runtime - the tree the browser built from your HTML, the only thing scripts can touch, and the reason 'view source' and 'inspect element' show different worlds. How markup becomes a tree, how selectors address it (the same selectors CSS styles with and scripts query with), and why the DOM is where XSS happens and where CSP stands guard.
LäsWhat Is an Algorithm? A Working Primer
An algorithm is a finite, unambiguous recipe that turns input into output - and the engineering questions are always the same three: is it correct, how does its cost grow, and what does it trade away. Big-O as the grammar of growth, why constants and asymptotes both matter, the core families you already operate (search, sort, hash, graph, state machines), and where each one is already running inside this site's own tools.
LäsThe IEEE 802 family, group by group
802 is not one standard but a committee of working groups, each owning a slice of the lower two layers. Here is the map: who owns Ethernet, who owns Wi-Fi, what the numbers after the dot mean, and which groups are alive, hibernating, or long dead.
LäsStructured cabling: the system behind the wall jack
TIA-568 turns a building's wiring from improvisation into a system: horizontal runs, telecom rooms, the 100-meter channel, categories, pinouts, and the fire ratings inspectors actually check. The map from wall plate to backbone.
LäsBGP: how the internet decides where traffic goes
The Border Gateway Protocol is the routing protocol between autonomous systems: each network tells its neighbours which prefixes it can reach and through which networks, and each router keeps one best path per prefix, chosen by local policy first and a fixed tie-break order after. After reading, you can place an AS number in its registry, follow a session from TCP to Established, read the path attributes, walk the best-path decision on real router output, and say what an AS path does and does not prove.
LäsOSPF: the map, the math, and area 0
OSPF is the Internet Standard link-state interior gateway protocol: each router floods a description of its own links, every router in an area holds the same database, and each one computes its own shortest-path tree from it. After reading, you can work out a route by hand from link costs, say why two routers will not become neighbours, explain the designated router election and the rules for areas, set costs without the reference-bandwidth trap, and read FRRouting's neighbour, database, route and interface output.
LäsIS-IS: the routing protocol hiding under the internet
Intermediate System to Intermediate System (IS-IS) is the link-state routing protocol ISO wrote for OSI and RFC 1195 extended to IP: it floods link state as OSPF does, but its packets travel on the link layer, not inside IP. After reading, you can build a NET from a loopback address, tell Level 1 from Level 2 routing, predict which router becomes the DIS on a LAN, read show isis neighbor and show isis database in FRRouting, and say what its authentication protects and what it leaves open.
LäsMPLS: labels, stacks, and the BGP-free core
Multiprotocol Label Switching (MPLS) classifies a packet once, at the edge of a network, and from then on routers forward it on a short label they swap, pop or push, without reading the IP header again. After reading, you can decode a label stack entry in hex, name the special-purpose labels, follow one label-switched path through a real Label Distribution Protocol (LDP) binding table, say exactly what a BGP-free core keeps and drops, and explain the two labels of a layer 3 virtual private network (VPN) packet.
LäsPeer-to-peer, from Napster to the swarm: the architectures that outlived the piracy
Napster, Gnutella, Kazaa, eMule, BitTorrent - four years of file-sharing produced five distinct network architectures, each solving the weakness the last one died from. The centralized index, unstructured flooding, the supernode, the distributed hash table, and the swarm - what each actually was, how the courtroom shaped the topology, and why these ideas quietly power Skype, streaming CDNs, and blockchains today.
LäsThe Brazilian market reserve, in theory and in practice
For eight years Brazil legally reserved its computer market for domestically-owned companies. The theory was an infant industry that would grow up and compete. The practice was clones, smuggling, a trade war with Washington, and a generation of engineers who learned on machines the policy created. Both halves are true.
LäsDigital transformation: what actually changed, and how to read what comes next
Transformation is not the technology arriving. It is the moment a capability stops being remarkable and becomes assumed. A look at what genuinely changed across money, work, health, and the state, and then an honest method for reading predictions, including a deadline that is real and moving at the same time.
LäsHow the internet gets shut down, and who can actually do it
There is no off switch, but there are chokepoints: cables, routing, exchanges, and the small number of companies most traffic passes through. A tour of the mechanisms, what each state can genuinely do with them, and the uncomfortable conclusion that watching everything is easier than switching anything off.
LäsWho actually governs the internet in Brazil
Brazil built one of the world's most distinctive internet governance models: multistakeholder before that was a word, with a research foundation running the country's first connection and a committee that is not a ministry. The organs, the laws, the state computing backbone underneath it all, and the 2025 ruling that rewrote platform liability.
LäsAmateur radio: callsigns, modes, and why it still matters
A callsign is an identity issued by treaty, readable anywhere on earth. What the letters and the digit mean, how PY2 says São Paulo, the difference between voice and CW and digital, what a repeater actually does, and why a hobby older than broadcasting is still the fallback when everything else fails.
LäsThe data communications window, 1968 to 1972
A regulator opened a market. The Carterfone decision let equipment AT&T had not built attach to the telephone network, and within four years an industry of modem and multiplexer companies existed that could not have existed before. The trigger, the window, the products that defined it, and why it closed.
LäsThe networking window, 1979 to 1982
Corporations had bought computers for a decade and now needed them to talk to each other inside a building. The window that opened around 1979 produced local area networks and the data PBX, settled a contest between two answers to the same problem, and closed once the answer was obvious.
LäsThe radio spectrum: which frequencies go how far, and why
Why a shortwave signal crosses an ocean on 100 watts while your Wi-Fi struggles through a wall. The bands from VLF to EHF, the three propagation modes that explain nearly everything, and the trade that governs all radio: reach or capacity, never both.
LäsThe internetworking window, 1984 to 1988
The previous window's success created this one's problem: buildings full of local area networks that could not reach each other. Bridges and routers answered it, a standards war ran alongside, and two trade shows in 1988 made the outcome visible before the argument was formally over.
LäsThe two shows of 1988
One trade show put competing vendors' equipment on a single live network in public, where failure would be seen. The other showed an ecosystem that was largely described rather than shipped. The standards argument was formally undecided and a buyer walking both floors did not need it settled.
LäsThe founders who kept founding
Reading this industry as a sequence of companies misses that it is substantially the same population of people, recombining. Ungermann left Intel for Zilog and Zilog for Ungermann-Bass; Metcalfe left Xerox for 3Com. What that pattern explains, and what it does not.
LäsBFD: when a link is up and dead at the same time
Bidirectional Forwarding Detection (BFD) is a small Hello protocol between two forwarding engines that notices a path has stopped carrying packets, including when both interfaces stay up, long before a routing protocol's own timers would. After reading, you can compute a detection time from the two timers and the multiplier, read a session in FRRouting field by field, choose which protocol should be its client, and say where BFD itself can be fooled.
LäsSizing BFD timers: the arithmetic of detection
Bidirectional Forwarding Detection (BFD) never sends its detection time: each receiver computes it from the other side's multiplier and the interval the two sides agree, separately in each direction. After reading, you can work backwards from a detection target to intervals and a multiplier, predict both directions of a session from its six configured numbers, and recognise the slow start, jitter, hardware and Echo effects that stretch the result.
LäsFirst-hop redundancy: VRRP, HSRP, and the gateway that is a fiction
First-hop redundancy protocols such as VRRP and HSRP let several routers share one default gateway address and one virtual MAC address, so that hosts keep forwarding when the router behind that address fails. After reading, you can say what a host can and cannot do on its own, compute a VRRPv3 failover time from priority and interval, compare HSRP's defaults, recognise the usual failures and the attack surface, and find both protocols in a capture and in router output.
LäsMulticast: what it costs to not flood
IP multicast sends one datagram to a group address and lets the network make the copies, and the price is state in every switch and router that must know where the members are. After reading, you can map a group address to its media access control (MAC) address, compute the Internet Group Management Protocol (IGMP) timeouts, explain why a switch floods multicast and what a missing querier does, read Protocol Independent Multicast (PIM) state in FRRouting, and say what Source-Specific Multicast removes.
LäsPublic DNS resolvers: what you are actually choosing
A public resolver is a recursive resolver anyone may use, and switching to one hands the operator every name your device looks up. What separates 1.1.1.1, 8.8.8.8, 9.9.9.9 and 208.67.222.222 is policy, not speed: what is logged and for how long, which addresses filter and how a block answers, whether DNSSEC is validated, whether your subnet is passed to authoritative servers, and which encrypted transports are offered. After reading, you can read an operator's pages against the list RFC 8932 asks it to publish, choose by those criteria, and test each one with dig and curl.
LäsPython as a network engineer's calculator: the standard library already knows your arithmetic
Subnet splits, route aggregation, wildcard masks, EUI-64, a DNS header in bytes, an HMAC, a p95 of latency samples, a transfer time at line rate: each is a few lines of Python with nothing installed, because ipaddress, struct, hmac, statistics and re ship with the interpreter. This article walks the twelve examples the Python playground opens with, says which module does the work in each and why it is the right one, points at the pitfalls (hosts() on a /31, round-half-even, the universal/local bit), and shows where the same answers come from by hand on this site's other tools, so you can check one against the other.
LäsHTTP, from the request line: what a message means, and how it travels
Every HTTP exchange is two messages, a request and a response, and since June 2022 the standard describes them in two layers: what a message means (methods, status codes, header fields), defined once for every version, and how its bytes travel, defined for each version on its own. The map of the HTTP series: which article reads which part of a message, and in what order.
LäsThe family histories: twenty-three technologies, each read from its first day
Twenty-three of the technologies a network and its security are built from, from the transceiver to the web application firewall, each told as a family history: the dated moment it began and the people in it, the argument that decided what it became, what it did to jobs and practices, and where it goes. How the histories are told, what to look for in each, and an order to read them in.
LäsThe Ethernet frame, field by field: preamble to FCS, the 802.1Q tag, and the sizes that matter
Every Ethernet frame is the same short sequence of fields: a preamble to wake the receiver, two addresses, one field that is either a length or a type, the payload, and a checksum. What each field holds, why the minimum is 64 octets and the maximum 1518, where the 802.1Q tag goes and what it carries, and why jumbo frames are not in the standard.
LäsVLANs and 802.1Q trunking: tagged, untagged, native, and the voice VLAN
A VLAN turns one switched network into several that cannot hear each other's broadcasts, and 802.1Q is how a single cable carries many of them at once. Access and trunk ports in the standard's own terms, the native VLAN and the mismatch that loops a network, the VLAN-hopping attacks and the settings that stop them, the voice VLAN behind every desk phone, and why traffic between VLANs always needs a router.
LäsSpanning tree in one article: why a blocked port is the feature, and how RSTP and MSTP made it fast
Redundant links between switches make loops, and Ethernet has nothing in its header to stop a frame circling forever. The Spanning Tree Protocol solves it by electing a root and blocking every port the tree does not need. The election, the costs and the timers, the 30 to 50 seconds classic STP took to recover, the handshake that made RSTP fast, the regions and instances of MSTP, Cisco's per-VLAN variants and guards, and the engineer who wrote the algorithm's abstract as a poem.
LäsLink aggregation and LACP: several links that act as one, and the protocol that keeps them honest
A link aggregation group bundles parallel Ethernet links into one logical link for more bandwidth and for resilience. Where the standard came from (802.3ad, then 802.1AX), how LACP lets both ends agree before a single frame is sent, the fast and slow timers, why static bundles are risky, why one flow never goes faster than one member link, the rules members must follow, multi-chassis bundles, and the Linux bonding modes.
LäsEthernet physical layers, from 10BASE-T to 400GBASE: naming, auto-negotiation, duplex, and the mismatch that cripples a link
Ethernet is one frame format over dozens of physical layers, from 10 Mb/s on telephone-grade copper to 400 Gb/s on parallel fibre. How to read a name like 100GBASE-SR4, the amendments that brought each speed, what copper needs to reach 100 metres, how bits become signals, why full duplex ended collisions, what auto-negotiation settles, and how one side fixed at full duplex while the other negotiates produces the classic duplex mismatch.
LäsFibre basics: multimode and single-mode, the grades and their colours, connectors and polarity, the loss budget, and why dirt is the first suspect
Optical fibre carries Ethernet's longer and faster links. The two kinds of fibre and why a wide core limits reach; the OM and OS grades and the jacket colours that tell them apart; how far one optic reaches on each grade; LC, SC and MPO connectors; flat and angled end faces and why they must never be mated; transmit-to-receive polarity; the loss budget worked through with real numbers; dirt, inspection and cleaning; the light you cannot see; and the readings the optic reports about itself.
LäsDynamic routing compared: distance vector, link state and path vector
Every dynamic routing protocol answers the same question, where to send a packet next, and the families differ in what each router is told and what it works out for itself. Distance-vector routers trade their tables with their neighbours; link-state routers flood a map and each computes its own tree; path-vector routers carry the list of networks a route has crossed; EIGRP's DUAL refines distance vector until it is loop-free at every instant. What each knows, how each keeps loops out, how fast each recovers, and where RIP, OSPF, IS-IS, BGP and EIGRP sit, read from their RFCs.
LäsRoute redistribution and the loops it invites
Redistribution is a router announcing in one routing protocol the routes it learned from another, or from its own static and connected routes. Every network with more than one protocol needs it, and it is the commonest way to build a routing loop by configuration. What the standard requires, why metrics have to be invented on the way in, how administrative distance turns two redistribution points into a feedback loop, and the fixes that work: filters, tags, one-way redistribution and a default route, read from RFC 1812, the OSPF and RIP specifications and Cisco's own examples.
LäsBOOTP and DHCP options: what a client asks for, and what it is told
Name every field of the packet that BOOTP defined in 1985 and that DHCP still sends, and say how DHCP turned its last field into a list of options. Decode an option from the magic cookie to the end marker, say what the common options carry and which side sends them, and use the IANA registry to tell a standard code from a private one when a capture or a server log shows a number you do not recognise.
LäsThe DHCP relay agent: one server for many subnets
A DHCP client that has no address yet broadcasts its request, and the server it needs is usually on another network. The relay agent receives that broadcast, marks it with the address of the subnet it came from, sends a new message to the server and carries the reply back. After reading you can follow both messages step by step, explain giaddr, the hops field, the BROADCAST flag and option 82, configure ip helper-address on Cisco IOS, and work through a remote subnet that gets no lease.
LäsPXE and network boot: how a machine with no disk finds what to run
A machine with no operating system, or no disk at all, can still boot by asking the network for an address and for the name of a program to download and run. After reading, you will be able to follow a PXE boot from the first DHCPDISCOVER to the first instruction executed, read the options that identify the client, explain why Proxy DHCP listens on port 4011, choose the right boot file for BIOS and UEFI machines, and place the IPv6 and HTTP successors of the 1999 design.
LäsTFTP: the simplest file transfer, and where it still runs
The Trivial File Transfer Protocol moves one file over UDP in 512-byte blocks, one block in flight and one acknowledgement each, with no login and no directory listing. After reading, you can follow a transfer packet by packet from port 69 to the last short block, explain the Sorcerer's Apprentice Syndrome and the options that negotiate block size, timeout, file size and window, and say where the protocol still runs and what to check when a transfer stalls.
LäsZone transfers and NOTIFY: how secondary name servers stay in step
Every DNS zone has to be served by at least two authoritative servers, and their copies have to agree. After reading you will be able to read the timers in a zone's SOA record and predict when a secondary polls, recognise an AXFR, IXFR or NOTIFY exchange in a packet capture, explain why transfers are restricted and encrypted, and check with dig whether a zone's servers carry the same serial.
LäsDNSSEC end to end: from the root's key to a validated answer
After reading, you can follow a DNSSEC validation from the root's trust anchor down to a signed answer, name the record that carries each link, and say why a resolver returned SERVFAIL, an ad flag, or nothing special at all. You will also know which root key is signing today, which algorithms the IANA registry still allows, and how to check a validation yourself with dig and delv.
LäsDoT, DoH and DoQ compared: encrypting the question
Classic DNS sends every question in the clear, and the leg between the stub resolver and the recursive resolver is where an eavesdropper learns the most. DoT, DoH and DoQ encrypt that leg in three different ways. After reading you can say what each one hides and what none of them hides, read their ports and framing, tell a Strict profile from an Opportunistic one, explain how a client discovers an encrypted resolver, and choose a transport for a given network with the standards' own reasons.
LäsAnycast: one address in many places
Anycast announces one service address from many independent places and lets the routing system decide which one each client reaches. After reading you can define it in the words of RFC 1546 and BCP 126, explain why nearest means nearest in the routing table rather than on the map, say why DNS over UDP suits it and TCP strains it, read the root server list on root-servers.org, and run a dig query that reveals which instance answered you.
Läs