Glossary

72 terms, each linked to the lessons that use it. Search if you know the word, browse the letters if you half-remember it, or filter by protocol if you know where you met it.

72 of 72 shown

A

Acknowledgement number: 'I have everything before this byte — send this one next.'; The acknowledgement number names the next byte the receiver expects, which implicitly confirms everything before it (a cumulative ACK). It is only valid when the ACK flag is set.; see: sequence-number see: duplicate-ack lesson: sequence-and-ack-numbers
Administrative distance: How much a router trusts each source of routing information. Lower is more trusted.; Connected 0, static 1, eBGP 20, OSPF 110, iBGP 200 — widely used values, though a vendor convention rather than a standard. The number matters less than where it sits in the comparison: distance is checked BEFORE the metric, so a route with a far worse metric still wins if its source is more trusted. That ordering is a necessity, not a preference — an OSPF cost and a BGP MED are different units, so there is nothing meaningful to compare across protocols except trust.; see: rib see: routing-table see: longest-prefix-match lesson: routing-how-a-route-is-chosen
AIMD: Additive Increase, Multiplicative Decrease — grow gently, cut hard; the control loop behind TCP's sawtooth.; In congestion avoidance TCP adds about one MSS per round trip (additive increase); on loss it halves its window (multiplicative decrease). Plotted over time this makes a sawtooth. The asymmetry is the point: cautious growth and drastic reaction let millions of independent flows converge on a roughly fair share of a bottleneck without any coordination. Modern algorithms (CUBIC, BBR) reshape the curves but keep the architecture.; see: cwnd see: slow-start see: ssthresh lesson: congestion-control
ARP: Address Resolution Protocol — finds the MAC address that owns an IP address on the local wire.; A host that wants to send to an IP address on its own subnet broadcasts 'who has this address?' and the owner replies with its MAC. The answer is cached, so the exchange happens once per cache lifetime rather than per packet. ARP is carried directly in Ethernet (EtherType 0x0806) — it is not inside IP, which is why an ARP packet has no IP header at all.; see: mac-address see: arp-cache see: broadcast-domain lesson: arp-why-it-exists lesson: arp-local-vs-remote
ARP cache: A host's table of learned IP-to-MAC mappings, with an expiry timer per entry.; Populated from any ARP packet the host sees — including requests it was not the target of. Entries age out after tens of seconds to a few minutes, which is why a long-idle flow sometimes shows an ARP exchange before its next packet. `arp -a` on most systems prints it.; see: arp see: mac-address lesson: arp-why-it-exists lesson: arp-caching-and-failure
AS_PATH: The list of networks an announcement has crossed. Also BGP's entire loop prevention.; Each AS prepends its own number when passing a route out of an eBGP session, so the path is a record of who has already handled the announcement. Two consequences: it is compared early — commonly right after LOCAL_PREF, though the steps before it vary by implementation — and a router that finds its OWN number in a received path discards the route because it has come back round. Note what the length counts — entries in the path, not routers or kilometres. Usually one entry is one organisation, but prepending repeats an AS deliberately, so 65001 65001 65001 has length 3 and crosses one. A two-entry path may be physically far longer than a three-entry one. It is also unverified, which is why prepending your own AS repeatedly is the standard way to make a path look worse on purpose.; see: bgp see: bgp-decision-process see: autonomous-system lesson: bgp-choosing-a-path
Authoritative server: The server that holds a zone's real records, rather than a cached copy.; It answers with the AA flag set, which is how a resolver knows it has reached the source. A recursive resolver, by contrast, answers from cache or by asking others - useful, but always one step removed from the truth.; see: dns see: recursive-resolver lesson: dns-how-a-name-is-resolved
Autonomous system (AS): One organisation's network, identified by a number. The unit BGP reasons about.; BGP has no interest in what is inside an AS — that is the interior gateway protocol's business. It cares only about which AS can reach what, and which ASes an announcement has crossed. Numbers are assigned by the regional registries; the private ranges (64512–65534 and 4200000000–4294967294) exist so examples and internal use need not consume a real allocation.; see: bgp see: as-path lesson: bgp-how-a-peering-works

B

BGP: How separate organisations exchange routes — the protocol that holds the internet together.; A path-vector protocol: it advertises reachability with attributes attached, rather than topology. Between organisations, shortest is the wrong goal — what matters is who you pay, who pays you, and who you have agreed to carry traffic for, and none of that is visible in the topology. So BGP computes no best path; it applies an ordered list of comparisons, several of which are values an operator sets. Two networks receiving identical announcements can legitimately choose differently, and both are right.; see: autonomous-system see: as-path see: local-pref see: bgp-decision-process lesson: bgp-how-a-peering-works lesson: bgp-choosing-a-path
BGP decision process: An ordered list of comparisons. The first one that separates the candidates decides — but the order is partly implementation-defined.; Highest LOCAL_PREF, then shortest AS path, then lowest ORIGIN, then lowest MED, then eBGP over iBGP, then vendor tie-breaks such as lowest router id. That order is SubnetLayer's teaching sequence: RFC 4271's comparisons plus near-universal convention. It is not a universal law. Route eligibility and local policy run before any of it, Cisco compares a proprietary weight BEFORE LOCAL_PREF, some platforms prefer a locally originated route first, and the router-id tie-break is vendor convention rather than a standard requirement. Consult your platform's documentation for its actual sequence. It is lexicographic rather than arithmetic — there is no single number, because between organisations no number would mean the same thing to both. The ORDER carries real weight: an attribute below the deciding step is never read at all, so tuning MED on a session where LOCAL_PREF already differs changes nothing.; see: local-pref see: as-path see: bgp see: rib lesson: bgp-choosing-a-path
BGP session: A configured peering between two routers, carried over TCP port 179.; BGP defines no neighbour discovery, so every neighbour is written into the configuration with the AS it is expected to be — routing relationships and policy must be intentional. The relationship behind one may be settlement-free peering, customer-provider transit, a private interconnect, internal iBGP, or enterprise or lab policy; it is not always commercial. (Some implementations offer dynamic-neighbour or listen-range configuration, but the protocol itself discovers nothing.) Running over TCP gives BGP reliability and ordering for free (which is why it has no acknowledgements of its own) and means a peer need not be on the same wire, unlike an OSPF neighbour. The states run Idle → Connect → OpenSent → OpenConfirm → Established, and nothing is exchanged until the last of those.; see: bgp see: autonomous-system see: three-way-handshake lesson: bgp-how-a-peering-works
Broadcast domain: The set of interfaces a broadcast frame reaches — the scope of one ARP request.; Switches extend a broadcast domain; routers terminate it. Because ARP relies on broadcast, resolution only works within one domain — which is precisely why a host must resolve its gateway rather than a remote destination.; see: arp see: default-gateway lesson: arp-why-it-exists

C

Certificate chain: A sequence of certificates, each signed by the next, ending at a root your machine already trusts.; The leaf says 'I am this name' and is signed by an intermediate, which is signed by a root that shipped with your operating system. Validation walks that chain and checks three independent things: the name matches what was requested, the dates are current, and every signature verifies. A server that forgets to send its intermediate works in clients that have it cached and fails everywhere else.; see: tls see: sni lesson: tls-handshake lesson: tls-when-validation-fails
Checksum: A 16-bit sum letting receivers detect corrupted headers or data.; IPv4 checksums its header; TCP checksums its header, payload, and a pseudo-header containing the IP addresses (so misdelivered packets fail). Both use the one's-complement Internet checksum from RFC 1071.; see: tcp lesson: tcp-header-anatomy
Congestion window (cwnd): The sender's self-imposed cap on unacknowledged data in flight — its estimate of what the network can carry.; Unlike the receive window, cwnd never appears in any packet header: it lives only in the sender's memory. The sender may keep min(cwnd, receiver's window) bytes unacknowledged. cwnd starts small, grows while ACKs arrive (slow start, then congestion avoidance), and shrinks sharply when loss signals congestion. You infer it from a capture by counting bytes in flight between ACKs.; see: slow-start see: ssthresh see: aimd see: receive-window lesson: congestion-control

D

Default gateway: The router a host sends traffic to when the destination is not on its own subnet.; It is the next hop for the default route (0.0.0.0/0). A host resolves the gateway's MAC address, not the destination's, and the frame goes to the gateway while the IP header still names the final destination.; see: subnet-mask see: routing-table see: arp lesson: arp-local-vs-remote lesson: arp-caching-and-failure
Designated router (DR): On a shared segment, the router everyone forms an adjacency with, so the wire does not need one per pair.; It reduces n(n-1)/2 adjacencies to 2n-3 — ten routers go from forty-five conversations to seventeen. It is a conversation hub and nothing more: it computes no routes for anyone, holds no authoritative copy of anything, and has no say in forwarding. Elected by highest priority, ties broken by highest router id, with priority 0 meaning never.; see: ospf-adjacency see: ospf lesson: ospf-becoming-neighbours
DHCP: Hands a machine its address, mask, gateway and resolver when it joins a network.; A machine that has just been plugged in has no address, so it cannot be addressed - which is why every message before the lease is granted is broadcast from 0.0.0.0. The four-message DORA exchange (Discover, Offer, Request, Acknowledge) solves that bootstrapping problem, and the ACK is the only message that commits anything. DORA describes INITIAL allocation only: a renewal at T1 is a unicast REQUEST and ACK with no DISCOVER and no OFFER, and INFORM, RELEASE and DECLINE are not part of it at all.; see: dhcp-lease see: default-gateway see: udp lesson: dhcp-getting-an-address lesson: dhcp-partial-configuration
DHCP lease: A time-limited grant of an address, with renewal timers built in.; The client renews at T1 (half the lease) with a unicast request to the granting server, and if that fails tries any server at T2 (seven eighths). Leases expire so that addresses return to the pool when machines leave - which is also why a laptop that has been away can come back to a different address. RELEASE is the only thing that frees an address early, and nothing sends it for a machine that is simply unplugged.; see: dhcp see: dhcp-relay lesson: dhcp-getting-an-address lesson: dhcp-the-lease-lifecycle lesson: dhcp-the-messages-you-rarely-see
DHCP relay agent: Software on a router that carries DHCP across a boundary broadcasts cannot cross.; A client with no address can only broadcast, and a router does not forward broadcasts - so a client and a server on different segments cannot reach each other. The relay resolves that without bending either rule: it receives the broadcast as a destination, ORIGINATES a new unicast to the configured server, and sets giaddr to its own address on the client's segment. giaddr is both the return address for the reply and the server's only clue about which subnet the client is on, which is how one server holds a scope per segment. A missing relay is indistinguishable from a dead server when seen from the client, so the diagnosis has to happen on the router.; see: dhcp see: broadcast-domain lesson: dhcp-across-a-router
DNS: The Domain Name System - turns names people can remember into addresses machines can route to.; A distributed database organised as a tree, so no single server holds it all. Root servers know who runs each top-level domain, those know who runs each domain beneath them, and only the authoritative server at the bottom holds the actual records. A resolver walks that chain once and caches the answer for its TTL.; see: dns-cache see: udp see: tcp lesson: dns-how-a-name-is-resolved lesson: dns-when-it-fails
DNS cache: A resolver's store of recent answers, each valid until its TTL expires.; Caching is what makes DNS affordable: a cold lookup costs one round trip per level of the hierarchy, and every subsequent one costs a single exchange. It is also why a record change takes time to be seen everywhere - old answers remain valid until they expire, which is why TTLs are lowered before a planned migration.; see: dns lesson: dns-how-a-name-is-resolved
Duplicate ACK: The same ACK number repeated — the receiver is signalling a gap.; When a segment arrives out of order, the receiver re-sends an ACK for the byte it is still waiting for. Repeated identical ACKs tell the sender that later data arrived but something before it is missing. (Three of them trigger fast retransmit in full TCP.); see: retransmission see: ack-number lesson: retransmission-packet-loss

E

Ephemeral port: The temporary local port the OS picks for an outgoing connection.; Clients don't care which local port they use, so the OS assigns one from a high range (typically 49152–65535). Together with the two IPs and the server port, it uniquely identifies the connection.; see: tcp lesson: three-way-handshake
Exponential backoff: Doubling the wait after each failed retry: 1s, 2s, 4s, 8s…; After every retransmission timeout, TCP doubles the RTO before retrying. If the network is congested, hammering it with fast retries would make things worse; backing off gives it room to recover. The doubling intervals are a fingerprint you can read directly off a capture's timestamps.; see: rto lesson: retransmission-packet-loss lesson: tcp-troubleshooting

F

Fast retransmit: Three duplicate ACKs mean the segment is gone — resend immediately, don't wait for the RTO.; When segments keep arriving behind a gap, the receiver repeats the same acknowledgement number for each one. Three such duplicates are treated as proof of loss (one or two could be mere reordering), so the sender retransmits the missing segment right away — typically an order of magnitude faster than waiting for the retransmission timer. Fast recovery follows: ssthresh is halved and transmission continues rather than collapsing to one segment.; see: duplicate-ack see: rto see: ssthresh see: cwnd lesson: congestion-control lesson: retransmission-packet-loss
FIN: The 'finished sending' flag — starts the polite close.; FIN says 'no more data from me', and consumes one sequence number. Each direction closes independently: FIN + ACK from one side, then FIN + ACK from the other — the four-way termination.; see: time-wait see: half-close lesson: connection-termination lesson: tcp-flags
Flow control: Pacing the sender so the receiver's buffer never overflows.; Flow control protects the receiver (the window mechanism); congestion control protects the network (cwnd, slow start). TCP does both; this MVP simulates flow control and leaves congestion control to a later release.; see: receive-window see: zero-window lesson: sliding-window-flow-control

H

Half-close: One side has finished sending; the other may keep transmitting.; Because each direction of a TCP stream closes independently, a host that has sent its FIN can still receive data indefinitely. Some protocols rely on this (e.g., sending a request, half-closing, then reading the full response).; see: fin lesson: connection-termination
HTTP: Requests and responses in text, carried over a TCP byte stream.; A request is a line saying what you want, some headers, a blank line and optionally a body; a response replaces the first line with a status. The subtlety is that TCP has no message boundaries, so HTTP frames its own: the blank line ends the headers, and Content-Length or chunked encoding ends the body. One message may span many packets and several may share one.; see: tcp see: https see: segment lesson: http-request-and-response lesson: http-spanning-packets
HTTPS: Not a separate protocol - HTTP inside TLS inside TCP inside IP inside Ethernet.; Five layers, each solving a different problem, stacked. The boundary worth knowing is where visibility stops: everything below TLS stays readable in a capture - addresses, ports, sizes, timing, and the site name from SNI - while the request and response themselves do not.; see: http see: tls see: tcp lesson: https-the-whole-stack

I

ICMP: IP's companion protocol for reporting errors and testing reachability.; Carries echo request/reply (ping) and the error messages a router sends when it cannot deliver a packet — time exceeded, destination unreachable, fragmentation needed. Error messages quote the offending packet's header so the sender can tell which of its packets failed. Filtering all ICMP breaks path-MTU discovery and turns explicit errors into indistinguishable silence.; see: ttl see: mtu lesson: icmp-ping-and-errors lesson: icmp-errors-and-information
Initial Sequence Number (ISN): The random starting point each side picks for numbering its bytes.; Each direction of a TCP connection numbers its bytes starting from a randomly chosen 32-bit ISN. Randomisation makes it hard for attackers who can't see the traffic to forge valid segments. Tools usually display sequence numbers relative to the ISN so they start at 0.; see: sequence-number lesson: three-way-handshake lesson: sequence-and-ack-numbers
IP fragmentation: Splitting one IP datagram into several packets to fit a smaller link.; Each fragment repeats the original identification and carries its offset in 8-byte units; only the last has More Fragments clear. Reassembly is all-or-nothing at the destination, so one lost fragment discards the entire datagram — which is why a single lost fragment costs far more than a single lost packet.; see: mtu see: icmp lesson: ipv4-fragmentation

L

Link-state protocol: Advertises the inputs — what each router is connected to — rather than the conclusions.; The contrast is with distance-vector, which advertises conclusions ("I can reach X at cost 5"). A receiver cannot tell whether such a path loops back through itself, which is the origin of counting to infinity. A link-state receiver holds the whole graph, so a loop is simply visible. The cost is state and CPU: every router keeps every advertisement and recomputes on every change, which is why areas exist.; see: ospf see: lsdb see: spf lesson: ospf-shortest-path-first
LOCAL_PREF: How much this network likes a route. Compared early — before AS path length on most implementations.; Set by your own inbound policy and never carried across an eBGP session, so it says nothing to anybody else — which is exactly what makes it the reliable tool for choosing where your traffic leaves. On SubnetLayer's model, and on most real implementations, it is compared before AS path length — so a higher LOCAL_PREF beats a shorter path outright and every later comparison is skipped. What runs BEFORE it varies: local policy always does, and some platforms compare a proprietary weight or prefer a locally originated route first. That is how a network prefers a cheaper transit provider over a shorter route.; see: bgp-decision-process see: as-path see: bgp lesson: bgp-choosing-a-path
Longest-prefix match: When several routes match a destination, the most specific one wins.; A /24 beats a /16 beats a /0, regardless of configuration order or metric. It is what lets a specific exception coexist with a general default route, and it is the reason a default route never prevents a more specific route from being used. Note what it does NOT consider: where the route came from. A /24 from a barely-trusted protocol still beats a /16 from a hand-typed static route, because the two were never candidates for the same decision.; see: routing-table see: subnet-mask see: administrative-distance lesson: routing-how-a-route-is-chosen
LSA (Link State Advertisement): One router's description of its own links, with a cost on each. Never a route.; A Router-LSA's Link State ID equals its Advertising Router: the advertisement is about its author and nothing else. That is a structural guarantee rather than a cryptographic one — a router can misrepresent its own connectivity, but has no way to say anything about anybody else's. Each re-origination increments a sequence number, which is how receivers tell a newer copy from the one they hold and how flooding is stopped from circulating forever.; see: lsdb see: ospf see: link-state lesson: ospf-shortest-path-first
LSDB (Link State Database): Every LSA in the area, identical on every router once converged.; This, not the routing table, is where an OSPF fault is diagnosed. SPF is arithmetic and cannot be wrong, so a route that looks wrong is a correct computation over a database that is wrong or incomplete. Comparing the database between two routers and finding where they differ is the fastest way to the actual fault.; see: lsa see: spf see: ospf lesson: ospf-shortest-path-first

M

MAC address: A 48-bit hardware address identifying one network interface on one link.; Assigned to the network card rather than configured, and meaningful only within a single broadcast domain. A router rewrites both MAC addresses at every hop, so the source MAC in a capture identifies the previous hop and never the original sender.; see: arp see: broadcast-domain lesson: arp-why-it-exists lesson: arp-local-vs-remote
Maximum Segment Size (MSS): The largest payload one segment may carry, announced on the SYN.; Each side announces the biggest TCP payload it can accept in one segment, typically 1460 bytes (1500-byte Ethernet MTU minus 20 IP + 20 TCP header bytes). Senders respect the peer's MSS to avoid IP fragmentation.; see: segment see: tcp-options lesson: three-way-handshake lesson: basic-data-transfer
MTU: The largest packet a link will carry, in bytes.; Classic Ethernet is 1500. A packet that exceeds the next link's MTU is either fragmented or, if the Don't Fragment bit is set, discarded with an ICMP fragmentation-needed message naming the MTU that would have worked. When that message is filtered, large transfers hang while small ones succeed — the path-MTU black hole.; see: icmp see: fragmentation lesson: ipv4-fragmentation lesson: icmp-path-mtu-discovery

N

NXDOMAIN: A definitive answer that a name does not exist.; Quite different from a timeout, which means 'I could not find out'. NXDOMAIN lets an application fail immediately rather than retrying, and resolvers cache it negatively so a typo in a config file cannot generate the same doomed lookup forever.; see: dns see: dns-cache lesson: dns-when-it-fails

O

OSPF: Routers inside one organisation describing their links to each other, so all of them can compute the same map.; A link-state protocol: routers exchange descriptions of their own connections rather than routes, every router in an area ends up holding the same database, and each independently runs Dijkstra over it. Nobody is in charge and nobody has to be trusted to have done the arithmetic, because everybody does it themselves. That is a statement about the sums, not about security — a router that lies about its own links is believed. It runs directly on IP as protocol 89, providing its own reliability and checksum with no transport layer beneath it.; see: link-state see: lsdb see: spf see: ospf-cost lesson: ospf-becoming-neighbours lesson: ospf-shortest-path-first
OSPF adjacency: Two routers that have agreed to synchronise databases — more than merely seeing each other.; It is reached in steps, each guarding against something. Init means a hello was heard but the link is not yet proven both ways. 2-Way means this router found its OWN id in the neighbour's hello, which proves bidirectionality without needing an extra packet. Full means the databases match. On a shared segment, 2-Way is the correct resting state between two non-DR routers; on a point-to-point link it is a fault.; see: ospf see: designated-router lesson: ospf-becoming-neighbours
OSPF cost: The price of sending out an interface. Configured, not measured, and one-way.; Conventionally derived from bandwidth, but it is whatever an operator sets. OSPF sums it along a path and has no notion of hop count at all, so four cheap hops beat two expensive ones. Because it is per-interface and one-way, a link can legitimately cost different amounts in each direction — a real cause of asymmetric routing. The failure mode worth knowing: a reference bandwidth left at a value every modern link exceeds makes all of them cost 1, and OSPF can no longer tell them apart.; see: spf see: ospf lesson: ospf-shortest-path-first

P

PCAP / PCAPNG: The standard file formats for saved packet captures.; Wireshark, tcpdump, and virtually every network tool read pcap/pcapng files. Every scenario in this app exports real, byte-accurate PCAPNG you can open in Wireshark — the same packets you inspected here.

R

Receive window: How many more bytes the receiver can buffer — the flow-control throttle.; Every segment advertises how much buffer space its sender has free. The other side must never have more than that many unacknowledged bytes in flight. When an application stops reading, the window shrinks toward zero and the sender must stop.; see: zero-window see: flow-control lesson: sliding-window-flow-control
Recursive resolver: The server a client asks, which does the chasing on the client's behalf.; A stub resolver on a normal machine asks one question and expects a final answer. The recursive resolver takes on the work: querying the root, following referrals down the hierarchy, and caching what it learns. The Recursion Desired flag is how the client requests that service.; see: dns see: authoritative-server see: dns-cache lesson: dns-how-a-name-is-resolved
Retransmission: Sending the same bytes again — same sequence number, new packet.; When data is presumed lost, TCP resends it with the ORIGINAL sequence number, so the receiver slots it into the same stream position. In a capture you spot retransmissions as repeated sequence numbers.; see: rto see: duplicate-ack lesson: retransmission-packet-loss
Retransmission timeout (RTO): The timer that fires when an expected ACK never arrives.; Whenever unacknowledged data is outstanding, a retransmission timer runs. If it expires, TCP resends the oldest unacknowledged data and doubles the timeout (exponential backoff) so a struggling network isn't flooded with retries.; see: retransmission see: exponential-backoff lesson: retransmission-packet-loss
RIB (Routing Information Base): Every route offered by every source, including the ones that lost.; The RIB holds all the candidates; the forwarding table holds one winner per prefix. That is why a prefix you know a protocol is advertising can be missing from `show ip route` — it was offered and beaten. Keeping the losers is what makes failover fast: withdraw the winner and the runner-up is installed at once, with no protocol exchange and nobody re-advertising anything.; see: administrative-distance see: routing-table lesson: routing-how-a-route-is-chosen
Routing table: The list of destination prefixes a device knows, and where to send each.; Every entry names a prefix, a next hop and an outgoing interface. A lookup finds every entry that contains the destination and picks the most specific one. Hosts have small tables (connected subnets plus a default route); routers can have hundreds of thousands.; see: longest-prefix-match see: default-gateway lesson: routing-how-a-route-is-chosen lesson: ipv4-forwarding
RST: The reset flag: kill the connection immediately, no goodbye.; RST aborts a connection instantly: nothing more is sent, nothing is retransmitted, and there is no reply. You see it when connecting to a closed port ('connection refused'), when an application crashes, or when middleboxes forcibly terminate connections.; see: fin lesson: tcp-reset lesson: tcp-flags

S

Segment: One TCP protocol message: header plus (optionally) a chunk of the byte stream.; TCP slices the application's byte stream into segments, each carried inside one IP packet. A segment's header says where its bytes fit in the stream (sequence number) and what the sender has received so far (acknowledgement number).; see: mss see: sequence-number lesson: basic-data-transfer
Sequence number: The stream position of a segment's first payload byte.; Every byte in a TCP stream has a number. A segment's sequence number is the number of its first payload byte, so the receiver can place it precisely — and detect anything missing, duplicated, or out of order. SYN and FIN each occupy one sequence number; pure ACKs occupy none.; see: ack-number see: isn lesson: sequence-and-ack-numbers
Slow start: cwnd grows by one MSS per ACKed segment — doubling the sending rate every round trip.; A new connection knows nothing about the path, so it probes: start around one segment and let each acknowledgement raise the budget by one MSS. The result is exponential growth per round trip (1, 2, 4, 8 segments…) until loss occurs or cwnd crosses ssthresh, where gentler congestion avoidance takes over. The name is historical — it was slow only compared to the pre-1988 behaviour of dumping the whole buffer at once.; see: cwnd see: ssthresh see: aimd lesson: congestion-control
Slow-start threshold (ssthresh): TCP's memory of where congestion last appeared — the boundary between exponential and linear growth.; Below ssthresh, cwnd grows exponentially (slow start); above it, roughly one MSS per round trip (congestion avoidance). Every loss event writes the memory anew: ssthresh is set to half the data in flight at detection time. A fresh connection has ssthresh effectively at infinity — it has no history to be cautious about.; see: cwnd see: slow-start see: fast-retransmit lesson: congestion-control
SNI (Server Name Indication): The site name, sent in the clear at the start of a TLS handshake.; One address commonly hosts many sites, so the server must know which one is wanted before it can choose a certificate - and at that moment no keys exist yet. The consequence is that an observer cannot read your traffic but can see which site you visited. Encrypted Client Hello is the work in progress to close that gap.; see: tls see: certificate-chain see: dns lesson: tls-handshake lesson: tls-when-validation-fails
SPF (Shortest Path First): Dijkstra's algorithm, run over the link-state database, rooted at the router running it.; Each router computes its own shortest path tree from the shared database. Every router in the area reaches the same conclusions because the inputs and the algorithm are the same — no agreement protocol is needed, and no router's arithmetic has to be trusted by any other. The result is offered into the RIB as ordinary routes at administrative distance 110, where a static route can still beat them.; see: lsdb see: ospf-cost see: rib lesson: ospf-shortest-path-first
Subnet mask / prefix length: Splits an IP address into a network part and a host part.; Written as 255.255.255.0 or as /24. A host ANDs its own address and the destination against the mask; equal results mean the destination is a local neighbour, different results mean it is remote and must go via the gateway. Getting the mask wrong flips that decision and produces failures that look like network faults.; see: default-gateway see: longest-prefix-match lesson: arp-local-vs-remote
SYN: The 'synchronise' flag that opens a connection and announces an ISN.; A segment with SYN set asks to open a connection and carries the sender's Initial Sequence Number. SYN consumes one unit of sequence space, which is why it is acknowledged with ISN+1.; see: three-way-handshake see: isn lesson: three-way-handshake lesson: tcp-flags

T

TCP: Transmission Control Protocol — reliable, ordered byte streams between applications.; TCP turns the Internet's unreliable packet delivery into a reliable, ordered byte stream. It numbers every byte, acknowledges what arrives, retransmits what doesn't, and paces senders so receivers and networks aren't overwhelmed. Almost everything you use — web, mail, SSH — rides on it.; see: segment see: three-way-handshake lesson: tcp-header-anatomy
TCP options: Extensions carried mainly on SYN packets: MSS, SACK, timestamps, window scaling.; The TCP header can carry up to 40 bytes of options. The important ones ride on the SYN and SYN-ACK: MSS, SACK-permitted, timestamps, and window scale — together they modernise a 1981 protocol for today's networks.; see: mss see: window-scaling lesson: three-way-handshake lesson: tcp-header-anatomy
Three-way handshake: SYN → SYN-ACK → ACK: how every TCP connection starts.; Before data can flow, both sides must agree to talk and learn each other's starting sequence numbers. The client sends SYN, the server answers SYN-ACK, the client confirms with ACK. Three packets, and both ends are in the ESTABLISHED state.; see: isn see: syn lesson: three-way-handshake
TIME-WAIT: The closing side's mandatory quiet period after the last ACK.; The side that sends the final ACK of a close waits 2×MSL (minutes, in real stacks) before forgetting the connection. This absorbs stray delayed segments and protects a new connection reusing the same ports from ghosts of the old one. This simulator compresses the wait so lessons stay short.; see: fin lesson: connection-termination
TLS: Adds confidentiality, integrity and identity to an ordinary TCP connection.; Three separate guarantees, and the third is the one people forget: the certificate proves you are talking to the server you asked for. Encryption to an impostor protects a conversation you should never have had. The handshake travels in the clear, so a capture can still read the site name, the versions offered and the certificate itself.; see: certificate-chain see: sni see: https see: tcp lesson: tls-handshake lesson: tls-when-validation-fails
TTL (Time To Live): A hop counter that stops a looping packet from circulating forever.; Every router decrements it and discards the packet if it reaches zero, reporting ICMP Time Exceeded. It is a hop count, not a duration, despite the name. Traceroute exploits it deliberately, sending probes with TTL 1, 2, 3 … so each router in turn reveals itself by reporting the expiry.; see: icmp see: routing-table lesson: ipv4-header-anatomy lesson: icmp-traceroute

U

UDP: A minimal transport: ports, a length, a checksum, and no promises.; Eight bytes of header and nothing else — no handshake, no retransmission, no ordering, no flow control. Datagram boundaries ARE preserved, unlike TCP's byte stream. Anything an application needs beyond best-effort delivery it must implement itself, which is exactly why DNS carries its own retry logic.; see: tcp see: icmp lesson: udp-what-you-dont-get lesson: udp-the-eight-byte-header

W

Window scaling: A SYN option multiplying the 16-bit window so fast networks stay busy.; The window field is 16 bits — 64 KB max — far too small for high-bandwidth, high-latency paths. The window-scale option (SYN-only) sets a multiplier of up to 2¹⁴ that applies to every later segment's window field.; see: receive-window see: tcp-options lesson: three-way-handshake
Window update: An ACK whose only news is 'I have buffer space again.'; After the application reads buffered data, the receiver sends an otherwise-empty ACK advertising the reopened window so the sender can resume.; see: zero-window lesson: sliding-window-flow-control

Z

Zero window: The receiver's 'stop!' — no buffer space left, sender must pause.; When a receiving application stops reading, arriving data piles up in the receive buffer until the advertised window hits 0. The sender must stop completely and wait for a window update announcing space again. Persistent zero windows are a classic sign of a slow application, not a slow network.; see: receive-window see: window-update lesson: sliding-window-flow-control