The Internet & Networks
Architecture

When you type https://google.com and press Enter, roughly 47 distinct technical systems fire in sequence before a single pixel renders. Most developers interact with the internet every day but have never traced that full journey. This deep-dive maps it completely.

The internet is not one thing. It is a layered stack of protocols, hardware, and agreements , an emergent global system where no single entity owns or controls the whole. Understanding its architecture means understanding each layer independently, then seeing how they compose.

The Open Systems Interconnection (OSI) model is the conceptual framework for how network communication is structured. Published in 1984 by ISO, it partitions the communication system into seven abstraction layers. Real implementations (TCP/IP) collapse some of these, but understanding OSI is essential for diagnosing, designing, and reasoning about networks.

Remember the mnemonic: All People Seem To Need Data Processing (Application → Physical, top-down) or Please Do Not Throw Sausage Pizza Away (bottom-up).

TCP/IP vs OSI: The Real Stack

In practice, the internet runs on the TCP/IP model, which collapses OSI's 7 layers into 4:

Every device connected to the internet needs an address. The Internet Protocol (IP) defines how addresses are structured, assigned, and routed. Understanding IP addressing means understanding the difference between public and private, static and dynamic, IPv4 and IPv6, and how subnetting carves address space into manageable chunks.

IPv4: Structure and Anatomy

IPv4 addresses are 32-bit integers expressed as four 8-bit octets separated by dots. Each octet ranges from 0–255.

CIDR Notation & Subnetting

CIDR (Classless Inter-Domain Routing) notation expresses a network as address/prefix_length. The prefix length indicates how many bits are the network portion. The remaining bits are available for hosts.

# /prefix  | hosts available | typical use
/32        → 1 host        (single IP, firewall rule, loopback)
/31        → 2 hosts       (point-to-point links)
/30        → 2 usable      (small p2p with network + broadcast)
/29        → 6 usable      (tiny subnet)
/28        → 14 usable     (very small network)
/24        → 254 hosts     (typical home/small office, 192.168.1.0/24)
/16        → 65,534 hosts  (large enterprise or VPC)
/8         → 16.7M hosts   (massive networks, entire Class A)

# Formula: usable hosts = 2^(32-prefix) minus 2
# Subtract 2: network address + broadcast address

IPv6: The Future (That's Already Here)

IPv4's ~4.3 billion addresses ran out (IANA exhausted its pool in 2011). IPv6 uses 128-bit addresses, expressed as 8 groups of 4 hex digits. The address space: 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses , enough to assign trillions to every atom on Earth.

# Full IPv6
2001:0db8:85a3:0000:0000:8a2e:0370:7334

# Leading zeros suppressed
2001:db8:85a3:0:0:8a2e:370:7334

# Consecutive zero groups compressed with ::
2001:db8:85a3::8a2e:370:7334

# Special addresses
::1          → Loopback (equivalent to 127.0.0.1)
fe80::/10    → Link-local (auto-configured, not routable)
fc00::/7     → Unique local (private, like 192.168.x.x)
2000::/3     → Global unicast (public internet)

NAT: The IPv4 Lifeline

Network Address Translation (NAT) is how billions of devices share a handful of public IPs. Your router has one public IP. Every device behind it gets a private IP. When you make a request, the router rewrites the source IP/port and maintains a translation table to route responses back. It's an elegant hack that extended IPv4's life by decades, at the cost of breaking true end-to-end connectivity.

The Domain Name System (DNS) translates human-readable names (google.com) into IP addresses (142.250.185.46). Without DNS, you'd memorize IPs. DNS is a globally distributed, hierarchically organized database, one of the internet's most critical and most attacked systems.

The DNS Hierarchy

DNS Resolution: Step by Step

When you type api.github.com, here's the exact resolution path, assuming nothing is cached:

DNS Record Types

HTTPS is HTTP running over TLS (Transport Layer Security). TLS provides three guarantees: confidentiality (nobody can read your data), integrity (nobody can tamper with it), and authentication (you're talking to who you think you are). Every HTTPS connection begins with a TLS handshake.

TLS 1.3 Handshake (Modern)

TLS 1.3 (2018) reduced the handshake from 2 round-trips to 1, cutting latency significantly. Here's the choreography:

What Happens Inside TLS

Certificate Validation Chain

A Network Interface Card (NIC) is the hardware that physically connects a device to a network. Every NIC has a MAC address, a 48-bit hardware identifier burned into the card at manufacture. Modern systems often have multiple NICs: ethernet, WiFi, virtual adapters for VMs/containers, loopback.

MAC Addresses: Hardware Identity

A MAC address is a 48-bit (6-byte) identifier, expressed as 6 hex pairs. The first 3 bytes are the OUI (Organizationally Unique Identifier), assigned to manufacturers. The last 3 bytes are device-specific.

# Example: AC:DE:48:00:11:22

AC:DE:48   → OUI, Apple Inc. (registered with IEEE)
00:11:22   → Device-specific serial number

# Special bit flags in first octet:
Bit 0 = 0  → Unicast   (specific device)
Bit 0 = 1  → Multicast (group of devices)
Bit 1 = 0  → Globally Unique (burned-in address)
Bit 1 = 1  → Locally Administered (random/virtual)

# MAC randomization (modern WiFi):
# iOS, Android, Linux now randomize MAC per-network
# to prevent location tracking across APs

ARP: Bridging Layer 3 → Layer 2

IP addresses (Layer 3) must be resolved to MAC addresses (Layer 2) for local delivery. ARP (Address Resolution Protocol) does this resolution on local networks.

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Firewalls operate at different OSI layers, with higher-layer firewalls offering more context, and more processing overhead.

Firewall Generations

iptables: Linux Firewall Rules

# View all rules
iptables -L -n -v --line-numbers

# Allow established/related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from specific IP only
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

# Allow HTTPS in
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Rate limit: prevent brute force
iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min -j ACCEPT

# Log and drop everything else
iptables -A INPUT -j LOG --log-prefix "DROPPED: "
iptables -A INPUT -j DROP

# Modern systems: nftables replaces iptables

Stateful Connection Tracking

Modern firewalls maintain a connection state table. When a TCP connection is established (SYN → SYN-ACK → ACK), the firewall records it. Subsequent packets matching an established connection bypass rule evaluation, only new connections get full inspection. This enables "allow out, allow related back in" policies without explicitly permitting inbound on every ephemeral port.

The internet is a network of networks, tens of thousands of Autonomous Systems (ASes), each operated by ISPs, cloud providers, universities, and enterprises. BGP (Border Gateway Protocol) is the protocol that ties them together, the "routing protocol of the internet."

How Routers Make Decisions

# Destination      Gateway          Interface  Metric
default           via 10.0.0.1   eth0       100     # 0.0.0.0/0, send unknown traffic to gateway
10.0.0.0/24       directly         eth0       0       # local subnet, deliver directly
172.16.0.0/12     via 10.0.0.254  eth0       10      # route to another network via router
192.168.100.0/24  via 10.0.0.10   eth1       5       # specific /24 wins over broader routes

# Longest prefix match wins:
# Packet to 192.168.100.55 matches /24 (more specific) over default /0
# This is the fundamental routing rule.

Every layer of the network stack is a potential attack surface. Understanding network security means knowing the attack patterns at each layer and the defenses that counter them.

Security Protocols by Layer

Let's trace a single HTTP request from start to finish, your browser requesting https://api.example.com/data. This is everything that happens, in order, from keystroke to response.

Packet Structure at Each Layer

Each layer wraps the payload from above with its own header, this is encapsulation. Here's what a single HTTPS packet looks like at every layer:

Key Port Numbers to Know