Networking Cheat Sheet

Network terminology from TCP to DNS

308 terms

404: 404 is the HTTP status code that means Not Found, returned by a web server when the requested resource does not exist at the specified URL. It is one of the most recognizable error codes on the internet, often encountered when a page has been deleted, a link is broken, or a URL is mistyped. The 404
404 Error Page: 404 Error Page is the web page displayed to users when they attempt to access a URL that does not exist on a server, corresponding to the HTTP 404 Not Found status code. While the default server-generated 404 page is typically a plain, unhelpful error message, well-designed custom 404 pages have bec
Air-Gapped Network: Air-Gapped Network is a network intentionally isolated from the internet and untrusted networks to reduce remote attack paths. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configu
Amplification Attack: A denial-of-service technique that sends small spoofed requests to services which reply with much larger responses toward the victim, multiplying attack traffic. DNS, NTP, and misconfigured UDP-based services have historically been used for amplification attacks.
Anycast: A network addressing method where the same IP address is advertised from multiple locations worldwide. Traffic is automatically routed to the nearest (by BGP hop count) server. Used by CDNs (Cloudflare, Fastly), DNS providers (Google's 8.8.8.8, Cloudflare's 1.1.1.1), and DDoS mitigation services to
API Endpoint: A specific network path or callable interface exposed by an API to perform an operation or access a resource. Endpoints are usually defined by a route plus method, expected input, and response contract rather than by URL alone.
API Rate Limit Header: HTTP response headers that inform API consumers about rate limit status: X-RateLimit-Limit (max requests per window), X-RateLimit-Remaining (requests left), X-RateLimit-Reset (when the window resets, as Unix timestamp or seconds). The IETF draft RateLimit header standardizes these. Enables clients t
ARP: Address Resolution Protocol — a Layer 2 protocol that maps IP addresses to MAC (hardware) addresses on a local network. When a device needs to send a packet to a local IP, it broadcasts an ARP request asking 'who has this IP?' and the owner responds with its MAC address. ARP spoofing is a common att
ARPANET: Advanced Research Projects Agency Network — the first wide-area packet-switching network and direct precursor to the modern internet. Launched in 1969 connecting four universities, ARPANET pioneered TCP/IP, email, and the fundamental architectural principle that networks should be decentralized and
Backoff: A retry strategy where the delay between attempts increases (typically exponentially) after each failure. Prevents overwhelming a recovering service with a flood of retries. Often combined with jitter (random delay) to avoid thundering herd problems.
Bad Gateway: Often used casually to refer to 502 errors or to the general situation where a proxy or gateway cannot get a valid response from an upstream service. In ops slang, 'bad gateway' can become shorthand for a whole class of upstream connectivity pain.
Bayesian Neural Network: A neural network that models uncertainty by treating weights or predictions probabilistically rather than deterministically. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually track
BBS: Bulletin Board System — a computer server that users could dial into via modem to exchange messages, share files, and play text-based games. BBSes were the social networks of the 1980s and early 1990s, fostering local communities and hacker culture before the World Wide Web made them largely obsolet
BGP: Border Gateway Protocol — the routing protocol that glues the internet together by enabling autonomous systems (ISPs, cloud providers, enterprises) to exchange reachability information. Often called 'the protocol that runs the internet,' BGP operates on trust between operators and has no built-in au
BGP hijacking: An attack where a malicious or misconfigured network announces ownership of IP address blocks it does not control, causing internet traffic destined for those addresses to be rerouted. Because BGP relies on trust between operators, any autonomous system can claim any prefix, and the global routing s
Binary Protocol: A communication protocol that encodes messages as binary structures instead of human-readable text. Binary protocols often trade easier debugging for better performance, smaller payloads, and stricter parsing semantics.
Broadcast: A communication pattern where one sender delivers the same message or signal to multiple recipients instead of to a single consumer. Broadcast behavior appears in networks, event systems, UI state updates, and distributed coordination mechanisms.
Bulletin Board System: An early online system users dialed into to post messages, share files, and participate in discussion communities.
Cache Control: The policies and directives that determine whether and how a response may be cached, revalidated, or shared by browsers, CDNs, or proxies. In HTTP, cache control is typically expressed through headers that balance freshness, bandwidth savings, and correctness.
Cache Proxy: A proxy that stores reusable responses and serves future matching requests from cache instead of always forwarding them upstream. Cache proxies are common in CDNs, reverse proxies, and internal gateways where reducing origin load and response time matters.
CIDR: Classless Inter-Domain Routing — a method of allocating IP addresses and routing that replaced the wasteful Class A/B/C system. CIDR notation (e.g., 10.0.0.0/24) uses a prefix length to specify the network portion of an address, enabling more efficient use of the IPv4 address space and reducing rout
Cilium: A cloud-native networking, security, and observability project built heavily around eBPF, often used in Kubernetes environments.
Client: A piece of hardware or software that requests services or resources from a server. In client-server architecture, the client initiates communication and processes or displays the response. Web browsers, mobile apps, and API consumers are all clients.
Cloud Gateway: A gateway component in a cloud environment that routes, secures, or transforms traffic between clients, services, or external networks and cloud-hosted workloads. Cloud gateways may handle ingress, API routing, NAT, service exposure, or hybrid connectivity depending on the platform and design.
Cloud Networking: The design and operation of network connectivity inside and around cloud environments, including virtual networks, subnets, routing, load balancers, gateways, and private connectivity. Cloud networking shapes service reachability, latency, security boundaries, and hybrid integration with on-prem sys
Cloud VPN: A VPN connection or managed service used to link cloud networks with other environments such as offices, datacenters, or user devices. Cloud VPNs are commonly used in hybrid architectures where secure connectivity is needed without exposing internal services publicly.
CNI Security: Security concerns and controls related to container networking interfaces, especially in orchestrated environments such as Kubernetes. CNI security affects segmentation, policy enforcement, visibility, and how workloads communicate on the network.
Coffee Chat: An informal one-on-one or small-group conversation, often framed around coffee, used for networking, mentoring, relationship building, or low-pressure exploration of ideas. In tech culture coffee chats are common in hiring, remote team bonding, and internal alignment.
Communication Layer: The part of a system responsible for sending, receiving, or abstracting communication between components, services, or clients. A communication layer typically hides protocol details so the rest of the application can work with higher-level messages or interfaces.
Communication Protocol: A Communication Protocol is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer ab
Community Event: An event organized for a community such as users, developers, contributors, or local tech groups, often focused on learning, networking, or belonging. Community events are part relationship work as much as content delivery.
Computer Network Defense: A term often used in government and military contexts for the protection, monitoring, and defense of networked systems against attack. It includes detection, hardening, response, and resilience activities.
Computer Network Exploitation: A government and intelligence term for gaining access to and deriving value from targeted networks or systems, often for surveillance, collection, or operational advantage. It is more specific than general 'hacking' and tied to mission-oriented access activities.
Connection: An established communication link between a client and a server, process and resource, or one system and another. Connections may be persistent or short-lived, and their lifecycle has major implications for latency, pooling, retries, and failure handling.
Connection Handler: A component or function responsible for establishing, managing, and reacting to the lifecycle of a connection. Connection handlers commonly process events such as open, close, retry, handshake completion, or errors in networked applications.
Connection Manager: A Connection Manager is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstra
Connection String: A Connection String is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstrac
Connection Timeout: The maximum time a client or system will wait for a connection attempt to succeed before treating it as failed. Connection timeouts are distinct from read or overall request timeouts and are crucial for avoiding hangs during unreachable-host scenarios.
Consul: A service networking and discovery tool used for service registration, health checking, and configuration in distributed systems.
Container Network: A Container Network is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstrac
Container Port: A network port exposed or listened to by a process running inside a container. Container ports are often mapped or routed differently at the platform level, so developers need to distinguish internal listen ports from host or service exposure settings.
Content Encoding: The representation or transformation applied to response content, often indicated in protocols like HTTP to show compression or alternate encodings such as gzip or br. Correct content encoding matters for performance and interoperability because clients need to know how to decode what they receive.
Content Negotiation: An HTTP mechanism where the client and server agree on the best representation of a resource. The client sends Accept headers (Accept: application/json, text/html) and the server selects the best match. Also applies to language (Accept-Language), encoding (Accept-Encoding), and character set. Enable
Content Type: A label describing the media type of data, such as `application/json`, `text/html`, or `image/png`, so systems know how to parse or handle it. Correct content type handling is essential in APIs, uploads, downloads, and browser interactions where the same bytes may need to be interpreted differently
Conversation Starter: A topic, question, or prompt used to begin a conversation more easily. In workplace and community settings, good conversation starters reduce awkwardness and create openings for actual connection or discovery.
Convolutional Neural Network: A model architecture concept tied to convolutional neural network and how modern AI systems represent or process information. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually track
Cookie: Cookie is a small piece of data that a web server sends to a user's browser, which stores it and sends it back with subsequent requests to the same server. Cookies enable stateful interactions on the inherently stateless HTTP protocol. They are used for session management (keeping users logged in),
CoreDNS: A flexible DNS server widely used in cloud-native environments, especially as Kubernetes' cluster DNS service.
CORS: CORS, or Cross-Origin Resource Sharing, is a browser security mechanism that controls how web pages from one domain can request resources from a different domain. By default, browsers enforce the same-origin policy, blocking JavaScript from making requests to a different origin (combination of proto
CORS Origin: The scheme + hostname + port combination that identifies where a web request originates from. CORS (Cross-Origin Resource Sharing) checks prevent JavaScript on one origin from accessing resources on another unless the server explicitly allows it via Access-Control-Allow-Origin headers. Origin: https
CORS Preflight: An automatic OPTIONS request sent by the browser before a cross-origin request to check whether the server allows it. Triggered by non-simple methods (PUT, DELETE), custom headers, or non-standard content types. The server responds with allowed origins, methods, and headers.
cURL: A command-line tool and library for making network requests across many protocols, especially HTTP APIs.
Custom Protocol: A communication protocol designed for a specific application or environment rather than using a standard protocol unchanged. Custom protocols can optimize for special constraints, but they also increase maintenance and interoperability costs.
DANE: DANE is a DNSSEC-backed mechanism that binds TLS certificates or public keys to DNS records for a domain. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, lifecycle man
Deep Q-Network: A reinforcement learning method that uses a neural network to approximate action-value estimates. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually track it alongside data quality,
DGA: Short for domain generation algorithm, a technique malware uses to generate many pseudo-random domain names so operators and infected hosts can rendezvous without relying on one fixed domain. DGAs make takedown harder because defenders must predict or block large changing sets of domains.
DHCP: Dynamic Host Configuration Protocol — the protocol that automatically assigns IP addresses and network settings to devices when they join a network. Without DHCP, every device would need its IP address manually configured. DHCP leases addresses temporarily, reclaiming them when devices leave.
dial-up: A method of connecting to the internet by using a modem to place a telephone call to an ISP's access number. Characterized by the iconic handshake screech, agonizing speeds (typically 28.8–56 kbps), and the inability to use the phone while online. Dominated home internet access from the early 1990s
DKIM: DKIM is a mail authentication standard that lets receiving systems verify a signed domain-level message header. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, lifecyc
DNS: DNS, or Domain Name System, is the hierarchical naming system that translates human-readable domain names (like google.com) into the numeric IP addresses that computers use to route traffic. Often called the 'phonebook of the internet,' DNS makes it possible to navigate the web using memorable names
DNS Cache Poisoning: DNS Cache Poisoning is an attack technique in which an adversary inserts forged DNS answers into a resolver cache so victims are directed to attacker-controlled infrastructure. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with la
DNS Exfiltration: DNS Exfiltration is an attack technique in which an adversary encodes stolen data into DNS queries or responses to bypass normal egress paths. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
DNS Firewall: DNS Firewall is a DNS control that blocks or rewrites lookups for malicious, unauthorized, or policy-violating domains. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration,
DNS over HTTPS: DNS over HTTPS is a method of transporting DNS queries over HTTPS to improve privacy and resist straightforward interception. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configur
DNS over TLS: DNS over TLS is a protocol for sending DNS queries over TLS so intermediaries cannot easily read or modify them. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, lifecy
DNS Propagation: The time it takes for DNS changes to spread across all recursive resolvers worldwide. Controlled by the TTL (Time to Live) of the record -- resolvers cache records until TTL expires. A record with TTL 3600 may take up to 1 hour to propagate. Lower the TTL before planned changes, then raise it after.
DNS Rebinding: DNS Rebinding is an attack technique in which an adversary abuses browser trust in DNS answers to pivot from a public origin to internal services. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validat
DNS Record Types: The different types of entries in the Domain Name System: A (IPv4 address), AAAA (IPv6), CNAME (alias to another domain), MX (mail server), TXT (text data -- used for SPF, DKIM, domain verification), NS (nameserver delegation), SRV (service discovery), CAA (certificate authority authorization), and
DNS resolver: A server that translates human-readable domain names into IP addresses by recursively querying the DNS hierarchy. When you type a URL, your resolver (often provided by your ISP or services like 1.1.1.1 or 8.8.8.8) checks its cache, then queries root servers, TLD servers, and authoritative nameserver
DNSSEC: Short for Domain Name System Security Extensions, a set of DNS protocol additions that let resolvers verify that DNS data was signed by the correct zone and not tampered with in transit. DNSSEC protects authenticity and integrity of DNS answers, not confidentiality of the query itself.
DNS Sinkhole: DNS Sinkhole is a defensive DNS response that redirects malicious domain requests to controlled infrastructure for blocking or observation. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on co
DNS Spoofing: DNS Spoofing is an attack technique in which an adversary returns forged name-resolution answers so traffic is redirected or observed. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardeni
DNS Tunneling: DNS Tunneling is an attack technique in which an adversary encapsulates command traffic or data inside DNS records and lookups. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening, rat
Docker Network: A Docker Network is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractio
DoH: Short for DNS over HTTPS, a protocol that sends DNS queries through encrypted HTTPS connections instead of traditional plaintext DNS. It improves privacy and makes passive monitoring harder, though it can complicate enterprise visibility and policy enforcement.
Domain: In domain-driven design, the subject area or business problem a software system addresses. In networking, a human-readable address (e.g., example.com) that maps to an IP address via DNS.
Domain Generation Algorithm: Domain Generation Algorithm is a malware routine that creates many candidate domain names so operators can regain command channels dynamically. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends o
Domain Hijacking: Domain Hijacking is the unauthorized takeover of domain registration, DNS management, or delegation control for a domain. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuratio
DoT: Short for DNS over TLS, a protocol that encrypts DNS traffic inside a dedicated TLS session instead of sending queries in plaintext. Compared with DoH, DoT uses its own standard port and is often easier to identify at the network layer.
DTLS: DTLS is a transport-layer security protocol adapted for datagram traffic such as UDP-based voice, video, and tunnel traffic. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configura
Dynamic DNS Abuse: The malicious use of dynamic DNS services to keep domain names pointed at changing IP addresses, often for phishing, malware command and control, or rapid infrastructure rotation. It helps attackers stay reachable while moving between hosts quickly.
Dynamic Proxy: A Dynamic Proxy is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstraction
EAP: EAP is an authentication framework used on network access links such as Wi-Fi, VPN, and 802.1X environments. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, lifecycle
Egress: Data transferred out of a cloud provider's network to the internet or another region. Cloud providers typically charge for egress but not ingress, making it one of the most surprising line items on cloud bills. A major factor in vendor lock-in.
Encrypted DNS: DNS resolution sent over encrypted protocols such as DoH or DoT so intermediaries cannot easily read or tamper with queries in plaintext. It improves privacy and integrity on the wire, though trust still shifts toward the chosen resolver.
Encryption in Transit: Encryption in Transit is cryptographic protection applied to data moving across networks to reduce interception and tampering risk. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct co
endianness: The order in which bytes of a multi-byte value are stored in memory or transmitted over a network. Big-endian stores the most significant byte first (like writing numbers left-to-right); little-endian stores the least significant first. Named after the Lilliputian factions in Gulliver's Travels who
Endianness: The byte order used to store multi-byte values in memory. Big-endian stores the most significant byte first (like reading left-to-right); little-endian stores the least significant byte first. x86/ARM are little-endian; network protocols (TCP/IP) use big-endian ('network byte order'). Mismatched end
Envoy Proxy: A high-performance open-source proxy widely used for service meshes, edge routing, and observability in distributed systems.
Epoll: A Linux I/O event notification mechanism that efficiently monitors thousands of file descriptors for readiness events. Unlike poll/select (which scan all descriptors every time), epoll only reports descriptors with events, scaling O(1) with the number of watched descriptors. The foundation of high-p
Error 500: A casual reference to internal server errors, usually standing in for generic backend failure from a user's perspective. In engineering slang, '500' is often both diagnosis placeholder and shorthand for 'something on our side broke.'
ETag: An HTTP response header containing a unique identifier (hash or version) for a specific version of a resource. Clients can send If-None-Match with the ETag on subsequent requests — if the resource hasn't changed, the server returns 304 Not Modified (no body), saving bandwidth. More precise than Last
Exfiltration Channel: Exfiltration Channel is a path or protocol used to move stolen data out of a controlled environment. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, lifecycle manageme
Feed-Forward Network: A model architecture concept tied to feed-forward network and how modern AI systems represent or process information. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually track it alon
Fetch API: The modern browser API for making HTTP requests, replacing the older XMLHttpRequest. Returns Promises, supports streaming responses, and integrates with Service Workers. Cleaner syntax than XHR but notably doesn't reject on HTTP error status codes (404, 500) — only on network failures.
Fire and Forget: An action pattern where a message, task, or request is sent without waiting for confirmation or a direct response. It can be efficient, but it also shifts responsibility for error handling elsewhere.
Flat Network: A network design with little or no internal segmentation, where many systems can communicate freely once inside the perimeter. Flat networks are dangerous because initial compromise on one host often leads to easy lateral movement across the environment.
Flywheel: A self-reinforcing business cycle where each component accelerates the next. Amazon's flywheel: more customers → more sellers → more selection → lower prices → more customers. Unlike funnels (linear, leaky), flywheels compound over time. Once spinning, they're hard for competitors to replicate.
Fragment Attack: An attack that abuses IP packet fragmentation to evade inspection, confuse reassembly behavior, or trigger bugs in network stacks and firewalls. Fragment attacks rely on the fact that different devices may process fragmented traffic differently.
Frame Injection: The insertion of unauthorized protocol frames into a communication stream, commonly in wireless networks where management or data frames can be spoofed or replayed. Frame injection is often used for disruption, impersonation, or traffic manipulation.
FTP: FTP, or File Transfer Protocol, is a standard network protocol used for transferring files between a client and a server over a TCP/IP network. Developed in 1971 and standardized in RFC 959, FTP is one of the oldest internet protocols still in use. It operates on a client-server model using two chan
Gating Network: A network component that decides which expert, branch, or submodule should handle a given input in architectures such as mixture-of-experts models.
Generative Adversarial Network: A model architecture concept tied to generative adversarial network and how modern AI systems represent or process information. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually tra
Git Protocol: The communication protocol or protocols used by Git to transfer repository data between clients and servers. In practical culture, discussions of the Git protocol usually arise around authentication, performance, hosting, or compatibility issues.
Graph Convolutional Network: A neural network that aggregates neighborhood information to learn representations over graph-structured data. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually track it alongside d
Graph Neural Network: A neural model family designed to learn from nodes, edges, and neighborhoods in graph data. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually track it alongside data quality, comput
Handshake: A Handshake is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions, a
HAProxy: A high-performance load balancer and proxy commonly used to distribute traffic and terminate connections for backend services.
Hostile Network: A network environment assumed to be untrusted, observable, or actively manipulated by adversaries, such as public Wi-Fi or compromised internal segments. Designing for a hostile network means relying on encryption, strong authentication, and least trust in the transport itself.
HTTP: HTTP, or HyperText Transfer Protocol, is the application-layer protocol that powers the World Wide Web. It defines how clients (typically web browsers) and servers communicate by exchanging request and response messages. An HTTP request includes a method (GET, POST, PUT, DELETE, PATCH, and others),
HTTP Cache: A HTTP Cache is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Client: A HTTP Client is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Connection: A HTTP Connection is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstracti
HTTP Cookie: A HTTP Cookie is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Header: A HTTP Header is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Method: A HTTP Method is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Method Tampering: A technique that abuses alternate or unexpected HTTP methods such as PUT, DELETE, or HEAD to bypass filters, reach hidden functionality, or trigger unsafe behavior. It often succeeds when security controls focus only on GET and POST while backend logic accepts more methods.
HTTP Middleware: A HTTP Middleware is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstracti
HTTP Proxy: A HTTP Proxy is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Redirect: A HTTP Redirect is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstraction
HTTP Request: A HTTP Request is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions
HTTP Response: A HTTP Response is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstraction
HTTP Router: A HTTP Router is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Server: A HTTP Server is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractions,
HTTP Status Code: A HTTP Status Code is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstract
HTTP Streaming: A HTTP Streaming is a development concept used to shape how software is built, executed, or maintained in real systems. Developers rely on it to make code easier to reason about, integrate, and operate as projects grow. It usually matters most when teams need predictable behavior, clearer abstractio
Hypernetwork: A neural network that generates some or all of the weights used by another network. It influences how models are trained, evaluated, or served, and it can materially change accuracy, robustness, latency, cost, or interpretability. Practitioners usually track it alongside data quality, compute limits
ICMP: Internet Control Message Protocol — a network protocol used for diagnostic and error-reporting purposes. ICMP is the backbone of tools like ping and traceroute, sending messages about unreachable hosts, expired TTLs, and network congestion. Many firewalls block ICMP, which is why 'the network is fin
Idempotent Request: An HTTP request that produces the same result regardless of how many times it's executed. GET, PUT, DELETE, and HEAD are idempotent by design. POST is not -- creating a resource twice creates duplicates. Making non-idempotent operations safe for retry (via idempotency keys) is critical for reliable
IMAP: Internet Message Access Protocol — a protocol for retrieving and managing email on a remote server. Unlike POP3, IMAP keeps messages on the server and supports folders, flags, and search, enabling multi-device email access.
IPSec: IPSec is a suite of protocols that authenticates and encrypts IP traffic, commonly for site-to-site or remote-access VPNs. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configurati
IPv4: The fourth version of the Internet Protocol, which uses 32-bit addresses written in dotted-decimal form such as 192.0.2.1. Its limited address space led to widespread use of NAT and eventually to the adoption of IPv6.
IPv6: The successor to IPv4, using 128-bit addresses written in hexadecimal groups such as 2001:db8::1. It vastly expands address space and includes protocol-level features such as stateless autoconfiguration and simplified packet header design.
JSON API: An application programming interface that sends and receives data encoded as JSON, typically over HTTP. In practice the term often implies REST-style endpoints with structured request and response bodies rather than form posts, HTML, or XML payloads.
Koa: A minimalist Node.js web framework created by the same team behind Express, designed around async/await and a middleware stack that uses a cascading (downstream then upstream) execution model via next().
LAN Party: A gathering where people bring their computers to the same location and connect them over a local area network for multiplayer gaming, file sharing, or social hacking. LAN parties are a formative part of PC gaming and youth computing culture.
Latency: The time delay between a request and its response. In networking, it's the round-trip time for a packet. In user experience, it's the time between click and response. Every millisecond counts — Amazon found that 100ms of added latency cost 1% of sales.
Latency vs Throughput: Two often-confused performance metrics: latency is the time for a single operation to complete (measured in ms), while throughput is the number of operations completed per unit time (measured in req/s, Mbps). They're not inverses — a system can have high latency but high throughput (batch processing
Linkerd: A lightweight open-source service mesh focused on secure service-to-service communication and observability.
LLM Proxy: A proxy service that sits between applications and large language models to add routing, logging, caching, security, or compatibility layers. An LLM proxy can be lighter-weight than a full platform while still centralizing important controls.
Load Balancer: A load balancer is a device or piece of software that distributes incoming network traffic across multiple servers to ensure no single server becomes overwhelmed. By spreading requests evenly, load balancers improve application availability, reliability, and response times. They operate at different
Localhost: The hostname that refers to the current machine — resolves to 127.0.0.1 (IPv4) or ::1 (IPv6). Every developer's first server. 'It works on localhost' is both a milestone and a warning.
Long Poll: A web communication technique where the client opens a request that the server holds until new data is available, then reconnects to wait again. It predates more modern realtime patterns like WebSockets for many use cases.
Long Polling: A technique where the client sends an HTTP request and the server holds it open until new data is available (or a timeout expires), then responds. The client immediately sends another request, creating near-real-time updates over plain HTTP. Simpler to implement than WebSockets but less efficient fo
Loopback Attack: An attack that abuses access to the local loopback interface, such as `127.0.0.1`, to reach services that were assumed to be accessible only from the same host. Loopback attacks commonly appear in SSRF, browser abuse, and sandbox escape scenarios where 'local-only' assumptions break down.
Mail Exchange Security: The protection of the infrastructure and configuration involved in routing email between domains, including MX records, mail gateways, TLS settings, anti-spoofing controls, and relay policies. Weak mail exchange security can enable interception, spoofing, open relay abuse, or delivery manipulation.
mDNS: Multicast DNS — a protocol that resolves hostnames to IP addresses on local networks without a DNS server. Devices announce themselves as name.local and respond to queries via multicast. Powers Apple's Bonjour (AirDrop, AirPlay), Avahi on Linux, and is how you access printer.local or raspberrypi.loc
Media Access Control: The data-link layer mechanism and addressing scheme used to identify network interfaces on local networks, commonly abbreviated MAC in Ethernet and Wi-Fi contexts. In security discussions, media access control appears in topics such as MAC addresses, filtering, spoofing, and switch behavior.
Memory Augmented Network: Memory Augmented Network is a model component or design choice that shapes how information flows through a learned system. It is commonly used for building neural architectures and deciding where capacity should live, where teams need predictable behavior under real workloads rather than toy example
Mesh VPN: A VPN model in which devices establish direct or selectively routed encrypted connections to one another within a managed overlay network rather than all traffic passing through a single central concentrator. Mesh VPNs are attractive for device-to-device access and zero-trust designs, but they requi
Message Protocol: A set of rules governing how messages are framed, sequenced, acknowledged, and error-handled between communicating parties. Encompasses both the wire format and the behavioral contract — request/response patterns, connection lifecycle, versioning, and flow control. Examples include AMQP, MQTT, STOMP
Middle Box: A network device or service that sits between endpoints and modifies, filters, caches, proxies, or inspects traffic rather than simply forwarding it transparently. Firewalls, load balancers, proxies, and WAN optimizers are all examples of middleboxes with security implications.
Mitmproxy: An interactive proxy used to inspect, modify, and debug HTTP and related traffic in transit.
MTU: Maximum Transmission Unit — the largest packet size (in bytes) that a network link can transmit without fragmentation. Standard Ethernet MTU is 1500 bytes. Mismatched MTU settings between network segments cause mysterious failures where small requests work fine but large transfers fail, a notoriousl
MTU: Maximum Transmission Unit — the largest packet size (in bytes) that a network interface can transmit without fragmentation. Ethernet's standard MTU is 1500 bytes. Jumbo frames (9000 bytes) improve throughput for bulk data transfers. MTU mismatches cause mysterious connectivity issues, especially wit
Multi-Hop: Involving multiple sequential network relays, tunnels, or pivot points between origin and destination rather than a single direct path. In security, multi-hop paths appear in anonymity systems, attacker pivoting, complex VPN routing, and chained administrative access.
Multiplexing: The technique of combining multiple independent signals or data streams over a single shared channel — in networking, HTTP/2 multiplexes many request/response pairs over one TCP connection; in I/O, `select`/`epoll` multiplex readiness events from many file descriptors onto a single thread.
NAT: Network Address Translation — a technique where a router modifies IP addresses in packet headers to map between private (internal) and public (internet-facing) addresses. NAT is why millions of home networks can all use 192.168.1.x internally while sharing a single public IP. It extended IPv4's life
NAT Security: The security implications and controls associated with network address translation, including how internal addresses are hidden, how sessions are tracked, and what exposure still exists through translated services. NAT can reduce casual visibility of internal hosts, but it is not a substitute for fi
NAT Traversal: Techniques for establishing direct connections between devices that are behind NAT (Network Address Translation) routers. Methods include STUN (discovering public IP), TURN (relaying traffic), and ICE (trying multiple strategies). Essential for peer-to-peer applications.
Negotiation: The process by which two communicating parties agree on parameters for their exchange — in HTTP, content negotiation uses `Accept`, `Accept-Language`, and `Accept-Encoding` headers to select the best representation; in TLS, cipher suite negotiation determines the encryption algorithms for the sessio
Netty: An asynchronous, event-driven network application framework for the JVM that provides a high-performance, non-blocking I/O pipeline for building protocol servers and clients — used internally by Elasticsearch, Cassandra, gRPC-Java, and Play Framework.
Network Access Control: Network Access Control is policy enforcement that decides whether a device or user may connect to a network and with what restrictions. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correc
Network Detection and Response: Network Detection and Response is the collection and analysis of network telemetry to detect malicious behavior and support investigation. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on cor
Network Effect: A phenomenon where a product becomes more valuable as more people use it. The telephone is the classic example: one phone is useless; a billion phones form the most valuable communication network in history. Facebook, Uber, and marketplaces all depend on network effects.
Network Forensics: Network Forensics is the reconstruction and analysis of network communications for investigation, scoping, and evidence collection. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct co
Network Interface: A hardware or virtual endpoint through which a host connects to a network, identified by a name (e.g., `eth0`, `wlan0`, `lo`) and configured with IP addresses, MTU, and routing rules — each container in Docker typically gets its own virtual network interface via a veth pair.
Network Intrusion Detection: Network Intrusion Detection is monitoring of network traffic for malicious signatures, anomalies, or policy violations. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration,
Network Isolation: The deliberate separation of systems or segments so traffic between them is prevented or tightly controlled. Network isolation is used both for architecture, such as separating critical systems, and for incident response, such as cutting off a compromised host or subnet.
Network Layer: Layer 3 of the OSI model, responsible for logical addressing (IP addresses) and routing packets across interconnected networks — implemented primarily by the Internet Protocol (IPv4/IPv6) and routing protocols like BGP and OSPF.
Network Mapping: The process of identifying devices, subnets, routes, services, and connectivity relationships across a network. Defenders use network mapping for visibility and segmentation planning, while attackers use it to find targets and lateral movement paths.
Network Perimeter Security: The controls placed at network boundaries to monitor, filter, or restrict traffic entering and leaving an environment, such as firewalls, gateways, DDoS protections, and VPN concentrators. It remains important, but modern architectures recognize that the perimeter is no longer the only trust boundar
Network Policy: A defined rule set controlling which network communications are allowed between systems, services, namespaces, or endpoints. The term is commonly used in container platforms and zero-trust designs where traffic permissions are declared explicitly instead of assumed implicitly.
Network Probe: A device, service, or software sensor that observes and records network traffic, metadata, or protocol behavior for analysis. Network probes are used in IDS, NDR, performance monitoring, and forensics to provide visibility into communications on a link or segment.
Network Protocol: A formal specification of rules governing the format, sequencing, and error handling of data exchanged between networked systems — examples span every layer from Ethernet (L2) and IP (L3) to TCP/UDP (L4) and HTTP/gRPC (L7).
Network Segmentation: Network Segmentation is the division of networks into smaller trust zones so movement and blast radius are constrained. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration,
Network Stack: The layered set of protocols and software components in an operating system that processes network traffic — from the NIC driver and IP layer through TCP/UDP to the socket API — each layer adding headers or handling concerns like fragmentation, retransmission, and congestion control.
Network Tap: Network Tap is a device or virtual mechanism that passively copies network traffic for analysis without being in the forwarding path. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct
Network Telemetry: Operational and security data collected from networks, such as flow records, packet data, DNS logs, connection metadata, and device events. Network telemetry gives defenders broad visibility into communication patterns even when full payload inspection is unavailable.
Network Traffic Analysis: The study of packets, flows, timing, volumes, and communication patterns to understand normal behavior, detect anomalies, and investigate attacks. Network traffic analysis can reveal scanning, exfiltration, malware beaconing, and lateral movement even without full application logs.
Neural Network: A computing system loosely inspired by biological neural networks, consisting of layers of interconnected nodes (neurons) that process information by adjusting weighted connections during training. The building block of all modern AI — though the resemblance to actual brains is more metaphorical tha
Neural Network Depth: The number of layers in a neural network, which affects representational capacity, compute cost, and optimization behavior.
Neural Network Detail: Neural Network Detail is a model component or design choice that shapes how information flows through a learned system. It is commonly used for building neural architectures and deciding where capacity should live, where teams need predictable behavior under real workloads rather than toy examples.
Neural Network Pruning: The removal of weights, neurons, or connections from a neural network to make it smaller or more efficient while trying to preserve performance. Pruning is one way to reduce inference cost and model size.
NFS: Network File System — a distributed filesystem protocol originally developed by Sun Microsystems that allows a client machine to access files over a network as if they were on a local disk, using remote procedure calls (RPC) to handle read, write, and metadata operations transparently.
Non-Blocking IO: An I/O model in which system calls like `read()` and `write()` return immediately — either with available data or an EAGAIN/EWOULDBLOCK status — instead of suspending the thread until data is ready. Typically used with multiplexing mechanisms like epoll, kqueue, or io_uring to handle thousands of co
On the Wire: In actual transmission or visible in real traffic rather than in theory or static code. In engineering slang, what happens on the wire often matters more than what the spec said should happen.
Open Invention Network: A patent non-aggression consortium formed to help protect the Linux ecosystem and related open source technologies from patent litigation among its members. It is an example of legal infrastructure built to support open source at industry scale.
OpenVPN: OpenVPN is a VPN system that creates encrypted tunnels over IP networks using TLS-based key exchange and configuration profiles. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct confi
OpenWrt: An open-source Linux-based operating system for routers and embedded networking devices. In networking culture, OpenWrt is valued for turning commodity hardware into configurable, scriptable systems rather than opaque appliances.
OPNsense: An open-source firewall and routing platform used for network security and gateway management.
OSI Model: A seven-layer conceptual model for understanding network communication: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), Application (7). While real protocols don't map perfectly, the model provides a shared vocabulary — 'Layer 7 load balancer' means it underst
packet: A formatted unit of data transmitted across a network, containing both a header (with source/destination addresses, sequence numbers, and protocol information) and a payload (the actual data). The packet-switching paradigm — breaking data into small, independently-routed packets — is the fundamental
Packet Capture: A network or infrastructure security concept involving packet capture and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect advers
Packet Filter: A filtering mechanism that makes allow-or-deny decisions based on packet-level properties such as source, destination, protocol, and port rather than full application context. Packet filters are efficient and foundational, but they provide less nuance than deeper stateful or application-aware inspec
Packet Injection: The insertion of crafted packets into a network flow or medium to disrupt communications, spoof traffic, exploit protocol behavior, or trigger device responses. Packet injection is common in wireless attacks, protocol testing, and some man-in-the-middle scenarios.
Packet Loss: The failure of one or more network packets to reach their destination, caused by congestion, faulty hardware, signal degradation, or deliberate QoS dropping. TCP automatically retransmits lost packets at the cost of latency, while UDP simply loses them, making packet loss particularly impactful for
Packet Replay: The retransmission of previously captured packets or messages in order to repeat, confuse, or bypass a protocol exchange. Packet replay is effective when the protocol does not properly enforce freshness, sequence checks, or nonce validation.
Packet Sniffing: A network or infrastructure security concept involving packet sniffing and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adver
Packet Spoofing: The crafting of network packets with falsified source or other header fields to disguise origin, bypass simple trust assumptions, or aid reflection and evasion attacks. Packet spoofing is a long-standing technique in denial-of-service attacks, trust abuse, and protocol testing.
Passive DNS: A historical record of observed DNS resolutions collected from sensors or providers, used to investigate how domains have mapped to IPs over time. Passive DNS is valuable in threat hunting because malicious infrastructure often changes rapidly, leaving patterns that live DNS queries no longer show.
peering: An arrangement between two networks (typically ISPs or content providers) to exchange traffic directly rather than paying a third-party transit provider. Settlement-free peering means neither side pays the other, while paid peering involves compensation. Peering disputes between major ISPs have caus
Peer-to-Peer: A network architecture in which each node (peer) acts as both client and server, communicating directly with other peers without relying on a central coordinating server. Used in BitTorrent, WebRTC, IPFS, and blockchain networks.
Ping: 1. A network utility that sends ICMP echo requests to test connectivity and measure latency. Named after sonar. 2. In office slang: to send someone a message, typically on Slack or Teams. 'I'll ping you later' has replaced 'I'll call you.'
Ping of Death: A classic network attack that used oversized or malformed IP fragments to create an illegal reassembled packet, crashing or destabilizing vulnerable systems when processed. It is mainly of historical importance today because modern stacks generally defend against it, but it remains a well-known exam
Point-to-Point VPN: A VPN connection established directly between two endpoints or sites to create a secure encrypted link over an untrusted network. Point-to-point VPNs are common for branch connectivity, site-to-site tunnels, and direct secure links between controlled systems.
Pong: The response message sent back after receiving a ping, used in network protocols (ICMP, WebSocket, IRC) to confirm that a connection is alive and measure round-trip latency. In WebSocket, the server sends a pong frame in reply to a client's ping frame to keep the connection from being closed by inte
Port: A 16-bit number (0–65535) that identifies a specific process or service on a networked host, used by TCP and UDP to multiplex connections over a single IP address. Well-known ports include 80 (HTTP), 443 (HTTPS), and 5432 (PostgreSQL).
Port 443: The well-known TCP port commonly used for HTTPS and other TLS-protected web traffic. In security operations, references to port 443 often matter because many legitimate services use it, and attackers also hide malicious traffic there to blend in with normal encrypted web activity.
Port 80: The well-known TCP port traditionally used for unencrypted HTTP web traffic. From a security perspective, port 80 is often associated with redirecting users to HTTPS or with risk when sensitive traffic is still served without transport encryption.
Port Binding: The practice of a service binding to a network port to listen for incoming requests, making itself available as a self-contained, externally accessible process. One of the twelve-factor app principles, it means the app exports HTTP (or other protocols) by binding to a port rather than relying on an
Port Forwarding: The redirection of traffic arriving on one port to a different internal host, service, or port, often through a router, firewall, SSH tunnel, or NAT device. Port forwarding is useful operationally, but it can also expose internal services unexpectedly or create bypass paths around intended controls.
Private Network: A network that is not directly exposed to the public internet and is intended for internal or restricted communication. A private network is not automatically secure, but it reduces direct exposure and can support stronger access control and segmentation.
Protocol: A set of rules governing communication between systems. In networking, protocols like HTTP, TCP, and WebSocket define how data is formatted and transmitted. In Swift and Elixir, a protocol defines a contract (interface) that types must implement.
Protocol Vulnerability: A weakness in a protocol's design or implementation that can be exploited to bypass trust, leak data, disrupt service, or manipulate communications. Protocol vulnerabilities may arise from poor authentication, parsing flaws, ambiguous state handling, or unsafe assumptions about the network.
Proxy: A proxy is an intermediary that sits between a client and a target resource, forwarding requests on the client's behalf while optionally adding functionality. Network forward proxies route outbound traffic for access control, caching, or anonymity. Reverse proxies (Nginx, HAProxy) sit in front of se
Proxy Chain: A network or infrastructure security concept involving proxy chain and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
Proxy Server: A server that acts as an intermediary for network requests between clients and destination servers. A forward proxy acts on behalf of clients (hiding their identity or filtering content), while a reverse proxy (like Nginx or HAProxy) sits in front of backend servers to handle load balancing, SSL ter
Public DNS: DNS resolution services offered for broad public use over the internet, such as Google's or Cloudflare's public recursive resolvers. Public DNS can improve reliability or privacy in some cases, but it can also bypass enterprise policy, monitoring, or internal naming assumptions.
Public Network: A network environment that is broadly accessible and not under the exclusive control of the organization using it, such as the public internet or shared Wi-Fi. Security designs treat public networks as inherently untrusted, requiring encryption, authentication, and minimal exposure assumptions.
Query Parameter: A key-value pair appended to a URL after the ? character (e.g., ?page=2&sort=name) used to pass data to a server in an HTTP GET request. Multiple parameters are separated by & and values are percent-encoded. In database contexts, it can also refer to a parameterized placeholder in a prepared stateme
QUIC: A transport protocol built on UDP that provides the reliability of TCP with faster connection setup, built-in encryption (TLS 1.3), and multiplexed streams without head-of-line blocking. QUIC is the foundation of HTTP/3.
Rack: A Ruby web server interface specification that defines a minimal contract: an application is any object that responds to call(env) and returns a [status, headers, body] triplet. Rack provides the common layer between Ruby web frameworks (Rails, Sinatra) and web servers (Puma, Unicorn), and enables c
Rails Router: The component in Ruby on Rails (defined in config/routes.rb) that maps incoming HTTP request URLs and methods to controller actions. It supports RESTful resource routing, nested routes, named route helpers, constraints, and namespace scoping to organize URL structures declaratively.
Ready State: A property (readyState) on browser objects like XMLHttpRequest and Document that indicates the current phase of a lifecycle — for XHR: 0 (UNSENT) through 4 (DONE); for Document: "loading", "interactive", or "complete". Kubernetes also uses a ready state to indicate a pod can accept traffic, gated by
Recurrent Neural Network: Recurrent Neural Network is a model component or design choice that shapes how information flows through a learned system. It is commonly used for building neural architectures and deciding where capacity should live, where teams need predictable behavior under real workloads rather than toy example
Recursive DNS: The DNS resolution process or service in which a resolver queries other DNS servers on behalf of a client until it reaches an answer, rather than simply returning referrals. Recursive DNS infrastructure is security-relevant because it affects filtering, logging, privacy, cache poisoning risk, and po
Redis Pipeline: A technique for sending multiple Redis commands to the server in a single batch without waiting for each individual reply, dramatically reducing round-trip latency by amortizing network overhead across many operations.
Reflected Attack: An attack that causes a target's own input or a third-party service's response to be sent back in a way that harms the victim, as in reflected XSS or reflection-based DDoS. The common theme is that attacker-supplied data is bounced through another component to create the effect.
Remote Procedure Call: A communication protocol that allows a program to invoke a function on a remote server as if it were a local call, with a client stub marshalling arguments into a network message and a server stub unmarshalling them to execute the actual procedure. gRPC, JSON-RPC, and XML-RPC are common implementati
Remoting: A programming paradigm that allows objects or methods to be invoked across process or machine boundaries as if they were local, abstracting away network communication details.
Rendezvous: A synchronization point where two or more processes, threads, or network peers meet to exchange data or coordinate before proceeding independently.
Request: A message sent from a client to a server asking it to perform an action — in HTTP, composed of a method (GET, POST, PUT, DELETE, etc.), a URL, headers, and an optional body. Each request initiates a transaction that the server processes and responds to.
Request Handler: A function or method that receives an incoming HTTP request, executes the business logic for that endpoint (reading/writing data, calling services, validating input), and returns an HTTP response. In Express it's a route callback, in Django a view function, in Spring a controller method.
Request-Response: A communication pattern in which a client sends a single request and synchronously waits for a single response from the server, forming a paired exchange. HTTP is the canonical request-response protocol, in contrast to streaming, event-driven, or fire-and-forget models.
Residual Network: Residual Network is a model component or design choice that shapes how information flows through a learned system. It is commonly used for building neural architectures and deciding where capacity should live, where teams need predictable behavior under real workloads rather than toy examples. Pract
Response: A message sent from a server back to a client in answer to a request — in HTTP, composed of a status code (200, 404, 500, etc.), headers (Content-Type, Cache-Control, Set-Cookie), and an optional body containing the requested data or an error message.
REST API: An API that follows REST (Representational State Transfer) principles: resources are identified by URIs, manipulated via standard HTTP methods (GET, POST, PUT, DELETE), represented in formats like JSON, and interactions are stateless — each request contains all information needed to process it witho
Restricted Network: A network segment with tight access controls, limited connectivity, and stricter usage rules than general-purpose internal networks. Restricted networks are often used for sensitive systems such as payment environments, production administration, research data, or regulated workloads.
Reverse DNS: A DNS lookup that maps an IP address back to a hostname using PTR records instead of resolving a hostname to an IP. Reverse DNS is useful in logging, reputation checks, mail handling, and investigation, but the returned name is only as trustworthy as the party controlling that DNS zone.
reverse proxy: A server that sits in front of one or more backend servers and forwards client requests to them, appearing to the client as the origin server. Reverse proxies provide load balancing, SSL termination, caching, compression, and security benefits. Nginx and Cloudflare are the most common reverse proxie
Route: A mapping between a URL pattern (and optionally an HTTP method) and the handler function that should process matching requests. In frontend SPA frameworks, routes map URL paths to the components that render for that view.
Route Handler: The function or method that executes when an incoming request matches a defined route. In Express it's the callback passed to app.get(); in Next.js App Router, it's an exported GET/POST function in a route.ts file that runs on the server.
Route Middleware: A function that intercepts an HTTP request before (or after) it reaches the route handler, performing cross-cutting concerns like authentication, logging, rate limiting, or body parsing. Middleware can modify the request/response objects, short-circuit the chain, or pass control to the next middlewa
Router: In networking, a device that forwards packets between networks by examining destination IP addresses and consulting a routing table. In web development, a software component that matches incoming URLs to the appropriate handler or component — such as Express Router or React Router.
RPC: RPC, or Remote Procedure Call, is a communication protocol that allows a program to execute a function or procedure on a remote server as if it were a local function call, abstracting away the details of network communication. The client calls a function, the RPC framework serializes the arguments,
Rubber Banding: Rubber Banding in software and gaming refers to an effect where movement or progress appears to snap back to a previous position, as if attached to an elastic band. In online multiplayer games, rubber banding occurs due to network latency: a player moves forward on their screen, but the server's pos
Rubber Banding: In gaming and real-time applications, the visible effect of network latency compensation — an object appears to jump back to a previous position when the server corrects the client's prediction. Named because the object seems to snap back like a rubber band. Also refers to game mechanics that artifi
Rubber Duck DNS: Rubber Duck DNS is a humorous tech community concept combining two beloved debugging traditions: rubber duck debugging (explaining your problem to a rubber duck to find the solution) and the perennial observation that every mysterious network problem turns out to be DNS. The joke suggests that when
Samba: Open-source software that provides SMB/CIFS file and print services, especially for interoperability with Windows networks.
Scapy: A Python packet crafting and analysis tool widely used for network testing, fuzzing, and traffic inspection. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
Security Headers: HTTP response headers that instruct browsers to enable security features. Key headers: Content-Security-Policy (XSS prevention), Strict-Transport-Security (force HTTPS), X-Frame-Options (clickjacking), X-Content-Type-Options (MIME sniffing), and Referrer-Policy (data leakage). Check your score at se
Select: A system call (or its language-level equivalent like Go's `select`) that monitors multiple file descriptors or channels and blocks until one or more become ready for reading, writing, or have an exceptional condition — the classic I/O multiplexing primitive, largely superseded by `poll` and `epoll`/
Serialization: The process of converting an in-memory data structure or object graph into a linear byte or text format (JSON, Protobuf, MessagePack, etc.) so it can be stored on disk, transmitted over a network, or passed between processes — with deserialization being the reverse.
Server: A computer or software process that listens for and responds to requests from clients over a network, providing services such as web pages, API responses, database queries, or file storage.
Server Push: A mechanism in which the server proactively sends resources to the client before the client requests them — originally an HTTP/2 feature (PUSH_PROMISE) for preloading assets like CSS and JS, and more broadly any pattern (WebSockets, SSE) where the server initiates data delivery.
Server-Sent Events: A simple HTTP-based protocol for one-way server-to-client streaming. The server sends text events over a long-lived HTTP connection using the text/event-stream content type. Supports automatic reconnection and event IDs for resuming. Simpler than WebSockets for push-only use cases like live feeds, n
Service Discovery: The mechanism by which services in a distributed system automatically find and connect to each other without hardcoded addresses. Can be client-side (Consul, etcd) or server-side (Kubernetes DNS, AWS Cloud Map). Enables dynamic scaling and deployment.
service mesh: A dedicated infrastructure layer that handles service-to-service communication in microservice architectures, implemented as a network of lightweight proxies (sidecars) deployed alongside each service. Service meshes provide mutual TLS, load balancing, circuit breaking, and observability without req
Service Mesh: A dedicated infrastructure layer for managing service-to-service communication in a microservice architecture, handling load balancing, encryption, observability, and failure handling transparently. Istio and Linkerd are the major implementations.
Short Polling: A client-side technique where the browser or application repeatedly sends HTTP requests to the server at fixed intervals (e.g., every 2 seconds) to check for new data, as opposed to maintaining a persistent connection like WebSockets or long polling.
SMTP: Simple Mail Transfer Protocol — the standard protocol for sending email across the internet. SMTP handles outbound delivery between mail servers on port 25 (or 587 for submission), while IMAP/POP3 handle retrieval.
Sneakernet: A humorous term for physically transporting data on storage media by walking it from one machine or location to another instead of sending it over a network. It is often used ironically when bandwidth, isolation, or policy makes physical transfer easier or necessary.
SNI: Server Name Indication -- a TLS extension that lets the client specify which hostname it's connecting to during the handshake, before encryption begins. Enables hosting multiple HTTPS sites on a single IP address (each with its own certificate). Without SNI, each HTTPS site required a dedicated IP.
Snort: An open-source intrusion detection and prevention system that matches network traffic against protocol and attack rules. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary act
Socket: A software endpoint for bidirectional communication between two processes, identified by an IP address and port number for network sockets (TCP/UDP) or a filesystem path for Unix domain sockets. The POSIX socket API (socket, bind, listen, accept, connect) is the foundational interface for virtually
Socket Pool: A cache of pre-established, reusable network socket connections maintained by an HTTP client or application to avoid the overhead of repeated TCP handshakes and TLS negotiations. Browsers typically maintain per-origin socket pools (Chrome caps at 6 per origin), and server-side HTTP clients like Go's
SPF Record: A DNS record that lists which mail servers are authorized to send email for a domain. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or define stronger c
Stale-While-Revalidate: A caching strategy (HTTP header and React Query/SWR pattern) that immediately returns stale cached data while simultaneously fetching a fresh version in the background. Users see content instantly (from cache), and it's silently updated moments later. Provides the speed of aggressive caching with th
subnet: A logical subdivision of an IP network, created by applying a subnet mask to partition a larger address space into smaller, isolated segments. Subnetting enables network segmentation for security (isolating databases from web servers), efficient address allocation, and traffic management.
Suricata: An open-source intrusion detection and network security monitoring engine.
Tailscale: A mesh VPN product built on WireGuard concepts, popular for simple secure connectivity between devices and services.
TCP: TCP, or Transmission Control Protocol, is a connection-oriented transport protocol that provides reliable, ordered delivery of data between applications over an IP network. Before any data is sent, TCP establishes a connection using a three-way handshake (SYN, SYN-ACK, ACK), and it guarantees that p
TCP/IP: The foundational protocol suite of the internet, consisting of TCP (reliable, ordered delivery) and IP (addressing and routing). The four-layer TCP/IP model (Link, Internet, Transport, Application) is the practical alternative to the OSI model. Every internet communication ultimately runs on TCP/IP
TCP Tears: A joking phrase for the pain caused by subtle network issues, connection states, and transport-level debugging. In engineering slang, TCP tears are what you cry when the packets are technically flowing and nothing useful is working.
Tech Conference: A conference focused on technology topics such as software engineering, infrastructure, startups, security, or product design. Tech conferences combine knowledge sharing, vendor marketing, recruiting, and community signaling.
Tech Meetup: A smaller, usually local gathering where people interested in technology share talks, demos, discussions, or networking around a topic, language, or ecosystem. Tech meetups are often the backbone of community-building outside major conferences.
Telemetry Security: A network or infrastructure security concept involving telemetry security and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect ad
Timeout: A configured maximum duration that a system will wait for an operation (network request, database query, lock acquisition) to complete before aborting it and treating it as a failure — a critical circuit-breaker against cascading hangs.
TLS handshake: The multi-step negotiation process that establishes an encrypted connection between a client and server. During the handshake, the parties agree on a TLS version, select cipher suites, authenticate the server's certificate, and derive shared session keys. TLS 1.3 reduced this from two round-trips to
TOFU: Short for Trust On First Use, a security model where a key or identity is accepted the first time it is seen and treated as trusted afterward unless it changes. It is common in tools like SSH and illustrates a pragmatic compromise between usability and stronger verification.
Token Ring: A LAN protocol (IEEE 802.5) in which networked stations are arranged in a logical ring and a special 'token' frame circulates continuously — a station may only transmit data when it holds the token, preventing collisions but largely supplanted by Ethernet.
Tor Project: The open-source project and organization behind Tor, which routes internet traffic through relays to improve privacy and anonymity.
traceroute: A network diagnostic tool that maps the path packets take from source to destination by sending packets with incrementally increasing TTL values. Each router along the path decrements the TTL and sends back an ICMP Time Exceeded message when it hits zero, revealing the hop-by-hop route and latency a
Transport: The network layer or mechanism responsible for reliably (or unreliably) moving data between endpoints — most commonly referring to TCP or UDP at OSI Layer 4, but also used abstractly for any pluggable delivery mechanism in frameworks (HTTP, WebSocket, gRPC, etc.).
Transport Layer Security: The cryptographic protocol family used to secure network sessions such as HTTPS, SMTP, and VPN traffic. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
TTL: Time to Live — a counter or timestamp that limits the lifespan of data. In DNS, TTL specifies how long a resolver should cache a record (in seconds). In IP packets, TTL limits the number of hops to prevent infinite routing loops. In caching, TTL defines when cached data expires and must be refreshed
UDP: UDP, or User Datagram Protocol, is a connectionless transport protocol that sends packets (called datagrams) without establishing a connection or guaranteeing delivery. Unlike TCP, UDP does not perform handshakes, ordering, or retransmission, which makes it significantly faster and lower-overhead bu
Unix Domain Socket: An inter-process communication mechanism on Unix-like systems that uses the socket API but communicates via a file path in the filesystem (e.g., `/var/run/docker.sock`) instead of a network address. Since data never traverses the network stack, Unix domain sockets have lower latency and higher throu
Upload: The transfer of data from a local client to a remote server, typically via HTTP multipart form data, FTP, or a cloud storage API. In web applications, uploads often involve streaming the file to avoid loading it entirely into memory.
URI: Uniform Resource Identifier — a compact string defined by RFC 3986 that identifies a resource either by location (a URL), by name (a URN), or both. Every URL is a URI, but not every URI is a URL; for example, 'urn:isbn:0451450523' identifies a book without telling you where to fetch it.
URL: Uniform Resource Locator — a specific type of URI that includes both the scheme (protocol) and the network location needed to retrieve a resource, such as 'https://example.com/path?query=1'. It is the primary addressing mechanism of the World Wide Web.
URL Router: The component of a web framework or server that matches an incoming request's URL path (and often its HTTP method) against a set of registered route patterns to dispatch the request to the correct handler function. Routers typically support path parameters, wildcards, and middleware attachment.
User Agent: An HTTP header string that identifies the client software making a request, traditionally including the browser name, version, rendering engine, and operating system. Decades of browser-war spoofing have made most user-agent strings comically long chains of compatibility lies.
Virtual Network: A software-defined network that provides isolated Layer 2 or Layer 3 connectivity between virtual machines or containers without requiring dedicated physical switches. AWS VPCs, Azure VNets, and overlay networks like VXLAN are common implementations.
VLAN: Virtual Local Area Network — a method of creating logically separate networks on the same physical switch infrastructure by tagging Ethernet frames with a VLAN ID. VLANs isolate broadcast domains, improve security by segmenting traffic, and allow network topology to be reconfigured in software witho
VPC Peering: A networking connection between two Virtual Private Clouds that enables private IP communication without traversing the public internet. Traffic stays on the cloud provider's backbone network. Non-transitive by default — if VPC-A peers with VPC-B and VPC-B peers with VPC-C, A cannot reach C.
VPN: VPN, or Virtual Private Network, is a technology that creates an encrypted tunnel between your device and a remote server, routing your internet traffic through that tunnel to protect it from eavesdropping and hide your real IP address. In the corporate world, VPNs allow remote employees to securely
VPN Split Tunneling: A network or infrastructure security concept involving vpn split tunneling and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect a
VPN Tunnel: A network or infrastructure security concept involving vpn tunnel and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
Web API: An interface exposed over HTTP (typically REST, GraphQL, or gRPC-Web) that allows client applications to read and write server-side data and trigger server-side logic using standard request-response or streaming protocols.
Web Framework: A structured library or platform that provides conventions, routing, middleware, templating, and tooling for building web applications — server-side examples include Django, Rails, and Express; client-side examples include React, Vue, and Angular.
Web Server: Software (such as Nginx, Apache, or Caddy) that listens for incoming HTTP/HTTPS requests and responds by serving static files, proxying requests to application servers, terminating TLS, or load-balancing across backend instances.
WebTransport: A browser API built on HTTP/3 and QUIC that supports both reliable bidirectional streams and unreliable datagram delivery between client and server, designed as a modern replacement for WebSockets with lower latency, multiplexing without head-of-line blocking, and native support for unordered/lossy
Whisper Network: An informal, usually private channel through which people share warnings, reputational information, or safety concerns about individuals or organizations. In tech it often appears where formal reporting systems are weak or mistrusted.
WireGuard: A modern VPN protocol and implementation known for simplicity, performance, and strong cryptographic design.
Wireshark: The world's most widely used network protocol analyzer, allowing users to capture and interactively inspect network traffic down to the individual packet level. Formerly known as Ethereal.
Zero Trust Network Access: An access model that brokers application connections after verifying user, device, and policy context. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or