networking
Networking & Protocols
From bits on a wire to TLS 1.3 — the journey of one packet, retold for senior engineers.
Start track → 00
Start from zero
Before the senior material: what a network even is, and the handful of words the rest of the track assumes you already know. 01
The physical link
How bits become electricity, light, or radio — and what limits them. 01 Bits on the wire 10 min 02 Modulation and Shannon 12 min 03 Latency math 12 min 04 Bufferbloat and congestion 12 min 05 The datacentre fabric 13 min 06 The physical frontier 13 min 07 The physical link: multiple-choice review 13 min 08 The physical link: free-recall review 13 min 09 The physical link: code and trace reading 14 min 10 The physical link: audit and tame a real link 240 min
02
IP packets: addressed envelopes
How a packet finds its way across millions of independent networks, what the IP header carries, and where datagrams die. 01 The IP envelope 10 min 02 Reading the IP header 12 min 03 Routing and forwarding 14 min 04 MTU and fragmentation 12 min 05 NAT, addressing, and IPv6 deployment 14 min 06 IP security and operations 16 min 07 IP packets: multiple-choice review 13 min 08 IP packets: free-recall review 13 min 09 IP packets: dump and trace reading 14 min 10 IP packets: trace, decode, and fix a path-MTU black hole 240 min
03
The TCP handshake
What SYN, SYN-ACK, and ACK actually negotiate — and why a connection's first RTT decides the speed of every request on it. 01 The three-way handshake 10 min 02 Sequence numbers and connection state 14 min 03 Flow control and congestion control 16 min 04 TCP options and common pathologies 15 min 05 SYN cookies, TFO, and TIME-WAIT at scale 16 min 06 BBR, production observability, and beyond TCP 18 min 07 TCP handshake: multiple-choice review 13 min 08 TCP handshake: free-recall review 13 min 09 TCP handshake: trace and code reading 14 min 10 TCP handshake: measure and tame a connection-churn problem 240 min
04
DNS: from name to address
How a recursive resolver climbs the root → TLD → authoritative tree to turn google.com into an IP, and where caches and DNSSEC live. 01 DNS: what it does and why it exists 8 min 02 The resolver walk: referrals, record types, and glue 14 min 03 TTL, caching, and DNS propagation 14 min 04 DNSSEC: chain of trust and validation failure 16 min 05 Encrypted DNS: DoH, DoT, DoQ, and cache poisoning 18 min 06 DNS: multiple-choice review 13 min 07 DNS: free-recall review 13 min 08 DNS: dig and zone-file reading 14 min 09 DNS: run a signed zone through a migration and a rollover 210 min
05
TLS 1.3: keys and confidentiality in one RTT
How ClientHello key shares plus a certificate verifier collapse the old TLS 1.2 two-RTT handshake into one — and what 0-RTT actually buys you. 01 What TLS does and why it exists 8 min 02 The 1-RTT handshake: key shares and ECDHE 14 min 03 Session resumption and 0-RTT 12 min 04 Key schedule, SNI, ALPN, and extensions 14 min 05 0-RTT defenses, ECH, hybrid PQ, and production TLS 16 min 06 TLS 1.3: multiple-choice review 13 min 07 TLS 1.3: free-recall review 13 min 08 TLS 1.3: trace and config reading 14 min 09 TLS 1.3: build and break a hardened endpoint 240 min
06
HTTP versions: from 1.1 to 3
How HTTP evolved from serial request-response to multiplexed streams to QUIC datagrams — and what each version costs to run in production. 01 HTTP: the request-response language of the web 8 min 02 HTTP/2: streams, frames, and HPACK 14 min 03 HTTP/3 and QUIC: stream-level loss isolation 14 min 04 HTTP headers, caching, and CORS 16 min 05 HTTP streaming, SSE, WebSockets, and gRPC 12 min 06 HTTP/3 in production: QUIC internals, fallback, and observability 18 min 07 HTTP design: priorities, WebTransport, and semantic correctness 16 min 08 HTTP versions: multiple-choice review 13 min 09 HTTP versions: free-recall review 14 min 10 HTTP versions: header and trace reading 14 min 11 HTTP versions: measure HOL blocking and ship an HTTP/3 edge 240 min
07
CDN and edge delivery
How edge servers, cache hierarchies, and smart routing cooperate to deliver content in 20 ms instead of 200 ms — and what breaks when any layer is misconfigured. 01 CDN: putting content next door 8 min 02 Anycast and GeoDNS: routing to the nearest edge 10 min 03 Tiered cache and Cache-Control 12 min 04 Vary header and cache keys 12 min 05 Stale-while-revalidate and cache stampede 12 min 06 Edge workers and edge-side composition 14 min 07 CDN operations and observability 14 min 08 CDN and edge: multiple-choice review 13 min 09 CDN and edge: free-recall review 13 min 10 CDN and edge: header and trace reading 14 min 11 CDN and edge: build and tune an edge delivery layer 240 min
08
WebSocket and real-time
How WebSocket upgrades an HTTP connection to a persistent full-duplex channel — and everything that breaks when 10,000 slow clients pile into one broadcast server. 01 WebSocket: the HTTP upgrade handshake 10 min 02 WebSocket frame format: opcodes, masking, fragmentation 12 min 03 WebSocket vs SSE vs long-polling: choosing the right transport 10 min 04 WebSocket backpressure: when clients can''''t keep up 12 min 05 Reconnection: jittered backoff, thundering herd, message resumption 12 min 06 WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10M 14 min 07 WebSocket in production: proxies, security, and distributed architecture 14 min 08 WebSocket: multiple-choice review 14 min 09 WebSocket: free-recall review 14 min 10 WebSocket: code and config reading 14 min 11 WebSocket: survive the broadcast storm 240 min
09
Proxy and load balancing
A reverse proxy opens two TCP connections per request so it can route, health-check, and scale backends invisibly — and every load balancing decision from round-robin to consistent hashing is a tradeoff between speed, fairness, and state. 01 What reverse proxies do 8 min 02 Balancing algorithms: round-robin to power-of-two-choices 12 min 03 L4 vs L7 load balancing and client-IP preservation 11 min 04 Health checks, connection draining, and slow start 12 min 05 Session affinity, consistent hashing, and the right fix 12 min 06 Retry storms, circuit breakers, and load shedding 14 min 07 Resilient LB architecture: anycast, zone-aware routing, and observability 14 min 08 Proxy and load balancing: multiple-choice review 14 min 09 Proxy and load balancing: free-recall review 14 min 10 Proxy and load balancing: config and code reading 14 min 11 Proxy and load balancing: survive a failing backend 240 min
10
QUIC internals
QUIC fuses UDP, TLS 1.3, and multiplexed streams in user space — giving 1-RTT handshakes, HoL-free streams, and connection migration, at the cost of 15–30% more CPU per byte than kernel TCP. 01 Why QUIC and not TCP+TLS 8 min 02 QUIC streams and head-of-line blocking 10 min 03 Integrated handshake and 1-RTT 12 min 04 Connection IDs and network migration 10 min 05 Loss detection and congestion control 12 min 06 0-RTT resumption and packet encryption 14 min 07 Deployment tradeoffs and CPU cost 14 min 08 QUIC internals: multiple-choice review 13 min 09 QUIC internals: free-recall review 13 min 10 QUIC internals: code and trace reading 14 min 11 QUIC internals: prove it on the wire 240 min
11
Network security
DDoS attacks, amplification floods, and infrastructure-layer hijacks (DNS/BGP) are defeated by layered defenses — anycast edge absorption, rate limiting, WAF, mTLS, and RPKI/ROV — because no single defense stops all vectors. 01 DDoS: what it is and why it works 10 min 02 Amplification attacks and state exhaustion 12 min 03 Rate limiting: algorithms and architecture 14 min 04 WAFs, firewalls, mTLS, and HSTS 14 min 05 DNS cache poisoning and BGP hijacking 14 min 06 Defense-in-depth architecture and attack economics 16 min 07 Network security: multiple-choice review 13 min 08 Network security: free-recall review 14 min 09 Network security: config and log reading 14 min 10 Network security: survive a layered DDoS 240 min
12
Putting it all together
Every layer from DNS to circuit breaker fires on every request — the capstone chapter shows how they compose, fail, and recover as a system. 01 The twelve layers: one URL, seven actors 10 min 02 DNS, TCP, TLS in sequence: where the milliseconds go 14 min 03 Critical render path and Core Web Vitals 14 min 04 Proxy intercepts and security gates: rate limiters, WAF, mTLS 13 min 05 Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migration 14 min 06 Observability: distributed traces, USE/RED, and sampling 15 min 07 Resilience: cascading retries, circuit breakers, and error budgets 16 min 08 Putting it together: multiple-choice review 13 min 09 Putting it together: free-recall review 14 min 10 Putting it together: trace and capture reading 14 min 11 Putting it together: trace and optimise a full page load 240 min
Build with this track
Guided projects that exercise what you learn here.
Collaborative cursors
Show every connected user's live cursor and selection in a shared document, conflict-free, over WebSocket.
Feature-flag service
Build a small flag service with targeting rules, percentage rollouts, and a typed SDK that evaluates flags client-side from a cached ruleset.
Homelab Secure Stack
Stand up a self-hosted media and home-server stack on nas01.example where five services share a single VPN container's network namespace — the kill-switch drops all traffic the moment the tunnel dies, a split-tunnel whitelist carves out LAN access, and three layered access rings (localhost / LAN 10.0.0.0/24 / mesh-VPN 100.64.0.30) keep the right doors open to the right people. Harden the host with SSH key-only auth, fail2ban, and unattended security upgrades; write a rotating, age-encrypted off-site backup; and walk away knowing the stack stays dark if anything breaks.
Offline PWA sync
Offline-first notes PWA: a local write queue (IndexedDB) that syncs on reconnect with last-writer-wins conflict resolution, a service worker for asset caching, and background sync for missed flushes.
Presigned upload flow
Direct-to-storage uploads via presigned URLs with size/content-type limits and a completion webhook that verifies the object actually arrived — so your API server never touches file bytes.
Static page deploy
Take a static HTML/CSS page from a file on disk to a public URL with a deploy you can re-run — your first real delivery, no build step required.
Browser & Frontend Runtime
What actually happens inside the browser when your page loads and runs — how JavaScript is scheduled, how pixels get drawn, and where the slow parts hide.