Glossary

76 terms

Every term the lessons define, with the same wording they use. Anywhere one of these appears in a lesson it is underlined -- tap it, click it or Tab to it for the short version without leaving the page.

  • access point

    also: access points, Wi-Fi access point

    An access point connects radio to cable. It passes messages between wireless devices and the rest of the network without deciding where they go next. In many homes it is built into the same box as the router.

    Taught inYour devices are on a network

    Watch it runNetwork Map

  • anycast

    Anycast makes routing do the load balancing: there is nothing to look up and no decision to make at the client. It is how root DNS servers and CDN edges present a single address worldwide, and why "the same IP" can be a different machine on different continents.

    Taught inCDNs and the edge

    Watch it runNetwork MapInternet Simulator

  • API

    also: APIs

    A web API is ordinary HTTP with the audience changed. Because the caller is code, the parts that matter most are the ones a human browsing would forgive: exact status codes, stable field names, and errors that say what to do next.

    Taught inREST, and what GraphQL changesAPI authentication

    Watch it runAPI Visualizer

  • authoritative server

    also: authoritative, authoritative name server, nameserver, name server

    Authoritative servers answer from a zone file rather than from a cache, which is why only they can return NXDOMAIN. Everything else in the chain -- roots, TLDs, resolvers -- either delegates or remembers.

    Taught inHow a name is resolvedRecords, aliases, and delegation

    Watch it runDNS Explorer

  • autonomous system

    also: AS, autonomous systems, AS number, ASN

    The Internet is not a graph of routers, it is a graph of about a hundred thousand autonomous systems. Routing inside one is that operator’s private business; routing between them is BGP, and every path you can trace is a sequence of AS numbers.

    Taught inRouting: how a packet finds its way

    Watch it runNetwork Map

  • bandwidth

    Bandwidth describes a rate; latency describes a delay. Confusing the two is behind most wrong guesses about why a page is slow, because a page load is usually dozens of small round trips rather than one large transfer.

    Taught inWhat a network actually is

    Watch it runInternet Simulator

  • bearer token

    also: bearer, JWT, access token

    "Bearer" is the whole security model: possession is sufficient, so the token must travel only over TLS and never in a URL. A JWT is one common shape -- signed so it cannot be altered, base64url so it can be read by anyone holding it.

    Taught inAPI authentication

    Watch it runAPI Visualizer

  • BGP

    also: Border Gateway Protocol

    BGP is a policy protocol wearing a routing protocol’s clothes: a network advertises what it is willing to carry, not what is shortest. That is why traffic between two neighbours can cross a continent, and why a single wrong advertisement can black-hole a large part of the Internet.

    Taught inRouting: how a packet finds its way

    Watch it runNetwork Map

  • browser

    also: browsers, web browser, web browsers

    A browser turns a web address into a page on your screen. To do that it looks up where the site is, connects to its server, asks for the page, and then draws what comes back, often asking for more files along the way.

    Taught inWhat happens when you open a website?Asking for the page

    Watch it runInternet SimulatorHTTP Explorer

  • cache

    also: caches, caching, cached

    Every cache is a bet that the answer has not changed yet, and every caching mechanism is really an argument about how to bound that bet -- a TTL, a max-age, an ETag. A hit is not a faster request; it is no request at all.

    Taught inHTTP cachingCaching, TTLs, and saying noThe second visit

    Watch it runHTTP ExplorerInternet SimulatorDNS Explorer

  • CDN

    also: content delivery network, edge, edge server

    An edge is an ordinary shared HTTP cache obeying the same RFC 9111 rules a browser does -- the trick is where it sits, not what it is. Traffic is steered to a nearby one by DNS or by anycast, so the distance a request travels shrinks to a few milliseconds.

    Taught inCDNs and the edge

    Watch it runInternet SimulatorNetwork Map

  • certificate

    also: certificates, leaf certificate

    The certificate itself is public and is not a secret; what proves the server owns it is a signature made with the matching private key during the handshake. Identity is matched against the subjectAltName list, and against nothing else.

    Taught inCertificates, and where trust comes from

    Watch it runHTTPS Explorer

  • certificate authority

    also: CA, certificate authorities, trust store

    Trust in the web PKI is a fixed list installed with the operating system or browser, not something discovered during a handshake. A chain can be internally perfect and still worth nothing if nobody in it appears on that list.

    Taught inCertificates, and where trust comes from

    Watch it runHTTPS Explorer

  • CNAME

    also: alias record, CNAMEs

    Because a CNAME replaces the name entirely it must be the only record at that name, which is why an apex like example.com cannot have one. Following an alias into another operator’s zone is exactly how a name is handed to a CDN.

    Taught inRecords, aliases, and delegationCDNs and the edge

    Watch it runDNS Explorer

  • CORS

    also: Cross-Origin Resource Sharing, preflight

    CORS relaxes the same-origin policy rather than enforcing it. The request is usually sent and executed regardless; what CORS controls is whether the calling page is allowed to see the answer -- and for anything beyond a simple form-style request, a preflight asks permission first.

    Taught inOrigins, CORS, and the preflight

    Watch it runHTTP ExplorerAPI Visualizer

  • default gateway

    also: gateway, gateways

    A host has a tiny routing table: one entry for its own subnet, and a default route pointing at the gateway. That is why a laptop needs to know exactly one router address to reach the entire Internet -- every decision after the first is made by somebody else.

    Taught inAddresses, subnets, and the default gatewayRouting: how a packet finds its way

    Watch it runNetwork MapPacket Journey

  • DHCP

    also: Dynamic Host Configuration Protocol

    DHCP hands out a lease -- an address held for a bounded time and then renewed. It is why plugging a laptop into an unfamiliar network works with no configuration at all, and why the address it gets is not stable across networks or even across days.

    Taught inAddresses, subnets, and the default gateway

    Watch it runNetwork Map

  • DNS

    also: Domain Name System

    No single machine holds the mapping. The namespace is a tree cut into zones, each delegated to somebody, and an answer is found by walking down from the root. Almost every lookup in practice is answered from a cache rather than by walking anything.

    Taught inHow a name is resolvedFrom a URL to pixels

    Watch it runDNS ExplorerInternet Simulator

  • DNSSEC

    DNSSEC authenticates, it does not encrypt: a signed answer is still readable by anyone on the path. Trust is chained from a root key the resolver already holds, down through a DS record in each parent zone to the DNSKEY in each child.

    Taught inDNSSEC and the chain of trust

    Watch it runDNS Explorer

  • domain name

    also: domain names, hostname, hostnames

    A domain name is for people. Computers need a number, an IP address, before they can send anything, so a visit to a named site starts with a lookup that turns the name into that number. DNS is the system that does it.

    Taught inFinding a website's address

    Watch it runDNS ExplorerInternet Simulator

  • encryption

    also: encrypted, encrypt, encrypts, encrypting

    Encrypted data still crosses every network in between, and anyone on the way can copy it. What they copy is unreadable without the secret, which only the two ends hold. It is what keeps passwords and messages private over HTTPS.

    Taught inKeeping it private with HTTPS

    Watch it runHTTPS Explorer

  • ETag

    also: entity tag, validator, validators

    Sent back as If-None-Match, an ETag lets the server answer 304 Not Modified with no body at all. The saving is the body, and it is worth a round trip whenever the body is larger than the request that asked about it.

    Taught inHTTP cachingThe second visit

    Watch it runHTTP Explorer

  • firewall

    also: firewalls

    A stateful firewall remembers connections it allowed out so it can let the replies back in, which is what makes "allow outbound, deny inbound" a workable default. Its value comes almost entirely from where it is placed, not from how many rules it has.

    Taught inFirewalls and segmentation

    Watch it runNetwork MapNetwork Diagnostics

  • forward secrecy

    also: perfect forward secrecy, PFS

    It comes from deriving each session’s keys from a fresh ephemeral exchange rather than from the long-term private key. TLS 1.3 makes it mandatory; TLS 1.2 allowed static RSA key transport, under which one stolen key retroactively opened every recorded session.

    Taught inHandshakes, versions, and resumptionWhat TLS actually does

    Watch it runHTTPS Explorer

  • frame

    also: frames, framing

    Framing is how a receiver knows where one message ends and the next begins on a stream that has no natural boundaries. A WebSocket frame, an HTTP/2 frame and an Ethernet frame are different formats solving exactly this problem at different layers.

    Taught inThe upgrade, and the frames after itHTTP/1.1, HTTP/2, HTTP/3

    Watch it runWebSocket ViewerPacket Journey

  • GraphQL

    One POST replaces several REST round trips and returns no field the client did not ask for. What is given up is everything that came from the method and the URL: HTTP caching, per-resource authorisation, and a request whose cost is obvious before it runs.

    Taught inREST, and what GraphQL changes

    Watch it runAPI Visualizer

  • handshake

    also: handshakes

    TCP’s handshake establishes sequence numbers; TLS’s establishes keys and checks identity. Each one costs at least a round trip, which is why nearly every protocol optimisation of the last decade has been about removing one.

    Taught inWhat TLS actually doesTCP and UDP: two ways to use a network

    Watch it runHTTPS ExplorerPacket JourneyWebSocket Viewer

  • head-of-line blocking

    also: HOL blocking, head of line blocking

    HTTP/1.1 has it in the request queue; HTTP/2 removes that but inherits a worse one from TCP, which will not deliver later bytes until a lost earlier segment is retransmitted. Only HTTP/3 escapes it, because QUIC tracks loss per stream.

    Taught inHTTP/1.1, HTTP/2, HTTP/3Why pages feel slow

    Watch it runHTTP Explorer

  • hop

    also: hops

    Path length is counted in hops because that is what a packet actually experiences. Each hop is a fresh forwarding decision, a fresh queue, and one decrement of the TTL that stops a looping packet from circulating forever.

    Taught inWhat a network actually is

    Watch it runPacket JourneyNetwork Diagnostics

  • host

    also: hosts

    Your laptop is a host; so is the server it fetches a page from. The distinction that matters is against a router, which forwards packets addressed to other machines and is not an endpoint of the conversation.

    Taught inWhat a network actually is

    Watch it runNetwork Map

  • HTTP

    also: Hypertext Transfer Protocol

    HTTP is stateless by design -- each request is complete on its own, which is what lets caches and proxies reason about one without tracking a conversation. HTTP/1.1, /2 and /3 share these semantics exactly and differ only in how the bytes are framed.

    Taught inThe anatomy of an HTTP messageHTTP/1.1, HTTP/2, HTTP/3

    Watch it runHTTP ExplorerAPI Visualizer

  • HTTP request

    also: request, requests, HTTP requests

    A request works like a written order. It names what is wanted, with a method such as GET and a path such as /index.html, and adds notes called headers, such as which site it is for. The server sends back a response.

    Taught inAsking for the page

    Watch it runHTTP ExplorerInternet Simulator

  • HTTP response

    also: response, responses, HTTP responses

    A response works like the reply to a written order. It opens with a status code that says how it went, adds headers that describe what follows, and then carries the thing that was asked for, such as the page itself.

    Taught inAsking for the page

    Watch it runHTTP ExplorerInternet Simulator

  • HTTPS

    also: Hypertext Transfer Protocol Secure

    HTTPS is the same HTTP requests and responses, carried inside TLS. The browser checks the site’s certificate before it sends anything, and everything after that is encrypted. The padlock beside the web address means the page came over HTTPS.

    Taught inKeeping it private with HTTPSWhat happens when you open a website?

    Watch it runHTTPS ExplorerInternet Simulator

  • idempotent

    also: idempotency, idempotence

    Idempotency is about the resulting state, not the response: a DELETE that answers 404 the second time is still idempotent. It is the property that makes a retry safe, which is why GET, PUT and DELETE may be retried automatically and POST may not.

    Taught inREST, and what GraphQL changesWebhooks: when the API calls you

    Watch it runAPI VisualizerHTTP Explorer

  • internet

    also: the internet

    Nobody owns the internet as a whole. Homes, schools, companies and internet providers each run their own network, and routers pass messages between them. A message to a website usually crosses several of these networks on the way.

    Taught inWhat happens when you open a website?Your devices are on a network

    Watch it runNetwork MapPacket Journey

  • internet service provider

    also: internet provider, internet providers

    Your home router sends everything meant for the internet to your internet service provider, usually shortened to ISP. The ISP’s routers pass it on toward the network it is addressed to, often through other providers on the way.

    Taught inYour devices are on a networkMessages travel in small packets

    Watch it runNetwork MapPacket Journey

  • IP address

    also: IP, IP addresses, address

    An IP address names a location in the network rather than a machine: move a laptop to another network and it gets a different one. That is the difference between an address and a name, and it is the reason DNS exists.

    Taught inWhat a network actually is

    Watch it runNetwork MapDNS Explorer

  • latency

    Latency and bandwidth are independent: a link can be enormously fast and still slow to answer. Distance sets a floor no amount of money removes, which is why the fastest request is the one that is never made.

    Taught inWhat a network actually is

    Watch it runInternet SimulatorNetwork Diagnostics

  • load balancer

    also: load balancers, load balancing

    A layer-4 balancer forwards TCP connections without reading them; a layer-7 balancer terminates the connection, reads the HTTP request and can route on its contents. Health checks are the half people forget, and they are what turns a crashed server into a non-event.

    Taught inLoad balancers and reverse proxies

    Watch it runNetwork Map

  • MTU

    also: maximum transmission unit

    A packet larger than the MTU of the next link must be fragmented or dropped. Path MTU discovery finds the smallest MTU along a route by sending packets marked Don’t Fragment and reading the ICMP errors that come back.

    Taught inTCP and UDP: two ways to use a network

    Watch it runPacket Journey

  • NAT

    also: NAPT, network address translation

    The router keeps a table mapping each inside address and port to a port of its own, rewrites outgoing packets, and reverses the rewrite on the way back. It is what lets a household of a dozen devices exist behind one IPv4 address, and it is also why an unsolicited inbound connection has nowhere to go.

    Taught inNAT and private addressesAddresses, subnets, and the default gateway

    Watch it runNetwork MapPacket Journey

  • network

    also: networks

    A network can be as small as a laptop and a phone sharing one home router, or as large as a company with thousands of machines. What makes it a network is that every device on it can reach the others, and they agree on how to talk.

    Taught inYour devices are on a network

    Watch it runNetwork Map

  • NXDOMAIN

    also: negative caching

    Only an authoritative server can say it, and the SOA record it comes with is what tells resolvers how long they may remember the "no". Without negative caching, every typo in the world would walk the tree from the root every time.

    Taught inCaching, TTLs, and saying noWhen a page load fails

    Watch it runDNS ExplorerNetwork Diagnostics

  • OAuth

    also: OAuth 2.0, PKCE

    The password is typed into the authorization server and nowhere else; the application receives a code through the browser and exchanges it, out of band, for a token. PKCE binds that exchange to the client that started it, so a stolen code is worthless.

    Taught inAPI authentication

    Watch it runAPI Visualizer

  • origin

    also: origins, same-origin

    Two pages share an origin only if all three parts match, so https://example.com and http://example.com are different origins, as are example.com and api.example.com. Almost every rule the browser enforces about who may read what is expressed in these terms.

    Taught inOrigins, CORS, and the preflight

    Watch it runHTTP ExplorerAPI Visualizer

  • packet

    also: packets

    Networks move packets rather than whole files because a shared link has to be shared. Splitting data into bounded chunks lets many conversations interleave on one wire, lets a lost chunk be resent on its own, and lets each chunk be routed independently.

    Taught inWhat a network actually is

    Watch it runPacket JourneyNetwork Map

  • payload

    The payload of one layer is the entire packet of the next, headers and all. That nesting is what lets HTTP travel over TCP over IP without any of the three knowing much about the others.

    Taught inWhat a network actually is

    Watch it runPacket Journey

  • peering

    also: peer, transit

    Peering is why a CDN edge is one hop away and a server on another continent is fifteen. The economics decide the topology: networks peer where the traffic is mutual and buy transit where it is not.

    Taught inRouting: how a packet finds its wayCDNs and the edge

    Watch it runNetwork Map

  • port

    also: ports, port number

    An address gets a packet to the right machine; a port gets it to the right program. Ports are a transport-layer idea, which is why TCP and UDP each have their own independent set of them and why NAT can only work for protocols that have them.

    Taught inTCP and UDP: two ways to use a networkNAT and private addresses

    Watch it runPacket JourneyNetwork Map

  • protocol

    also: protocols

    A protocol fixes what a message looks like on the wire and what each side is allowed to send next. It is the reason a browser written by one company can talk to a server written by another with no prior arrangement. Almost everything in this product is a protocol being taken apart.

    Taught inWhat a network actually is

    Watch it runPacket JourneyInternet Simulator

  • rate limit

    also: rate limiting, rate limits, token bucket

    The usual implementation is a token bucket: a level and a timestamp, recomputed on arrival, with capacity setting the burst and the refill rate setting the sustained limit. A 429 owes the client a Retry-After, which turns a refusal into an instruction.

    Taught inPagination and rate limits

    Watch it runAPI VisualizerNetwork Diagnostics

  • redirect

    also: redirects, redirection

    Each redirect is a whole extra round trip before anything useful is served, and a chain costs one per hop. The codes differ mainly on whether a POST survives the jump: 301 and 302 have browsers rewrite it to GET, 307 and 308 do not, and 303 does so deliberately.

    Taught inStatus codes and redirects

    Watch it runHTTP Explorer

  • resolver

    also: resolvers, recursive resolver, stub resolver

    Your machine asks one question and waits; the resolver asks as many as it takes -- root, then TLD, then authoritative -- and caches every answer it gets. Everything that makes DNS fast, and everything that makes it a privacy question, lives at the resolver.

    Taught inHow a name is resolvedCaching, TTLs, and saying no

    Watch it runDNS ExplorerNetwork Diagnostics

  • REST

    also: RESTful

    Putting the verb in the method rather than the path is what lets every cache and proxy on the way reason about a request without understanding the application. The cost is that the response shape is fixed by the server, which is the itch GraphQL was invented to scratch.

    Taught inREST, and what GraphQL changes

    Watch it runAPI Visualizer

  • reverse proxy

    also: reverse proxies

    The client believes it is talking to the site; the application behind it never sees the raw Internet. It is the natural place to terminate TLS, apply caching, compress, rate-limit and rewrite -- which is why it usually ends up doing all five.

    Taught inLoad balancers and reverse proxies

    Watch it runNetwork MapInternet Simulator

  • round trip

    also: round trips, RTT, round-trip time

    A page load is dozens of dependent round trips, not one transfer, which is why distance dominates and why every handshake optimisation of the last decade has been about removing one. Bandwidth changes how long a big body takes; nothing changes how long a round trip takes but being closer.

    Taught inWhy pages feel slowHandshakes, versions, and resumption

    Watch it runInternet SimulatorHTTPS Explorer

  • router

    also: routers

    A router makes one decision per packet, using only the destination address and its own table: which way next. It has no memory of the conversation and no view of the whole path, which is exactly why the Internet scales.

    Taught inWhat a network actually is

    Watch it runNetwork MapPacket Journey

  • server

    also: servers, web server, web servers

    A server is an ordinary computer whose job is to answer. A website lives on one or more servers, and your browser asks them for each page. Other servers answer other questions, such as which number a website name belongs to.

    Taught inWhat happens when you open a website?Asking for the page

    Watch it runInternet SimulatorHTTP Explorer

  • Server-Sent Events

    also: SSE, EventSource

    SSE gives up sending anything back, and in exchange gets automatic reconnection and event replay via Last-Event-ID for free. For notifications, tickers and progress -- anything where the traffic is genuinely one-directional -- it is less machinery than a WebSocket for the same result.

    Taught inChoosing a real-time transport

    Watch it runWebSocket Viewer

  • session

    also: sessions, session cookie

    The cookie usually holds nothing but a random id; everything real about the session lives on the server, where it can be revoked. That indirection is what makes logging out mean something, and what makes a stolen cookie a bounded rather than permanent problem.

    Taught inCookies and sessionsAPI authentication

    Watch it runHTTP ExplorerAPI Visualizer

  • status code

    also: status codes

    1xx is informational, 2xx succeeded, 3xx wants you to go elsewhere, 4xx blames the request and 5xx blames the server. A client that understands only the first digit still behaves correctly, which is exactly why the range is grouped that way.

    Taught inStatus codes and redirectsREST, and what GraphQL changes

    Watch it runHTTP ExplorerAPI Visualizer

  • subnet

    also: subnets, subnet mask, netmask, prefix length

    The subnet mask is the only thing a host uses to decide whether a destination is reachable directly or has to go through the router. Everything inside the prefix is a neighbour on the same link; everything outside it is somebody else’s problem, handed to the default gateway.

    Taught inAddresses, subnets, and the default gatewayFirewalls and segmentation

    Watch it runNetwork Map

  • switch

    also: switches, network switch

    A switch works like a building’s internal mail room: it delivers between the devices on one network. It never sends anything on to another network. That is a router’s job.

    Taught inYour devices are on a network

    Watch it runNetwork Map

  • TCP

    also: Transmission Control Protocol

    TCP numbers every byte, acknowledges what arrived, retransmits what did not, and delivers to the application strictly in order. All of that is built on top of IP, which promises none of it -- and all of it costs a handshake before the first byte of data.

    Taught inTCP and UDP: two ways to use a networkFrom a URL to pixels

    Watch it runPacket JourneyInternet Simulator

  • TLS

    also: SSL, SSL/TLS, Transport Layer Security

    TLS gives three things and they are separable: confidentiality so nobody can read the traffic, integrity so nobody can alter it undetected, and authentication of the server’s identity. HTTPS is exactly HTTP carried inside it -- the semantics do not change at all.

    Taught inWhat TLS actually doesFrom a URL to pixels

    Watch it runHTTPS ExplorerInternet Simulator

  • TTL

    also: time to live

    In an IPv4 header the TTL is a hop counter every router decrements, and a packet that reaches zero is dropped: that is what stops a routing loop from circulating forever. In DNS the same three letters mean a duration in seconds, and are what makes caching safe.

    Taught inRouting: how a packet finds its wayCaching, TTLs, and saying no

    Watch it runPacket JourneyDNS Explorer

  • UDP

    also: User Datagram Protocol, datagram, datagrams

    Eight bytes of header, no connection, no acknowledgement, no ordering and no retransmission. That is a feature when an application would rather handle loss itself -- a DNS lookup simply asks again, and a lost video frame is better skipped than delivered late.

    Taught inTCP and UDP: two ways to use a networkHow a name is resolved

    Watch it runPacket JourneyDNS Explorer

  • VLAN

    also: VLANs, 802.1Q

    A VLAN tag on each frame keeps the groups apart on shared cabling, so traffic between them has to leave through a layer-3 device. That forced detour is the point: it gives the firewall somewhere to stand.

    Taught inFirewalls and segmentation

    Watch it runNetwork Map

  • web address

    also: web addresses

    A web address says three things: how to talk to the site (https), which site it is (the domain name, such as www.example.com), and which page on that site you want (the part after the name). URL stands for Uniform Resource Locator.

    Taught inWhat happens when you open a website?

    Watch it runInternet SimulatorHTTP Explorer

  • webhook

    also: webhooks

    The roles reverse -- your endpoint becomes the server, and it must be public, fast, signature-checking and idempotent. Delivery is at-least-once in practice, because a timeout and a lost reply are indistinguishable to the sender.

    Taught inWebhooks: when the API calls you

    Watch it runAPI Visualizer

  • WebSocket

    also: WebSockets

    The upgrade handshake is an ordinary GET on port 443, which is exactly why WebSockets pass through infrastructure that has never heard of them. After the 101 there is no request/response pairing at all -- two independent streams of frames sharing one socket.

    Taught inThe upgrade, and the frames after itChoosing a real-time transport

    Watch it runWebSocket Viewer

  • Wi-Fi

    also: WiFi, wireless network

    Wi-Fi carries the same messages a cable would, over radio. Devices on one Wi-Fi channel take turns to send, which is why a wireless link is usually slower than a cable into the same router.

    Taught inYour devices are on a network

    Watch it runNetwork Map

  • zone

    also: zones, zone cut

    A zone is not the same as a domain: example.com and shop.example.com may be one zone or two, depending on whether a delegation was made between them. Every place the tree changes hands is a zone cut, and every zone cut is where a referral happens.

    Taught inRecords, aliases, and delegationDNSSEC and the chain of trust

    Watch it runDNS Explorer