Computer Networks
From the wire to the browser: the layered models, subnetting arithmetic, TCP's reliability machinery, routing, DNS and HTTPS — with the numbers examiners ask you to compute.
If you remember nothing else
- OSI has seven layers and is a reference model; TCP/IP has four (or five) and is what actually runs.
- TCP is connection-oriented, reliable, ordered and flow-controlled; UDP is none of those, which is exactly why it is faster.
- The three-way handshake is SYN, SYN-ACK, ACK — it exists to synchronise sequence numbers in both directions, not merely to say hello.
- A /24 network has 256 addresses but only 254 usable hosts — the first is the network address and the last is broadcast.
- ARP maps an IP address to a MAC address within one broadcast domain; DNS maps a name to an IP address across the internet.
- Congestion control responds to the state of the network; flow control responds to the state of the receiver. Different problems, different mechanisms.
The layered models
Layering exists so that each level solves one problem and depends only on the service beneath it. A change of physical medium does not disturb TCP; a change of application protocol does not disturb routing.
| OSI layer | Job | Data unit | TCP/IP layer | Examples |
|---|---|---|---|---|
| 7 Application | Network services to the user | Data | Application | HTTP, FTP, SMTP, DNS |
| 6 Presentation | Translation, encryption, compression | Data | Application | TLS, JPEG, ASCII |
| 5 Session | Establish, manage and end sessions | Data | Application | NetBIOS, RPC |
| 4 Transport | End-to-end delivery, reliability, ports | Segment (TCP) / Datagram (UDP) | Transport | TCP, UDP |
| 3 Network | Logical addressing and routing between networks | Packet | Internet | IP, ICMP, OSPF |
| 2 Data Link | Framing and hop-to-hop delivery on one link | Frame | Network Access | Ethernet, PPP, ARP* |
| 1 Physical | Bits onto a medium | Bit | Network Access | Cables, hubs, repeaters |
*ARP straddles layers 2 and 3 — it carries an IP address inside a link-layer frame. Examiners accept either placement if you explain why.
The data link layer
The data link layer moves frames across a single link and detects (sometimes corrects) transmission errors. It splits into two sublayers: LLC for flow and error control, and MAC for deciding who transmits when.
| Error technique | Detects | Cost | Used in |
|---|---|---|---|
| Parity bit | Any odd number of bit errors | 1 bit | Memory, simple serial links |
| Checksum | Most errors; weak against reordering | 16 bits | IP, TCP, UDP headers |
| CRC | All burst errors up to the polynomial degree | 16–32 bits | Ethernet, Wi-Fi, storage |
| Hamming code | Detects 2-bit, corrects 1-bit errors | bits where | ECC memory |
Media access control
- CSMA/CD (Ethernet, historically) — listen before sending; if a collision is detected, stop, jam, and back off for a random interval that doubles after each collision (binary exponential backoff). Obsolete on modern switched full-duplex Ethernet, where collisions cannot occur.
- CSMA/CA (Wi-Fi) — collisions cannot be detected on a radio (a station cannot transmit and listen at once), so 802.11 avoids them instead: wait a random backoff before transmitting, and optionally exchange RTS/CTS to handle the hidden-terminal problem.
- Token passing — a token circulates; only its holder may transmit. Deterministic, so it bounds worst-case latency, which is why it survived in industrial networks.
IP addressing and subnetting
| Class | First octet | Default mask | Networks | Hosts per network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | — | Multicast | — |
| E | 240–255 | — | Reserved / experimental | — |
127.x.x.x is loopback and is why class A stops at 126. Classful addressing is obsolete — CIDR replaced it — but it remains examinable.
Given: 192.168.10.0/24, split into 4 equal subnets.
Need 4 subnets -> borrow 2 host bits (2^2 = 4). New prefix: /26
Block size = 256 - 192 = 64 (mask 255.255.255.192)
Subnet Network Usable range Broadcast
1 192.168.10.0 192.168.10.1 - 192.168.10.62 192.168.10.63
2 192.168.10.64 192.168.10.65 - 192.168.10.126 192.168.10.127
3 192.168.10.128 192.168.10.129 - 192.168.10.190 192.168.10.191
4 192.168.10.192 192.168.10.193 - 192.168.10.254 192.168.10.255
Each: 64 total addresses, 62 usable hosts (64 - 2).
Reverse question - which subnet is 192.168.10.100 in?
100 / 64 = 1 remainder 36 -> subnet starting at 64 -> subnet 2.| Private range | Prefix | Size |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | One class A |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 16 class B blocks |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 256 class C blocks |
| IPv4 | IPv6 | |
|---|---|---|
| Address size | 32 bits | 128 bits |
| Notation | Dotted decimal, 192.168.1.1 | Hex colon groups, 2001:db8::1 |
| Header | Variable length, 20–60 bytes | Fixed 40 bytes — faster to process |
| Checksum in header | Yes | No — left to layers 2 and 4 |
| Fragmentation | Routers or sender | Sender only |
| Configuration | Manual or DHCP | Also stateless autoconfiguration (SLAAC) |
| Broadcast | Yes | No — replaced by multicast and anycast |
Routing
| Distance vector | Link state | |
|---|---|---|
| Each router knows | Distance to every destination, via neighbours | The full topology of the network |
| Shares | Its whole table, with neighbours only | Its link states, flooded to everyone |
| Algorithm | Bellman-Ford | Dijkstra |
| Convergence | Slow; count-to-infinity problem | Fast |
| Resource use | Low CPU, low memory | Higher CPU and memory |
| Protocols | RIP, IGRP | OSPF, IS-IS |
- Interior gateway protocols (RIP, OSPF, EIGRP) route within one autonomous system and optimise for shortest path.
- BGP is the exterior protocol routing between autonomous systems. It is a path-vector protocol and optimises for policy — business relationships between providers — rather than for hop count.
- Longest prefix match decides forwarding: given routes for 10.0.0.0/8 and 10.1.0.0/16, a packet for 10.1.2.3 takes the /16, because the more specific route wins.
- TTL (hop limit) decrements at every router; at zero the packet is discarded and an ICMP Time Exceeded returned. This both kills routing loops and is the mechanism
tracerouteexploits.
| Device | Layer | Forwards on | Collision domains | Broadcast domains |
|---|---|---|---|---|
| Hub | 1 Physical | Nothing — repeats to all ports | One (shared) | One |
| Switch | 2 Data link | MAC address | One per port | One (unless VLANs) |
| Router | 3 Network | IP address | One per port | One per port |
| Gateway | Up to 7 | Protocol translation | — | — |
The examinable line: a switch segments collision domains, a router segments broadcast domains.
The transport layer: TCP and UDP
| TCP | UDP | |
|---|---|---|
| Connection | Connection-oriented (handshake first) | Connectionless — just send |
| Reliability | Guaranteed delivery, retransmits losses | Best effort; losses are not detected |
| Ordering | Reassembles in order | None — datagrams may arrive out of order |
| Flow control | Yes — sliding window | No |
| Congestion control | Yes | No |
| Header size | 20–60 bytes | 8 bytes |
| Speed | Slower — acknowledgements and handshakes | Faster |
| Transmission | Byte stream | Discrete datagrams, boundaries preserved |
| Used by | HTTP, HTTPS, FTP, SMTP, SSH | DNS, DHCP, VoIP, video streaming, online games |
The three-way handshake
SYN
The client sends a segment with the SYN flag set and its initial sequence number x. The client is now in SYN-SENT.SYN-ACK
The server replies with SYN set, its own initial sequence number y, and ACK = x+1. The server is now in SYN-RECEIVED.ACK
The client sends ACK = y+1. Both sides are ESTABLISHED, and both now know the other's starting sequence number.
Teardown takes four messages, because TCP connections are full duplex and each direction closes independently: FIN from the initiator, ACK from the peer, FIN from the peer once it has finished sending, and a final ACK. The closer then waits in TIME_WAIT for twice the maximum segment lifetime, so that stray duplicates from this connection cannot be mistaken for data on a new connection reusing the same port pair.
Flow control and congestion control
TCP's sender is limited by the smaller of the two: .
Sliding window and ARQ
| Protocol | On a lost frame | Receiver buffer | Efficiency |
|---|---|---|---|
| Stop-and-wait | Retransmit the one frame | None | Very poor on long links — one frame in flight |
| Go-Back-N | Retransmit that frame and all after it | None — discards out-of-order frames | Simple receiver, wasteful sender |
| Selective Repeat | Retransmit only the lost frame | Buffers out-of-order frames | Efficient; more complex, needs window ≤ half the sequence space |
Congestion control phases
Slow start
The congestion window starts at 1 MSS and doubles every RTT — exponential growth despite the name — until it reaches the slow-start threshold.Congestion avoidance
Past the threshold, the window grows by roughly 1 MSS per RTT — linear (additive increase), because the network is now near capacity.Fast retransmit
Three duplicate ACKs signal a lost segment without waiting for a timeout. Retransmit it immediately.Fast recovery
After a fast retransmit, halve the window rather than dropping to 1 (multiplicative decrease) — three duplicate ACKs prove packets are still flowing, so the network is congested, not broken.
The application layer
DNS
DNS resolves a hostname to an IP address through a hierarchy: root servers, then top-level domain servers (.com), then the authoritative server for the domain. A recursive resolver does this walking on the client's behalf and caches the result for the record's TTL. It runs over UDP port 53 for speed, falling back to TCP when a response exceeds 512 bytes or for zone transfers.
| Record | Maps | Example |
|---|---|---|
| A | Name → IPv4 address | example.com → 93.184.216.34 |
| AAAA | Name → IPv6 address | example.com → 2606:2800:220:: |
| CNAME | Name → another name (alias) | www.example.com → example.com |
| MX | Domain → mail server | example.com → mail.example.com |
| NS | Domain → authoritative name server | example.com → ns1.example.com |
| PTR | IP → name (reverse lookup) | Used in spam filtering |
HTTP
| Method | Purpose | Safe? | Idempotent? |
|---|---|---|---|
| GET | Retrieve a resource | Yes | Yes |
| POST | Submit data; create a subordinate resource | No | No |
| PUT | Replace a resource entirely | No | Yes |
| PATCH | Partially modify a resource | No | Not necessarily |
| DELETE | Remove a resource | No | Yes |
| HEAD | GET without the body | Yes | Yes |
Safe means it does not change server state. Idempotent means N identical requests have the same effect as one — which is why a failed PUT can be retried safely and a failed POST cannot.
| Status class | Meaning | Common codes |
|---|---|---|
| 1xx | Informational | 100 Continue, 101 Switching Protocols |
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirection | 301 Moved Permanently, 302 Found, 304 Not Modified |
| 4xx | Client error | 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found |
| 5xx | Server error | 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable |
Self-check
12 questions on Computer Networks · nothing is stored