Computer Networks

From the wire to the browser: the layered models, subnetting arithmetic, TCP's reliability machinery, routing, DNS and HTTPS - with the numbers examiners ask you to compute.

If you remember nothing else

OSI has seven layers and is a reference model; TCP/IP has four (or five) and is what actually runs.
TCP is connection-oriented, reliable, ordered and flow-controlled; UDP is none of those, which is exactly why it is faster.
The three-way handshake is SYN, SYN-ACK, ACK - it exists to synchronise sequence numbers in both directions, not merely to say hello.
A /24 network has 256 addresses but only 254 usable hosts - the first is the network address and the last is broadcast.
ARP maps an IP address to a MAC address within one broadcast domain; DNS maps a name to an IP address across the internet.
Congestion control responds to the state of the network; flow control responds to the state of the receiver. Different problems, different mechanisms.

7 chapters

1The layered models
2The data link layer
3IP addressing and subnetting
4Routing
5The transport layer: TCP and UDP
6Flow control and congestion control
7The application layer

The layered models

Layering exists so that each level solves one problem and depends only on the service beneath it. A change of physical medium does not disturb TCP; a change of application protocol does not disturb routing.

OSI layer	Job	Data unit	TCP/IP layer	Examples
7 Application	Network services to the user	Data	Application	HTTP, FTP, SMTP, DNS
6 Presentation	Translation, encryption, compression	Data	Application	TLS, JPEG, ASCII
5 Session	Establish, manage and end sessions	Data	Application	NetBIOS, RPC
4 Transport	End-to-end delivery, reliability, ports	Segment (TCP) / Datagram (UDP)	Transport	TCP, UDP
3 Network	Logical addressing and routing between networks	Packet	Internet	IP, ICMP, OSPF
2 Data Link	Framing and hop-to-hop delivery on one link	Frame	Network Access	Ethernet, PPP, ARP*
1 Physical	Bits onto a medium	Bit	Network Access	Cables, hubs, repeaters

*ARP straddles layers 2 and 3 - it carries an IP address inside a link-layer frame. Examiners accept either placement if you explain why.

The data link layer

The data link layer moves frames across a single link and detects (sometimes corrects) transmission errors. It splits into two sublayers: LLC for flow and error control, and MAC for deciding who transmits when.

Error technique	Detects	Cost	Used in
Parity bit	Any odd number of bit errors	1 bit	Memory, simple serial links
Checksum	Most errors; weak against reordering	16 bits	IP, TCP, UDP headers
CRC	All burst errors up to the polynomial degree	16–32 bits	Ethernet, Wi-Fi, storage
Hamming code	Detects 2-bit, corrects 1-bit errors	$r$ bits where $2^{r} \geq m + r + 1$	ECC memory

Media access control

CSMA/CD (Ethernet, historically) - listen before sending; if a collision is detected, stop, jam, and back off for a random interval that doubles after each collision (binary exponential backoff). Obsolete on modern switched full-duplex Ethernet, where collisions cannot occur.
CSMA/CA (Wi-Fi) - collisions cannot be detected on a radio (a station cannot transmit and listen at once), so 802.11 avoids them instead: wait a random backoff before transmitting, and optionally exchange RTS/CTS to handle the hidden-terminal problem.
Token passing - a token circulates; only its holder may transmit. Deterministic, so it bounds worst-case latency, which is why it survived in industrial networks.

IP addressing and subnetting

Class	First octet	Default mask	Networks	Hosts per network
A	1–126	/8 (255.0.0.0)	126	16,777,214
B	128–191	/16 (255.255.0.0)	16,384	65,534
C	192–223	/24 (255.255.255.0)	2,097,152	254
D	224–239	-	Multicast	-
E	240–255	-	Reserved / experimental	-

127.x.x.x is loopback and is why class A stops at 126. Classful addressing is obsolete - CIDR replaced it - but it remains examinable.

Plain textWorked subnetting - the standard exam question

Given: 192.168.10.0/24, split into 4 equal subnets.

Need 4 subnets -> borrow 2 host bits (2^2 = 4). New prefix: /26
Block size = 256 - 192 = 64      (mask 255.255.255.192)

Subnet   Network         Usable range                    Broadcast
  1      192.168.10.0    192.168.10.1   - 192.168.10.62  192.168.10.63
  2      192.168.10.64   192.168.10.65  - 192.168.10.126 192.168.10.127
  3      192.168.10.128  192.168.10.129 - 192.168.10.190 192.168.10.191
  4      192.168.10.192  192.168.10.193 - 192.168.10.254 192.168.10.255

Each: 64 total addresses, 62 usable hosts (64 - 2).

Reverse question - which subnet is 192.168.10.100 in?
  100 / 64 = 1 remainder 36  ->  subnet starting at 64  ->  subnet 2.

Private range	Prefix	Size
10.0.0.0 – 10.255.255.255	10.0.0.0/8	One class A
172.16.0.0 – 172.31.255.255	172.16.0.0/12	16 class B blocks
192.168.0.0 – 192.168.255.255	192.168.0.0/16	256 class C blocks

	IPv4	IPv6
Address size	32 bits	128 bits
Notation	Dotted decimal, 192.168.1.1	Hex colon groups, 2001:db8::1
Header	Variable length, 20–60 bytes	Fixed 40 bytes - faster to process
Checksum in header	Yes	No - left to layers 2 and 4
Fragmentation	Routers or sender	Sender only
Configuration	Manual or DHCP	Also stateless autoconfiguration (SLAAC)
Broadcast	Yes	No - replaced by multicast and anycast

Routing

	Distance vector	Link state
Each router knows	Distance to every destination, via neighbours	The full topology of the network
Shares	Its whole table, with neighbours only	Its link states, flooded to everyone
Algorithm	Bellman-Ford	Dijkstra
Convergence	Slow; count-to-infinity problem	Fast
Resource use	Low CPU, low memory	Higher CPU and memory
Protocols	RIP, IGRP	OSPF, IS-IS

Interior gateway protocols (RIP, OSPF, EIGRP) route within one autonomous system and optimise for shortest path.
BGP is the exterior protocol routing between autonomous systems. It is a path-vector protocol and optimises for policy - business relationships between providers - rather than for hop count.
Longest prefix match decides forwarding: given routes for 10.0.0.0/8 and 10.1.0.0/16, a packet for 10.1.2.3 takes the /16, because the more specific route wins.
TTL (hop limit) decrements at every router; at zero the packet is discarded and an ICMP Time Exceeded returned. This both kills routing loops and is the mechanism traceroute exploits.

Device	Layer	Forwards on	Collision domains	Broadcast domains
Hub	1 Physical	Nothing - repeats to all ports	One (shared)	One
Switch	2 Data link	MAC address	One per port	One (unless VLANs)
Router	3 Network	IP address	One per port	One per port
Gateway	Up to 7	Protocol translation	-	-

The examinable line: a switch segments collision domains, a router segments broadcast domains.

The transport layer: TCP and UDP

	TCP	UDP
Connection	Connection-oriented (handshake first)	Connectionless - just send
Reliability	Guaranteed delivery, retransmits losses	Best effort; losses are not detected
Ordering	Reassembles in order	None - datagrams may arrive out of order
Flow control	Yes - sliding window	No
Congestion control	Yes	No
Header size	20–60 bytes	8 bytes
Speed	Slower - acknowledgements and handshakes	Faster
Transmission	Byte stream	Discrete datagrams, boundaries preserved
Used by	HTTP, HTTPS, FTP, SMTP, SSH	DNS, DHCP, VoIP, video streaming, online games

The three-way handshake

SYN
The client sends a segment with the SYN flag set and its initial sequence number x. The client is now in SYN-SENT.
SYN-ACK
The server replies with SYN set, its own initial sequence number y, and ACK = x+1. The server is now in SYN-RECEIVED.
ACK
The client sends ACK = y+1. Both sides are ESTABLISHED, and both now know the other's starting sequence number.

Teardown takes four messages, because TCP connections are full duplex and each direction closes independently: FIN from the initiator, ACK from the peer, FIN from the peer once it has finished sending, and a final ACK. The closer then waits in TIME_WAIT for twice the maximum segment lifetime, so that stray duplicates from this connection cannot be mistaken for data on a new connection reusing the same port pair.

Flow control and congestion control

TCP's sender is limited by the smaller of the two: $effective window = min (receiver window, congestion window)$ .

Sliding window and ARQ

Protocol	On a lost frame	Receiver buffer	Efficiency
Stop-and-wait	Retransmit the one frame	None	Very poor on long links - one frame in flight
Go-Back-N	Retransmit that frame and all after it	None - discards out-of-order frames	Simple receiver, wasteful sender
Selective Repeat	Retransmit only the lost frame	Buffers out-of-order frames	Efficient; more complex, needs window ≤ half the sequence space

Congestion control phases

Slow start
The congestion window starts at 1 MSS and doubles every RTT - exponential growth despite the name - until it reaches the slow-start threshold.
Congestion avoidance
Past the threshold, the window grows by roughly 1 MSS per RTT - linear (additive increase), because the network is now near capacity.
Fast retransmit
Three duplicate ACKs signal a lost segment without waiting for a timeout. Retransmit it immediately.
Fast recovery
After a fast retransmit, halve the window rather than dropping to 1 (multiplicative decrease) - three duplicate ACKs prove packets are still flowing, so the network is congested, not broken.

The application layer

DNS

DNS resolves a hostname to an IP address through a hierarchy: root servers, then top-level domain servers (.com), then the authoritative server for the domain. A recursive resolver does this walking on the client's behalf and caches the result for the record's TTL. It runs over UDP port 53 for speed, falling back to TCP when a response exceeds 512 bytes or for zone transfers.

Record	Maps	Example
A	Name → IPv4 address	example.com → 93.184.216.34
AAAA	Name → IPv6 address	example.com → 2606:2800:220::
CNAME	Name → another name (alias)	www.example.com → example.com
MX	Domain → mail server	example.com → mail.example.com
NS	Domain → authoritative name server	example.com → ns1.example.com
PTR	IP → name (reverse lookup)	Used in spam filtering

HTTP

Method	Purpose	Safe?	Idempotent?
GET	Retrieve a resource	Yes	Yes
POST	Submit data; create a subordinate resource	No	No
PUT	Replace a resource entirely	No	Yes
PATCH	Partially modify a resource	No	Not necessarily
DELETE	Remove a resource	No	Yes
HEAD	GET without the body	Yes	Yes

Safe means it does not change server state. Idempotent means N identical requests have the same effect as one - which is why a failed PUT can be retried safely and a failed POST cannot.

Status class	Meaning	Common codes
1xx	Informational	100 Continue, 101 Switching Protocols
2xx	Success	200 OK, 201 Created, 204 No Content
3xx	Redirection	301 Moved Permanently, 302 Found, 304 Not Modified
4xx	Client error	400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found
5xx	Server error	500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable

Computer Networks

From the wire to the browser: the layered models, subnetting arithmetic, TCP's reliability machinery, routing, DNS and HTTPS - with the numbers examiners ask you to compute.

If you remember nothing else

OSI has seven layers and is a reference model; TCP/IP has four (or five) and is what actually runs.
TCP is connection-oriented, reliable, ordered and flow-controlled; UDP is none of those, which is exactly why it is faster.
The three-way handshake is SYN, SYN-ACK, ACK - it exists to synchronise sequence numbers in both directions, not merely to say hello.
A /24 network has 256 addresses but only 254 usable hosts - the first is the network address and the last is broadcast.
ARP maps an IP address to a MAC address within one broadcast domain; DNS maps a name to an IP address across the internet.
Congestion control responds to the state of the network; flow control responds to the state of the receiver. Different problems, different mechanisms.

7 chapters

1The layered models
2The data link layer
3IP addressing and subnetting
4Routing
5The transport layer: TCP and UDP
6Flow control and congestion control
7The application layer

The layered models

OSI layer	Job	Data unit	TCP/IP layer	Examples
7 Application	Network services to the user	Data	Application	HTTP, FTP, SMTP, DNS
6 Presentation	Translation, encryption, compression	Data	Application	TLS, JPEG, ASCII
5 Session	Establish, manage and end sessions	Data	Application	NetBIOS, RPC
4 Transport	End-to-end delivery, reliability, ports	Segment (TCP) / Datagram (UDP)	Transport	TCP, UDP
3 Network	Logical addressing and routing between networks	Packet	Internet	IP, ICMP, OSPF
2 Data Link	Framing and hop-to-hop delivery on one link	Frame	Network Access	Ethernet, PPP, ARP*
1 Physical	Bits onto a medium	Bit	Network Access	Cables, hubs, repeaters

*ARP straddles layers 2 and 3 - it carries an IP address inside a link-layer frame. Examiners accept either placement if you explain why.

The data link layer

Error technique	Detects	Cost	Used in
Parity bit	Any odd number of bit errors	1 bit	Memory, simple serial links
Checksum	Most errors; weak against reordering	16 bits	IP, TCP, UDP headers
CRC	All burst errors up to the polynomial degree	16–32 bits	Ethernet, Wi-Fi, storage
Hamming code	Detects 2-bit, corrects 1-bit errors	$r$ bits where $2^{r} \geq m + r + 1$	ECC memory

Media access control

CSMA/CD (Ethernet, historically) - listen before sending; if a collision is detected, stop, jam, and back off for a random interval that doubles after each collision (binary exponential backoff). Obsolete on modern switched full-duplex Ethernet, where collisions cannot occur.
CSMA/CA (Wi-Fi) - collisions cannot be detected on a radio (a station cannot transmit and listen at once), so 802.11 avoids them instead: wait a random backoff before transmitting, and optionally exchange RTS/CTS to handle the hidden-terminal problem.
Token passing - a token circulates; only its holder may transmit. Deterministic, so it bounds worst-case latency, which is why it survived in industrial networks.

IP addressing and subnetting

Class	First octet	Default mask	Networks	Hosts per network
A	1–126	/8 (255.0.0.0)	126	16,777,214
B	128–191	/16 (255.255.0.0)	16,384	65,534
C	192–223	/24 (255.255.255.0)	2,097,152	254
D	224–239	-	Multicast	-
E	240–255	-	Reserved / experimental	-

127.x.x.x is loopback and is why class A stops at 126. Classful addressing is obsolete - CIDR replaced it - but it remains examinable.

Plain textWorked subnetting - the standard exam question

Given: 192.168.10.0/24, split into 4 equal subnets.

Need 4 subnets -> borrow 2 host bits (2^2 = 4). New prefix: /26
Block size = 256 - 192 = 64      (mask 255.255.255.192)

Subnet   Network         Usable range                    Broadcast
  1      192.168.10.0    192.168.10.1   - 192.168.10.62  192.168.10.63
  2      192.168.10.64   192.168.10.65  - 192.168.10.126 192.168.10.127
  3      192.168.10.128  192.168.10.129 - 192.168.10.190 192.168.10.191
  4      192.168.10.192  192.168.10.193 - 192.168.10.254 192.168.10.255

Each: 64 total addresses, 62 usable hosts (64 - 2).

Reverse question - which subnet is 192.168.10.100 in?
  100 / 64 = 1 remainder 36  ->  subnet starting at 64  ->  subnet 2.

Private range	Prefix	Size
10.0.0.0 – 10.255.255.255	10.0.0.0/8	One class A
172.16.0.0 – 172.31.255.255	172.16.0.0/12	16 class B blocks
192.168.0.0 – 192.168.255.255	192.168.0.0/16	256 class C blocks

	IPv4	IPv6
Address size	32 bits	128 bits
Notation	Dotted decimal, 192.168.1.1	Hex colon groups, 2001:db8::1
Header	Variable length, 20–60 bytes	Fixed 40 bytes - faster to process
Checksum in header	Yes	No - left to layers 2 and 4
Fragmentation	Routers or sender	Sender only
Configuration	Manual or DHCP	Also stateless autoconfiguration (SLAAC)
Broadcast	Yes	No - replaced by multicast and anycast

Routing

	Distance vector	Link state
Each router knows	Distance to every destination, via neighbours	The full topology of the network
Shares	Its whole table, with neighbours only	Its link states, flooded to everyone
Algorithm	Bellman-Ford	Dijkstra
Convergence	Slow; count-to-infinity problem	Fast
Resource use	Low CPU, low memory	Higher CPU and memory
Protocols	RIP, IGRP	OSPF, IS-IS

Interior gateway protocols (RIP, OSPF, EIGRP) route within one autonomous system and optimise for shortest path.
BGP is the exterior protocol routing between autonomous systems. It is a path-vector protocol and optimises for policy - business relationships between providers - rather than for hop count.
Longest prefix match decides forwarding: given routes for 10.0.0.0/8 and 10.1.0.0/16, a packet for 10.1.2.3 takes the /16, because the more specific route wins.
TTL (hop limit) decrements at every router; at zero the packet is discarded and an ICMP Time Exceeded returned. This both kills routing loops and is the mechanism traceroute exploits.

Device	Layer	Forwards on	Collision domains	Broadcast domains
Hub	1 Physical	Nothing - repeats to all ports	One (shared)	One
Switch	2 Data link	MAC address	One per port	One (unless VLANs)
Router	3 Network	IP address	One per port	One per port
Gateway	Up to 7	Protocol translation	-	-

The examinable line: a switch segments collision domains, a router segments broadcast domains.

The transport layer: TCP and UDP

	TCP	UDP
Connection	Connection-oriented (handshake first)	Connectionless - just send
Reliability	Guaranteed delivery, retransmits losses	Best effort; losses are not detected
Ordering	Reassembles in order	None - datagrams may arrive out of order
Flow control	Yes - sliding window	No
Congestion control	Yes	No
Header size	20–60 bytes	8 bytes
Speed	Slower - acknowledgements and handshakes	Faster
Transmission	Byte stream	Discrete datagrams, boundaries preserved
Used by	HTTP, HTTPS, FTP, SMTP, SSH	DNS, DHCP, VoIP, video streaming, online games

The three-way handshake

SYN
The client sends a segment with the SYN flag set and its initial sequence number x. The client is now in SYN-SENT.
SYN-ACK
The server replies with SYN set, its own initial sequence number y, and ACK = x+1. The server is now in SYN-RECEIVED.
ACK
The client sends ACK = y+1. Both sides are ESTABLISHED, and both now know the other's starting sequence number.

Flow control and congestion control

TCP's sender is limited by the smaller of the two: $effective window = min (receiver window, congestion window)$ .

Sliding window and ARQ

Protocol	On a lost frame	Receiver buffer	Efficiency
Stop-and-wait	Retransmit the one frame	None	Very poor on long links - one frame in flight
Go-Back-N	Retransmit that frame and all after it	None - discards out-of-order frames	Simple receiver, wasteful sender
Selective Repeat	Retransmit only the lost frame	Buffers out-of-order frames	Efficient; more complex, needs window ≤ half the sequence space

Congestion control phases

Slow start
The congestion window starts at 1 MSS and doubles every RTT - exponential growth despite the name - until it reaches the slow-start threshold.
Congestion avoidance
Past the threshold, the window grows by roughly 1 MSS per RTT - linear (additive increase), because the network is now near capacity.
Fast retransmit
Three duplicate ACKs signal a lost segment without waiting for a timeout. Retransmit it immediately.
Fast recovery
After a fast retransmit, halve the window rather than dropping to 1 (multiplicative decrease) - three duplicate ACKs prove packets are still flowing, so the network is congested, not broken.

The application layer

DNS

Record	Maps	Example
A	Name → IPv4 address	example.com → 93.184.216.34
AAAA	Name → IPv6 address	example.com → 2606:2800:220::
CNAME	Name → another name (alias)	www.example.com → example.com
MX	Domain → mail server	example.com → mail.example.com
NS	Domain → authoritative name server	example.com → ns1.example.com
PTR	IP → name (reverse lookup)	Used in spam filtering

HTTP

Method	Purpose	Safe?	Idempotent?
GET	Retrieve a resource	Yes	Yes
POST	Submit data; create a subordinate resource	No	No
PUT	Replace a resource entirely	No	Yes
PATCH	Partially modify a resource	No	Not necessarily
DELETE	Remove a resource	No	Yes
HEAD	GET without the body	Yes	Yes

Safe means it does not change server state. Idempotent means N identical requests have the same effect as one - which is why a failed PUT can be retried safely and a failed POST cannot.

Status class	Meaning	Common codes
1xx	Informational	100 Continue, 101 Switching Protocols
2xx	Success	200 OK, 201 Created, 204 No Content
3xx	Redirection	301 Moved Permanently, 302 Found, 304 Not Modified
4xx	Client error	400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found
5xx	Server error	500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable

Computer Networks

If you remember nothing else

The layered models

The data link layer

Media access control

IP addressing and subnetting

Routing

The transport layer: TCP and UDP

The three-way handshake

Flow control and congestion control

Sliding window and ARQ

Congestion control phases

The application layer

DNS

HTTP

Self-check

Computer Networks

If you remember nothing else

The layered models

The data link layer

Media access control

IP addressing and subnetting

Routing

The transport layer: TCP and UDP

The three-way handshake

Flow control and congestion control

Sliding window and ARQ

Congestion control phases

The application layer

DNS

HTTP

Self-check

Computer Networks

If you remember nothing else

1The layered models

2The data link layer

Media access control

3IP addressing and subnetting

4Routing

5The transport layer: TCP and UDP

The three-way handshake

6Flow control and congestion control

Sliding window and ARQ

Congestion control phases

7The application layer

DNS

HTTP

Computer Networks

If you remember nothing else

1The layered models

2The data link layer

Media access control

3IP addressing and subnetting

4Routing

5The transport layer: TCP and UDP

The three-way handshake

6Flow control and congestion control

Sliding window and ARQ

Congestion control phases

7The application layer

DNS

HTTP

The layered models

The data link layer

IP addressing and subnetting

Routing

The transport layer: TCP and UDP

Flow control and congestion control

The application layer

The layered models

The data link layer

IP addressing and subnetting

Routing

The transport layer: TCP and UDP

Flow control and congestion control

The application layer