Networks
Pages in this section
- Access control list (ACL) filtersLast edited: 2026-02-05Access control list (ACL) filters
Access Control List filters are deployed by ISPs or IXPs at their AS border routers to filter out unwanted traffic. These filters, whose implementation depends on vendor-specific hardware, are effective when the hardware is homogeneous, and the deployment of the filters can be automated. The drawbacks of these filters include limited scalability, and since the filtering does not occur at the ingress points, it can exhaust the bandwidth to a neighbouring AS.
- Additive Increase Multiplicative Decrease (AIMD)
Last edited: 2026-02-05Additive Increase Multiplicative Decrease (AIMD)This is a method of probe-and-adjust that some TCP implementations use.
- Address Resolution Protocol (ARP)
Last edited: 2026-02-05Address Resolution Protocol (ARP)This protocol is used to update a nodes ARP cache within a network . When this node needs to send packet to a address within its network (as identified by the network mask ) but that entry is missing from the ARP cache it does the following.
- Angur
Last edited: 2026-02-05AngurThis is a system that monitors for censorship through connectivity disruptions. It uses two internet protocols:
- ARP cache
Last edited: 2026-02-05ARP CacheThe ARP cache of a node in a network is a mapping from IP addresses within the same network to their MAC address . A node can identify a IP address within its network using the network mask . This gets updated using the Address Resolution Protocol (ARP) .
- ARTEMIS
Last edited: 2026-02-05ARTEMISARTEMIS is a system designed to detect and mitigate BGP Hijacking , operated locally by network operators to protect their own prefixes. The system is based on several key ideas and can be found in this paper .
- ASwatch
Last edited: 2026-02-05ASwatchASwatch is a system that identifies malicious Autonomous system (AS) by analysing their routing behaviour, focusing specifically on “bulletproof” networks run by cybercriminals. Unlike other approaches that might rely on data from network traffic or content, ASwatch exclusively examines control plane information, which pertains to how networks route data.
- Automatic Repeat Request (ARQ)
Last edited: 2026-02-05Automatic Repeat Request (ARQ)This is the way TCP makes messaging reliable. This uses a combination message acknowledgements and message timeouts to determine if it needs to resend a segment . The timeout is a length of time before it reseeds the message. This will need to be fine tuned by guessing the Round trip time (RTT) .
- Autonomous system (AS)
Last edited: 2026-02-05Autonomous system (AS)An Autonomous system (AS) is a collection of IP addresses with a common prefix all controlled by a single administrative entity or domain.
- Autonomous system number (ASN)
Last edited: 2026-02-05Autonomous system number (ASN)This is an identifier for an AS .
- BGP Blackholing
Last edited: 2026-02-05BGP BlackholingThis is a method of initiating blackholing in the event of a DDoS attack using an upstream service.
- BGP Communities
Last edited: 2026-02-05BGP CommunitiesA BGP (Border Gateway Protocol) community is a mechanism used to group multiple routes together to simplify routing policies and facilitate route management.
- BGP Flowspec
Last edited: 2026-02-05BGP FlowspecBGP Flowspec is an extension of BGP designed to allow the creation and propagation of detailed traffic flow filtering rules. These rules can be applied across different ASs .
- BGP Hijacking
Last edited: 2026-02-05BGP HijackingThis is a class of attacks that use the BGP protocol as its method of attack. This falls into 3 categories:
- BGP squatting
Last edited: 2026-02-05BGP squattingThis is a form of BGP Hijacking where the attacking AS announces a prefix before the genuine AS does - thus becoming the de facto route. This disrupts the flow of traffic to the intended AS .
- Bitrate
Last edited: 2026-02-05BitrateThis is the upload/download rate of some application. It is normally measured in bits per second (bps), though it scales to kilobits per second (kbps) or megabits per second (Mbps).
- Bitrate adaption
Last edited: 2026-02-05Bitrate adaptionThis is the process of choosing the quality of streamed content based on the network and device requirements.
- Blackholing (BH)
Last edited: 2026-02-05BlackholingThis is when a server drops messages either intended for itself or another server. This is done in case of a DDoS attack to protect the service being attacked. Though it can be used for malicious purposes as well in the case of a Blackholing attack .
- Blackholing attack
Last edited: 2026-02-05Blackholing attackThis is a form of BGP Hijacking where an attacking AS intercepts messages between two parties and drops the messages.
- Border gateway protocol (BGP)
Last edited: 2026-02-05Border gateway protocol (BGP)This is a class of protocols that are used for interdomain routing . That is sharing subnets between AS . Two routers connected over BGP are called BGP peers. They open a semi-permanent TCP connection where they exchange routes. There are two varieties of this class.
- Bridge
Last edited: 2026-02-05BridgeA bridge only has two ports but they know which devices are on either side. They will only repeat signals if the destination host is on the opposite side of the bridge. To do this a bridge maintains a forwarding table which maps MAC addresses to ports . It learns which hosts are on either side by reading the source MAC address of frames coming into the bridge.
- Broadcast (networks)
Last edited: 2026-02-05BroadcastYou broadcast a message on a network by setting the destination MAC address to be “all f’s” this relates to the MAC address with all 1’s. This is understood by the router to be sent on to all ports it is connected to.
- Checksum
Last edited: 2026-02-05ChecksumA checksum is a small fingerprint added to some data used to verify the validity of that data. There are different ways to compute this.
- Checksum in layer 4
Last edited: 2024-05-27To compute the checksum for a layer 4 header (either TCP or UDP ):
- You first construct the header with an all zeros Checksum .
- Then you append the pseudo-header to the message.
- You break the message down into 16-bit segments potentially adding 0’s if needed.
- Then compute the ones complement addition off all segments. If this is all 0’s it is sent as all 1’s. An all 0 header means that the checksum was not computed.
- Fill this in as the checksum component. (Now if you perform the ones complement addition of all the 16-bit segments you should end up with all 1’s.)
- Strip the pseudo-header off the segment .
To verify the checksum on the receivers end they simply need to add all 16-bit segments and check it results in all 1’s. This makes it robust to a single bit flip whilst also being robust to most double bit flips if this happens in the same position in the 16-bit segments it will not be noticed.
- Client
Last edited: 2026-02-05ClientA client is defined in reference to any transaction. The client is the Host (networks) who is receiving data in that transaction.
- Client-Server model
Last edited: 2026-02-05Client-Server modelThe client-server model is a distributed application structure with two roles. There are servers providing resources and clients requesting them. For example, a web-server follows the client server model. The user of the browser is the client and the server providing web-pages is the server.
- Congestion control in TCP
Last edited: 2024-05-28# Congestion control in TCP
Congestion control is use to utilise the network with the following goals in mind:
- Efficiency: We should try to have high utilisation of the network at all times.
- Fairness: Each user should have a fair share of the network.
- Low delay: We should not overwhelm the switches and routers buffers causing a large delay within the network.
- Fast convergence: We want to get to a stable point that achieves all the above quickly.
There are two approaches when it comes to congestion control.
- Connection between OSI and IPS models
Last edited: 2026-02-05# Connection between OSI and IPS models
The OSI model was originally invented when the main computers were mainframes. Making layer 5 more important; however, in modern applications the roles and responsibilities of the last 3 layers in the OSI get very mixed and end up being combined into one another. Some applications might not implement some of them.
- Content delivery network (CDN)
Last edited: 2026-02-05Content delivery network (CDN)These are distribution networks that large content providers use to guarantee consistent converge across a region. This is due to the provider having more control of how the network is connected and lowering the costs of distribution.
- Count to infinity problem
Last edited: 2024-06-04This is a problem within the Distance vector routing algorithms caused by a change in the underlying graph or its distances. This causes very slow convergence to the correct intradomain distances as nodes all believe sending messages to one another using the old distances is the shortest path.
# Example
Suppose we have an AS with 3 routers $\{x,y,z\}$ which are all connected to one another with initial distances $d(z,x) = d(x,y) = 1$ and $d(y,z) = 10$ then we have the following shortest path tables.
- DDoS reflection and amplification
Last edited: 2026-02-05DDoS reflection and amplificationInstead of attacking your target directly in DDoS attack - you can instead find legitimate services that respond to requests (for example when opening a TCP connection). You can make requests to such services where you spoof the source IP as your target. This has two advantages:
- Default Gateway
Last edited: 2026-02-05Default GatewayThe default gateway for a network is a Gateway of a router on the network which this host will route Packets that have an Internet Protocol (IPv4) that is not in this Network (as given by the Network mask ).
- Difference between an IP and MAC address
Last edited: 2024-05-22For any packet we attach the source and destination Internet Protocol (IPv4) . This packet may need to travel through many different networks . For each different network it will get a new layer 2 header with the MAC address of the router it entered the network on and the router it needs to leave the network on.
- Distance vector routing algorithms
Last edited: 2026-02-05Distance vector routing algorithmsDistance vector routing is a distributed routing algorithm. It uses the Bellman-Ford algorithm but in a distributed manner.
- Distributed Denial-of-Service (DDoS)
Last edited: 2026-02-05Distributed Denial-of-Service (DDoS)This is an attack against a service where you flood it with requests that it cannot handle. This causes the service to crash, denying access to it for other users.
The diagram demonstrates the simplest form of attack, but this has many variants such as Spoofing
and DDoS reflection and amplification
.- DNS censorship
Last edited: 2026-02-05DNS censorshipDNS censorship is a large-scale network traffic filtering strategy opted by a network to enforce control and censorship over Internet infrastructure to suppress material that they deem as objectionable.
- DNS injection
Last edited: 2026-02-05DNS injectionThis is a form of DNS censorship . It uses a ruleset for which DNS entries are unacceptable and fakes the replies from a DNS lookup so the requester can not resolve the IP address . The works in the following way:
- DNS records
Last edited: 2026-02-05DNS recordsThis is the response from a DNS server. This comes in a question/answer format as bellow. Typically these 4 vales:
- Domain Name System (DNS)
Last edited: 2026-02-05Domain Name System (DNS)The domain name systems main function is to translate a human readable domain name into an IP address . It is in essence a massive distributed database across many server. This distributed database uses different DNS records and a hierarchy of servers.
- DSN-based content delivery
Last edited: 2026-02-05DSN-based content deliveryContent delivery network (CDN) use DNS -based methods to efficiently deliver content by distributing it across multiple servers worldwide. When a user requests a service via DNS, the CDN determines the “nearest edge server” based on factors such as network topology and current link characteristics. This server’s IP address is then returned to the user’s DNS client, ensuring that content is delivered from a location that is geographically or network-proximity closer to the user.
- Duplex
Last edited: 2026-02-05DuplexA connection method is duplex if the communication channel is bi-directional, i.e. both parties can send and receive data.
- Dynamic Adaptive Streaming over HTTP (DASH)
Last edited: 2026-02-05Dynamic Adaptive Streaming over HTTP (DASH)This is a technique to implement bitrate adaption . This has multiple implementations such as HTTP Live Streaming (HLS) or MPEG-DASH . These implementations differ in detail such as the encoding algorithms, segment sizes, DRM support, bitrate adaptation algorithms, etc.
- Dynamic Host Configuration Protocol (DHCP)
Last edited: 2026-02-05Dynamic Host Configuration Protocol (DHCP)To connect to the internet you need 4 pieces of information:
- End to end principle
Last edited: 2026-02-05End to end principleThe end to end principle states that certain functions in a network , such as error correction or data integrity, are best implemented at the endpoints (source and destination) rather than in the intermediary nodes (like routers and switches ). This ensures more efficient and reliable communication by minimizing the complexity and potential points of failure within the network.
- Evolutionary Architecture model (EvoArch)
Last edited: 2026-02-05Evolutionary Architecture model (EvoArch)This is a model built to explain the Internet protocol stack hourglass shape . It builds a DAG in discrete time steps $G_i = (V_i,E_i)$ over time $i \in \mathbb{N}$ to model the protocols in the OSI model .
- Exact prefix hijacking
Last edited: 2026-02-05Exact prefix hijackingThis is a form of BGP Hijacking where the attacking AS announces a path for the same prefix as a genuine AS . This disrupts the flow of traffic to the intended AS .
- Fast retransmit
Last edited: 2026-02-05Fast retransmitThis is a method of handling unacknowledged messages. The keeps sending packages until it sees a package hasn’t be acknowledged 3 times. Then it restransmits that message before the timeout.
- Fast-Flux Service Networks (FFSN)
Last edited: 2026-02-05Fast-Flux Service Networks (FFSN)Fast-Flux Service Networks (FFSN) extend the principles of Round robin DNS (RRDNS) and Content delivery network (CDN) to enhance resilience and scalability, but they are often exploited by spammers and cybercriminals. FFSNs employ a technique where DNS responses rapidly change, featuring a very short Time to live (TTL) compared to RRDNS and CDNs. Each DNS lookup returns a different set of IP addresses from a larger pool of compromised machines.
- File Transfer Protocol (FTP)
Last edited: 2026-02-05File Transfer Protocol (FTP)This is a simple file transfer protocol which starts with the client sending a RETR message with the file name to retrieve a file from a server.
- Finding rouge networks (FIRE)
Last edited: 2026-02-05Finding rouge networks (FIRE)The FIRE (FInding Rogue nEtworks) system is designed to monitor the Internet for rogue networks—networks primarily used for malicious activities such as phishing, hosting spam pages, and distributing pirated software. It utilises three main data sources to identify potential rogue networks:
- Firewall
Last edited: 2026-02-05FirewallA firewall introspects Packets entering a network and filters packets out that are selected as malicious or unnecessary. This violates the End to end principle as introspection on the packets happens before they get to their destination. This is seen as needed to protect hosts and network integrity.
- Flow control in TCP
Last edited: 2024-05-28# Flow control in TCP
Suppose host A is transmitting data to host B. When this starts up host B will reserve some amount of memory to buffer unprocessed packages. Lets say it can fit
RcvBufferbytes. Then it keeps track ofLastByteReadandLastByteRecieved.- Frame (networks)
Last edited: 2026-02-05Frame (networks)During the process of encapsulation the frame is a packet with added MAC addresses for the source and destination.
- Gateway
Last edited: 2026-02-05GatewayThe gateway for a router connected to a network is its Internet Protocol (IPv4) address on that network .
- Go back N
Last edited: 2026-02-05Go back NThis is a method of handling unacknowledged messages. When a sequence number is either skipped or timed out the send starts re-sending segments from the missing number.
- Great Firewall of China (GFW)
Last edited: 2026-02-05Great Firewall of China (GFW)China runs a massive firewall that covers the whole of the country. It uses DNS censorship by injecting fake DNS record responses into the network.
- Head of line (HOL) blocking
Last edited: 2026-02-05Head of line (HOL) blockingIn the switching fabric , head of line blocking happens when all inputs want to connect to the same output line. Then each of the queues are blocked whilst these requests get served. This can slow down switching fabric especially if inputs also have messages for other outputs that could get served.
- Host (networks)
Last edited: 2026-02-05Host (networks)A host can have multiple meanings in the context of networks. Most broadly it means any actor that can send and receive traffic on a network. In the context of Internet Protocol (IPv6) it is a Node (IPv6) that is not a Router (IPv6) .
- Hot potato routing
Last edited: 2026-02-05Hot Potato RoutingThis is the term used when deciding between two external egress routes to the Autonomous system (AS) . Routes use he external egress that has the shortest intradomain routing distance.
- HTTP redirection
Last edited: 2026-02-05HTTP redirectionThis is a response in the HTTP protocol . If a client sends a GET request to a server for a particular resource, the server can respond with a 3xx code and the name of the new server to retrieve the resource from. This causes the client to go to another domain to retrieve that asset.
- Hub
Last edited: 2026-02-05HubA Hub is a multi-port Repeater .
- Hyper Text Transfer Protocol (HTTP)
Last edited: 2026-02-05Hyper Text Transfer Protocol (HTTP)The underlying protocol for web-servers.
- Hypertext Transfer Protocol Secure (HTTPS)
Last edited: 2026-02-05Hypertext Transfer Protocol Secure (HTTPS)This is HTTP using TLS encryption. This is sometimes refereed to as HTTP over TLS.
- Imposture attack (IM)
Last edited: 2026-02-05Imposture attack (IM)This is a form of BGP Hijacking where an attacking AS intercepts messages between two parties and continues the conversation pretending to be one of the parties.
- Interdomain routing
Last edited: 2026-02-05Interdomain routingThis is the process of routing between Autonomous system (AS) . Here there is a lot of commercial pressure on the decision of which routes to offer. The protocols that are used for this are called Border gateway protocol (BGP) .
- Interior gateway protocol (IGP)
Last edited: 2026-02-05Interior gateway protocol (IGP)This is a class of protocols used for intradomain routing . That is for routers in the same network to exchange subnet addresses.
- Internet
Last edited: 2026-02-05InternetA internet is just a massive inter connected set of networks that are connected by routers .
- Internet engineering task force (IETF)
Last edited: 2026-02-05Internet engineering task force (IETF)The Internet Engineering Task Force (IETF) is an open standards organization that develops and promotes voluntary internet standards, particularly those related to the TCP/IP protocol suite. Founded in 1986, it operates through a collaborative process involving working groups and discussions, primarily conducted via mailing lists and periodic meetings.
- Internet Exchange Points (IXPs)
Last edited: 2026-02-05Internet Exchange Points (IXPs)These are massive interchanges for different internet providers such as ISPs and CDNs . These can exchange traffic locally in a commercial model that promotes more open transfer of traffic.
- Internet Protocol (IP)
Last edited: 2026-02-05Internet Protocol (IP)This is the only layer 3 protocol and identifies hosts on different networks . Though here are two versions of this protocol which are IPv4 and IPv6 . As the names suggests the second protocol is an updated version of the first. This was mainly brought about as We are running out of IPv4 addresses on the pubic internet .
- Internet Protocol (IPv4)
Last edited: 2026-02-05IP addressAn IP address forms the address for a host in a Network . It is 32-bits long which is normally broken down into 4 8-bit chunks turned into decimal numbers between 0-255.
- Internet Protocol Stack (IPS) 4 layers
Last edited: 2026-02-05Internet Protocol Stack (IPS) 4 layersThe IPS stack is a model of how communication should work over the internet. It is structured into 4 different layers:
- Internet Protocol Stack (IPS) 5 layers
Last edited: 2026-02-05Internet Protocol Stack (IPS) 5 layersThe IPS stack is a model of how communication should work over the internet. It is structured into 5 different layers:
- Internet protocol stack hourglass shape
Last edited: 2024-05-23When you look at the number of protocols at each layer of the OSI model you notice that there is an hour glass shape. With layer 7 and layer 1 having a variety of protocols in them buts layer 3 only using a single protocol the Internet Protocol (IP) . layer 4 is dominated by UDP and TCP .
- Internet Service Provider (ISP)
Last edited: 2026-02-05Internet Service Provider (ISP)An internet service provider (ISP) is a company that provides individuals and organizations access to the Internet and other related services.
- Intradomain routing
Last edited: 2026-01-28Intradomain routingIntradomain routing is the process of routers within an AS discovering their routing table. The main class of protocols used here are Interior gateway protocol (IGP) .
- IP Anycast
Last edited: 2026-02-05IP AnycastThis is a protocol that uses Hot potato routing in the BGP . It broadcasts the same IP address from multiple different locations and records the path that gets advertised to a given AS . This is a cheap way to calculate the shortest path in terms of AS -paths from a set of locations to your AS . This is used in server selection within CDNs .
- Iris
Last edited: 2026-02-05IrisThis is a system that detects DNS censorship . It does this by comparing the responses of open DNS resolvers on the internet. This is done in a multi-step process as shown below.
This first looks for open DNS
resolvers that are part of the internet infrastructure (i.e. not home routers that are sometimes open due to misconfiguration).- Layer 1 Physical
Last edited: 2026-02-05Layer 1 PhysicalThis is the first layer of the OSI model. These are all the tools that help transport the physical bits from one host to another. For example:
- Layer 2 Data Link
Last edited: 2026-02-05Layer 2 Data LinkLayer 2 of the OSI model concerns itself with MAC addresses and within network communication. It will have a header that stores the source and destination MAC address of the current hop within a network . These are tools that put data on or off the Physical layer . For example:
- Layer 3 Network
Last edited: 2026-02-05Layer 3 NetworkThis layer works with nodes identified by an IP addresses . This applies a header to a Segment with the source and destination Internet Protocol (IPv4) . Devices at level 3 are:
- Layer 4 Transport
Last edited: 2026-02-05Layer 4 TransportThis layer is responsible for getting the data to the right application once we are on the host . It attaches a layer 4 header with the destination and source port . There are two different types of ports .
- Layer 5 Session
Last edited: 2026-02-05Layer 5 SessionLayer 5 of the OSI model is responsible for separating out users who might be connecting through the same lower levels or the same user who is switching between different networks to connect to the same server.
- Layer 6 Presentation
Last edited: 2026-02-05Layer 6 PresentationLayer 6 of the OSI model is responsible for telling us the form the data is in. How should we break down the long binary expression into something the application can understand.
- Layer 7 Application
Last edited: 2026-02-05Layer 7 ApplicationThis layer determines what to do with this data. In a HTTP web server these would be the key words get, post, head ect.
- Link-state routing algorithms
Last edited: 2026-02-05Link-state routing algorithmsLink-state algorithms are used for intradomain routing . These use knowledge of the whole network - including topology and weights - to perform Dijkstra’s algorithm on the network to find the shortest path to every node. This gives us where to route packets to. The computational complexity of this is $O(n^2)$ where $n$ is the size of the network.
- MAC address
Last edited: 2026-02-05MAC addressA MAC address is a 48-bit address that represent physical devices. These are made human readable by representing them as 12 hex digits (these are grouped into 2 characters and separated by - for windows : for Linux and in groups of 4 separated by a . SISCO routers and switches)
- Man-in-the-middle attack (MM)
Last edited: 2026-02-05Man-in-the-middle attack (MM)This is a form of BGP Hijacking where an attacking AS intercepts messages between two parties and reads or manipulates the messages before passing them on.
- Middleboxes
Last edited: 2026-02-05MiddleboxesThese are devices on a network that effect traffic but do not server the role to propagating messages within a network. Such examples are firewalls , NAT boxes , Load balancer , and Intrusion detection systems .
- MPEG-DASH
Last edited: 2026-02-05 - Additive Increase Multiplicative Decrease (AIMD)