Networking from scratch

How any network works, for readers starting from zero: nodes, links and protocols; bits and the signals that carry them; speed versus delay; packets, headers and addresses; layers, devices and topologies; sharing a medium; and how errors are caught and fixed. It is the first sheet of Networking; the web's view of the same stack (latency budgets, IP addressing, DNS, TCP, TLS, HTTP) is in Communication networks.

What a network is

A network is a set of nodes (devices that send, receive or pass on data) joined by links (anything that carries a signal: a copper cable, a glass fiber, a radio channel), working by shared protocols: rules for the format and order of messages and for what to do when one is lost, garbled or unexpected. A host (or end system) is a node that runs applications, such as a phone, laptop or server; switches and routers are nodes that only pass data along.

The postal system is a fair first model:

Where the analogy breaks: a router copies bits onward and forgets them in microseconds, a lost packet is simply sent again, and packets of one message may take different roads.

The internet is a network of networks: each operator runs its own autonomous system, and they agree how to reach each other. That part is in Autonomous systems & BGP.

Information as bits

A bit is a single choice between two values, written 0 and 1. Everything a network carries is first turned into bits by an encoding: the letter A is 01000001 in ASCII and UTF-8, an uncompressed pixel is three bytes (red, green, blue), and telephone-quality voice is 8,000 samples a second of 8 bits each, 64,000 bits per second.

Worked example: a 5 GB video over a 100 Mb/s connection is 5 × 8 = 40 Gb, and 40 Gb ÷ 0.1 Gb/s = 400 s, about 7 minutes, plus a few percent for headers.

From bits to signals

A signal is a physical quantity that changes over time to carry information: voltage on copper, the brightness of light in a fiber, or the amplitude, frequency or phase of a radio wave. The sender turns bits into a signal (line coding on cables, modulation of a carrier on radio and optics) and the receiver samples the signal at the right instants and decides which value it saw. To know when to sample, the receiver recovers the sender's clock from the edges (level changes) in the signal, so a good code never goes long without an edge.

Block codes guarantee edges by sending a few extra bits: 4B/5B (100BASE-TX, 25% extra), 8b/10b (1000BASE-X, SATA, early PCIe, 25%) and 64b/66b (10 Gb/s Ethernet and faster, about 3%).

The symbol rate (in baud) counts how many times per second the line takes a new symbol (a level, a pulse, a radio state). The bit rate is the symbol rate × bits per symbol, and a code with M distinct symbols carries log₂(M) bits each. Raising bits per symbol is how links get faster without more bandwidth; noise sets the ceiling, as Radio fundamentals explains.

Bandwidth, throughput and latency

• Bandwidth has two meanings. To radio and electrical engineers it is the width of a frequency range in hertz (a 20 MHz Wi-Fi channel). To everyone else it is a link's maximum bit rate (a 1 Gb/s port). More hertz allows more bits per second, which is why the word stuck to both.
• Throughput is the rate you actually achieve end to end, after sharing, protocol overhead and retransmissions. Goodput counts only useful application bytes.
• Latency (delay) is the time a bit takes to get from sender to receiver. RTT (round-trip time) is there and back, which is what a request and its reply cost.
• Jitter is the variation in delay from packet to packet. Calls and games feel it; a playout buffer smooths it by adding delay.
• Loss is the share of packets that never arrive: full queues, corrupted frames, radio fades.

One 1500-byte packet over 1,000 km of fiber at 100 Mb/s
  transmission   12,000 bit / 100,000,000 bit/s   = 0.12 ms
  propagation    1,000 km × 5 µs/km               = 5 ms
  processing     10 routers × ~10 µs              ≈ 0.1 ms
  queuing        idle network                     ≈ 0
  one way                                         ≈ 5.2 ms
Same packet at 10 Gb/s: transmission 0.0012 ms, total ≈ 5.1 ms
A 1 GB file at 100 Mb/s: 8,000,000,000 bit / 10^8 = 80 s

Faster links shrink transmission delay but not propagation: past a few hundred Mb/s, distance and queues dominate for small transfers, while big transfers are still limited by the rate. Most switches and routers store and forward: they receive a whole frame before sending it on, so the transmission delay is paid again at every hop. ITU-T G.114 suggests keeping one-way delay for voice under about 150 ms. RTT tables between cities and the bandwidth-delay product are in Communication networks.

Circuit switching and packet switching

In circuit switching the network reserves a path, and a fixed share of every link on it, before any data flows, and holds it until the call ends. The classic telephone network did this: each call was a 64 kb/s channel, and 24 of them were interleaved in a 1.544 Mb/s T1 line (30 voice channels in a 2.048 Mb/s E1 outside North America). Capacity is guaranteed, but silence wastes it.

In packet switching data is cut into packets, each carrying its destination, and every router forwards each packet on its own. Links are shared by whoever has packets to send at that instant (statistical multiplexing). The idea came from Paul Baran and Donald Davies in the 1960s and became the ARPANET and then the internet.

Virtual circuits sit in between: a path is set up once and packets follow it, as in MPLS label-switched paths inside carrier networks. Most phone calls today travel as packets (VoIP, VoLTE, Wi-Fi calling).

Packets, headers and encapsulation

A packet is a header (addresses, length, the type of what follows, sequence numbers, a checksum) plus a payload (the data), sometimes with a trailer after it. Each layer of the stack wraps the unit it gets from the layer above in its own header: encapsulation. Only the matching layer on the far side reads that header, so each layer can change without the others noticing.

Full-size TCP/IPv4 packet on Ethernet: bytes on the wire
  preamble + SFD        8
  Ethernet header      14
  IPv4 header          20
  TCP header           20   (32 with the usual timestamps)
  payload            1460
  FCS                   4
  interframe gap       12
  total              1538   -> 1460 / 1538 = 94.9%
So a 1 Gb/s link carries at most ≈ 949 Mb/s of TCP payload.

The MTU (maximum transmission unit) is the largest packet a link carries in one frame, 1500 bytes on standard Ethernet. A larger IPv4 packet is split into fragments or dropped; IPv6 routers never fragment and send back an ICMP "packet too big" instead. Common sizes are in Communication networks.

Addresses and names

In postal terms the name is who you write to, the IP address is the street address, the port is the apartment number, and the MAC address is the label on each mailbox on one street, used only for the last stretch.

IP addresses stay the same from end to end (unless NAT rewrites them), while MAC addresses change at every hop, because each link puts the packet in a new frame. Packet journey follows one request through all of this; address ranges and prefixes are in IP addressing.

Layer models

Networks are built in layers: each one offers a service to the layer above and uses the one below. A browser doesn't care whether its packets ride Wi-Fi or fiber, and Wi-Fi doesn't care whether it carries a web page or a video call. Two models name the layers.

The end-to-end principle keeps the middle of the internet simple: routers just forward packets, and reliability, ordering and security are handled by the two hosts. The full protocol-by-layer table is in Communication networks.

Network devices

• A collision domain is the set of devices whose transmissions can collide: every port on a hub shares one; each switch port is its own.
• A broadcast domain is the set of devices that receive each other's broadcasts (ARP, DHCP): a switch passes broadcasts to all ports, a router stops them. VLANs split one switch into several broadcast domains, as Wired networks shows.

Topologies

A topology is the shape of the connections. The physical topology is how the cables or radio links run; the logical topology is how data actually flows. A hub wired as a star behaves like a bus, and a PON's fiber tree behaves like a broadcast bus downstream.

Building networks shows how these combine in homes, offices and data centers.

Sharing a medium

Radio, coax and some fiber are shared media: one channel, many transmitters. If two send on the same frequency at the same moment, the signals add up and both are garbled (a collision). Multiple access methods decide who may send when. Some divide the channel up front; others let stations contend and recover from collisions.

Unslotted ALOHA uses at most about 18% of the channel, slotted ALOHA about 37%, because random senders collide; carrier sensing does far better. A CDMA example with two senders and 4-chip codes:

A sends +1 with code + + + +    ->  + + + +
B sends -1 with code + - + -    ->  - + - +
the channel carries the sum     ->  0 2 0 2
receiver for A: (0·1 + 2·1 + 0·1 + 2·1) / 4 = +1
receiver for B: (0·1 - 2·1 + 0·1 - 2·1) / 4 = -1

Duplex describes direction: simplex is one way only (broadcast radio), half duplex is both ways but one at a time (walkie-talkies, Wi-Fi), full duplex is both at once (switched Ethernet, a phone call). Radio does full duplex with separate frequencies (FDD) or fast turn-taking (TDD), covered in Radio fundamentals.

Errors and error detection

Noise, interference and weak signals flip bits. The bit error rate (BER) is the fraction flipped: Ethernet physical layers are specified for 10⁻¹⁰ to 10⁻¹² or better (at 10 Gb/s and 10⁻¹², about one bad bit every 100 seconds), while radio links run far worse before correction. A receiver can't fix what it can't see, so every frame carries redundant bits computed from its contents; the receiver recomputes them and compares.

data             1011001   four 1s -> parity bit 0 -> 10110010
one bit flipped  10100010  three 1s: odd -> error detected
two bits flipped 10100110  four 1s: even -> error missed

Forward error correction (FEC) sends enough redundancy to repair errors without asking again: Hamming codes, Reed–Solomon (100G Ethernet, DSL, CDs), LDPC (Wi-Fi, 5G data, 10GBASE-T, satellite TV), turbo codes (3G, 4G) and polar codes (5G control). A code rate of 5/6 means 5 data bits in every 6 sent. FEC pays off where asking again is slow (satellites, deep space) or where links run close to the noise limit (radio, fast optics). A frame that still fails its check is dropped silently; recovering it is a higher layer's job.

Reliability: acknowledgments and retransmission

The internet layer may lose packets, so reliable protocols add four things: sequence numbers (to put data in order and spot duplicates), acknowledgments (ACKs, "I have everything up to byte n"), a timer (no ACK in time means resend) and retransmission.

• Stop-and-wait sends one packet and waits for its ACK. Simple, but one packet per RTT.
• A sliding window keeps several unacknowledged packets in flight; each ACK slides the window forward. Go-back-N resends everything after a loss; selective repeat (TCP with SACK, QUIC) resends only what is missing.
• Flow control stops a fast sender from flooding a slow receiver (TCP's receive window). Congestion control slows the sender when the network itself is overloaded.

Stop-and-wait, 1500-byte packets, RTT 50 ms
  20 packets/s × 12,000 bits = 240 kb/s, even on a 1 Gb/s link
Window of 64 KiB in flight
  65,536 × 8 bits / 0.05 s ≈ 10.5 Mb/s
To fill 1 Gb/s at 50 ms: 10^9 bit/s × 0.05 s = 6.25 MB in flight

How TCP does this, with slow start and its handshake, is in TCP.

Try it

Linux commands that show each idea on your own machine (interface names vary: eth0, enp3s0, wlan0; macOS uses en0 and the ifconfig, netstat -rn and arp -a commands instead).

ip -br link              # interfaces and MAC addresses
ip -br addr              # IP addresses per interface
ip route                 # "default via" = first router
ip neigh                 # ARP/NDP cache: IP -> MAC
ping -c 5 1.1.1.1        # RTT, jitter (mdev), loss
traceroute example.com   # every router on the path
ethtool eth0 | grep -E 'Speed|Duplex'
ss -tunap                # sockets, ports, programs
dig +short example.com   # name -> IP address

See encapsulation in real packets. -e prints the Ethernet header, -XX dumps every byte:

sudo tcpdump -i eth0 -nn -e -c 3 'tcp port 443'
sudo tcpdump -i eth0 -nn -XX -c 1 'tcp port 443'

In the hex dump the first 6 bytes are the destination MAC, the next 6 the source MAC, then the EtherType (0800 for IPv4, 86dd for IPv6). An IPv4 header starts with 45 (version 4, 20-byte header); the TCP header begins 20 bytes later with the two port numbers. Wireshark (opens in a new tab) shows the same capture decoded layer by layer.

Map of this collection

The web's view of the upper layers (DNS, TCP, TLS, HTTP/1.1 to HTTP/3, browser transports) is in Communication networks.

References

• Computer Networks: A Systems Approach (opens in a new tab): free textbook by Peterson and Davie, from links and encoding up to applications
• RFC 1122: Requirements for Internet Hosts (opens in a new tab): the four-layer internet model as specified
• RFC 9293: TCP (opens in a new tab): sequence numbers, acknowledgments, windows and retransmission
• RFC 1071: Computing the Internet checksum (opens in a new tab): the checksum used by IPv4, TCP and UDP
• RFC 826: ARP (opens in a new tab): how IP addresses are mapped to MAC addresses on a LAN
• IEEE 802.3 Ethernet Working Group (opens in a new tab): line codes, frame format and every Ethernet physical layer
• ITU-T G.114 (opens in a new tab): one-way delay guidance for voice
• tcpdump manual (opens in a new tab) and Wireshark documentation (opens in a new tab): capturing and reading packets