Series / #net
Networking, from cable to route
Eight parts that build up the Linux networking stack in the order it actually resolves: the physical link, addressing, routing decisions, then the tooling that inspects each layer.
- Parts
- 8
- Words
- 22,674
- Read time
- 115m
Start part 0 not started
Contents
- 00 The Fundamentals Somebody says "the app can't reach the database." You have a terminal and no idea where to start. This post is the on-ramp. Vocabulary, then the seven commands that answer "is it reachable, is the port open, is DNS working, is TLS working, and who owns this…
- 01 The Mental Model Most engineers learn Linux networking backwards. They memorise commands first, then spend years never quite knowing which one to reach for. So they run netstat -an , stare at 4000 lines, and guess. The fix is not more commands. The fix is a map. Once you know…
- 02 Reading Sockets with ss You have nginx running. Someone says it's broken. You need to know, in the next thirty seconds: who is connected, from where, to which port, and whether anything is stuck. One command answers all of that. Most people run it wrong. This is part 2 of the…
- 03 Proving Packet Loss "We're seeing packet loss." That sentence starts more wasted investigations than any other in infrastructure. It's not a diagnosis. It's a feeling. Packets can be discarded at six different places between the wire and your application, and each one has a…
- 04 Reading tcpdump Counters tell you that something is wrong. tcpdump tells you what happened . Most engineers can start a capture. Far fewer can look at forty lines of output and say "the firewall is dropping this" or "the server's accept queue is full" without opening…
- 05 Latency, Queues, and a Real nginx Hunt "The site is slow." Three words, and almost no information. Slow where? Slow for whom? Slow by how much, compared to what? Latency work is mostly attribution — cutting the total time into pieces until one piece is obviously the problem. Do that first and the…
- 06 Routing, ARP, Firewalls and Containers Five parts in, we've covered sockets, counters, packets and latency. There's a gap, and it's the one that eats the most time on modern infrastructure: the packet reaches the box and disappears. No socket sees it. No drop counter moves. tcpdump shows it…
- 07 The Cheat Sheet The whole series on one page. Print it, pin it, put it in your runbook. Parts 0 through 6 explain why each of these works. This is the lookup table for when you don't have time to read. Glossary Term Meaning Interface A network device as the kernel sees it …