Linux Networking Vocabulary

iptables is the classic userspace tool for configuring the Linux kernel's netfilter packet-filtering framework. Rules are organized into chains (INPUT, OUTPUT, FORWARD) within tables (filter, nat, mangle); each rule matches packets by criteria like source/destination address, port, or protocol and applies a target such as ACCEPT, DROP, or REJECT. It implements firewalls, port forwarding, and NAT. The kernel evaluates chains top to bottom until a rule matches. On modern systems nftables is the successor, though iptables remains widely used and understood.

A network namespace is a Linux kernel feature that gives a process group its own isolated instance of the network stack — separate interfaces, IP addresses, routing tables, ARP tables, and firewall rules. This is a cornerstone of container networking: each container runs in its own netns so it sees only its own virtual interfaces. Namespaces are connected to each other or the host using veth (virtual Ethernet) pairs and bridges. You can create and inspect them with the ip netns command, enabling lightweight, fully isolated network environments on one host.

DNS resolution is the process of translating a human-readable domain name like example.com into an IP address. A resolver queries a hierarchy of servers: starting at the root, then the TLD server (for .com), then the domain's authoritative name server, which returns the record. Results are cached at each level according to their TTL to avoid repeating the full lookup. On Linux, resolution is driven by configuration like /etc/resolv.conf and /etc/nsswitch.conf, and records come in types such as A, AAAA, CNAME, and MX.

The MTU (Maximum Transmission Unit) is the largest payload size, in bytes, that a network interface can transmit in a single packet without fragmentation — typically 1500 bytes on Ethernet. If a packet exceeds the MTU of a link along the path, it must be fragmented or dropped (when the "don't fragment" bit is set), which hurts performance. Mismatched MTUs, common with VPNs and tunnels that add headers, cause black-hole connections that hang. Path MTU Discovery finds the smallest MTU on a route to size packets appropriately.

A socket is an endpoint for network communication, identified by an IP address and port number plus a protocol; applications read and write data through the socket API. The TCP three-way handshake establishes a reliable connection before data flows: the client sends a SYN, the server replies with SYN-ACK, and the client answers with ACK. This exchange synchronizes initial sequence numbers and confirms both sides can send and receive. Only after it completes does the connection enter the ESTABLISHED state. Closing uses a separate FIN/ACK teardown sequence.