27 networking terms in plain English — what each one means, a command or example, and the gotcha worth knowing.
Last reviewed:
packetA small chunk of data, wrapped with header information, that travels across a network as one unit.
# a packet has headers (source/dest IP, protocol) + a payload (the actual data)💡 Large messages are split into many packets and reassembled at the destination.
protocolAn agreed-upon set of rules that lets two systems communicate — how to format, send, and interpret data.
# HTTP, TCP, DNS, SSH — all protocols, each solving a different layer of the problem💡 Two systems speaking different protocols simply can't understand each other, no matter how healthy the connection is.
bandwidthThe maximum amount of data a connection can carry per unit of time — the "width of the pipe".
# a 1 Gbps link can theoretically move 1 gigabit of data per second💡 High bandwidth doesn't mean low latency — a satellite link can have huge bandwidth and still feel slow due to distance.
latencyThe time it takes for a packet to travel from sender to receiver — how long you wait, not how much you can send.
ping example.com
# time=23ms <- round-trip latency💡 Physically bounded by the speed of light over distance — no amount of bandwidth fixes latency caused by geography.
throughputThe actual amount of data successfully transferred per unit of time — bandwidth is the ceiling, throughput is what you actually get.
# link is 1 Gbps (bandwidth), but real transfer averages 400 Mbps (throughput) due to congestion💡 Always lower than or equal to bandwidth — overhead, retransmits, and congestion eat into it.
IP addressA numeric address that identifies a device on a network — IPv4 (e.g. 192.168.1.1) or IPv6 (longer, hex-based).
ip addr show
# inet 10.0.0.5/24💡 IPv4 addresses are running out globally — IPv6 exists specifically to solve that, though adoption is still gradual.
subnetA logical, smaller network carved out of a larger one, identified by an IP range and a subnet mask.
# 10.0.0.0/24 = 256 addresses, from 10.0.0.0 to 10.0.0.255💡 The "/24" is CIDR notation — the number of bits reserved for the network portion of the address.
NATNetwork Address Translation — rewrites private IP addresses to a single public one so many devices can share one internet connection.
# your home router NATs every device's 192.168.x.x address to your one public IP💡 A side effect: devices behind NAT can't be reached directly from the internet without explicit port forwarding.
portA number that identifies a specific service or process on a device — an IP address gets you to the machine, a port gets you to the right application.
curl http://example.com:8080/api💡 Well-known ports are conventions, not laws — 80 (HTTP), 443 (HTTPS), 22 (SSH), 5432 (Postgres).
MAC addressA hardware address burned into a network interface, unique (in theory) to that physical device — used for local-network delivery.
ip link show
# link/ether 00:1a:2b:3c:4d:5e💡 Operates one layer below IP addresses — IP gets you across networks, MAC gets a frame to the right device on the local segment.
TCPA reliable, connection-oriented protocol — guarantees packets arrive, in order, or the sender is told they didn't.
# TCP handshake: SYN -> SYN-ACK -> ACK, then data flows💡 The reliability has a cost: more overhead and setup time than UDP.
UDPA fast, connectionless protocol that sends packets without guaranteeing delivery, order, or even that duplicates won't arrive.
# used for DNS queries, video calls, online games — where speed matters more than perfect delivery💡 The application, not the protocol, has to handle any reliability it actually needs on top of UDP.
three-way handshakeThe SYN / SYN-ACK / ACK exchange that establishes a TCP connection before any real data is sent.
Client -> SYN -> Server
Client <- SYN-ACK <- Server
Client -> ACK -> Server💡 Adds roughly one round-trip of latency before the first byte of actual data — part of why TCP feels "slower to start" than UDP.
DNSDomain Name System — translates human-readable domain names into IP addresses.
dig example.com +short
# 93.184.216.34💡 "DNS propagation" delay after a change is really just caches (yours, your ISP's, resolvers') expiring per their TTL.
TTLTime To Live — either how long a DNS record can be cached before re-checking, or how many network hops a packet can survive before being dropped.
# DNS: TTL 3600 = cache this answer for 1 hour
# IP packet: TTL decremented at each router hop, dropped at 0💡 The two meanings share a name but solve different problems — always clarify which TTL a conversation means.
routerA device that forwards packets between different networks, choosing the best path based on destination IP.
traceroute example.com
# shows every router hop along the way💡 A "switch" connects devices within one network; a router connects separate networks together.
gatewayThe router a device sends traffic to when the destination isn't on its own local network — the "way out".
ip route show
# default via 10.0.0.1 dev eth0 <- 10.0.0.1 is the gateway💡 Misconfigured gateway = local traffic works fine, but nothing reaches outside the local network.
load balancerDistributes incoming network traffic across multiple backend servers, so no single server gets overwhelmed.
# clients hit lb.example.com; the LB routes each request to one of N healthy backend instances💡 Also handles health checks — automatically stops sending traffic to a backend that stops responding correctly.
CDNContent Delivery Network — a distributed set of servers that cache and serve content from a location physically close to the user.
# a user in Tokyo gets served from a Tokyo edge node, not the origin server in Virginia💡 Cuts latency by shortening physical distance, and cuts origin server load by absorbing repeat requests.
firewallA system that inspects network traffic and allows or blocks it based on a set of rules.
ufw allow 443/tcp
ufw deny 23/tcp💡 Can operate at different layers — a simple packet filter (IP/port rules) vs. a deeper application-aware firewall.
VPNVirtual Private Network — creates an encrypted tunnel over a public network so traffic looks like it originates from a private, trusted network.
# connecting to a company VPN makes your laptop appear to be "inside" the office network💡 Encrypts the tunnel, but doesn't by itself guarantee anonymity — the VPN provider can still see your traffic.
TLS/SSLThe protocol that encrypts data in transit between a client and server — the "S" in HTTPS.
curl -v https://example.com 2>&1 | grep "SSL connection"💡 "SSL" is the older, deprecated name — everyone still says it out loud, but modern connections all use TLS.
DDoSDistributed Denial of Service — flooding a target with traffic from many sources at once to overwhelm it and take it offline.
# thousands of compromised devices (a botnet) all sending requests to one target simultaneously💡 "Distributed" is the key word — a single-source flood is just a DoS; the "distributed" part is what makes it hard to block by IP.
pingA command that sends a small packet to a host and measures how long the reply takes — the first tool to check "is it even reachable".
ping -c 4 example.com💡 No reply doesn't always mean the host is down — many servers deliberately block ping (ICMP) traffic.
tracerouteShows every router hop a packet passes through on its way to a destination, and the time taken at each hop.
traceroute example.com💡 Great for spotting exactly where in the path latency spikes or packets start dropping.
packet lossWhen packets sent never arrive at their destination — caused by congestion, a bad link, or a failing device along the path.
ping -c 100 example.com
# 100 packets transmitted, 87 received, 13% packet loss💡 Even a few percent packet loss can badly hurt TCP throughput, since each loss triggers a slowdown-and-retransmit cycle.
timeoutWhen a request gives up waiting for a response after a set amount of time, rather than waiting forever.
curl --max-time 5 https://example.com💡 "Timing out" and "connection refused" are different failures — a refusal means something answered and said no; a timeout means nothing answered at all.