27 networking terms in plain English — what each one means, a command or example, and the gotcha worth knowing.
Last reviewed:
packetA small chunk of data, wrapped with header information, that travels across a network as one unit.
# a packet has headers (source/dest IP, protocol) + a payload (the actual data)💡 Large messages are split into many packets and reassembled at the destination.
protocolAn agreed-upon set of rules that lets two systems communicate — how to format, send, and interpret data.
# HTTP, TCP, DNS, SSH — all protocols, each solving a different layer of the problem💡 Two systems speaking different protocols simply can't understand each other, no matter how healthy the connection is.
bandwidthThe maximum amount of data a connection can carry per unit of time — the "width of the pipe".
# a 1 Gbps link can theoretically move 1 gigabit of data per second💡 High bandwidth doesn't mean low latency — a satellite link can have huge bandwidth and still feel slow due to distance.
latencyThe time it takes for a packet to travel from sender to receiver — how long you wait, not how much you can send.
ping example.com
# time=23ms <- round-trip latency💡 Physically bounded by the speed of light over distance — no amount of bandwidth fixes latency caused by geography.
throughputThe actual amount of data successfully transferred per unit of time — bandwidth is the ceiling, throughput is what you actually get.
# link is 1 Gbps (bandwidth), but real transfer averages 400 Mbps (throughput) due to congestion💡 Always lower than or equal to bandwidth — overhead, retransmits, and congestion eat into it.
IP addressA numeric address that identifies a device on a network — IPv4 (e.g. 192.168.1.1) or IPv6 (longer, hex-based).
ip addr show
# inet 10.0.0.5/24💡 IPv4 addresses are running out globally — IPv6 exists specifically to solve that, though adoption is still gradual.
subnetA logical, smaller network carved out of a larger one, identified by an IP range and a subnet mask.
# 10.0.0.0/24 = 256 addresses, from 10.0.0.0 to 10.0.0.255💡 The "/24" is CIDR notation — the number of bits reserved for the network portion of the address.
NATNetwork Address Translation — rewrites private IP addresses to a single public one so many devices can share one internet connection.
# your home router NATs every device's 192.168.x.x address to your one public IP💡 A side effect: devices behind NAT can't be reached directly from the internet without explicit port forwarding.
portA number that identifies a specific service or process on a device — an IP address gets you to the machine, a port gets you to the right application.
curl http://example.com:8080/api💡 Well-known ports are conventions, not laws — 80 (HTTP), 443 (HTTPS), 22 (SSH), 5432 (Postgres).
MAC addressA hardware address burned into a network interface, unique (in theory) to that physical device — used for local-network delivery.
ip link show
# link/ether 00:1a:2b:3c:4d:5e💡 Operates one layer below IP addresses — IP gets you across networks, MAC gets a frame to the right device on the local segment.
TCPA reliable, connection-oriented protocol — guarantees packets arrive, in order, or the sender is told they didn't.
# TCP handshake: SYN -> SYN-ACK -> ACK, then data flows💡 The reliability has a cost: more overhead and setup time than UDP.
UDPA fast, connectionless protocol that sends packets without guaranteeing delivery, order, or even that duplicates won't arrive.
# used for DNS queries, video calls, online games — where speed matters more than perfect delivery💡 The application, not the protocol, has to handle any reliability it actually needs on top of UDP.
three-way handshakeThe SYN / SYN-ACK / ACK exchange that establishes a TCP connection before any real data is sent.
Client -> SYN -> Server
Client <- SYN-ACK <- Server
Client -> ACK -> Server💡 Adds roughly one round-trip of latency before the first byte of actual data — part of why TCP feels "slower to start" than UDP.
DNSDomain Name System — translates human-readable domain names into IP addresses.
dig example.com +short
# 93.184.216.34💡 "DNS propagation" delay after a change is really just caches (yours, your ISP's, resolvers') expiring per their TTL.
TTLTime To Live — either how long a DNS record can be cached before re-checking, or how many network hops a packet can survive before being dropped.
# DNS: TTL 3600 = cache this answer for 1 hour
# IP packet: TTL decremented at each router hop, dropped at 0💡 The two meanings share a name but solve different problems — always clarify which TTL a conversation means.
routerA device that forwards packets between different networks, choosing the best path based on destination IP.
traceroute example.com
# shows every router hop along the way💡 A "switch" connects devices within one network; a router connects separate networks together.
gatewayThe router a device sends traffic to when the destination isn't on its own local network — the "way out".
ip route show
# default via 10.0.0.1 dev eth0 <- 10.0.0.1 is the gateway💡 Misconfigured gateway = local traffic works fine, but nothing reaches outside the local network.
load balancerDistributes incoming network traffic across multiple backend servers, so no single server gets overwhelmed.
# clients hit lb.example.com; the LB routes each request to one of N healthy backend instances💡 Also handles health checks — automatically stops sending traffic to a backend that stops responding correctly.
CDNContent Delivery Network — a distributed set of servers that cache and serve content from a location physically close to the user.
# a user in Tokyo gets served from a Tokyo edge node, not the origin server in Virginia💡 Cuts latency by shortening physical distance, and cuts origin server load by absorbing repeat requests.
firewallA system that inspects network traffic and allows or blocks it based on a set of rules.
ufw allow 443/tcp
ufw deny 23/tcp💡 Can operate at different layers — a simple packet filter (IP/port rules) vs. a deeper application-aware firewall.
VPNVirtual Private Network — creates an encrypted tunnel over a public network so traffic looks like it originates from a private, trusted network.
# connecting to a company VPN makes your laptop appear to be "inside" the office network💡 Encrypts the tunnel, but doesn't by itself guarantee anonymity — the VPN provider can still see your traffic.
TLS/SSLThe protocol that encrypts data in transit between a client and server — the "S" in HTTPS.
curl -v https://example.com 2>&1 | grep "SSL connection"💡 "SSL" is the older, deprecated name — everyone still says it out loud, but modern connections all use TLS.
DDoSDistributed Denial of Service — flooding a target with traffic from many sources at once to overwhelm it and take it offline.
# thousands of compromised devices (a botnet) all sending requests to one target simultaneously💡 "Distributed" is the key word — a single-source flood is just a DoS; the "distributed" part is what makes it hard to block by IP.
pingA command that sends a small packet to a host and measures how long the reply takes — the first tool to check "is it even reachable".
ping -c 4 example.com💡 No reply doesn't always mean the host is down — many servers deliberately block ping (ICMP) traffic.
tracerouteShows every router hop a packet passes through on its way to a destination, and the time taken at each hop.
traceroute example.com💡 Great for spotting exactly where in the path latency spikes or packets start dropping.
packet lossWhen packets sent never arrive at their destination — caused by congestion, a bad link, or a failing device along the path.
ping -c 100 example.com
# 100 packets transmitted, 87 received, 13% packet loss💡 Even a few percent packet loss can badly hurt TCP throughput, since each loss triggers a slowdown-and-retransmit cycle.
timeoutWhen a request gives up waiting for a response after a set amount of time, rather than waiting forever.
curl --max-time 5 https://example.com💡 "Timing out" and "connection refused" are different failures — a refusal means something answered and said no; a timeout means nothing answered at all.
Bandwidth is how much data a connection can carry per unit of time — the width of the pipe. Latency is how long a single packet takes to travel from sender to receiver — how long you wait, regardless of how much you're sending. A satellite link can have huge bandwidth and still feel slow because latency is bounded by physical distance and the speed of light, not by pipe size.
Bandwidth is the theoretical ceiling of a connection; throughput is what you actually get in practice after overhead, retransmits, and congestion. A 1 Gbps link (bandwidth) might only sustain 400 Mbps of real transfer (throughput) under load — throughput is always less than or equal to bandwidth, never more.
TCP is connection-oriented and reliable — it guarantees packets arrive, in order, or tells the sender they didn't, at the cost of setup overhead (the three-way handshake) and more per-packet bookkeeping. UDP is connectionless and sends packets with no delivery, ordering, or duplication guarantees, trading reliability for speed. UDP is used where speed matters more than perfect delivery — DNS queries, video calls, online games.
NAT (Network Address Translation) rewrites private IP addresses to a single shared public IP so many devices on a local network can share one internet connection. Because inbound traffic has no NAT table entry mapping a public port back to a specific internal device, outside hosts can't reach anything behind a NAT device unless port forwarding is explicitly configured to create that mapping.
A switch connects devices within a single local network, typically forwarding based on MAC addresses. A router forwards packets between separate networks, choosing a path based on the destination IP address — it's what lets traffic leave your local subnet and reach the wider internet. A gateway is specifically the router a device sends traffic to when the destination isn't on its own local network.
Ping relies on ICMP, and many servers and firewalls are deliberately configured to drop or ignore ICMP traffic for security reasons, even though the host is fully up and serving other traffic like HTTP normally. A missing ping reply only tells you ICMP isn't getting through — it doesn't prove the host or its actual services are unreachable.
A timeout means nothing answered at all within the allotted wait time — the request could be lost in transit, blocked by a firewall, or the host could be unreachable. A connection refused means something did answer, actively, and explicitly rejected the connection (commonly because nothing is listening on that port). They point to very different root causes, so it's worth distinguishing them when debugging.
A CDN (Content Delivery Network) caches and serves content from edge servers physically close to the user, instead of every request traveling all the way to a single origin server. A user in Tokyo gets served from a Tokyo edge node rather than an origin server in Virginia, which shortens the physical distance the data travels and also reduces load on the origin by absorbing repeat requests.
TLS is the protocol that encrypts data in transit between a client and a server — it's the 'S' in HTTPS, protecting traffic from being read or tampered with as it crosses the network. SSL is the older, deprecated predecessor name; virtually everyone still says 'SSL' out loud and in casual writing, but every modern secure connection actually uses TLS underneath.
Yes — every term and example on this page is free to read and reference without an account or paywall.