Complete Linux Network Stack Guide: Layers, Protocols & Security

Chapter 1: Overview

Introduces fundamental networking concepts: links (copper, fiber, satellite), nodes (computers, hubs, switches, routers), protocols (syntax, semantics, timing), services, entities, peer entities, and PDUs per layer. Explains C/S, B/S, and P2P communication models. Classifies networks by scope: PAN (~10 m), LAN (~1 km), MAN (5–50 km), WAN (tens to thousands of km). Defines performance metrics: rate (bit/s), bandwidth (max data rate), throughput (actual rate), delay (transmission, propagation, processing, queuing), round‐trip time, and channel utilization (noting higher utilization increases delay).

Chapter 2: Physical Layer

Covers signal encoding: Non‐Return‐to‐Zero (NRZ) and Manchester encoding. Lists factors affecting signal distortion: data rate, distance, medium, noise. Describes transmission media: twisted pair (UTP/STP, straight‐through vs crossover), coaxial cable (50 Ω for LAN, 75 Ω for CATV), fiber optics (multimode for short distance using LED, single‐mode for long distance using laser), and wireless. Details multiplexing techniques: FDM (frequency division), TDM (time division), STDM (statistical TDM), WDM (wave division, optical FDM), CDM (code division, CDMA with orthogonal codes, chip sequences, processing gain). Explains broadband access: ADSL (frequency division over telephone line), HFC (cable TV network with cable modem), FTTx (FTTH, FTTB, FTTC).

Chapter 3: Data Link Layer

Defines link, data link, and the layer’s role in heterogeneous networks. Three core problems: framing (SOH/EOT delimiters, character stuffing for transparency), error detection (CRC polynomial division, remainder zero means no error). Describes PPP for point‐to‐point links: frame format (flag, address, control, protocol, data, FCF), zero‐bit stuffing (insert 0 after five 1s) and byte stuffing (escape 0x7E, 0x7D, 0x03). For broadcast channels: CSMA/CD (carrier sense, collision detection, jam signal, exponential backoff with contention period 2τ = 51.2 µs for 10 Mbps Ethernet), MAC frame format (preamble, destination/source MAC, type, data, FCS), minimum frame 64 bytes, maximum 1518 bytes. NIC function, MAC address structure (OUI + vendor), frame types (unicast, broadcast, multicast). Compares hub (physical star, logical bus, CSMA/CD, single collision domain) vs switch (full‐duplex, per‐port collision domain, self‐learning, forwarding table aging, STP to break loops). Defines broadcast domain vs collision domain, VLAN (port‐based, MAC‐based, IP‐based), and Spanning Tree Protocol (STP) to eliminate logical loops.

Chapter 4: Network Layer

Network devices: repeater/hub (physical), switch (data link), router (network). IP addressing: classful (A–E ranges), special addresses (network, directed broadcast, limited broadcast, loopback 127.x, link‐local 169.254.x). IP vs MAC: IP unchanged end‐to‐end, MAC changes per hop. ARP: cache, request/reply, cross‐subnet via gateway. IP datagram header: version, IHL (5–15, 4‐byte units), total length (max 65535), identification, flags (MF, DF), fragment offset (8‐byte units), TTL, protocol ( 6=TCP, 17=UDP, 1=ICMP, 41=IPv6), header checksum (one’s complement sum). Subnetting: subnet mask, network/broadcast address calculation, host count. CIDR: prefix notation (e.g., 200.23.16.0/23), route aggregation (longest prefix match). ICMP: error messages (destination unreachable, time exceeded, parameter problem, redirect), query messages (echo request/reply for ping, traceroute uses TTL expiration). Router forwarding: routing table lookup, next‐hop selection. RIP: distance vector, hop count metric (max 15), split horizon, periodic updates every 30 s, slow convergence. OSPF: link‐state, Dijkstra SPF, areas (backbone area 0, area border routers, AS boundary routers), flooding within area. BGP: path vector, policy‐based, TCP port 179, seeks reachable not necessarily optimal path. IPv6: fixed 40‐byte base header, extension headers, 128‐bit addresses (colon hex, zero compression, CIDR, URLs), transition via dual stack and tunneling. IP multicast: D‐class addresses ( 224.0.0.0–239.255.255.255), MAC mapping ( 01-00-5E-00-00-00 to 01-00-5E-7F-FF-FF), IGMP for group management. VPN: private IP ranges ( 10/8, 172.16/12, 192.168/16), tunneling (encapsulate original packet), types (intranet, extranet, remote access). NAT: replace source IP/port, maintain translation table, replace destination on return. MPLS: label switching, FEC (forwarding equivalence class), label swap at each LSR, label removed at egress.

Chapter 5: Transport Layer

Role: end‐to‐end process communication, shielding network details. UDP: connectionless, unreliable, supports unicast/multicast/broadcast, no flow/congestion control. TCP: connection‐oriented, reliable, in‐order, flow control (sliding window), congestion control (slow start, congestion avoidance, fast retransmit/recovery). Well‐known ports table. UDP header: source/dest port, length, checksum (pseudo‐header + data). TCP header: ports, sequence number, acknowledgment number, data offset, flags (URG, ACK, PSH, RST, SYN, FIN), window, checksum, urgent pointer. Reliable transmission: timeout retransmission ( RTO = RTTs + 4*RTTd, with EWMA estimators), flow control (sender window = min(cwnd, rwnd), zero‐window deadlock avoided by persist timer), send/receive buffers, piggybacked and cumulative ACKs. Congestion control: cwnd doubles per RTT in slow start, increases by 1 MSS per RTT in congestion avoidance; on timeout ssthresh = cwnd/2, cwnd = 1; on three duplicate ACKs ssthresh = cwnd/2, cwnd = ssthresh + 3 MSS (fast recovery). Connection management: three‐way handshake (SYN, SYN+ACK, ACK), four‐way termination (FIN, ACK, FIN, ACK) with TIME_WAIT.

Chapter 6: Application Layer

DNS: hierarchical naming, root/TLD/authoritative/local servers, iterative vs recursive resolution, caching ( ipconfig /displaydns, /flushdns). FTP: control connection (port 21), data connection (port 20), anonymous access methods. HTTP: URL structure, request/response exchange, persistent pipelined connections (1 RTT ideal), message format (request line, headers, blank line, body), cookies (authentication, shopping cart, personalization), document types (static, dynamic CGI, active), search engines (full‐text crawler vs directory). Email: MUA + MTA + protocols (SMTP port 25 for transfer, MIME for multimedia, POP3/IMAP for retrieval, webmail). DHCP: DISCOVER, OFFER, REQUEST, ACK, lease renewal at 50%/87.5%, relay agent for cross‐subnet. P2P file distribution: BitTorrent‐style tit‐for‐tat, choking/optimistic unchoking.

Chapter 7: Network Security

Attack types: interception, modification, malicious code, DoS. Symmetric crypto (shared secret key) vs asymmetric (public/private key pair). Digital signature: authentication, integrity, non‐repudiation. Key distribution: KDC (symmetric) and CA (asymmetric certificates).

Chapter 8: Wireless LAN

Infrastructure WLAN (AP required) vs Ad‐hoc (IBSS, no AP). Wireless Sensor Networks (low power, bandwidth, storage). CSMA/CA: DIFS ( 128 µs) wait, SIFS ( 28 µs) for ACK, random backoff, collision scenarios (similar backoff, hidden terminal). 802.11 frame formats with four address fields for different topologies (AP‐to‐STA, STA‐to‐AP, WDS).

Chapter 9: Comparative Summary

Address lengths: MAC 6 bytes, IPv4 4 bytes, IPv6 16 bytes, port 2 bytes. Header lengths: Ethernet 18 bytes (header+trailer), IPv4 20–60 bytes, IPv6 40 bytes base. Error detection: CRC (polynomial), IPv4 header checksum (one’s complement), UDP/TCP checksum with pseudo‐header. Routing protocols: RIP (distance vector, hop count), OSPF (link‐state, Dijkstra), BGP (path vector, policy), MPLS (label switching). Switching: circuit (dedicated path), message (store‐and‐forward whole message), packet (store‐and‐forward fixed‐size packets). TCP vs UDP comparison. IPv6 advantages: larger address space, hierarchical addressing, flexible headers, better options, extensibility, plug‐and‐play, resource reservation, 8‐byte alignment. P2P vs C/S. Search engine types. CSMA/CD (wired) vs CSMA/CA (wireless). Attack taxonomy. Common commands: ipconfig (/all, /displaydns, /flushdns, /release, /renew), ping (-n, -l, -t), tracert, arp (-a, -d, -s). Glossary of terms: ISP, IXP, Hub, LAN, MAN, WAN, WLAN, VLAN, P2P, C/S, CSMA/CD, CSMA/CA, LiFi, WiFi, ADSL, HFC, FTTH, URL, VPN, IPSec, NAT, ICMP, IGMP, MSS, BGP, AS, HTTPS, MPLS, AP, SSID, AdHoc, Blockchain.