Day45: Mastering Computer Networks – IP Subnetting, Routing, DNS, HTTP/HTTPS & Load Balancing

Core Technical Flow of a Real Request

A user enters https://image.example.cn/studies/20260730001. The request traverses the following layers and mechanisms:

Address Types

Domain name – human‑readable service identifier, e.g. image.example.cn IP address – identifies the destination host, e.g. 203.0.113.10 Port – selects the process on the host, e.g. 443 for HTTPS

MAC address – identifies the NIC on the local link, e.g. 00:1A:… One‑sentence summary: DNS maps a domain to an IP, the IP is routed across networks, the port selects the service, and the MAC delivers the frame on the current link.

Relevant OSI Layers

Layer 4 – Transport : TCP/UDP segments, ports

Layer 3 – Network : IP packets, routing

Layer 2 – Data Link : Ethernet frames, MAC addresses

Layer 1 – Physical : bits on cable, fiber or wireless

Thus IP packets belong to layer 3, Ethernet frames to layer 2, and the physical signals to layer 1.

IPv4, Subnet Mask & CIDR

IPv4 is a 32‑bit address written in dotted decimal, e.g. 192.168.10.130. A CIDR prefix /26 means the first 26 bits are the network prefix and the remaining 6 bits are host bits.

Network bits = n
Host bits   = 32‑n
Address count = 2^(32‑n)

For 192.168.10.130/26:

Network prefix (first 26 bits) → 192.168.10.128
Host bits (6) → 64 addresses
Network address: 192.168.10.128
Broadcast address: 192.168.10.191
Usable hosts: 192.168.10.129‑192.168.10.190 (62 hosts)

Same‑Subnet, Default Gateway & ARP

Workstation configuration example:

IP: 192.168.10.130
Mask: 255.255.255.192 (/26)
Default gateway: 192.168.10.129

To decide whether a target IP is in the same subnet, both the host and the target perform IP AND mask. If the results match, they are on the same link and the host sends an ARP request for the target’s MAC. Otherwise the host ARPs for the default‑gateway MAC while the IP packet still carries the remote server’s IP.

Routing – Longest Prefix Match

Routers examine the destination IP, look up the routing table, and select the entry with the longest matching prefix.

10.10.0.0/16   → Gateway A
10.10.20.0/24  → Gateway B
0.0.0.0/0      → Gateway C (default)

For destination 10.10.20.5, both /16 and /24 match, but /24 is more specific, so the packet is sent to Gateway B. The default route 0.0.0.0/0 matches any address but is used only when no other entry matches.

Private Addresses & NAT

IPv4 private ranges:

10.0.0.0/8
172.16.0.0/12 (172.16.0.0‑172.31.255.255)
192.168.0.0/16

NAT translates many internal IP:port pairs to a single public IP with distinct ports, allowing multiple hosts to share one public address while hiding internal topology.

DNS Resolution Process

Typical lookup flow (recursive query):

Browser cache → OS cache → Recursive resolver cache
If miss: query root → .cn TLD → example.cn authoritative server → obtain A record (e.g., 203.0.113.10)

Common record types: A, AAAA, CNAME, MX, NS, TXT, PTR.

TCP Three‑Way Handshake

Client → Server: SYN (seq=x)
Server → Client: SYN+ACK (seq=y, ack=x+1)
Client → Server: ACK (ack=y+1)

The third ACK confirms that the server’s SYN+ACK was received, ensuring the reverse path is functional before data transfer begins.

HTTP Basics

Request example:

GET /studies/20260730001 HTTP/1.1
Host: image.example.cn
Authorization: Bearer ...
Accept: application/json

Key methods and idempotence:

GET – read resource – idempotent

POST – create/trigger – not idempotent

PUT – replace whole resource – idempotent

PATCH – partial update – not guaranteed idempotent

DELETE – delete resource – idempotent per HTTP spec

Typical status‑code groups:

2xx – Success (200 OK, 201 Created)

3xx – Redirection (301, 302, 304)

4xx – Client errors (401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests)

5xx – Server / gateway errors (500, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout)

HTTP is stateless; session state is kept via cookies, tokens, or external session stores.

HTTPS & TLS

HTTPS = HTTP over TLS. TLS provides confidentiality, integrity, and server authentication. A digital certificate binds a domain name to a public key and is signed by a trusted CA. Clients verify the certificate chain, hostname match, validity period, and signature.

Load Balancing – L4 vs L7

Four‑layer (L4) balancers forward based on IP, port, and protocol – they treat traffic as generic TCP/UDP connections.

Seven‑layer (L7) balancers understand HTTP/HTTPS details (Host header, URL path, headers, cookies) and can perform content‑based routing, TLS termination, authentication, rate limiting, etc.

Common algorithms:

Round‑robin

Weighted round‑robin

Least connections

Hash‑based (source IP or session key)

Health checks are mandatory; without them a failed instance would still receive traffic. The balancer itself should be redundant (active‑active or active‑passive) to avoid a new single point of failure.

End‑to‑End Request Walkthrough (Medical Imaging Example)

1. Browser enters https://image.example.cn/studies/20260730001
2. DNS resolves image.example.cn → 203.0.113.10 (cached if possible)
3. Workstation checks same‑subnet: IP AND mask vs target IP AND mask → different, so ARP for default‑gateway MAC (192.168.10.129)
4. Ethernet frame (dest MAC = gateway) carries IP packet (dest IP = 203.0.113.10)
5. Router chain performs longest‑prefix match at each hop, re‑encapsulating a new Ethernet frame for the next link
6. TCP three‑way handshake establishes a reliable connection
7. TLS handshake validates the server certificate and derives a symmetric session key
8. HTTP GET request is sent over the encrypted channel
9. 7‑layer load balancer selects an image‑service instance (e.g., instance B) based on URL path or round‑robin
10. Service processes the request and returns an HTTP response (e.g., 200 OK with JSON payload)
11. Response travels back over the same TCP/TLS connection, is decrypted by the client, and displayed.

Key Recall Points

/26 gives 64 addresses; network address ends with host bits zero, broadcast address ends with host bits one.

ARP resolves IP→MAC locally; DNS resolves domain→IP globally.

If the target is outside the local subnet, ARP queries the default‑gateway MAC.

Longest prefix match selects the most specific route, not the smallest numeric prefix.

DNS success does not guarantee the service is up.

HTTP 401 = unauthenticated, 403 = forbidden, 502 = bad gateway, 504 = gateway timeout.

PUT is idempotent (re‑setting state), POST is not (creates new resources).

HTTPS protects the transport but does not replace application‑level security.

Load balancers must have health checks; the balancer entry point must also be redundant.

Minimal Memorization List

Domain → DNS → IP
Same subnet? IP & mask → ARP target MAC : ARP gateway MAC
Router → longest‑prefix match → next hop
TCP 3‑way handshake → bidirectional path
HTTP method + status code + idempotence
HTTPS = TLS + certificate (confidentiality, integrity, auth)
4‑L vs 7‑L load balancer (IP/port vs Host/URL)
Health check + redundant balancer = no single point of failure