Linux Network Stack Complete Guide: Illustrated Deep Dive

Chapter 1: Overview

1. Basic Concepts

Link: Connection between nodes (copper, fiber, satellite).

Node: Computer, hub, switch, router.

Protocol: Rules for peer entity communication; three elements: syntax, semantics, timing.

Service: Lower layer provides service to upper layer under protocol control.

Entity: Hardware or software process that sends/receives information.

Peer Entity: Entities at same layer communicating with each other.

PDU per Layer: Data units exchanged between peer layers (image included).

2. Communication Models

C/S: Client requests service; server provides. Client must know server address.

B/S: Browser-server; database on server, browser interacts via web server.

P2P: Peer-to-peer; each host acts as both client and server.

3. Network Scope Classification

WAN (tens to thousands km), MAN (5-50 km), LAN (~1 km), PAN (~10 m).

4. Performance Parameters

Rate: Data transmission speed (bit/s).

Bandwidth: Maximum data rate per unit time (bit/s).

Throughput: Actual data rate between sender and receiver (bit/s).

Delay: Time for data to travel from one end to another. Components: transmission delay (frame length/rate), propagation delay (channel length/wave speed), processing delay, queuing delay.

RTT: Round-trip time from sending to receiving acknowledgment.

Channel Utilization: Fraction of time channel carries data; higher utilization increases delay.

5. Internet Composition

Edge: End systems (hosts, phones) running applications. Core: Interconnected routers; key functions: routing and forwarding. Switches forward within subnet; routers forward between subnets.

6. Switching Techniques

Circuit Switching: Dedicated resources (telephone network). Phases: connection setup, communication, release. Uses multiplexing.

Packet Switching: Message split into packets; each packet has header with control info; packets routed independently; reassembled at destination.

Datagram Switching: Store-and-forward at each node; routing table lookup per packet.

Virtual Circuit Switching: Pre-established logical path; packets carry VC identifier; no per-packet routing decision.

7. TCP/IP Architecture & Encapsulation

TCP/IP model layers with diagrams. Encapsulation: each layer adds header (and trailer at link layer). Decapsulation reverses process.

Chapter 2: Physical Layer

1. Signal Encoding

NRZ: 1 = high, 0 = low.

Manchester: 1 = high-to-low mid-bit; 0 = low-to-high mid-bit (image).

2. Distortion Factors

Transmission rate, distance, medium, noise. Symbol rate limited to avoid intersymbol interference.

3. Transmission Media

Twisted Pair: 4 pairs (8 wires); UTP vs STP; straight-through (same standard both ends) vs crossover (different standards).

Coaxial: 50Ω for LAN/digital; 75Ω for CATV/analog.

Fiber: Core (high refractive index) + cladding (low). Multimode: Short distance, LED source, multiple paths, higher dispersion. Single-mode: Long distance, laser source, small core, no reflection.

Wireless: Radio, microwave, satellite (image).

4. Multiplexing Techniques

FDM: Bandwidth divided into frequency bands; each user occupies band continuously.

TDM: Time divided into fixed slots; each user gets same bandwidth at different times; idle slots wasted.

STDM: Dynamic slot allocation on demand.

WDM: Optical FDM; multiple light wavelengths on one fiber.

CDMA: Code Division Multiple Access; each user gets unique orthogonal code; strong anti-interference, used in 2G/3G. Bit divided into m chips; 1 sends code, 0 sends complement; orthogonality via normalized inner product.

5. Broadband Access

ADSL: Uses existing phone line; FDM (image).

HFC: Cable TV network; FDM; coax to set-top box; cable modem to computer (image).

FTTx: FTTH (fiber to home), FTTB (fiber to building), FTTC (fiber to curb).

Chapter 3: Data Link Layer

1. Role & Three Fundamental Problems

Link: Physical line between adjacent nodes.

Data Link: Physical link + protocol.

Position: Hosts, switches (LAN); hosts, routers (internet).

Function: Hide different link-layer protocols from network layer.

Framing: Add header/trailer; delimiters SOH/EOT.

Transparent Transmission: Character stuffing if delimiter appears in data.

Error Detection: CRC: sender appends n-bit remainder (k+n bits); receiver divides by same polynomial; remainder 0 = accept.

2. Point-to-Point Links (PPP)

Channel: One-to-one; PPP for ISP access.

PPP Frame: Flag (0x7E), Address, Control, Protocol, Data, FCS, Flag (image).

Zero-bit Stuffing (sync): After five consecutive 1s, insert 0; receiver removes.

Byte Stuffing (async): Escape 0x7E→0x7D5E, 0x7D→0x7D5D, 0x03→0x7D23 (image).

CRC: Same as above.

3. Broadcast Links (Ethernet)

Characteristics: Shared medium; simultaneous transmission causes collision.

CSMA/CD: Carrier Sense Multiple Access / Collision Detection. Multi-point access (bus); listen before/during send; on collision: stop, wait random backoff. Contention period = 2τ = 51.2μs for 10Mbps. First station to finish contention period without collision wins. Backoff: r × 2τ, r ∈ [0, 2^k-1], k = min(retransmissions, 10); drop after 16 attempts (images).

MAC Frame: Type 0x0800 (IP), 0x0806 (ARP) (image).

Min/Max Frame Length: 64/1518 bytes (data length determines).

4. NIC & MAC Address

NIC: Connects computer to LAN (image).

MAC: 6 bytes burned in ROM; first 3 bytes OUI (IEEE), last 3 vendor-assigned. Multiple NICs → multiple MACs.

Frame Types: Unicast (match MAC), Broadcast (all receive), Multicast (subset).

5. Hub vs Switch

Hub: Physical star, logical bus; CSMA/CD; single collision domain; no buffering; broadcasts all frames.

Switch: Data link layer; full duplex; no CSMA/CD; per-port collision domain; buffers frames; self-learning.

Half vs Full Duplex: Half: one direction at a time; Full: simultaneous send/receive.

6. Switch Self-Learning & Forwarding

Table empty initially.

On first frame: flood to other ports; non-target discards; learn source MAC/port.

Forward: lookup table; if found, forward to port; else flood.

Entries age out to handle NIC/host changes.

Redundant links: Spanning Tree Protocol (STP) logically disables one.

7. Broadcast/Collision Domains, VLAN, STP

Broadcast Domain: Range affected by a broadcast frame.

Collision Domain: Range where unicast frames collide; only one sender at a time.

VLAN: Virtual LAN; logical segmentation by port, MAC, or IP (802.1Q tag) (image).

STP: Eliminates loops logically without changing physical topology.

Chapter 4: Network Layer

1. Network Devices & Layers

Repeater/Hub: Physical.

Switch: Data Link.

Router: Network.

2. IP Addressing

Classful: A (0-127), B (128-191), C (192-223), D (224-239 multicast), E (240-255 reserved).

Structure: Network ID + Host ID; host ID unique within network.

Special Addresses: Net ID + host all 0 = network address; host all 1 = directed broadcast; all 1 = limited broadcast; all 0 = default route; 127.x = loopback; 169.254.x = APIPA.

3. IP-MAC Mapping & ARP

IP constant; MAC changes per hop.

ARP: Resolve IP to MAC. Cache stores mappings.

Same LAN: Check cache; if miss, broadcast ARP request; target replies unicast.

Cross-network: Send to gateway; destination IP = gateway IP, MAC = broadcast.

4. IP Datagram Format

Header Length: 4 bits; 20-60 bytes (units of 4 bytes).

Total Length: 16 bits; max 65535 bytes; ≤ MTU.

Fragmentation: MTU limits frame payload. Large datagram fragmented. Identification (16b): Same for all fragments. Flags (3b): MF=1 more fragments; MF=0 last; DF=1 no fragment. Fragment Offset (13b): Position in original (units of 8 bytes).

TTL: 8 bits; max router hops; decremented per hop; 0 → discard.

Protocol: 8 bits; 6=TCP, 17=UDP, 1=ICMP, 41=IPv6.

Header Checksum: Only header; sum 16-bit words, carry wrap, one's complement.

5. Subnetting

Subnet Mask: Network+subnet bits =1, host bits=0 (images).

Calculations: Network address (IP AND mask), broadcast (network + host all 1), subnet count (2^subnet bits), hosts per subnet (2^host bits -2) (image).

Routing Priority: Direct > Host > Static > Dynamic > Default.

6. CIDR & Route Aggregation

CIDR: a.b.c.d/x (e.g., 200.23.16.0/23 = 255.255.254.0).

Aggregation: Combine contiguous blocks; longest prefix match (image).

7. ICMP

Purpose: Error reporting & network probing; reports errors but doesn't correct.

Error Messages: Destination unreachable, Time exceeded (TTL=0 or reassembly timeout), Parameter problem, Redirect (better route).

Ping: ICMP Echo Request/Reply for connectivity.

Traceroute: Tracks path via TTL expiration.

8. Router Forwarding

Route Types: Static (manual), Dynamic (protocol), Default (catch-all), Direct (connected interfaces).

Forwarding: Lookup destination in routing table; determine next hop.

9. RIP

AS: Autonomous System.

IGP: RIP, OSPF. EGP: BGP.

Metric: Hop count (direct=1, indirect=routers+1). Max 15 hops; 16 = unreachable.

Distance Vector: Receive neighbor table; set next hop to neighbor, increment distance; update local table: add new, update if same next hop, replace if smaller distance (image).

Operation: Start with direct networks; periodic exchange (30s); triggered updates on change; convergence = all nodes have correct info.

Characteristics: Neighbor-only exchange; full table; periodic; small scale; hop metric; high bandwidth; slow convergence.

10. OSPF

Link State: Local interface IPs, neighbor IPs, link costs.

Process: Each router maintains LSDB (full topology). Run Dijkstra to build shortest-path tree; derive routing table (images).

Areas: Partition AS to limit flooding scope; backbone area (area 0) connects others; area border routers, AS boundary routers (images).

11. BGP

Goal: Find reachable path between ASes; not necessarily optimal.

Policy Routing: Path vector; AS path attributes (image).

12. IPv6

Datagram: Base header (40 bytes) + payload (extension headers + data) (image).

Fields: Priority (8b), Flow Label (20b), Payload Length (16b), Next Header (8b), Hop Limit (8b).

Changes vs IPv4: Fixed header, no checksum, extension headers, larger address (image).

Address Notation: Colon-hex, zero compression (::), CIDR, URLs.

Transition: Dual stack (routers have both), Tunneling (IPv6 in IPv4).

13. IP Multicast

Comparison: Unicast (1→1), Broadcast (1→all), Multicast (1→group), Anycast (1→nearest).

Encapsulation: IP header (protocol=2) + IGMP; destination = Class D (224.0.0.0-239.255.255.255).

Multicast MAC: Low 23 bits from IP; 01-00-5E-00-00-00 to 01-00-5E-7F-FF-FF.

IGMP: Router learns group membership on LAN.

14. VPN & NAT

Private IP: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

VPN Encapsulation: Original IP packet encrypted as payload in new IP packet; new header: source=sender router, dest=receiver router.

VPN Types: Intranet (internal depts), Extranet (partner orgs), Remote Access (mobile workers).

NAT: Replace source IP on outbound; record in translation table; replace destination IP on inbound (image).

15. MPLS

Concept: Multi-Protocol Label Switching; label at ingress; hardware forwarding.

vs Traditional Routing: Traditional: per-hop IP lookup, variable-length packets, slower. MPLS: fixed-length labels, between L2/L3, multiple link protocols (image).

FEC & Load Balancing: Forwarding Equivalence Class = packets treated identically (same interface, next hop, service class, drop priority). One label per FEC (image).

Chapter 5: Transport Layer

1. Role

Provides end-to-end, process-to-process reliable communication; shields network details.

2. UDP vs TCP

UDP: Unicast/multicast/broadcast; connectionless, unreliable; any rate.

TCP: Unicast only; connection-oriented, reliable, ordered; flow control (receiver window), congestion control (network load).

Application examples and well-known ports (images).

3. UDP Header & Checksum

Header: Source/Dest Port, Length, Checksum (image). Checksum: pseudo-header + UDP header + data; sender: zero checksum, sum 16-bit words, carry wrap, one's complement; receiver: sum including checksum → all 1s if ok (images).

4. TCP Header

Ports (2B each), Sequence (4B), Acknowledgment (4B), Window (2B), Header Length (4b), Flags (6): URG, ACK, PSH, RST, SYN, FIN (image).

5. Reliable Transmission

RTO: RTO = RTTs + 4×RTTd. RTTs = (1-α)RTTs + α·SampleRTT (α=1/8). RTTd = (1-β)RTTd + β·|RTTs-SampleRTT| (β=1/4).

Flow Control: Sequence (send window), Acknowledgment (expected next), ACK flag, Window (receiver capacity). Deadlock: sender waits for window update, receiver waits for data. Persistent timer: on zero window, send zero-window probe; reset on zero, reopen on non-zero.

Buffers: Send: ready + sent-unacked. Receive: received-unread + out-of-order.

Acknowledgments: Cumulative (ack last in-order), Piggybacked (ack on data frame).

6. Congestion Control

Detection: Retransmission timeout.

cwnd vs RTT: Slow Start: cwnd doubles per RTT. Congestion Avoidance: cwnd +1 per RTT. Threshold ssthresh: switch at cwnd = ssthresh. On timeout: ssthresh = cwnd/2, cwnd=1, slow start. On 3 duplicate ACKs: fast recovery (image).

7. Connection Management

Socket: Endpoint abstraction for inter-process communication.

Three-Way Handshake: 1) SYN (seq=x) 2) SYN+ACK (seq=y, ack=x+1) 3) ACK (seq=x+1, ack=y+1) (image).

Four-Way Termination: 1) FIN (seq=u) 2) ACK (ack=u+1) half-close 3) FIN (seq=w, ack=u+1) 4) ACK (seq=u+1, ack=w+1) (image).

Chapter 6: Application Layer

1. DNS

Relation: One domain → one IP; one IP → multiple domains.

Function: Name resolution, aliases, load balancing, distributed database.

Structure: Labels separated by dots (image).

Server Types: Root (knows TLDs), TLD (com, org, cn), Authoritative (org internal), Local (client configured; forwards to root).

Resolution: Recursive (server queries on behalf) vs Iterative (server refers). Caching at each level; commands: ipconfig /displaydns, /flushdns.

2. FTP

TCP, C/S. Control connection (port 21): commands. Data connection (port 20): file transfer; closed after transfer.

Anonymous FTP: CLI ftp, browser ftp://, GUI clients (CuteFTP).

3. WWW/HTTP

HTTP: Strict client-server interaction for web resources.

URL: <protocol>://<host>:<port>/<path> (image).

Interaction: DNS → TCP → HTTP request → response (image).

Pipelined Persistent: HTTP/1.1 default; send requests immediately; ideal ~1 RTT; time = doc transfer + 2RTT (image).

Messages: Request = request line + headers + blank + body. Response = status line + headers + blank + body.

Cookie: Client-side storage for auth, cart, personalization.

Doc Types: Static (fixed), Dynamic (CGI-generated), Active (browser-run program).

Search Engines: Full-text (Google, Bing, Baidu) vs Directory (Yahoo, Sina).

4. Email

Components: Client (Outlook, browser) + Server (Winmail) + Protocols (SMTP, POP/IMAP).

Format: Header + body (image).

SMTP: TCP port 25; phases: connect, transfer, close; ASCII commands/responses.

MIME: Adds content-type headers for multimedia.

POP3 vs IMAP: POP3 downloads; IMAP syncs (image).

Webmail: HTTP for user↔server; SMTP between servers (image).

5. DHCP

Provides: IP, mask, gateway, DNS.

Process: 1) Discover (UDP 68→67 broadcast) 2) Offer (broadcast) 3) Request (select one) 4) ACK (bound) 5) Renew at 50% (Request) 6) ACK or NAK 7) Rebind at 87.5% 8) Release anytime (image).

Relay: Server can be remote; relay agent forwards unicast.

6. P2P File Distribution

BitTorrent-style: Tit-for-Tat; upload to top 4 peers by download rate (re-evaluate 10s); optimistic unchoke every 30s (image).

Chapter 7: Network Security

1. Attack Types

Intercept data.

Modify intercepted data.

Malicious code.

DoS via multiple hosts.

2. Cryptosystems

Symmetric: Same key (K1=K2); E,D public; key secret (image).

Asymmetric: Key pair (public PK, private SK); PK encrypts, SK decrypts; PK public, SK secret; cannot decrypt with PK (image).

3. Digital Signature & Confidentiality

Signature Properties: Authentication, integrity, non-repudiation.

Process: Sender signs with private key; receiver verifies with public key (image).

4. Key Distribution

KDC (Key Distribution Center) and CA (Certificate Authority) hierarchies (images).

Chapter 9: Wireless LAN

1. WLAN Types

Infrastructure: AP required; stations communicate via AP.

Ad Hoc: No AP; temporary; nodes run routing, forward packets.

2. Wireless Sensor Networks

Low power, bandwidth, storage; IoT (image).

3. CSMA/CA

Scenario: A→B, C→D.

A senses idle, waits DIFS (128μs), sends.

B waits SIFS (28μs), sends ACK.

C senses busy, picks random backoff; decrements on idle, freezes on busy; sends at 0.

Collision cases: similar backoff values; hidden terminal (A and C out of range, both send to B) (images).

4. 802.11 Frame

Four address fields for various distributions (images).

Comparisons & Commands

Address Lengths

MAC: 6 bytes (24b OUI + 24b vendor).

IPv4: 32 bits (4 bytes).

IPv6: 128 bits (16 bytes); notations: colon-hex, ::, CIDR, URL.

Port: 16 bits.

Header Lengths

Ethernet frame header+trailer: 18 bytes.

IPv4: 20-60 bytes.

IPv6: 40 bytes fixed base header.

Error Detection

CRC: Polynomial division; remainder appended; receiver checks remainder=0.

IPv4 Checksum: Header only; zero field, sum 16-bit words, carry wrap, one's complement.

UDP Checksum: Pseudo-header + header + data; similar algorithm.

TCP Checksum: Same as UDP but protocol=6, TCP length.

Routing Technologies

RIP: Distance vector, hop count, 15 max, neighbor exchange, slow convergence.

OSPF: Link state, Dijkstra, areas, flooding.

BGP: Path vector, policy-based, TCP 179, AS path.

MPLS: Label switching; ingress labels, swap at LSR, egress pops.

Data Switching

Circuit: dedicated path (telephone).

Message: store-and-forward whole message.

Packet: store-and-forward fixed-size packets (modern standard).

TCP vs UDP

TCP: connection, 3-way handshake, 4-way close. UDP: no connection, fire-and-forget, no state, multicast capable.

IPv4 vs IPv6

IPv6 advantages: larger space, hierarchy, flexible header, extensibility, plug-and-play, resource reservation, 8-byte alignment. Differences: removed header length, service type, total length, fragmentation fields, TTL→hop limit, protocol→next header, no checksum, options→extension headers.

P2P vs C/S

P2P: symmetric, no fixed roles. C/S: distinct client (requester) and server (provider).

Search Engines

Full-text: crawler builds index; query keywords.

Directory: human-reviewed submissions; categorized.

CSMA/CD vs CSMA/CA

CD: wired, detect collisions via voltage. CA: wireless, avoid collisions via random backoff and RTS/CTS (implied).

Network Attacks

Malware: worms, trojans, logic bombs, backdoors, adware.

Eavesdropping: intercept and replay.

DoS: flood target with packets.

Key Commands

ipconfig: /all (full config), /displaydns, /flushdns, /release, /renew.

ping: -n count, -l size, -t continuous.

traceroute: path tracing.

arp: -a (show), -d (clear), -s (add static).

Terminology

Definitions for ISP, IXP, Hub, LAN, MAN, WAN, WLAN, VLAN, P2P, C/S, CSMA/CD, CSMA/CA, LiFi, WiFi, ADSL, HFC, FTTH, URL, VPN, IPSec, NAT, ICMP, IGMP, MSS, BGP, AS, HTTPS, MPLS, AP, SSID, AdHoc, Blockchain.