A connection is not one thing that works or fails. It is a stack of independent steps — find the name, reach the address, open the transport, agree on encryption, ask the question — and each fails with its own signature. That is what makes layering worth learning: it turns "the network is broken" into a search order. So this guide keeps asking what each mechanism looks like when it breaks, until symptoms start naming their own layer.
Each chapter opens with the short version. Tap one to read the detail.
Layering, and why it is a diagnostic tool
~2 min
Four layers: link, internet, transport, application. Each adds a header and treats what is above it as opaque. The payoff is not the diagram — it is that each layer fails distinctively, so a symptom points at one.
Addresses, masks, and getting onto the wire
~2 min
Before sending, a host masks the destination, masks itself, and compares. Same result means talk directly on the local link; different means hand it to a router. Most addressing bugs are that comparison going the wrong way.
Not IPv4 with longer addresses
~2 min
The notation is the easy part. What changes is the machinery: hosts build their own addresses, address resolution moved into the protocol, and routers may no longer split oversized packets — so discovering the path size is mandatory, not an optimisation.
Address translation, and the connections it quietly forbids
~2 min
A translator creates its mapping when the first packet goes out. Everything surprising follows: unsolicited inbound traffic matches nothing and is dropped, the box is stateful where a router is not, and protocols that quote their own address break.
Refused, hung, reset — and why "slow" is two problems
~3 min
Setup fails in two ways that mean opposite things: a fast refusal proves the host is reachable and nothing is listening, a timeout proves nothing. Once open, throughput is capped by the smaller of two windows, and short transfers are governed by round trips.
Datagrams, and what QUIC builds on them
~2 min
The datagram protocol is eight bytes of header and no promises: no ordering, no retransmission, no connection. One send is one receive. QUIC takes that blank slate and rebuilds the missing guarantees in application code, where they can actually be changed.
How a packet finds its way, and who really decides
~2 min
Forwarding is a lookup — the most specific matching prefix wins. Routing is the separate business of building that table, and between networks it is settled by policy rather than distance.
Nothing propagates; caches expire
~2 min
The name system is a hierarchy of delegations plus aggressive caching. There is no push and no way to hurry a change: your new record waits out the lifetime of the one it replaced, and "does not exist" is cached too.
Semantics, retries, and what a cache may do
~2 min
The method is a contract about repetition, which is what makes an automatic retry safe or dangerous. Caching turns on two questions — who may store this, and how will they learn it changed.
What the handshake proves, and what it does not
~2 min
Encryption in transit buys confidentiality, integrity, and proof that you reached the name you asked for — nothing about who owns that name or whether they are honest. Most real failures are chain and name-matching problems, not cryptography.
Reading a symptom back to its layer
~2 min
Control messages are the network explaining itself, and expiring hop counters are what make tracing a path possible. The diagnosis nobody guesses is packet size: "small works, large hangs" is almost always the path maximum.
Written by Keentune. We are not affiliated with or endorsed by the organizations whose documentation informs this guide, and any linked sources belong to their respective owners.
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.