Networking, Illustrated

DNS supplies an address before TCP begins. The client then selects a route and a next-hop link address; routers repeat forwarding decisions at each hop.

Boundary: The diagram keeps TLS and internet-provider routing outside the frame. 203.0.113.80 and 198.51.100.0/24 are documentation-only addresses.

Failure state: The resolver has no usable answer. No TCP SYN is sent because the application does not yet have a destination address.

Open Systems Interconnection (OSI) separates seven communication responsibilities. The TCP/IP model groups Internet protocols into application, transport, internet, and link layers. Select a band to connect the vocabulary to this HTTPS request.

• Application: HTTP gives the request meaning; TLS protects its bytes above TCP here. Representation and dialog functions live in applications and libraries rather than separate mandatory OSI modules.
• Transport: TCP carries an ordered byte stream between ports 51514 and 443. A successful TCP connection does not prove TLS trust or a successful HTTP response.
• Internet: IPv4 addresses identify the source and destination for routed delivery. Each router chooses its next hop; a destination IP does not identify the Ethernet next hop.
• Link: Ethernet frames target the next hop on this local link, and physical signaling carries the encoded data. At a router, the outgoing link gets a new frame.

Boundary: This is an approximate functional correspondence, not a one-to-one protocol assignment. Session functions can span applications and transport. TLS runs above TCP in this example; HTTP/3 uses a different stack with QUIC over UDP.

Failure state: The client loses physical link connectivity. Its configured IP address can still exist, but this interface cannot send frames to the gateway. Higher-layer configuration cannot restore the missing link.

The Ethernet frame is only for the current local link. The IP packet carries the end-to-end destination, while TCP identifies the receiving transport endpoint.

Boundary: The exact link layer changes across a path. A router removes the incoming frame and builds a new frame for its outgoing link.

Failure state: The route is valid, but the host cannot resolve the gateway’s link-layer address. Local delivery waits or fails before the frame can leave.

The client has 10.20.10.25/24, so its directly connected subnet is 10.20.10.0/24. A destination outside it needs a route through a next hop. A prefix describes a network range, not a physical wire.

Boundary: IPv6 uses prefixes too, but its address and neighbor behavior differs. Broadcast is an IPv4 local-link concept.

Failure state: A misconfigured prefix can make the host treat a remote peer as on-link and attempt neighbor resolution instead of using the intended gateway.

After route selection, the host resolves the selected IPv4 next hop with ARP on the local link. The outgoing frame uses the gateway’s MAC; the IP packet still names 203.0.113.80.

Boundary: This is IPv4 over Ethernet. IPv6 uses Neighbor Discovery instead of ARP.

Failure state: The route exists but the gateway cannot be resolved on this link, so the first frame cannot be sent to that next hop.

The deliberately overlapping route table selects 203.0.113.64/26 for 203.0.113.80. That beats 203.0.113.0/24 and the default route. Only then does the host resolve the selected next hop’s link address.

Boundary: NAT is a separate transformation at a configured edge. It is not performed by every router, and the translation state depends on that device.

Failure state: If all matching routes, including the default, are removed, the host stops before neighbor resolution.

The client sends SYN, receives SYN-ACK, and returns ACK before exchanging stream data. TCP numbers bytes and acknowledges delivery; UDP carries independent datagrams without a transport handshake.

Boundary: This is a simplified three-way handshake. TLS begins after transport setup, and modern clients may choose QUIC over UDP for some HTTPS traffic.

Failure state: The client retransmits according to TCP behavior; a route or policy problem can leave it waiting before application data is exchanged.

For this TCP flow, protocol, source IP and port, and destination IP and port distinguish the transport conversation. The server needs a listener on the destination address/port; a successful DNS lookup says nothing about that listener.

Boundary: A socket can bind a specific address or a wildcard; operating-system connection tracking and proxying can add additional state.

Failure state: A reachable host can reject a connection when no process is listening on the selected destination port.

In this source-NAT example, the edge maps 10.20.10.25:51514 to 198.51.100.25:62001. Return traffic uses that mapping to find the private client. The remote destination and its port stay the same in this example.

Boundary: This is an illustrative NAPT mapping, not a universal requirement for IP communication. Both public addresses shown are documentation blocks.

Failure state: Without matching translation state, a later reply cannot be mapped back to this private flow.

The application asks a resolver, which may answer from cache or query the DNS hierarchy. An A record supplies an IPv4 address; TTL bounds how long a cached answer may be reused. The later TCP packet does not pass through DNS.

• Cache hit: The resolver returns its cached 203.0.113.80 answer without querying authority.
• Cache miss: With no usable cached answer, the resolver follows delegation and returns the authoritative answer.

Boundary: Resolver behavior, search paths, multiple answers, IPv6 AAAA records, and connection reuse can change observed requests.

Alternate state: Authority now returns 203.0.113.81, but this resolver still returns 203.0.113.80 with 120 seconds left on its cached TTL. The DNS lookup succeeds; the client can attempt a connection to the older address.

A stateful firewall can remember an allowed flow and classify return packets using connection state. A stateless rule set evaluates each packet independently. Policy order, direction, and location determine where a packet first fails.

Boundary: Different firewalls implement state and timeout behavior differently. A silent drop and an active rejection produce different client evidence.

Failure state: A silent drop leaves the client waiting in SYN-SENT; the server may see no request at all.

An L4 balancer can use addresses, ports, protocol and connection state. An L7 HTTP balancer can inspect application attributes such as host and path once it terminates or parses that protocol. Both need healthy eligible targets.

• L4 connection: Use transport metadata to choose an eligible backend for this connection.
• L7 request: Inspect HTTP host and path to choose the API pool for this request.

Boundary: Products vary in TLS handling, source-IP preservation, connection reuse, and health-check implementation.

Failure state: The balancer can receive the request but has no eligible backend to send it to.

Test a claim at each layer: name resolution, route, neighbor reachability, TCP handshake, policy, then application response. A later test cannot repair an earlier missing prerequisite.

Boundary: ICMP behavior and firewall policy vary, so a failed ping does not by itself prove TCP is blocked.

Failure state: The packet reaches the policy boundary, which silently drops the SYN. The client remains in SYN-SENT until its timeout.