Comprehensive Study Notes: Computer Networks, Cloud Architecture, and Distributed Systems

Physical Layer Principles, Data Representation, and Transmission Dynamics

• Role of the Physical Layer:

  • Responsible for the physical transmission and reception of raw, unstructured bitstreams over a physical transmission medium (the communication channel).

  • Ensures that when a sending device transmits a bit ($0$ or $1$), the receiving device detects and interprets it correctly as that bit.

  • Encompasses the physical hardware specifications, signal generation, transmission media characteristics, modulation, synchronization, line encoding, and basic physical-level transmission properties.

  • Fundamental operational properties of a physical link:

  • Throughput (or Bit Rate): The actual rate at which information is delivered across the physical medium, measured in bits per second ($\text{bps}$, $\text{Kbps}$, $\text{Mbps}$, $\text{Gbps}$, $\text{Tbps}$).

  • Bit Error Rate (BER): The ratio of corrupted or erroneously decoded bits received relative to the total number of bits transmitted over a specified time interval.

  • Propagation Delay (Link Latency): The physical duration required for an electromagnetic or optical signal to travel from the sending interface to the receiving interface along the medium ($\text{seconds}$, $\text{milliseconds}$, $\text{microseconds}$). Strictly governed by the speed of light within the medium ($s \le c$) and the physical distance of the link ($d$):       $\text{Delay}_{\text{prop}} = \frac{d}{s}$

• Digital Representation of Heterogeneous Data:

  • Numbers: Unsigned integers are represented using base-2 positional binary notations ($2^0, 2^1, \dots, 2^n$). Signed numbers utilize Two's Complement representation, and fractional numbers utilize fixed-point or IEEE 754 floating-point standard binary representations.

  • Text: Mapped to standardized bit patterns. ASCII assigns 7-bit patterns (values 0–127; e.g., 'A' is decimal 65 or binary 0100 0001, 'a' is decimal 97 or binary 0110 0001). Extended character sets across world languages are encoded via multibyte Unicode standards (e.g., UTF-8, UTF-16).

  • Images: Grids of discrete picture elements (pixels). In 24-bit True Color displays, each screen pixel is composed of three separate 8-bit color channels: Red (R: 0–255), Green (G: 0–255), and Blue (B: 0–255), generating $2^{24} = 16,777,216$ unique color combinations (e.g., yellow is formed by full red 11111111, full green 11111111, and zero blue 00000000). Efficiency is improved via lossy compression schemes such as JPEG through Discrete Cosine Transform (DCT) and spatial redundancy elimination.

  • Audio: Continuous analog sound waves are digitized via Pulse Code Modulation (PCM). Involves two stages: periodic sampling at uniform time intervals (governed by the Nyquist theorem, $f_s \ge 2 \times f_{\max}$) and quantization (converting sampled amplitudes into discrete numerical binary values). Formats like MP3 achieve high compression by exploiting perceptual psychoacoustics (auditory masking).

  • Video: A temporal sequence of static raster image frames (e.g., 24, 30, or 60 frames per second). Video codecs achieve compression through spatial compression within individual frames (intra-frame coding or I-frames) and temporal compression across consecutive frames (inter-frame predictive coding via P-frames and B-frames tracking motion vectors).

• Modulation and Signal Conversion:

  • Modulation: The process of converting digital bit patterns into discrete electromagnetic or optical wave disturbances (symbols) suited for propagation across a physical transmission channel.

  • Demodulation: The inverse process performed at the receiving node, translating analog physical waveforms back into digital bit sequences.

  • Network Interface Controller (NIC) / Modem: The hardware unit incorporating transceiver electronics responsible for physical modulation, demodulation, synchronization, and line driving.

  • Baud Rate vs. Bit Rate: Baud rate (symbol rate) represents the number of distinct signal units or modulation state changes transmitted per second. If each symbol encodes $k$ bits, the data rate is given by:     $\text{Bit Rate} = \text{Baud Rate} \times k$

  • Common Modulation Techniques:

  • Pulse Amplitude Modulation (PAM): Information is encoded by varying the amplitude (magnitude) of voltage pulses (e.g., PAM-4 uses four discrete amplitude levels to represent 2 bits per symbol).

  • Frequency Shift Keying (FSK): Information is encoded by altering the frequency of a sinusoidal carrier wave above or below a central frequency to distinguish logic zeros and ones.

  • Phase Shift Keying (PSK): Information is encoded by shifting the starting phase angle of the carrier wave (e.g., Binary PSK uses a $180^\circ$ phase shift between logic 0 and logic 1; Quadrature PSK uses four $90^\circ$ phase shifts to encode 2 bits per symbol).

  • Quadrature Amplitude Modulation (QAM): Combines both amplitude variation and phase shifts simultaneously (e.g., 8-QAM conveys 3 bits per symbol; 16-QAM conveys 4 bits per symbol; 256-QAM conveys 8 bits per symbol).

• Signal Degradation and Physical Limitations on Throughput:

  • Signals do not traverse physical media perfectly; they degrade due to multiple physical phenomena:

  • Attenuation: Exponential decay of signal amplitude over transmission distance due to resistance or absorption in the medium.

  • Fading: Variations in signal strength over time and distance caused by environmental changes in wireless propagation.

  • Interference: Extraneous electromagnetic signals from other transmitting devices or power infrastructure coupling into the medium.

  • Limited Bandwidth Distortion: Channels attenuate higher-frequency Fourier components of rectangular pulses, rounding off pulse edges and causing inter-symbol interference (ISI).

  • Delay Distortion: Different frequency components propagate along guided media at slightly different phase velocities, causing pulses to spread out in time.

  • Multipath Distortion: In wireless links, reflected, refracted, and scattered copies of the transmitted signal arrive at the receiver over paths of varying lengths with differing time delays, causing destructive or constructive phase interference.

  • Thermal and Line Noise: Unavoidable kinetic motion of electrons within conductors and receiver circuitry adding a Gaussian noise floor to the signal.

• Physical Layer Synchronization:

  • Asynchronous Transmission: Data is transmitted in short character-sized blocks without a shared clock. Synchrony is established per character using framing control bits: a low "start bit", data bits, optional parity, and one or two high "stop bits". Implemented via Universal Asynchronous Receiver-Transmitter (UART) chips in microcontrollers and industrial programmable logic controllers (PLCs).

  • Synchronous Transmission: Data bits are transmitted continuously under tight timing alignment. Synchrony is achieved through:

  • Dedicated out-of-band clock signals carried on separate conductors.

  • Self-clocking line codes where transition timing is embedded into the data waveform itself (e.g., Manchester encoding transitions in the middle of every bit cell; NRZI; 4B/5B; 8B/10B block codes).

  • Frame Preamble Sequences: Explicit high-frequency alternating bit sequences prepended to transmissions (e.g., Ethernet and IEEE 802.11 Wi-Fi preambles) to lock receiver phase-locked loops (PLLs).

• Transmission Media Categories:

  • Guided Media (Conducted Waves):

  • Twisted Pair Copper Cable: Insulated copper wire pairs twisted helically around each other to cancel electromagnetic radiation and cross-talk. Common categories support bandwidths from $1\text{ Gbps}$ to $10\text{ Gbps}$.

  • Coaxial Cable: Central solid copper conductor surrounded by a concentric dielectric insulator, metallic braided shielding, and an external jacket. High noise immunity; supports $1\text{ Gbps}$ to $10\text{ Gbps}$.

  • Fibre-Optic Cable: Core of high-purity glass (silica) surrounded by a reflective optical cladding with a lower refractive index, guiding light pulses via total internal reflection. Extremely broad bandwidth ($10\text{ Gbps}$ to $100+\text{ Gbps}$ per wavelength), negligible attenuation, and total immunity to electromagnetic interference.

  • Unguided Media (Radiated Wireless Waves):

  • Electromagnetic wave propagation across atmosphere and vacuum: radio waves, microwaves, infrared.

  • Electromagnetic Propagation Rules of Thumb:

    • Transmitting and receiving antennas are sized on the order of a quarter of the carrier wavelength ($\lambda/4$), where $\lambda = c/f$.

    • Waves interact destructively and reflect off physical objects whose physical dimensions are comparable to their wavelength.

    • Higher-frequency waves (shorter wavelengths) exhibit line-of-sight propagation behaviors; they do not readily diffract around terrain or penetrate dense obstacles (e.g., concrete walls).

    • Permeable Zone ($< 2\text{ GHz}$): Excellent penetration through dense structures; highly valued for cellular and terrestrial broadcast services.

    • Semi-Permeable Zone ($2\text{ GHz} - 5\text{ GHz}$): Includes the $2.4\text{ GHz}$ and $5\text{ GHz}$ Industrial, Scientific, and Medical (ISM) unlicensed bands utilized by Wi-Fi, Bluetooth, cordless electronics, and microwave ovens. Moderate building penetration.

    • Line-of-Sight Zones ($> 5\text{ GHz}$ up to millimetre-wave bands $30 - 300\text{ GHz}$): Highly susceptible to atmospheric attenuation, rain fade, and solid physical blockages (walls, foliage).

Data Link Layer, Framing, Error Handling, and Media Access Control (MAC)

• The Abstraction of the Physical Layer:

  • The Data Link Layer (DLL) abstracts away the operational complexities of the physical medium—whether signals propagate as electrical pulses on copper, light pulses in optical fibre, or radio waves in the atmosphere.

  • Layering ensures higher-level protocols remain completely independent of the underlying modulation method, transmission frequency, and physical-layer channel noise.

• Core Responsibilities of the Data Link Layer:

  • Framing: Delineating continuous physical bitstreams into discrete, recognizable units of communication (frames).

  • Error Detection and Correction: Introducing redundant validation bits to detect or correct bit alterations caused by channel degradation.

  • Reliability: Managing acknowledgments and retransmissions to guarantee proper delivery over lossy links.

  • Medium Access Control (MAC): Arbitrating access when multiple transmitting nodes share a common physical channel.

  • Physical Addressing: Providing locally unique hardware identifiers (MAC addresses) to distinguish transmitting and receiving devices on the shared link.

• Mechanisms for Framing:

  • Byte-Oriented Framing (Sentinel Characters):

  • Special reserved byte characters delineate boundaries: e.g., Start of Header (SOH), Start of Text (STX), and End of Text (ETX).

  • Point-to-Point Protocol (PPP) uses the flag pattern 0111 1110 ($0\text{x}7\text{E}$) to designate frame boundaries.

  • Character Stuffing (Byte Stuffing): If the reserved sentinel byte sequence occurs naturally within the frame's payload data, the sender inserts an escape byte (e.g., DLE - Data Link Escape) immediately preceding it. The receiver detects the escape byte, strips it, and passes the subsequent byte through as raw data.

  • Bit-Oriented Framing (Flags and Bit Stuffing):

  • High-Level Data Link Control (HDLC) delineates frames using the 8-bit flag sequence 0111 1110 ($0\text{x}7\text{E}$).

  • Bit Stuffing Algorithm: Whenever the transmitting node encounters five consecutive 1s in the payload data, it automatically injects a stuffed 0 bit into the outgoing bitstream. The receiving node monitors the bitstream: after detecting five consecutive 1s, if the sixth bit is a 0, the receiver strips that 0 bit to restore original data; if the sixth bit is a 1 and the seventh is a 0, it recognises the valid frame flag (0111 1110); if the seventh bit is also a 1, it signals an error condition.

  • Length-Based Framing (Byte Count Field):

  • The frame header contains an explicit integer field indicating the total byte count of the frame.

  • Vulnerability: If transmission noise corrupts the count field, the receiver incorrectly determines where the frame ends and cannot locate the start of subsequent frames, causing catastrophic loss of framing synchronization until an entire reset occurs.

  • Clock-Based Framing (Synchronous Optical Network - SONET):

  • Frames are of fixed duration and length, synchronized to master atomic network clocks.

  • Rather than bit stuffing, special synchronization bit sequences appear once every fixed interval ($125\,\mu\text{s}$). The receiver hunts for this sequence across successive expected frame offsets; when seen consistently at identical offsets across multiple intervals, the receiver declares framing synchrony.

• Error Detection and Correction Principles:

  • Parity Check:

  • Appends a single redundant parity bit to a data word.

  • Even Parity: Parity bit is set such that the total count of 1s across the data word and the parity bit is an even integer.

  • Odd Parity: Parity bit is set such that the total count of 1s is an odd integer.

  • Limitations: Can only detect an odd number of bit errors ($1, 3, 5, \dots$). If an even number of bits flip ($2, 4, 6, \dots$), the total parity remains identical, and the error goes undetected. Cannot identify bit error locations, precluding correction.

  • Checksums:

  • Treats data as a sequence of fixed-width integers (e.g., 16-bit words), sums them using one's complement or two's complement arithmetic, and transmits the negated sum as the checksum field.

  • The receiver performs the same sum over the incoming data and compares it to the checksum.

  • Computationally lightweight for software processing, but vulnerable to bit-reordering errors and compensating errors.

  • Cyclic Redundancy Check (CRC):

  • Used universally at Layer 2 (e.g., Ethernet, HDLC, Wi-Fi).

  • Treats a frame of $k$ bits as coefficients of a binary polynomial $M(x)$. Sender and receiver agree on a generator polynomial $G(x)$ of degree $r$.

  • Computes an $r$-bit checksum remainder $R(x)$ by performing modulo-2 polynomial division of $M(x) \cdot x^r$ by $G(x)$.

  • The transmitted frame is $T(x) = M(x) \cdot x^r + R(x)$, which is exactly divisible by $G(x)$.

  • Exceptional capability at detecting all single-bit errors, all double-bit errors, any odd number of errors, and burst errors of length up to $r$ bits.

  • Forward Error Correction (FEC):

  • Uses advanced mathematical block codes (Hamming codes, Reed-Solomon codes, Convolutional codes, Low-Density Parity Check - LDPC codes) to embed sufficient mathematical redundancy to both detect and locate corrupted bit positions, correcting them without retransmission.

  • Trade-off: Error detection (CRC) requires minimal overhead bits during normal operation, incurring bandwidth costs only when retransmissions occur. FEC requires substantial redundant bits transmitted continuously on every frame.

  • FEC is therefore optimal only on high-error links (e.g., wireless channels, IEEE 802.11) or links where retransmission latency is prohibitive (e.g., deep-space, geostationary satellite communications with RTTs exceeding $500\,\text{ms}$).

• Media Access Control (MAC) in Shared Links:

  • MAC Addressing (EUI-48 Standard):

  • Globally unique 48-bit identifier assigned permanently to every network interface card (NIC), managed by the IEEE Registration Authority.

  • Formatted as six hexadecimal pairs separated by colons or hyphens (e.g., 3C:52:82:AB:9F:10).

  • Organizationally Unique Identifier (OUI): First 24 bits ($3\text{ bytes}$), assigned by the IEEE to identify the hardware manufacturer.

  • Device Identifier: Last 24 bits ($3\text{ bytes}$), assigned sequentially by the manufacturer.

  • Promiscuous Mode: A configuration state allowing a network adapter to read and deliver every frame appearing on the physical link to the operating system, regardless of whether the destination MAC matches its own.

  • Channel Partitioning Techniques:

  • Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Code Division Multiple Access (CDMA), and Orthogonal Frequency Division Multiple Access (OFDMA).

  • Eliminates collision contention by pre-allocating dedicated time slots or frequency bands. Requires a centralized scheduling coordinator, making it inefficient for bursty computer traffic where idle slots waste channel capacity.

  • Random Access Medium Access Control: CSMA/CD:

  • Desired properties: Decentralized, no master coordinator, no slot synchronization; full channel rate $R$ available to a single active sender; average rate $R/M$ when $M$ senders compete.

  • Carrier Sense Multiple Access (CSMA): Node listens to the shared channel before transmitting. If a carrier signal is sensed (channel busy), transmission is deferred until the channel falls idle.

  • Collision Detection (CD): Node continues monitoring the channel while transmitting. If the observed signal voltage or power exceeds normal transmission levels, a collision with another transmitting node is detected.

  • Minimum Frame Size Constraint: To detect a collision before finished sending, a node must transmit for at least two maximum propagation delays ($2 \times \tau$, the round-trip propagation time across the maximum allowable cable length). This sets the minimum frame length requirement in Ethernet (64 bytes or 512 bits at $10\text{ Mbps}$).

  • CSMA/CD Step-by-Step Procedure:

    1. Set collision counter $N = 0$.

    2. Sense channel carrier. If busy, defer; if idle, wait for the Inter-Frame Gap (IFG, $9.6\,\mu\text{s}$ in $10\text{ Mbps}$ Ethernet) to allow receiver electronics to stabilize.

    3. Begin transmitting frame while monitoring the channel.

    4. If collision is detected during transmission:

    • Immediately abort transmission and transmit a 32-bit jamming signal to ensure all competing nodes detect the collision.

    • Increment collision counter: $N = N + 1$.

    • If $N > 16$ (limit reached), abort transmission completely and report error to higher layers.

    • Calculate backoff: Select a random integer $k$ uniformly from the range $[0, 2^{\min(N, 10)} - 1]$.

    • Wait for a backoff duration of $k \times \text{Slot Time}$ (where Slot Time = 512 bit times), then return to carrier sensing (Step 2).

    1. If transmission finishes without collision, declare success.

  • Wireless Medium Access: CSMA/CA:

  • Why CSMA/CD Fails in Wireless: Transmitters radiate orders of magnitude more power than incoming signals; the local transmit power drowns out any colliding signal at the receiver, making collision detection during transmission physically impractical. Wireless environments also suffer from the Hidden Node Problem (nodes A and C cannot hear each other due to distance or physical obstacles, but both transmit simultaneously to intermediate node B, colliding at B).

  • Collision Avoidance (CA) Mechanisms:

    • Explicit Positive ACKs: Because collisions cannot be detected during transmission, the receiver validates the CRC of incoming frames and immediately transmits a short Layer 2 ACK frame. If the sender does not receive the ACK within a timeout, it assumes a collision occurred and retransmits.

    • RTS/CTS Channel Reservation (Virtual Carrier Sensing): Sender transmits a small Request to Send (RTS) frame indicating frame duration. Receiver responds with a Clear to Send (CTS) broadcast frame. All surrounding nodes hearing the CTS defer transmissions for the specified duration, mitigating hidden node collisions.

Local Area Networks (LANs) and Switched Ethernet Architecture

• Local Area Network (LAN) Definitions and Topologies:

  • A communication network interconnecting computers and peripheral devices within a limited geographical boundary (office, building, home, university campus), under private administrative ownership.

  • Offers high data rates ($100\text{ Mbps}$ to $100\text{ Gbps}$) and minimal latency ($< 1\text{ ms}$).

  • Historical Bus Topology: All hosts tapped into a single continuous coaxial cable segment via vampire taps (10BASE5 "Thicknet") or BNC T-connectors (10BASE2 "Thinnet"). The entire bus constituted a single shared collision domain running CSMA/CD.

  • Star Topology: Hosts connect directly to a centralized switching node via dedicated, point-to-point twisted pair or optical links.

• Hubs vs. Layer 2 Switches:

  • Hub (Layer 1 Device): Pure electrical repeater. Bits arriving on any port are blindly amplified and regenerated across all other connected ports. All connected devices reside in the same collision domain and compete for shared bandwidth via CSMA/CD. Rarely used in modern networks.

  • Switch (Layer 2 Device): Store-and-forward frame-processing device. Buffers complete frames, validates CRCs, parses destination MAC addresses, and forwards frames selectively to the specific physical port connecting the destination device.

  • Collision Domain Isolation: Each individual port on an Ethernet switch is its own isolated collision domain. Hosts operate in full-duplex mode (simultaneous transmission and reception without contention), rendering CSMA/CD collisions obsolete on switched links.

  • Switch port densities range from 5 ports ($10/100\text{ Mbps}$) in home routers to 16, 24, or 48 ports ($10/100\text{ Gbps}$) in enterprise rack switches.

• Ethernet Frame Structure (IEEE 802.3):

  • Preamble (7 bytes): Alternating bit pattern 10101010 used by the physical receiver to lock its clock synchronization.

  • Start Frame Delimiter - SFD (1 byte): Bit pattern 10101011 signaling the immediate start of the frame's addressing fields.

  • Destination MAC Address (6 bytes): 48-bit physical address of the receiving interface or broadcast address (FF:FF:FF:FF:FF:FF).

  • Source MAC Address (6 bytes): 48-bit physical address of the transmitting interface.

  • Type / Length Field (2 bytes): Identifies the encapsulated higher-layer protocol (EtherType; e.g., $0\text{x}0800$ for IPv4, $0\text{x}86\text{DD}$ for IPv6, $0\text{x}0806$ for ARP).

  • Payload / Data (46 to 1500 bytes): Network-layer datagram. If the payload is less than 46 bytes, padding bytes are appended to ensure the frame satisfies the 64-byte minimum frame size requirement.

  • Frame Check Sequence - FCS (4 bytes): 32-bit CRC remainder calculated over all fields from the destination MAC to the end of the padding.

  • Ethernet Level of Service: Connectionless (no preliminary handshake) and unreliable (receiver drops corrupted frames without issuing Layer 2 NACKs or ACKs).

• Switch Self-Learning and Forwarding Algorithms:

  • A switch maintains a dynamic Forwarding Table (MAC Table) containing entries of the form <MAC Address, Port, Time-To-Live (TTL)>.

  • Self-Learning Process: When a frame arrives on port $P$ with source MAC address $S$, the switch inspects $S$ and creates/refreshes an entry in its forwarding table mapping MAC $S$ to port $P$, resetting its TTL.

  • Filtering and Forwarding Logic:

  1. Inspect incoming frame on port $P_{\text{arrival}}$. Record/update <Source MAC, P_{\text{arrival}}, \text{TTL}> in the MAC table.

  2. Search MAC table for Destination MAC address $D$.

  3. If entry for $D$ is found in table (pointing to port $P_{\text{dest}}$):

     • If $P_{\text{dest}} == P_{\text{arrival}}$, discard the frame (filtering: destination is on the same local link segment).

     • Else, forward the frame strictly out of port $P_{\text{dest}}$.

  4. If entry for $D$ is NOT found in table (unknown destination):

     • Flood the frame: transmit a copy out of all operational ports except the arrival port $P_{\text{arrival}}$.

  • Security Vulnerability: MAC Address Flooding attacks exploit this self-learning mechanism by transmitting millions of bogus frames with spoofed source MAC addresses, overflowing the switch's CAM table and forcing it into a fail-open "hub" mode where all traffic is broadcast, facilitating packet sniffing.

• Spanning Tree Protocol (STP - IEEE 802.1D):

  • Redundant switch interconnections create physical cycles (loops), which cause broadcast storms (broadcast frames looping endlessly, consuming all link capacity) and forwarding table instability (MAC addresses being associated with different ports back and forth).

  • Spanning Tree Algorithm: Dynamically disables redundant physical links by logically placing ports in a "blocking" state while keeping them ready to transition to "forwarding" if an active link fails, ensuring a single loop-free spanning tree connects all LAN segments.

Network Layer: Internet Protocol (IPv4/IPv6), Addressing, and Forwarding

• Motivation and Architectural Position of the Network Layer:

  • Layer 2 switched networks cannot scale globally: flat MAC addresses require enormous forwarding tables, broadcast storms disrupt wide-area links, and switches cannot interconnect heterogeneous layer-2 technologies (e.g., Ethernet, Wi-Fi, optical, cellular).

  • Layer 3 (Network Layer) provides scalable, globally addressable, end-to-end packet delivery across heterogeneous interconnected networks (internetworks).

  • Routers are the specialized Layer 3 network entities that interconnect disparate networks.

• IP Service Model:

  • Best-Effort Delivery: Provides no delivery guarantees. Packets may be lost, discarded due to router buffer congestion, delivered out of order, delayed, duplicated, or corrupted.

  • Connectionless: Each IP datagram is treated as an independent routing entity with no connection setup state in intermediate routers.

  • Architectural Simplicity: Pushing complexity to end hosts (end-to-end principle) keeps the network core fast, inexpensive, and resilient.

• IPv4 Header Structure:

  • Minimum header length is 20 bytes; maximum length with options is 60 bytes.

• Detailed Field Descriptions:

  • Version (4 bits): IP protocol version (binary 0100 for IPv4).

  • Header Length - HLen (4 bits): Specifies header size in 32-bit (4-byte) words. Minimum value is 5 ($5 \times 4 = 20\text{ bytes}$); maximum is 15 ($15 \times 4 = 60\text{ bytes}$).

  • Type of Service - TOS / DiffServ (8 bits): Configures quality of service and packet prioritization.

  • Total Length (16 bits): Entire datagram size (header plus payload) in bytes. Theoretical maximum is $2^{16} - 1 = 65,535\text{ bytes}$.

  • Identification (16 bits): Unique sequential integer assigned by the sender to identify fragments originating from the same parent datagram.

  • Flags (3 bits):

    • Bit 0: Reserved (must be zero).

    • Bit 1 - Don't Fragment (DF): If set to 1, routers cannot fragment the packet; if it exceeds link MTU, it is dropped and an ICMP error is returned.

    • Bit 2 - More Fragments (MF): Set to 1 for all fragments except the final fragment (0).

  • Fragment Offset (13 bits): Indicates the starting byte position of the fragment's payload relative to the original unfragmented datagram, measured in 8-byte units ($\text{Offset} = \text{Byte Position} / 8$).

  • Time to Live - TTL (8 bits): Hop-limit counter decremented by at least 1 by every router that processes the datagram. When TTL reaches 0, the datagram is dropped and an ICMP Time Exceeded message is returned, preventing endless routing loops.

  • Protocol (8 bits): Identifies the transport-layer protocol receiving the payload (e.g., 1 for ICMP, 6 for TCP, 17 for UDP).

  • Header Checksum (16 bits): One's complement sum of all 16-bit words in the IP header only. Recomputed at every router because the TTL field changes at every hop.

  • Source IP Address (32 bits): IPv4 address of original sender.

  • Destination IP Address (32 bits): IPv4 address of final destination.

  • Options and Padding (variable length): Security, record route, source routing fields.

  • IP Fragmentation and Reassembly:

• Maximum Transmission Unit (MTU): The maximum packet size in bytes that a given Layer 2 network technology can physically transport within a single frame (e.g., Ethernet MTU is 1500 bytes; PPP link may be 532 bytes).

• When an IP datagram exceeds the outgoing link's MTU and DF=0, the intermediate router fragments the IP payload into smaller datagrams, replicating header fields, setting MF flags, and calculating offsets in multiples of 8 bytes.

• Reassembly: Reassembly occurs only at the ultimate destination host, never at intermediate routers. If any single fragment is lost, the entire original datagram must be discarded.

• Path MTU Discovery (PMTUD): Senders set DF=1 on outgoing packets. If a router cannot forward due to a small MTU, it drops the packet and returns an ICMP "Fragmentation Needed" message containing the link's MTU, allowing the sender to adjust its maximum segment size and avoid fragmentation entirely.

  • IPv4 Addressing:

• 32-bit numerical identifier, globally unique, represented as four decimal octets separated by dots (e.g., 192.168.1.75).

• Hierarchical Structure: Network Portion (Prefix) identifies the physical network/subnet; Host Portion identifies the individual interface on that subnet.

• Subnet Mask: A 32-bit mask with contiguous 1s across the network bits and contiguous 0s across the host bits. Bitwise ANDing an IP address with its subnet mask yields the Network Address:     $\text{Network Address} = \text{IP Address} \;\&\; \text{Subnet Mask}$

• Historical Classful Addressing (Pre-1993):

  • Class A: Starts with bit 0. Format /8 (8-bit net, 24-bit host). Range 0.0.0.0 to 127.255.255.255. Provides 128 network blocks, each supporting $2^{24} - 2 = 16,777,214$ hosts.

  • Class B: Starts with bits 10. Format /16 (16-bit net, 16-bit host). Range 128.0.0.0 to 191.255.255.255. Provides $2^{14} = 16,384$ networks, each supporting $2^{16} - 2 = 65,534$ hosts.

  • Class C: Starts with bits 110. Format /24 (24-bit net, 8-bit host). Range 192.0.0.0 to 223.255.255.255. Provides $2^{21} = 2,097,152$ networks, each supporting $2^8 - 2 = 254$ hosts.

  • Class D: Starts with 1110 (Multicast). Range 224.0.0.0 to 239.255.255.255.

  • Class E: Starts with 1111 (Experimental/Reserved). Range 240.0.0.0 to 255.255.255.255.

  • Address Deductions: On any subnet, the all-zero host address is reserved as the Network Address, and the all-one host address is reserved as the Subnet Broadcast Address.

• Classless InterDomain Routing (CIDR):

  • Deprecated fixed classes, allowing the network prefix to be of arbitrary bit length: a.b.c.d/x (where $x$ is the prefix length).

  • Enables Route Aggregation (Supernetting): Multiple contiguous network prefixes are combined into a single shorter prefix advertisement (e.g., eight /24 networks aggregated into a single /21 route), drastically reducing routing table sizes.

  • IP Forwarding: Longest Prefix Match (LPM):

• When an IP packet arrives at a router, the router searches its forwarding table for the destination address.

• If the destination matches multiple prefix entries, the router selects the entry with the longest prefix length ($x$), representing the most specific route to the destination.

• If no specific route matches, the router routes the packet via the default route (0.0.0.0/0).

  • IPv6 Overview:

• Developed to address IPv4 32-bit address exhaustion.

• Features 128-bit addresses represented as eight 16-bit hexadecimal blocks separated by colons (e.g., 47CD:1234:4422:AC02:0022:1234:A456:0124).

• Streamlined fixed-size 40-byte base header (eliminates header checksum to accelerate per-hop routing, replaces options with extension headers).

• Built-in support for auto-configuration (SLAAC), IPsec encryption/authentication, and jumbo payloads.

Supporting Network Layer Protocols: ARP, DHCP, and ICMP

• Address Resolution Protocol (ARP):

  • Purpose: Resolves an known Layer 3 IP address to an unknown Layer 2 physical MAC address on the local physical network.

  • ARP Cache (Table): Every host and router interface stores an ARP table mapping IP addresses to MAC addresses and physical ports, with entries expiring after a TTL (typically ~15 minutes).

  • ARP Resolution Procedure:

  1. Host A checks its local ARP cache for the target IP address.

  2. If missing, Host A generates an ARP Request packet containing its own source MAC and IP, and the target's IP address. This is encapsulated in a Layer 2 frame addressed to the broadcast MAC (FF:FF:FF:FF:FF:FF).

  3. All nodes on the local physical segment receive the broadcast. Each inspects the target IP; non-matching nodes silently drop the frame.

  4. The node whose IP matches the target IP creates an ARP Reply packet containing its physical MAC address and unicasts it directly back to Host A's MAC address.

  5. Host A enters the mapping into its local ARP cache and proceeds to transmit its queued data frame.

• Dynamic Host Configuration Protocol (DHCP):

  • Purpose: Automates the allocation and configuration of IP parameters for connecting devices (dynamic IP assignment, leasing, and mobile roaming support).

  • DHCP Four-Step Exchange (DORA):

  1. DHCP Discover: Client broadcasts an initialization request across the local subnet (Source IP: 0.0.0.0, Source Port: 68; Destination IP: 255.255.255.255, Destination Port: 67) carrying a unique transaction ID.

  2. DHCP Offer: A listening DHCP server broadcasts a proposed configuration (Source IP: Server_IP, Source Port: 67; Destination IP: 255.255.255.255, Destination Port: 68) offering an available IP address (yiaddr), subnet mask, lease duration (e.g., 3600 seconds), and transaction ID.

  3. DHCP Request: Client broadcasts an acceptance message referencing the selected server's IP and echoing the offered IP, confirming its choice to all listening DHCP servers.

  4. DHCP ACK: Selected server commits the binding and broadcasts an acknowledgment validating the IP lease.

  • Additional Network Parameters Configured by DHCP:

  • IP address of the first-hop default gateway router.

  • IP address and hostnames of primary and secondary Domain Name System (DNS) servers.

  • Subnet mask (network prefix length).

• Internet Control Message Protocol (ICMP):

  • Companion Layer 3 protocol used by routers and hosts to report network processing errors and exchange diagnostic information back to the source IP.

  • Common ICMP error messages:

  • Destination Unreachable (Type 3): Link down, router route missing, or port closed.

  • Time Exceeded (Type 11): Packet dropped because TTL decremented to 0.

  • Redirect (Type 5): Informs host of a more optimal first-hop router.

  • Echo Request (Type 8) and Echo Reply (Type 0): Diagnostic query-response pairs.

  • Network Diagnostic Utilities Utilizing ICMP:

  • Ping: Transmits ICMP Echo Requests to measure round-trip time (RTT), latency variance, and packet loss percentage.

  • Traceroute: Determines the sequence of Layer 3 routers traversing an end-to-end path. Transmits packets with artificially low, incrementing TTL values: the first packet ($\text{TTL}=1$) expires at the first router, which returns an ICMP Time Exceeded packet revealing its IP; the next packet ($\text{TTL}=2$) reveals the second hop, repeating until the destination is reached.

Routing Protocols: Distance Vector, Link State, Hierarchical Areas, and BGP

• Routing vs. Forwarding:

  • Forwarding (Data Plane): The local hardware-accelerated process of accepting a packet on an input interface, performing a lookup of its destination IP in the forwarding table, and directing it out of the designated output interface.

  • Routing (Control Plane): The network-wide distributed coordination process by which routers exchange topology information and run algorithms to construct and update forwarding tables.

  • Driving Analogy: Routing is calculating the best route across the entire city street network before departure (global view); forwarding is choosing which turn to make at each individual intersection along the journey (local view).

• Distance Vector Routing (Bellman-Ford Algorithm / RIP):

  • Core Concept: Each router maintains a routing table containing a vector of shortest distance estimates (costs) to all destinations, along with the designated next-hop router. Routers exchange their complete distance vectors only with their directly connected immediate neighbors, either periodically (e.g., every 30 seconds) or via triggered updates upon link state changes.

  • Bellman-Ford Equation: If router $x$ has neighbors $v$, its cost to destination $y$ is:     $D_x(y) = \min_v \{ c(x,v) + D_v(y) \}$

  • Failure Dynamics and Count-to-Infinity Problem:

  • Good news (decreased costs) propagates quickly across distance-vector networks, but bad news (increased costs or link failures) propagates slowly.

  • If a link fails, two adjacent routers can become trapped in a mutual dependency loop, each updating its cost through the other and incrementing hop counts endlessly ($2, 3, 4, 5, \dots$) toward infinity.

  • Mitigation Strategies: Setting infinity to a small integer (e.g., RIP defines $\infty = 16$); Split Horizon (a router does not advertise a route back out the interface from which it learned it); Poison Reverse (a router advertises a route back out the same interface with a cost of $\infty$).

• Link State Routing (Dijkstra's Algorithm / OSPF):

  • Core Concept: Every router discovers the operational status and cost of its directly connected links, bundles this information into a Link State Packet (LSP), and disseminates it globally across the network. Consequently, every router builds an identical topological map of the entire network graph and executes Dijkstra's algorithm independently.

  • Reliable Flooding of LSPs:

  • LSP Contents: ID of originating router, list of directly connected active neighbors with link costs, monotonically increasing 32-bit sequence number, and a packet TTL.

  • Routers forward newly received LSPs out of all interfaces except the one it arrived on. Duplicate or older LSPs (identified by sequence numbers) are immediately dropped.

  • Dijkstra's Shortest Path Calculation:

  • Each node maintains two lists: Confirmed (nodes whose shortest path from source is locked) and Tentative (candidate nodes with estimated costs).

  • Algorithm proceeds iteratively: initialize Confirmed with source node at cost 0; select newly confirmed node, inspect its LSP neighbors, calculate costs ($\text{Cost}_{\text{source}\to\text{next}} + \text{Cost}_{\text{next}\to\text{neighbor}}$), insert or update entries in Tentative; move candidate with the lowest cost from Tentative to Confirmed; repeat until Tentative is empty.

• Hierarchical OSPF Routing Areas:

  • Standard OSPF fails to scale across hundreds of thousands of networks due to excessive memory consumption for complete graph topologies and CPU exhaustion from frequent Dijkstra recalculations.

  • Area Partitioning: An Autonomous System is segmented into logical Routing Areas. Link state advertisements (LSAs) generated by internal routers remain strictly confined within their home area.

  • Backbone Area (Area 0): The central core area interconnecting all other non-backbone areas.

  • Area Border Routers (ABRs): Routers belonging simultaneously to Area 0 and a non-backbone area. ABRs summarize the internal routes of their area and inject aggregated summary routes into Area 0, which advertises them into other areas.

  • Trade-off: Achieves massive routing table scalability at the cost of routing optimality, as inter-area traffic is forced through Area 0 even if a shorter physical cross-area link exists.

• Interdomain Routing and Border Gateway Protocol (BGP):

  • Autonomous System (AS): A collection of connected IP routing prefixes under the control of a single administrative entity running a common internal routing policy.

  • Traffic Types: Local Traffic (originates or terminates within the AS) and Transit Traffic (passes through the AS without originating or terminating there).

  • Intra-domain vs. Inter-domain: Intra-domain protocols (OSPF, RIP) focus strictly on internal optimization using hop counts or link metrics. Inter-domain routing (BGP-4) operates between sovereign commercial entities where routing decisions are governed by business contracts, financial peering, and political policy rather than shortest physical path.

  • Path Vector Mechanism: BGP routers (gateways) advertise network reachability along with an enumerated list of autonomous systems traversed to reach that network (the AS-Path attribute; e.g., Prefix 192.4.153.0/24, Path: AS 2 -> AS 1 -> AS 4).

  • Loop Prevention: If a router observes its own AS number within an incoming AS-Path advertisement, it rejects the advertisement immediately.

  • Integration of BGP and IGP: Border routers run External BGP (eBGP) to exchange reachability with peering networks, and Internal BGP (iBGP) to distribute external routes across all routers within the home AS. Interior routers merge BGP external next-hop reachability with interior IGP forwarding tables.

  • Hyperscaler Impact: Large cloud providers (Google, Amazon, Microsoft, Meta) operate massive private inter-datacenter backbones, reaching over 76% of internet destinations directly without traversing Tier 1 transit networks.

Transport Layer Foundations: UDP, Pipelining, and Reliability Models

• Transport Layer Architecture:

  • Bridges the gap between host-to-host network delivery (Layer 3) and application process-to-process delivery (Layer 4).

  • Operates strictly on end-systems (hosts, servers, clients) at the network edge, never within interior routing nodes.

• Application Constraints and Transport Service Classes:

  • Data Loss Sensitivity: Loss-intolerant applications (file transfer via FTP, email via SMTP, web browsing via HTTP, financial applications) require absolute 100% reliable byte delivery. Loss-tolerant applications (real-time voice over IP, video streaming, interactive gaming) can tolerate minor packet loss without functional failure.

  • Bandwidth Sensitivity: Elastic applications adapt dynamically to whatever bandwidth the network provides. Inelastic applications require strict minimum throughput thresholds to maintain functionality.

  • Timing and Delay Sensitivity: Interactive games and telephony demand low propagation latencies ($< 100\text{ ms}$) and minimal jitter (latency variation).

• User Datagram Protocol (UDP):

  • Minimalist, lightweight, connectionless transport protocol (RFC 768).

  • Provides zero reliability mechanisms: no flow control, no congestion control, no ordering, and no acknowledgments.

  • Treats every application transmission as an independent, standalone datagram.

• 8-Byte Header Fields:

  • Source Port Number (16 bits / 2 bytes): Identifies the sending application process port.

  • Destination Port Number (16 bits / 2 bytes): Directs the datagram to the target application socket on the receiving host.

  • Total Length (16 bits / 2 bytes): Total length of the UDP datagram (header plus payload) in bytes.

  • Checksum (16 bits / 2 bytes): Error detection computed over the UDP header, payload, and a 96-bit (12-byte) pseudo-header extracted from the IP layer (Source IP, Destination IP, Protocol type 17, and UDP Length).

  • Reliable Data Transfer Principles:

• Stop-and-Wait Protocol:

  • Sender transmits one data packet with an alternating 1-bit sequence number ($0$ or $1$) and starts an expiration timer.

  • Receiver accepts the packet, checks errors, and returns an ACK ($0$ or $1$).

  • Sender waits until the ACK arrives before transmitting the next packet. If the timer expires before the ACK arrives, the sender retransmits the packet.

  • Inefficiency: If link round-trip time ($\text{RTT}$) is substantial, the sender spends almost all its operational time idle.

  • Performance Calculation Example: Consider a $1\text{ Gbps}$ link ($10^9\text{ bps}$) with a one-way propagation delay of $15\text{ ms}$ ($\text{RTT} = 30\text{ ms}$) transmitting a $1\text{ KB}$ packet ($8000\text{ bits}$):       $T_{\text{transmit}} = \frac{8000\text{ bits}}{10^9\text{ bps}} = 8\,\mu\text{s} = 0.008\text{ ms}$       $\text{Utilization } U = \frac{T_{\text{transmit}}}{\text{RTT} + T_{\text{transmit}}} = \frac{0.008\text{ ms}}{30.008\text{ ms}} \approx 0.000267 \; (0.027\%)$       $\text{Effective Throughput} = \frac{1000\text{ bytes}}{0.030008\text{ s}} \approx 33.3\,\text{kB/s}$       A $1\text{ Gbps}$ physical channel is throttled to $33.3\,\text{kB/s}$ by protocol design.

• Pipelined Protocols:

  • Allows the sender to have multiple packets transmitted and in-flight across the link simultaneously without waiting for immediate acknowledgments.

  • Utilizes a Sliding Window: Sequence number space is partitioned into four dynamic segments:

1. Packets already transmitted and acknowledged.
2. Packets transmitted but unacknowledged (in-flight; size bounded by window $N$).
3. Available sequence numbers for packets ready to transmit immediately.
4. Forbidden sequence numbers beyond the current window boundary.

• Go-Back-N (GBN):

  • Sender allows up to $N$ unacknowledged packets. Employs a single timer associated with the oldest unacknowledged packet.

  • Cumulative Acknowledgment: An acknowledgment for packet sequence $k$ indicates that all packets through $k$ have been received successfully.

  • Receiver Simplicity: Receiver accepts only strictly in-order packets. If packet $k$ is lost, all subsequent out-of-order packets ($k+1, k+2, \dots$) are discarded, and the receiver re-acknowledges the last correctly received in-order packet.

  • Upon timer expiration, the sender "goes back $N$" and retransmits all unacknowledged packets in the window.

• Selective Repeat (SR):

  • Sender allows up to $N$ in-flight packets, maintaining an independent retransmission timer for every individual packet.

  • Receiver accepts and buffers out-of-order packets falling within its receive window, transmitting individual non-cumulative ACKs for each.

  • Upon timer expiration, the sender retransmits only the specific unacknowledged packet that timed out.

  • Requires extensive buffering at both sender and receiver.

• Piggybacking: In bi-directional (full-duplex) streams, acknowledgment numbers are embedded directly inside returning data frames, eliminating dedicated Layer 4 ACK packet overhead.

Transmission Control Protocol (TCP): Mechanisms, State, Flow, and Congestion Control

• TCP Architecture and Characteristics (RFCs 793, 1122, 1323, 2018, 2581):

  • Point-to-point, full-duplex, reliable, connection-oriented byte stream protocol with flow and congestion control.

  • Does not preserve application message boundaries; packages bytes into segments based on Maximum Segment Size (MSS) and network limits.

• Detailed TCP Header Fields:

  • Source Port (16 bits) & Destination Port (16 bits): Identify transmitting and receiving application endpoints.

  • Sequence Number (32 bits): Byte stream sequence number of the first payload byte in the segment.

  • Acknowledgment Number (32 bits): Next byte sequence number the receiver expects to receive (cumulative ACK).

  • Data Offset / Header Length (4 bits): Specifies TCP header length in 32-bit words (minimum 5 words = 20 bytes).

  • Control Flags (9 bits):

  • URG: Urgent pointer field is valid.

  • ACK: Acknowledgment field is valid (set on all packets after initial SYN).

  • PSH: Push function; requests receiver push buffered data to application immediately.

  • RST: Reset the connection due to an unrecoverable error or rejected connection.

  • SYN: Synchronize sequence numbers during connection establishment.

  • FIN: No more data from sender; initiates connection termination.

  • CWR & ECE: Explicit Congestion Notification negotiation and signaling.

  • Window Size (16 bits): Advertised flow-control receive window (RcvWindow), indicating the number of free buffer bytes available.

  • Checksum (16 bits): One's complement sum covering header, payload, and pseudo-header.

  • Urgent Pointer (16 bits): Offset to urgent data when URG flag is set.

  • Options (variable): Negotiates MSS, Window Scaling, Timestamps, Selective Acknowledgment (SACK).

• Connection Life Cycle Management:

  • Three-Way Handshake (Connection Establishment):

  1. Active Open (Client): Sends segment with SYN=1, random client Initial Sequence Number ($\text{seq}=x$), and server destination port.

  2. Passive Open (Server): Responds with SYN=1, ACK=1, server Initial Sequence Number ($\text{seq}=y$), and acknowledgment number set to $\text{ack}=x+1$.

  3. Completion (Client): Sends segment with ACK=1, $\text{seq}=x+1$, and $\text{ack}=y+1$. Can carry application data.

  • Four-Way Handshake (Connection Teardown / Half-Close):

  1. Host A transmits FIN=1 ($\text{seq}=u$) to initiate termination (active close).

  2. Host B transmits ACK=1 ($\text{ack}=u+1$). Connection enters half-closed state: Host A cannot send data, but Host B may continue sending data to Host A.

  3. When Host B finishes, it transmits FIN=1 ($\text{seq}=v$).

  4. Host A responds with ACK=1 ($\text{ack}=v+1$) and enters TIME-WAIT (waiting for twice the Maximum Segment Lifetime, $2\text{MSL}$, typically 1–2 minutes) to ensure Host B receives the final ACK before fully closing.

• TCP Receiver ACK Generation Rules:

  • In-order segment arrival, no gaps, everything previously ACKed: Delay sending ACK. Wait up to $500\,\text{ms}$ for next segment. If no segment arrives, transmit single ACK.

  • In-order segment arrival, no gaps, one delayed ACK pending: Immediately send single cumulative ACK covering both segments.

  • Out-of-order segment arrival (gap detected): Immediately transmit a duplicate ACK specifying the sequence number of the next expected in-order byte.

  • Arrival of segment that partially or completely fills a gap: Immediately send an ACK acknowledging the highest in-order byte received.

• Fast Retransmit:

  • Timeouts are conservative to prevent false retransmissions. To recover faster, TCP monitors duplicate ACKs.

  • When a sender receives 3 duplicate ACKs (4 identical ACKs total) for a segment, it infers that the segment immediately following that ACK number was dropped in the network.

  • The sender executes Fast Retransmit, immediately retransmitting the missing segment before its retransmission timer expires.

• TCP Flow Control:

  • Prevents a fast sender from overflowing a slow receiver's input buffers.

  • Receiver explicitly advertises its remaining buffer capacity via the Window Size (RcvWindow) field in each TCP header:     $\text{RcvWindow} = \text{RcvBuffer} - [\text{LastByteRevd} - \text{LastByteRead}]$

  • The sender guarantees that the volume of unacknowledged data never exceeds RcvWindow:     $\text{LastByteSent} - \text{LastByteAcked} \le \text{RcvWindow}$

  • Zero-Window Probing: If RcvWindow drops to 0, the sender pauses transmission but periodically sends 1-byte probe segments to prompt the receiver to return an updated window size, avoiding deadlock when application reads drain the buffer.

• TCP Congestion Control:

  • Congestion Manifestations: Router buffer overflows causing dropped packets, and long queuing delays that provoke premature retransmissions, wasting network capacity.

  • Congestion Window (cwnd): Dynamic sender-side limit reflecting network capacity. The sender restricts in-flight data to:     $\text{Max In-Flight Bytes} \le \min(\text{cwnd}, \text{RcvWindow})$

  • Slow Start Phase: Probes network bandwidth upon connection startup. Begins with $\text{cwnd} = 1\,\text{MSS}$. For every ACK received, $\text{cwnd}$ increases by $1\,\text{MSS}$, effectively doubling $\text{cwnd}$ every round-trip time ($\text{RTT}$) (exponential growth).

  • Congestion Avoidance Phase: Triggered when $\text{cwnd}$ reaches the slow start threshold (ssthresh). Increases $\text{cwnd}$ additively by $1\,\text{MSS}$ per RTT ($\text{cwnd} = \text{cwnd} + \text{MSS} \times (\text{MSS}/\text{cwnd})$ per received ACK) to gently probe for available link bandwidth.

• Response to Packet Loss:

  • TCP Tahoe: Regardless of whether loss is signaled by a timeout or 3 duplicate ACKs, sets $\text{ssthresh} = \text{cwnd} / 2$, drops $\text{cwnd} = 1\,\text{MSS}$, and reverts to Slow Start.

  • TCP Reno: Distinguishes loss types:

  • Timeout: Sets $\text{ssthresh} = \text{cwnd} / 2$, drops $\text{cwnd} = 1\,\text{MSS}$, enters Slow Start.

  • Triple Duplicate ACKs: Enters Fast Recovery. Sets $\text{ssthresh} = \text{cwnd} / 2$, sets $\text{cwnd} = \text{ssthresh} + 3\,\text{MSS}$, and increments by $1\,\text{MSS}$ for each subsequent duplicate ACK. When an ACK for the missing data arrives, sets $\text{cwnd} = \text{ssthresh}$ and resumes linear Congestion Avoidance (Additive Increase, Multiplicative Decrease - AIMD).

• TCP Fairness: AIMD forces multiple competing TCP flows sharing a bottleneck link of capacity $R$ to converge toward an equal bandwidth share ($R/M$). In practice, fairness is skewed by UDP traffic (which does not back off) and browsers opening multiple parallel TCP connections.

Application Layer, Sockets, and the Domain Name System (DNS)

• Transport Layer Demultiplexing via Port Numbers:

  • Operating systems manage network communication via Sockets, the software interfaces through which application processes write and read network data.

  • Port Address Space: 16-bit integers (0 to 65535). Port numbers 0–1023 are Well-Known Reserved Ports (HTTP: 80, HTTPS: 443, SMTP: 25, DNS: 53, SSH: 22, Telnet: 23). Ports 1024–49151 are registered ports; 49152–65535 are dynamic/ephemeral client ports.

  • Demultiplexing Keys:

  • UDP Sockets: Identified solely by a 2-tuple: <Destination IP, Destination Port>.

  • TCP Sockets: Identified by a 4-tuple: <Source IP, Source Port, Destination IP, Destination Port>.

  • This 4-tuple allows a server process listening on port 80 to establish concurrent, isolated communication sockets with multiple clients using the same port number.

• Socket Programming Workflow (TCP vs. UDP):

  • TCP Connection Workflow:

  1. Server creates a listening socket (socket()), binds it to a local port (bind()), and marks it passive (listen()).

  2. Server calls accept(), blocking until an incoming connection arrives.

  3. Client creates a socket (socket()) and calls connect(), specifying the server's IP and port, initiating the 3-way handshake.

  4. Server unblocks from accept(), instantiating a new dedicated connection socket to service the client thread while the listening socket continues awaiting new connections.

  5. Data is transferred via streaming calls (read() / write()).

  6. Sockets are closed (close()).

  • UDP Connectionless Workflow:

  • Server and client create datagram sockets. No connection handshake takes place. Data is transmitted directly with explicit destination addresses attached using sendto() and retrieved using recvfrom().

• Naming, Addresses, and Resources:

  • Name: A persistent, location-independent human-friendly identifier that survives system migrations and restructuring.

  • Address: A routing-dependent spatial identifier indicating where a machine or service currently resides.

  • Uniform Resource Locators (URLs): Impure names because they couple a protocol and domain name with a physical server file-system path (e.g., https://ecs.wgtn.ac.nz/Courses/NWEN243_2026T2/). If the server directory changes or the file is relocated, the URL breaks.

• Domain Name System (DNS):

  • An application-layer distributed database running over UDP/TCP port 53, mapping human-readable domain names to numerical IP addresses.

  • Scalability via Decentralization: A centralized directory would suffer from a catastrophic single point of failure, massive traffic concentration, high propagation delays, and impossible maintenance overhead.

  • Hierarchical Tree Structure: Root Domain (.) at the top, branching to Top-Level Domains (TLDs: generic like .com, .org, or country-code like .nz, .uk), Second-Level Domains (.ac.nz, .vuw.ac.nz), and subdomains (ecs.vuw.ac.nz).

  • DNS Server Hierarchy:

  • Root Name Servers: 13 logical root server addresses worldwide (named a.root-servers.net through m.root-servers.net), operated by organizations like ICANN, NASA, and USC-ISI, replicated across hundreds of physical anycast instances.

  • Top-Level Domain (TLD) Servers: Manage generic domains (.com, .net) and country codes (.nz).

  • Authoritative Name Servers: Provide definitive, official name-to-IP mappings for specific organizational zones.

  • Local Name Servers (Resolvers): Operated by ISPs and universities, intercepting client queries to provide cached answers or coordinate resolution.

  • Query Resolution Modes:

  • Recursive Query: The queried DNS server takes full responsibility for resolving the request. If it lacks the answer, it queries other servers on the client's behalf, returning only the final address or failure.

  • Iterative Query: The queried DNS server returns the best referral it holds locally: "I do not know the answer, but contact this name server next."

  • DNS Resource Records (RR): Entries in the database formatted as 4-tuples: (Name, Value, Type, TTL).

  • Type A: Maps hostname to IPv4 address (e.g., circa.ecs.vuw.ac.nz -> 130.195.5.12).

  • Type AAAA: Maps hostname to IPv6 address.

  • Type NS: Maps domain to the authoritative name server for that zone (e.g., ecs.vuw.ac.nz -> 130.195.5.12).

  • Type CNAME: Maps an alias name to a canonical (real) domain name.

  • Type MX: Maps domain to the designated mail exchange server handling incoming mail.

  • Type SOA (Start of Authority): Contains zone management parameters, serial numbers, and refresh intervals.

  • DNS Caching: Resolved mappings are stored locally in name server caches for the duration specified by the record's Time-To-Live (TTL). Caching drastically reduces global query traffic, but delays the propagation of DNS configuration updates until cached entries expire.

Network Security Perimeters: Firewalls, Security Groups, and Protocol Encapsulation

• Firewall Hierarchies:

  • Stateless Packet Filters: Inspect each packet in complete isolation against fixed rules (IP 5-tuples: Protocol, Source IP, Dest IP, Source Port, Dest Port). Fast, but incapable of tracking connection state or inspecting application payloads.

  • Stateful Inspection Filters: Monitor TCP connection handshakes and packet sequences. Automatically recognize return/reply traffic for established outbound connections, permitting replies without requiring explicit reverse rules.

  • Application-Layer Gateways (Proxies): Reconstruct transport streams, fully parse application protocols (HTTP, FTP, DNS), and inspect payloads for malicious content, compliance, and unauthorized data leakage.

• AWS Security Groups (Instance-Level Firewalls):

  • A stateful virtual firewall applied directly to an EC2 instance's Elastic Network Interface (ENI), rather than at the subnet boundary.

  • Rule Structure: Each rule defines a 3-tuple: Protocol (TCP, UDP, ICMP), Port Range (e.g., 22, 443, 8000–8100), and Source/Destination (CIDR block such as 203.0.113.0/24, 0.0.0.0/0 for universal access, or the ID of another Security Group).

  • Differences from Classic Firewalls:

  • No Deny Rules: Operates on a default-deny whitelist model. Rules only grant access; there is no rule to explicitly block or deny specific IPs. Multiple attached security groups are evaluated as a logical union.

  • Stateful Behavior: If an inbound packet is permitted by an ingress rule, all return traffic for that specific session is automatically permitted outbound, regardless of egress rules.

  • Dynamic Security Group References: Rules can specify another Security Group ID as a traffic source, allowing auto-scaled instances within that group to communicate without maintaining static IP tables.

  • Network Access Control Lists (NACLs): Operated at the AWS VPC subnet boundary. Stateless, evaluated in sequential numerical order, and support explicit deny rules.

• The Dual Hourglass of Network Architecture:

  • The Classic IP Hourglass: Designed intentionally around the minimal, universal waist of the Internet Protocol (IP). Above IP sit diverse transport and application protocols (TCP, UDP, HTTP, DNS, SMTP); below IP sit diverse physical and link technologies (Ethernet, Wi-Fi, optical fibre, 5G). Enables any application to run over any physical link.

  • The Modern Firewall Hourglass: Created emergently by widespread firewall filtering and restrictive corporate security rules. Firewalls routinely block non-standard ports, but almost universally permit ports 80 (HTTP) and 443 (HTTPS).

  • Consequently, HTTP/HTTPS over port 443 has become the de facto "narrow waist" through which modern application protocols are tunneled (WebSockets, VPNs, git, gRPC, RPC).

  • Because Transport Layer Security (TLS) encrypts traffic over port 443, firewalls cannot inspect payload content at the network boundary, forcing deep security inspection to shift upward into application-layer proxies and authentication gateways.

Cloud Computing Foundations, Evolution, Economics, and Service Models

• Definitions of Cloud Computing:

  • NIST Definition: A model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

  • Vaquero et al. Definition: A large pool of easily usable and accessible virtualized resources dynamically reconfigured to adjust to variable load, optimizing resource utilization through a pay-per-use economic model governed by customized Service Level Agreements (SLAs).

  • Key Defining Characteristics:

  • On-demand self-service without human provider intervention.

  • Broad network access via standard protocols and devices.

  • Resource pooling (multi-tenancy) abstracting physical locations.

  • Rapid elasticity to scale resources dynamically up or down.

  • Measured service (utility pay-per-use billing).

  • Illusion of infinite computing resources available on demand.

• Technological Precursors to the Cloud:

  • The cloud represents a convergence of established computing paradigms:

  • Mainframe Time-Sharing: Remote teletype computing (first demonstrated between Dartmouth College and New York in 1940).

  • Cluster and High-Performance Computing (HPC): Coupling networked commodity machines to execute parallel computations.

  • Grid Computing: Coordinated resource sharing across heterogeneous institutions to solve scientific challenges (popularized by the Globus Alliance in the 1990s).

  • Utility Computing: Offering computational capacity, disk space, and memory as a metered utility service similar to electricity (late 1990s).

  • Software as a Service (SaaS): Network-hosted application subscriptions (emerged 2001).

  • Service-Oriented Architecture (SOA): Decoupled system components communicating via standardized web-service interfaces.

• Economic Models and IT Expenditure Restructuring:

  • Traditional corporate data centres require massive upfront Capital Expenditures (CapEx), tying up capital in server rooms, power plants, and chassis.

  • Cloud computing converts CapEx into dynamic Operational Expenditures (OpEx), allowing enterprises to pay incrementally based on consumption.

  • Prior to cloud migration, enterprises spent roughly 80% of their total IT budgets merely maintaining existing infrastructure (maintenance, operating overhead, power, cooling, and staff), leaving only 20% for innovation.

  • Migration to cloud infrastructure drives dramatic cost reductions:

  • Annualized Hardware Costs decrease by $\sim 88.7\%$.

  • Power and Facilities Costs decrease by $\sim 88.8\%$.

  • Operations and Maintenance Labor Costs decrease by $\sim 80.7\%$.

  • Overall annual operating expense decreases by roughly $80\%$, freeing capital for business innovation.

• The Capacity Provisioning Problem: Elasticity vs. Scalability:

  • Scalability: The structural property of a system, network, or algorithm indicating its capacity to handle growing workloads by adding resources (hardware or nodes) without architectural failure.

  • Elasticity: The dynamic property of a cloud platform to provision and de-provision physical and virtual resources autonomously in real time to match fluctuating demand curves.

  • The Flaws of Static Capacity Forecasting:

  • Under-Provisioning (Capital Deficit): Occurs when actual workload spikes exceed the provisioned hardware capacity. Leads to dropped requests, application crashes, customer frustration, and permanent loss of revenue.

  • Over-Provisioning (Capital Surplus): Occurs when hardware is sized to comfortably handle occasional peak annual traffic. During normal periods, capacity sits idle, resulting in low hardware utilization (historically $\sim 30\%$ in private data centres) and massive capital waste.

  • Elastic Cloud Solution: Dynamic auto-scaling continuously matches infrastructure to the real-time demand curve, eliminating both surplus and deficit.

• The Cloud Service Spectrum:

  • Arranged by increasing abstraction (and velocity) and decreasing management control (flexibility):

• Detailed Service Level Breakdown:

  • Infrastructure as a Service (IaaS):

    • Provider Manages: Physical facilities, power, cooling, network switches, server chassis, and virtualization hypervisors.

    • Customer Manages: Operating System installation, patching, runtime environments, middleware, security configuration, firewalls, and application code.

    • Examples: Amazon EC2, Google Compute Engine, Microsoft Azure VMs.

  • Containers as a Service (CaaS):

    • Provider Manages: Hardware, hypervisor, OS kernel, and container runtime engine (e.g., Docker, containerd) across managed worker nodes.

    • Customer Manages: Container images, library dependencies, application binaries, and container orchestration configurations.

    • Examples: Amazon ECS, Amazon EKS, Google Kubernetes Engine (GKE).

  • Platform as a Service (PaaS):

    • Provider Manages: Everything from hardware up through the operating system, language runtime, web server frameworks, automated scaling, and database engines.

    • Customer Manages: Application code and data schemas.

    • Examples: AWS Elastic Beanstalk, Google App Engine, Heroku.

  • Function as a Service (FaaS / Serverless):

    • Provider Manages: The entire software execution environment, event dispatchers, operational scaling, and underlying server instances. The server concept is entirely hidden.

    • Customer Manages: Discrete, stateless, single-purpose function code blocks executed in response to event triggers.

    • Examples: AWS Lambda, Google Cloud Functions, Azure Functions.

  • Software as a Service (SaaS):

    • Provider Manages: The complete application stack end-to-end.

    • Customer Manages: End-user access configuration, data input, and application preferences.

    • Examples: Google Docs, Microsoft Office 365, Salesforce.

  • The Pizza as a Service 2.0 Analogy:

• Traditional On-Premises = Homemade: You manage everything (electric/gas, oven, fire, pizza base, toppings, drinks, dining table, friends, conversation).

• IaaS = Communal Kitchen: Vendor provides kitchen utilities and oven; you provide pizza, fuel/fire, drinks, and conversation.

• CaaS = Bring Your Own: Vendor manages kitchen, oven, and utilities; you manage the pizza and drinks.

• PaaS = Takeaway: Vendor makes and bakes the pizza; you provide the home table, drinks, and conversation.

• FaaS = Restaurant: Vendor provides dining space, cooks pizza, and serves slices when ordered; you bring friends and conversation.

• SaaS = Catered Party: Vendor provides the venue, food, drinks, and entertainment; you simply attend.

Virtualization Technologies, Hypervisors, and Infrastructure Management

• Foundations of Server Virtualization:

  • Decouples the operating system and applications from the underlying physical computer hardware.

  • Historical Emergence: First introduced on IBM CP-67 / System 370 mainframes in 1972 to allow multiple interactive users to partition batch processing resources.

  • Popek-Goldberg Virtualization Requirements (1974):

  1. Equivalence: A program running within a virtual machine must exhibit behavior essentially identical to its execution on dedicated native hardware.

  2. Performance: The vast majority of machine instructions must be executed directly by the host processor without software emulation intervention.

  3. Control (Safety): The Virtual Machine Monitor (VMM) must maintain absolute, complete control over all physical system resources.

• Virtual Machine Monitor (VMM) / Hypervisor Architecture:

  • Intercepts and virtualizes sensitive and privileged hardware instructions, manages virtual memory address translations (Shadow Page Tables / Extended Page Tables), and arbitrates I/O operations across guests.

• Hypervisor Classifications:

  • Type I (Bare-Metal) Hypervisors: Deployed directly on the physical computer hardware without an underlying host operating system. The hypervisor acts as the kernel. Delivers low overhead, near-native performance, and robust isolation. Examples: VMware ESXi, Xen, KVM (Kernel-based Virtual Machine).

  • Type II (Hosted) Hypervisors: Runs as a standard application process on top of a conventional host operating system (e.g., Windows, macOS, Linux). Relies on the host OS for hardware drivers and scheduling, resulting in higher execution overhead. Examples: Oracle VirtualBox, VMware Workstation.

  • Full Hardware Emulation: Emulates an entire processor architecture in software, decoding and translating non-native instruction sets (e.g., running an ARM instruction set on an x86 host via QEMU or Android emulators). Substantially slower.

  • Anatomy and Encapsulation of a Virtual Machine:

• A complete virtual machine is encapsulated within a small set of files stored on disk:

  • Configuration File: Plaintext or XML describing virtual CPU allocations, RAM sizing, virtual disk UUID mappings, MAC addresses of virtual network adapters (vNICs), and peripheral attachments.

  • Virtual Disk Files: Formatted raw or dynamically expanding block images representing the physical drive (e.g., VMDK, VHD, QCOW2).

  • Paging, Log, and Memory Snapshot Files: Preserves running execution states.

• Because VMs exist as files, backing up, duplicating, migrating, or archiving an entire physical server requires only standard file-copying operations.

• Infrastructure as Code (IaC): Virtual machine specifications are automated through declarative code definitions (e.g., Terraform, AWS CloudFormation), ensuring consistent, repeatable environment provisioning.

  • Server Consolidation:

• Consolidation Ratio: The ratio of virtual server instances running concurrently on a single physical host machine (e.g., 4:1 or 6:1).

• Efficiency Impact: Consolidating legacy physical servers at a 4:1 ratio eliminates roughly 75% of physical hardware in a data centre, directly cutting capital costs, floor space, cooling demands, power consumption, and network cabling.

  • Virtual Infrastructure Managers (VIMs):

• Act as the distributed "Operating System" of the cloud data centre, managing the M:N mapping of thousands of virtual machines across pools of physical compute nodes.

• Responsibilities:

  • Automated scheduling, dynamic provisioning, and cluster-wide resource allocation.

  • Monitoring physical host load metrics to balance workloads and mitigate thermal hotspots.

  • Power management: migrating VMs to consolidate loads onto a minimal subset of physical servers during off-peak periods and placing idle servers into low-power sleep states.

  • High Availability (HA): Detecting host hardware failures, performing live migration of running VMs across hosts without service interruption, or automatically restarting check-pointed VMs on healthy backup nodes.

Cloud Storage Systems and Parallel Data Processing (MapReduce/Hadoop)

• AWS Cloud Storage Architecture:

• Instance Store (Ephemeral Storage):

  • Solid-state or magnetic drives physically attached to the server chassis hosting the EC2 instance.

  • Delivers high I/O performance and low latency.

  • Critical Constraint: Storage is strictly ephemeral. If the instance is stopped, terminated, or suffers hardware failure, all data in the instance store is permanently lost.

• Elastic Block Store (EBS):

  • Persistent, network-attached block-level storage volumes.

  • Mounted to an EC2 instance as a standard formatted raw block device, functioning identically to a local hard drive.

  • Suited for primary operating system root volumes, transactional databases, and raw file systems requiring low-latency random read/write access.

  • Features automated snapshots saved asynchronously into Amazon S3 for durable point-in-time recovery.

• Simple Storage Service (S3):

  • Highly durable ($99.999999999\%$ - "11 nines" durability), massively scalable, distributed object storage service.

  • Does not utilize a traditional hierarchical file system; data is organized as discrete binary objects stored in flat namespaces called Buckets.

  • Objects are accessed via unique keys through standardized REST and SOAP web service APIs (HTTP GET, PUT, DELETE).

• Elastic File System (EFS):

  • Fully managed, elastic Network File System (NFSv4) that can be mounted simultaneously by hundreds of EC2 instances, providing shared file-level access.

• S3 Glacier: Low-cost, long-term archival storage designed for cold data and compliance records where retrieval times of minutes to hours are acceptable.

  • Parallel Computing Models and Amdahl's Law:

• Distributed vs. Parallel Systems:

  • Parallel Computing: Multiple processor cores executing within a tightly coupled, single shared-memory system sharing a common CPU clock.

  • Distributed Computing: Multiple independent computers, each with private memory, interconnected by a network and coordinated via message passing; loosely coupled with no shared clock.

• Flynn's Classical Computer Architecture Taxonomy:

  • Single Instruction, Single Data (SISD): Traditional uniprocessor sequential execution.

  • Single Instruction, Multiple Data (SIMD): A single instruction operates synchronously on multiple data points (vector processors, graphics processing units - GPUs).

  • Multiple Instruction, Single Data (MISD): Multiple instructions operate on a single data stream (pipelined architectures, fault-tolerant redundant computing).

  • Multiple Instruction, Multiple Data (MIMD): Multiple independent processors execute different instruction streams on different data streams (multi-core CPUs, distributed clusters).

• Parallel Computing Limits - Amdahl's Law (1967):

  • Determines the maximum theoretical speedup of a program when executed across $N$ parallel processor cores.

  • Let $P$ be the proportion of the computational program that can be made parallel, and $(1 - P)$ be the inherently serial portion:       $\text{Speedup } S(N) = \frac{1}{(1 - P) + \frac{P}{N}}$

  • As the number of processors $N$ approaches infinity, the maximum possible speedup is strictly bounded by the reciprocal of the serial portion:       $\lim_{N \to \infty} S(N) = \frac{1}{1 - P}$

* *Example:* If a program is $90\%$ parallelizable ($P = 0.90$) and $10\%$ serial ($1 - P = 0.10$), the absolute maximum theoretical speedup on an infinite number of processors is:

      $S(\infty) = \frac{1}{1 - 0.90} = \frac{1}{0.10} = 10$

• The MapReduce Programming Paradigm (Google 2004 / Apache Hadoop):

  • Designed to process petabytes of unstructured or semi-structured data distributed across thousands of commodity server nodes.

  • Abstracts away the complex distributed engineering challenges: network communications, data partitioning, scheduling, load balancing, and node failure recovery.

• Execution Pipeline Phases:

  1. Splitting: The input dataset is split into independent blocks (e.g., 64 MB or 128 MB blocks) distributed across the cluster via a distributed file system (HDFS/GFS).

  2. Map Phase: Worker nodes execute a user-defined map function on local data splits, parsing raw data into intermediate key-value pairs:      $\text{map}(k_1, v_1) \to \text{list}(k_2, v_2)$      Example (Word Count): Processes input text lines and emits <word, 1> for every word.

  3. Shuffle and Sort Phase: The MapReduce framework automatically collects intermediate pairs from all mapper nodes, partitions them, transfers them across the network to reducer nodes, and sorts all entries by intermediate key $k_2$.

  4. Reduce Phase: Reducer nodes execute a user-defined reduce function over the sorted intermediate key and its list of associated values, aggregating them into a final output value:      $\text{reduce}(k_2, \text{list}(v_2)) \to \text{list}(v_3)$      Example (Word Count): Sums all 1s associated with a specific word key to produce <word, TotalCount>.

• Strengths: Ideal for "embarrassingly parallel" batch workloads (wide, shallow computation graphs over independent records; text indexing, web graph ranking, statistical aggregation).

• Limitations: Unsuitable for real-time, low-latency processing; significant network latency during the shuffle/sort phase; inefficient for iterative graph algorithms where data must be repeatedly written to and read from disk.

Containerization, Microservices Architecture, and Serverless Computing (FaaS)

• The Shipping Container Analogy:

  • Prior to 1960, cargo shipping was inefficient: goods of disparate shapes, sizes, and handling requirements had to be loaded manually, resulting in complex interactions between cargo and expensive transshipment between boats, trains, and trucks ($M \times N$ handling matrix).

  • The standardized intermodal shipping container (Malcolm McLean, 1956) solved this by introducing a universal shape, structural interface, and handling mechanism. Goods are loaded and sealed once; the container moves across trucks, trains, and ships without modification.

  • Software Analogy: Modern software faces an $M \times N$ complexity matrix: diverse software stacks (databases, web servers, Python, Node.js, Java) must deploy across diverse execution environments (developer laptops, QA servers, staging clusters, multi-cloud platforms). Containers encapsulate code, dependencies, runtimes, and system configurations into a portable, uniform unit that runs consistently across any infrastructure.

• Containers vs. Virtual Machines:

• Virtual Machines: Heavyweight. Each VM virtualizes physical hardware and runs a complete, independent guest operating system (kernel, device drivers, system daemons, utilities), consuming gigabytes of disk space and memory while requiring minutes to boot.

• Containers: Lightweight. Containers share the host operating system's kernel, virtualizing only operating system user-space primitives via Linux namespaces (isolating process IDs, network interfaces, mount points, IPC) and cgroups (enforcing resource limits on CPU, memory, and disk I/O). Containers contain only application binaries and library dependencies, consuming megabytes of disk space and instantiating in milliseconds.

  • Docker Architecture and Image Layering:

• Dockerfile: A declarative script describing the steps to construct an image.

  • Common instructions: FROM <base_image>, RUN <command>, COPY <src> <dest>, WORKDIR <path>, EXPOSE <port>, ENTRYPOINT ["executable", "param"].

• Layered File System (UnionFS / Copy-on-Write):

  • Each instruction in a Dockerfile creates an immutable, read-only filesystem layer identified by a unique cryptographic 256-bit hash.

  • When building or updating an image, only modified or new layers are generated and transferred across the network; unchanged layers are reused from the local cache.

  • When a container instantiates, a thin, writable container layer is added on top of the stacked read-only layers. All modifications during execution occur inside this temporary layer via Copy-on-Write (CoW), preserving the underlying base image.

• Docker Networking: Containers attach to virtual bridge networks (docker0) inside the host. Port mapping flags (e.g., -p 8080:80) bind an external host port (8080) to the container's internal listening port (80), allowing external network traffic to enter the container.

  • Microservices vs. Monolithic Architecture:

• Monolithic Architecture: Packages an entire application (user interface, business logic, data access, database connectors) into a single, cohesive binary or code base executing as a single process.

  • Scaling Penalty: Scaling requires replicating the entire monolith across multiple servers behind a load balancer, replicating idle components and compounding database contention.

  • Tight Coupling: Changes to a single component can introduce system-wide dependencies, increasing testing complexity and deployment friction.

• Microservices Architecture: Decomposes an application into a collection of small, loosely coupled, autonomous services.

  • Characteristics: Each service enforces the Single Responsibility Principle, owns its private database, exposes a standardized API (REST, gRPC), and can be written in any language and scaled horizontally on demand.

  • Function as a Service (FaaS) and Serverless Computing:

• Core Concept: Developers deploy individual, modular functions without provisioning, configuring, or managing physical or virtual servers. Execution is strictly event-driven: code executes only when triggered by an incoming event, and the cloud provider scales function instances automatically.

• Key Architectural Attributes:

  • Stateless: Functions must not persist state locally across invocations; all persistent data must be read from or written to external cloud stores (S3, DynamoDB).

  • Ephemeral: Containers spinning up to execute functions are terminated shortly after execution finishes.

  • Fine-Grained Billing: Charges are incurred purely for execution time measured in milliseconds and memory consumed ($\text{Gigabyte-seconds}$), with zero idle server costs.

• Execution Latency Profiles (Cold Starts vs. Warm Starts):

  • Cold Start: Occurs when a function is invoked with no pre-warmed container ready. The platform must allocate compute resources, download the function container image, configure the execution environment, initialize language runtimes, and execute code. Adds 200–1300 ms of latency.

  • Warm Start: Occurs when a function invocation reuses an already initialized, idle container instance. Initialization overhead is bypassed, reducing execution latency to 1–10 ms.

  • Benchmark Latencies: AWS Lambda shows cold starts of $\sim 469\,\text{ms}$ (overhead $\sim 468\,\text{ms}$, execution $0.6\,\text{ms}$) vs warm starts of $\sim 100\,\text{ms}$ (overhead $\sim 100\,\text{ms}$, execution $0.3\,\text{ms}$). Google Functions exhibits cold starts of $\sim 223\,\text{ms}$; Azure Functions exhibits cold starts of $\sim 1360\,\text{ms}$.

Data Centre Anatomy, Power, Cooling, and Green Computing Strategies

• Data Centre Physical Infrastructure:

  • An industrial facility designed to house tens of thousands of compute servers, massive storage arrays, and network fabrics.

  • Basic Building Blocks:

  • Server Unit: 1U/2U rack-mounted chassis containing motherboards, multicore CPUs, DRAM, solid-state drives, and network interfaces.

  • Rack Unit: Standard 19-inch cabinet housing 40 to 80 servers, connected via a redundant Top-of-Rack (ToR) Ethernet switch.

  • Cluster Unit: An aggregation of roughly 30 server racks interconnected by high-speed cluster switches, forming compute arrays of thousands of nodes.

• Data Centre Storage and Access Hierarchy (Jeff Dean Numbers):

  • System performance is governed by memory hierarchy locality:

  • Local DRAM: Capacity: $16\text{ GB}$, Latency: $100\text{ ns}$, Bandwidth: $20\text{ GB/s}$.

  • Local Disk: Capacity: $2\text{ TB}$, Latency: $10\text{ ms}$, Bandwidth: $200\text{ MB/s}$.

  • Rack DRAM (80 servers): Capacity: $1\text{ TB}$, Latency: $300\,\mu\text{s}$, Bandwidth: $100\text{ MB/s}$.

  • Rack Disk (80 servers): Capacity: $160\text{ TB}$, Latency: $11\text{ ms}$, Bandwidth: $100\text{ MB/s}$.

  • Cluster DRAM (30+ racks): Capacity: $30\text{ TB}$, Latency: $500\,\mu\text{s}$, Bandwidth: $10\text{ MB/s}$.

  • Cluster Disk (30+ racks): Capacity: $4.8\text{ PB}$, Latency: $12\text{ ms}$, Bandwidth: $10\text{ MB/s}$.

• Data Centre Cost Distributions (Amortized Breakdown):

  • Servers (CPU, memory, storage): $\sim 45\%$

  • Power Infrastructure (UPS, generators, power distribution units, cooling plant): $\sim 25\%$

  • Power Draw (Continuous electrical utility billing): $\sim 15\%$

  • Network (Switches, optical transceivers, transit connectivity): $\sim 15\%$

• Energy Consumption and Global Environmental Impact:

  • Data centres consume roughly 240–340 TWh annually ($\sim 1\% - 1.3\%$ of global final electricity demand); cryptocurrency mining adds an additional 110 TWh ($0.4\%$ of global demand).

  • Data centre facilities and transmission networks account for $1\%$ of global energy-related greenhouse gas emissions.

  • Energy demand is highly concentrated geographically: in Ireland, data centres accounted for $18\%$ of national electricity consumption in 2022, projected to reach $28\%$ by 2031.

  • Machine learning workload acceleration: Google estimated ML models consumed 10–15% of its total energy use between 2019 and 2021.

• Power Usage Effectiveness (PUE):

  • Standard metric evaluating data centre physical energy efficiency:     $\text{PUE} = \frac{\text{Total Facility Energy Consumption}}{\text{IT Equipment Energy Consumption}}$

  • An ideal, perfect score is $\text{PUE} = 1.0$, where 100% of incoming electricity directly powers IT compute hardware.

  • Historically, conventional enterprise data centres operate at $\text{PUE} \approx 2.0$ (every 1 watt of compute power consumes an extra 1 watt in cooling and facility overhead).

  • Modern hyperscale cloud providers achieve trailing twelve-month averages of $\text{PUE} \approx 1.10 - 1.11$.

  • Seasonal Fluctuations: PUE exhibits cyclic variations across the year, rising during summer months as high ambient temperatures require increased cooling energy.

• Green Computing Strategies:

  1. Hardware Rightsizing: Dynamically scaling processor clock frequencies, placing inactive CPU cores into low-power C-states, and rightsizing memory allocations to workload intensity.

  2. High-Efficiency Power Distribution: Minimizing alternating current (AC) to direct current (DC) transformation steps by feeding higher-voltage distribution directly to server motherboards, reducing conversion losses.

  3. Onsite Renewable Generation: Procuring dedicated solar and wind power plants adjacent to data centres to avoid the 25–50% transmission line losses inherent in long-distance electrical utility grids.

  4. Free Cooling and Geographic Siting: Siting data centres in naturally cold regions (e.g., Microsoft's Dublin facility, which circulates outside air directly across server rooms instead of running mechanical chillers). Floating data centre barges (Keppel, Nautilus) utilize cold seawater heat exchangers.

  5. Waste Heat Reuse: Approximately $98\%$ of data centre electrical energy is converted into low-grade waste heat. Reclaimed in localized projects: heating municipal swimming pools in Switzerland, district residential heating in Finland (Yandex), and biological greenhouse domes in Seattle (Amazon).

  6. Software Consolidation: Using Virtual Infrastructure Managers to bin-pack VMs tightly onto physical servers, allowing unneeded hosts to be powered off completely.

  7. "Dark" Data Centres: Fully automated robotic facilities where autonomous arms swap drives, replace servers, and handle physical maintenance. Eliminates the need for internal lighting, walkways, and human-friendly climate control, allowing the facility to operate at higher temperatures and reduce cooling overhead.

System Reliability, Hardware vs Software Failure Dynamics, and High Availability Modeling

• Reliability vs. Availability:

  • Reliability ($R(t)$): The mathematical probability that a system or component will perform its required function continuously, without failure, over a specified time duration $t$ under stated environmental conditions.

  • Availability ($A$): The probability that a system is operational and accessible at any random instant when called upon (also referred to as "uptime").

  • Distinction: A system can have high availability by recovering rapidly from frequent crashes (e.g., crashing every 10 minutes but rebooting in 100 milliseconds), but it has terrible reliability. Critical systems require improvements in both dimensions.

• Availability Expressed in "Nines":

  • One Nine (90%): Down 36.5 days per year ($876\text{ hours}$).

  • Two Nines (99%): Down 3.65 days per year ($87.6\text{ hours}$).

  • Three Nines (99.9%): Down 8.76 hours per year ($526\text{ minutes}$).

  • Four Nines (99.99%): Down 52.6 minutes per year ($3154\text{ seconds}$).

  • Five Nines (99.999%): Down 5.26 minutes per year ($315\text{ seconds}$).

  • Six Nines (99.9999%): Down 31.5 seconds per year.

• Failure Classifications:

  • Crash (Fail-Stop) Failures: A node halts completely and permanently ceases responding to network requests. From an external client's perspective, a server crash failure is indistinguishable from a severed network link. Mitigated straightforwardly via simple server replication and timeouts.

  • Byzantine (Arbitrary) Failures: A node fails arbitrarily and unpredictably, generating conflicting, incorrect, or corrupted responses to different clients. Extremely difficult to mask; requires robust distributed agreement protocols (e.g., Paxos, Raft, Byzantine Fault Tolerance requiring at least $3m + 1$ replicas to survive $m$ faulty nodes).

• Hardware vs. Software Failure Dynamics:

  • Hardware Failures: Governed by physical wear, thermal stress, and material degradation. Device failure events are statistically independent, allowing failure rates to be calculated from population data.

  • Software Failures: Originate from human design logic bugs, synchronization race conditions, and unhandled edge cases. Software failures are not statistically independent; software reuse and shared libraries mean a bug triggered on one node will simultaneously crash identical replicas.

• The Bathtub Curve and Failure Metrics:

• Bathtub Curve Stages:

  1. Infant Mortality: Early failures with a decreasing failure rate, caused by manufacturing flaws and component assembly defects.

  2. Useful Life (Normal Life): Extended period of low, nearly constant failure rate driven by random external shocks.

  3. Wear-Out Phase: Late period with a sharply increasing failure rate caused by mechanical degradation, fatigue, and component exhaustion.

• Mean Time Between Failures (MTBF):

  • The average operational hours expected between consecutive hardware failures in a repairable population:       $\text{MTBF} = \frac{\text{Total Operating Hours } T}{\text{Number of Failures } F}$

  • Misconception: An enterprise HDD rated at an MTBF of 1,200,000 hours does not indicate an individual drive will last 136 years. MTBF is a population statistic reflecting failure rates strictly during the flat, useful-life phase of the bathtub curve.

• Annualized Failure Rate (AFR):

  • The estimated percentage of a drive population expected to fail within one full calendar year ($8760\text{ hours}$):       $\text{AFR} = 1 - \exp\left(-\frac{8766}{\text{MTBF}}\right) \approx \frac{8760}{\text{MTBF}}$

  • Annualized Return Rate (ARR): Empirical warranty return rate approximation: $\text{ARR} = \frac{\text{AFR}}{0.6}$.

• Survival Probability at $t = \text{MTBF}$:

  • Assuming a constant failure rate $\lambda = 1/\text{MTBF}$, the probability $P(t)$ that any specific individual component survives up to time $t$ is:       $P(t) = \exp\left(-\frac{t}{\text{MTBF}}\right)$

  • Evaluating at $t = \text{MTBF}$:       $P(\text{MTBF}) = \exp(-1) = \frac{1}{e} \approx 0.367879 \; (36.8\%)$

  • An individual device has only a 36.8% probability of surviving for its calculated MTBF duration.

  • Multi-Node Failure Modeling and Redundancy:

• Scale of Failures in Large Facilities: If a data centre hosts 10,000 drives with an individual MTBF of 2,500,000 hours ($\text{AFR} \approx 0.35\%$), expected annual failures are $10,000 \times 0.0035 = 35\text{ failures/year}$ (~3 per month). At Facebook scale (450,000 servers in 2013 with a standard server $\text{AFR} = 5\%$), the data centre experiences 22,500 server failures annually—averaging roughly 2.5 hardware failures every hour.

• Replica Availability Calculation:

  • If components fail independently with probability $p$, the probability that all $n$ redundant replicas fail simultaneously is $p^n$.

  • The probability that at least one replica survives to maintain service availability is:       $\text{Availability } A = 1 - p^n$

  • Example: If an individual drive has a failure probability of $p = 0.05$ ($5\%$):

    • 1 drive: $A = 1 - 0.05^1 = 0.95 \; (95\%$\text{ availability})

    • 2 drives: $A = 1 - 0.05^2 = 1 - 0.0025 = 0.9975 \; (99.75\%$\text{ availability})

    • 3 drives: $A = 1 - 0.05^3 = 1 - 0.000125 = 0.999875 \; (99.9875\%$\text{ availability})

    • 4 drives: $A = 1 - 0.05^4 = 1 - 0.00000625 = 0.99999375 \; (99.9994\%$\text{ availability, exceeding 5 nines})

Exam Case Studies, Worked Calculations, and Practical Scenarios

• Binary, Hexadecimal, and Decimal Conversion Table:

• Subnetting and CIDR Division (Worked Problems):

  • Problem 1: Partitioning a /23 block into four equal customer subnets.

  • Given Range: 124.197.8.0/23 (or 203.0.1.2/23 from 2024 exam).

  • Total Address Count: A /23 network has $32 - 23 = 9$ host bits. Total addresses = $2^9 = 512$.

  • Division: Partitioning into 4 equal subnets requires stealing $\log_2(4) = 2$ additional subnet bits. The new prefix length is $23 + 2 = /25$.

  • Subnet Size: Each subnet contains $2^{32 - 25} = 2^7 = 128$ total addresses ($126$ usable hosts).

  • Allocated Ranges: Increment by 128 across the fourth octet:

    1. Subnet 1: 124.197.8.0/25 (Range: 124.197.8.0 – 124.197.8.127)

    2. Subnet 2: 124.197.8.128/25 (Range: 124.197.8.128 – 124.197.8.255)

    3. Subnet 3: 124.197.9.0/25 (Range: 124.197.9.0 – 124.197.9.127)

    4. Subnet 4: 124.197.9.128/25 (Range: 124.197.9.128 – 124.197.9.255)

  • Problem 2: Broadcast address calculation for 10.0.2.128/23.

  • Subnet mask for /23 is 255.255.254.0.

  • In binary, the third octet mask is 11111110. Network address for 10.0.2.128 is 10.0.2.0.

  • In a /23, the 9 host bits cover the last bit of the third octet and all 8 bits of the fourth octet.

  • Setting all 9 host bits to 1 yields 10.0.3.255. Thus, 10.0.3.255 is the broadcast address.

  • Problem 3: Subnet mask for Class B 130.196.0.0 with 120 subnets of 500 hosts.

  • To support 500 hosts, each subnet requires at least $h$ host bits where $2^h - 2 \ge 500$. Choosing $h = 9$ provides $2^9 - 2 = 510$ usable hosts.

  • The subnet prefix length is $32 - 9 = 23$ bits (/23).

  • Subnet mask in decimal: 255.255.254.0 (which provides $2^{23 - 16} = 2^7 = 128$ subnets, satisfying the 120 subnet requirement).

• HTTP Latency: Persistent vs. Non-Persistent Connections:

  • Scenario: Client downloads a base HTML file ($T_{\text{file}}$) and 5 referenced image objects ($T_{\text{image}}$) residing on the same server. Setup time for any new TCP connection requires $1\,\text{RTT}$.

  • Non-Persistent HTTP (HTTP/1.0 without parallel sockets):

  • Every object requires a dedicated, separate TCP connection.

  • Base HTML download: $1\,\text{RTT}$ (TCP handshake) + $1\,\text{RTT}$ (HTTP GET and server response) + $T_{\text{file}} = 2\,\text{RTT} + T_{\text{file}}$.

  • Each of the 5 images: Requires separate connection = $5 \times (2\,\text{RTT} + T_{\text{image}}) = 10\,\text{RTT} + 5\,T_{\text{image}}$.

  • Total Non-Persistent Latency: $12\,\text{RTT} + T_{\text{file}} + 5\,T_{\text{image}}$.

  • Persistent HTTP (HTTP/1.1 Pipelined):

  • A single TCP connection is established and reused for all requests.

  • Initial connection setup: $1\,\text{RTT}$.

  • Base HTML download: $1\,\text{RTT} + T_{\text{file}}$.

  • With pipelining, the client parses HTML and requests all 5 images simultaneously back-to-back: $1\,\text{RTT} + 5\,T_{\text{image}}$.

  • Total Persistent Latency: $3\,\text{RTT} + T_{\text{file}} + 5\,T_{\text{image}}$.

  • Latency Difference: Non-persistent HTTP requires 9 additional RTTs of delay relative to persistent pipelined HTTP.

• Step-by-Step Multi-Subnet Packet Forwarding and ARP Trace:

  • Topology: Host adm2 (130.160.192.10, MAC 10:C5:95:82:A0:C0) pings webserver (130.160.190.254, MAC D4:77:82:A0:C3:05). adm2 is on router R2's eth1 subnet (130.160.192.0/24); webserver is on router R1's eth2 subnet (130.160.190.252/30); routers R1 and R2 are interconnected on subnet 130.160.190.0/24.

  • Chronological Execution Steps (Clean Start, Empty Caches):

  1. adm2 inspects destination IP 130.160.190.254, applies its subnet mask (255.255.255.0), and identifies the destination as off-link.

  2. adm2 consults its routing table, selecting its default gateway R2 (130.160.192.1).

  3. adm2's ARP cache lacks R2's MAC. adm2 broadcasts an ARP Request (FF:FF:FF:FF:FF:FF) querying "Who has 130.160.192.1?". Switch records adm2's MAC on its arrival port and floods the frame.

  4. Router R2 (eth1) receives the ARP request, updates its ARP cache with adm2's mapping, and unicasts an ARP Reply with its MAC (D4:77:82:A0:BE:01). Switch learns R2's port and forwards to adm2.

  5. adm2 encapsulates the ICMP Echo Request in an Ethernet frame (Source MAC: adm2, Dest MAC: R2 eth1; Source IP: adm2, Dest IP: webserver) and transmits it.

  6. R2 accepts the frame, strips Layer 2 encapsulation, decrements TTL, and executes Longest Prefix Match in its forwarding table. The match points to next hop R1 (130.160.190.1) out interface eth0.

  7. R2 broadcasts an ARP request on subnet 130.160.190.0/24 for R1's IP. R1 responds with its eth1 MAC (F8:E8:82:A0:C0:01).

  8. R2 rewrites the Layer 2 frame (Source MAC: R2 eth0, Dest MAC: R1 eth1; IP addresses unchanged) and forwards it.

  9. R1 accepts the frame, decapsulates it, decrements TTL, checks its routing table, and finds a direct route for the webserver out eth2.

  10. R1 performs ARP resolution on eth2 to learn the webserver's MAC (D4:77:82:A0:C3:05), rewrites the frame, and delivers the ICMP packet to the webserver.

  11. The webserver generates an ICMP Echo Reply (Source IP: webserver, Dest IP: adm2) and repeats the reverse lookup and forwarding process back through R1 and R2 to adm2.

• Data Centre Drive Replacement Calculations:

  • Calculation 1: Monthly replacement count for 1000 HDDs with MTBF of 35,000 hours.

  • Hours in an average month: $8760\text{ hours/year} / 12\text{ months} = 730\text{ hours}$.

  • Total device hours per month: $1000 \times 730 = 730,000\text{ device-hours}$.

  • Expected monthly failures: $F = \frac{730,000}{35,000} \approx 20.857$.

  • Rounding up to the nearest integer: Technicians must replace 21 drives per month.

  • Calculation 2: Weekly replacement count for 2000 HDDs with MTBF of 100,000 hours.

  • Hours in a week: $24 \times 7 = 168\text{ hours}$.

  • Total device hours per week: $2000 \times 168 = 336,000\text{ device-hours}$.

  • Expected weekly failures: $F = \frac{336,000}{100,000} = 3.36\text{ failures/week}$.

  • Calculation 3: Replica requirement for 99.999% availability given component failure probability $p = 0.07$.

  • Target availability: $A \ge 0.99999$, which requires unreliability $p^n \le 0.00001$.

  • Taking natural logarithms:       $n \cdot \ln(0.07) \le \ln(0.00001)$       $n \cdot (-2.65926) \le -11.51293$       $n \ge \frac{-11.51293}{-2.65926} \approx 4.329$

  • Rounding up to the next integer: Exactly 5 replicas are required to guarantee five nines of availability.

• Green Computing Environmental Trade-Offs (Water Cooling):

  • Desert Environments: Consumptive evaporative cooling towers evaporate millions of gallons of potable water daily, severely depleting scarce regional aquifers and competing with drinking water reserves.

  • Agricultural / Farmland Environments: Massive industrial water consumption by data centres lowers regional water tables, depriving agricultural crops of irrigation water and risking salinization of topsoil.

  • Coastal / Marine Environments: Direct once-through seawater cooling discharges enormous volumes of superheated water back into local estuaries and bays, causing severe thermal pollution that degrades marine oxygen concentrations and destroys coastal fisheries.

  • Barriers to Widespread Waste Heat Reuse:

  1. Low-Grade Thermal Energy: Data centre exhaust water and air are relatively cool ($30^\circ\text{C} - 45^\circ\text{C}$), offering a low temperature differential that is difficult to convert into mechanical work or utilize without expensive heat pumps.

  2. Transport Inefficiency: Transporting thermal heat across distances is physically inefficient due to rapid thermal dissipation in pipes, restricting practical heat reuse strictly to facilities co-located immediately adjacent to the data centre building.