Overview
free

Course Setup and the Incremental Ladder
Why Sockets to Satellites
How to Use This Course
The Incremental Ladder (Step 0 to Step 7)
The Course Lenses
Diagram Legend and Notation Types

Mental Models: Layers, Paths, and Control
The Internet as a Layered System
Control Plane vs Data Plane
Reliability Emerges from Composition

Transport & Network Basics (Conceptual)
Sockets, Ports, and Processes
TCP vs UDP
IP Packets and MTU

Diagramming Networked Systems
Socket Flow Diagrams
Topology Diagrams
Layer Overlays

Step 0 Endpoints: Local Networking and Simple LANs
Single-Host Networking
Simple LANs and Default Gateways
Basic Address Assignment

Step 0 Transport Realities: Connections in Practice
TCP Lifecycle at a High Level: handshake, teardown, and why TIME_WAIT-ish realities matter
Middlebox Awareness: connection tracking, NAT intuition, and stateful filtering effects
Timeouts, Retries, and Reuse: correctness under loss, and how apps accidentally DDoS themselves

Step 0 Delivery: Minimal Network for a Service
The Minimal Service Network: one host, one service, basic firewall rules, and observability hooks
Failure Surfaces: packet loss, port blocks, MTU weirdness, and "it's always DNS" (eventually)
Validation in Small: repeatable tests, traffic captures conceptually, and safe change habits

Step 1 Addressing: Subnets and Practical IP Design
Prefixes and Subnets: conceptual masks, allocation, and why IP planning is architecture
Private vs Public Addressing: translation boundaries and where complexity accumulates
Dual Stack Basics: IPv6 framing, migration posture, and compatibility realities

Step 1 Layer 2: Switching, VLANs, and Segmentation
MACs and Broadcast Domains: why L2 scales until it doesn't
VLAN segmentation: separating traffic by purpose, security zone, and operational ownership
Loop avoidance concepts: spanning-tree-like intuition and failure modes of "just plug it in"

Step 1 Layer 3: Routing Inside an Organization
Routing tables and prefixes: static routes vs dynamic routing families (IGP-level view)
Default routes and gateways: designing the "exit" and preventing accidental hairpins
High availability basics: redundant routers, simple failover, and where state bites you

Step 1 Delivery: Enterprise LAN/WAN Design Slice
Core-Distribution-Access: common topology patterns and why hierarchy helps operations
Zoning by function and risk: prod vs corp, PCI-ish zones, and blast-radius management
NAT/firewalls as architectural boundaries: what they simplify, what they complicate, and how apps adapt

Step 2 DNS Fundamentals
Why Indirection Matters: names as stable handles; IPs as implementation details
Recursive vs Authoritative: caching, recursion, and the latency/availability trade space
TTLs and Propagation: designing for change without lying to yourself about time

Step 2 Records, Zones, and Architecture Patterns
Record Types as Primitives: A/AAAA/CNAME/TXT/SRV-like roles conceptually
Zones and Delegation: scaling ownership across orgs and environments
DNS in Application Architecture: multi-record load distribution and DNS-based failover patterns

Step 2 Service Discovery Strategies
Internal DNS and Split-Horizon Concepts: internal vs external naming, and boundary safety
Naming Conventions at Scale: service/region/env hierarchies that survive re-orgs
When DNS Isn't Enough: dedicated discovery systems conceptually and the cost of "more control"

The Internet as Autonomous Systems
ASNs and the Global Graph: how packets cross many networks
Prefixes and Reachability: why "announcing space" is power
Failure at the Edges: leaks, misconfigs, and why local mistakes go global

BGP Fundamentals and Policy (Conceptual)
Sessions and Route Exchange: peers, advertisements, withdrawals at a high level
Path Selection Intuition: attributes and policy shaping without knob-level depth
Inbound vs Outbound Control: what you can influence, what you mostly can't

Peering, Transit, and Routing Security
Peering vs Transit: economic drivers that become topology
IXPs and Peering Fabrics: why shared interconnects change cost and latency
Routing Security Basics: hijacks/leaks, RPKI intuition, and monitoring posture

Step 4 Edge Mental Models
Latency as Geography: why POPs exist and how proximity becomes product quality
Edge POP Footprints: placement heuristics and failure domains
Origin Shielding: using edge layers to protect core services

Step 4 Anycast and Caching
Anycast Addressing: one IP, many locations; "nearest" via routing outcomes
Cache Hierarchies: hit rates, parent/child caches, and controlling blast radius
Invalidation and Freshness: correctness vs cache efficiency as a living trade

Step 4 Beyond Caching: Edge Services
TLS Termination and WAF at the Edge: shifting work outward (and new trust boundaries)
Edge Compute Concepts: running logic close to users without turning POPs into snowflakes
Multi-CDN Strategies: traffic steering, portability, and operational complexity

Step 5 Load Balancing Fundamentals
L4 vs L7 Load Balancing: connection routing vs request routing as different control levers
Health Checks and Out-of-Rotation: truth, lies, and delayed failure detection
Algorithms and Weights: round robin, least connections, and why "fair" is not always stable

Step 5 Global Traffic Steering
Global Load Balancing Patterns: geo steering, failover, and multi-region posture
Anycast + L7 Steering: combining routing and application logic without fighting yourself
Session Affinity and State: sticky sessions, stateless design, and mobility of traffic

Step 5 Capacity and Failure Engineering
Traffic Engineering Goals: performance vs cost vs resilience in explicit trade-offs
Load Shedding and Admission Control: graceful degradation at edge and origin
Big Event Drills: peak planning, region evacuation patterns, and controlled rollback mindsets

Step 6 Threat Models and Defensive Design
Attack Classes at a High Level: volumetric, protocol, and application-layer pressures
Defense-in-Depth Topologies: edge, mid-tier, origin segmentation and blast-radius control
Flash Crowds vs Attacks: designing systems that survive both without guessing intent

Step 6 DDoS Mitigation Building Blocks
Rate Limiting and Filtering: where to enforce, what signals to use, and failure safety
Scrubbing and Diversion: traffic reroute concepts and operational implications
Anycast as Absorption: distributing attack load and the debugging complexity it introduces

Step 6 Security Operations and Governance
Security Telemetry: flows/logs/metrics and the minimum viable situational awareness
Incident Response for Network Events: runbooks, coordination with providers/peers, and rollback discipline
Policy and Abuse Handling: enforcement, privacy boundaries, and sustainable operations

Step 7 Long-Haul and Backbone Design (Conceptual)
Metro vs Long-Haul vs Subsea: diversity, latency, and capacity as first-class constraints
Owning vs Leasing: when control and predictability justify cost
Failure Domains at Backbone Scale: link cuts, regional events, and diversity planning

Step 7 Satellite and Non-Terrestrial Links (Conceptual)
GEO/MEO/LEO Trade-offs: latency, jitter, handoffs, and link variability as design inputs
Integrating Satellite into Broader Networks: routing posture, backhaul, and service expectations
Designing for Extreme Latency: timeouts, buffering, and user experience under long RTTs

Step 7 Internet-Scale Architecture and Operations
Regions, POPs, and Backbones: stitching edge and core into coherent failure domains
Multi-Cloud and Multi-Backbone: hybrid connectivity strategies and observability challenges
Operating Global Networks: NOCs, staged rollouts, change management, and continuous improvement culture

Step 7 Reference Architectures and Maturity
Global SaaS Network: multi-region ingress, edge acceleration, and operational safety rails
Streaming/Video Delivery Network: throughput, caching strategy, and peak-event readiness
Gaming and Global API Platforms: latency sensitivity, routing choices, and fairness under congestion

/sockets-to-satelites/sockets-to-satelites

Origin Shielding: using edge layers to protect core services

Sign in to access this lesson.

Sign in Create account