Network Security & Internet
Fundamentals

What is Data?

Data is simply information — any information. Your name is data. A photo is data. A song is data. The temperature outside is data. The price of a stock is data.

Humans represent information in many ways — words, drawings, numbers, sounds. But computers can't understand any of those directly. Computers are electronic machines. They only understand one thing: is there an electrical signal or not?

That's it. That's the entire foundation of computing and networking. Everything — every photo, video, email, webpage — is ultimately stored and transmitted as a long sequence of 1s and 0s.

Binary — The Language of Computers

This system of representing everything as 1s and 0s is called binary.

Humans use the decimal system — 10 digits (0–9). We chose 10 probably because we have 10 fingers. Computers use binary — 2 digits (0 and 1) — because transistors (the tiny switches inside every chip) have exactly two states: on or off.

Bits — The Smallest Unit of Data

A single 0 or 1 is called a bit — short for binary digit. It is the absolute smallest possible unit of data. One bit alone can only represent two things: yes/no, on/off, true/false.

Bytes — The Basic Working Unit

8 bits grouped together = 1 Byte. With 8 bits you get 2⁸ = 256 possible combinations — enough to represent every letter (upper and lowercase), every digit, and common symbols.

This mapping of characters to binary numbers is called ASCII (American Standard Code for Information Interchange):

So the word "Hi" stored in a computer is: 01001000 01101001 — two bytes, sixteen 1s and 0s.

Data Sizes

How Bits Travel Physically

When data travels across a network it's still 1s and 0s — just represented differently depending on the physical medium:

The data itself doesn't change — only the physical representation does. At the receiving end it's always converted back to 1s and 0s.

Why Three Number Systems?

Networking regularly uses three number systems. You don't need to be a mathematician — you need to understand what each is, why it exists, and how to read it. Converting between them is a bonus, not a core skill.

Decimal — What You Already Know

Decimal is base 10. Uses 10 digits: 0–9. When you run out of single digits, you add another column to the left. Each column represents a power of 10:

This is so natural we don't even think about it. But this exact same logic applies to every other number system — only the base changes.

Binary — How Computers Think

Binary is base 2. Only two digits: 0 and 1. Each column is a power of 2 instead of a power of 10:

Hexadecimal — Compact Binary

Hexadecimal (hex) is base 16. It uses 16 digits: 0–9 and then A–F for values 10–15. Letters were chosen simply because we ran out of single-digit numbers after 9.

The key insight: one hex digit = exactly 4 binary bits. This makes hex a compact shorthand for binary — much easier to read and write without losing any information.

Decimal ↔ Binary ↔ Hex — Side by Side

Where You'll See Hex in Networking

A computer processes data — but processing takes time. Data needs somewhere to live while the computer works on it, and somewhere to persist when the power goes off. These are two very different requirements solved by two very different types of storage.

RAM — Random Access Memory

RAM is your computer's working space. Everything actively being used right now lives in RAM — your open browser, your document, the video you're watching. The CPU needs to access data billions of times per second, and RAM delivers it in nanoseconds.

HDD — Hard Disk Drive

HDDs are permanent storage. A completely mechanical device with actual moving physical parts — spinning magnetic platters and a read/write head that physically moves across them.

To read data the head must physically seek to the right track, then wait for the platter to spin the right sector underneath — this mechanical movement takes milliseconds, making HDDs vastly slower than RAM.

SSD — Solid State Drive

SSDs also provide permanent storage but with no moving parts at all. They use flash memory — transistors that trap electrical charges permanently, even without power.

HDD vs SSD — Full Comparison

The Full Memory Hierarchy

Storage isn't just RAM vs disk. There is a full hierarchy from fastest and smallest to slowest and largest — each level a tradeoff between speed and cost.

What Actually Happens When You Open an App

This is why apps take a moment to open — that's the time copying from storage into RAM. Once loaded, everything runs fast because the CPU is reading from RAM, not the disk.

The CPU — Brain of the Computer

CPU stands for Central Processing Unit. It is the component that actually executes instructions — it does all the thinking. Everything else — RAM, storage, keyboard, screen — exists either to feed data to the CPU or receive results from it.

The Fetch–Decode–Execute Cycle

This is the fundamental loop every CPU runs, billions of times per second. Everything a computer does — from loading a webpage to running a video game — is just this cycle repeating at incredible speed.

What's Inside a CPU

1. Cores

A core is one complete fetch-decode-execute unit. One core = one thing at a time. Multiple cores = multiple things simultaneously.

2. Clock Speed

The CPU has an internal clock — a crystal that oscillates at a fixed frequency, setting the rhythm for every operation. Every tick of the clock = one cycle. Operations complete in one or more cycles.

3. CPU Cache

We learned about the memory hierarchy in Topic 1.3. The CPU has its own tiny, ultra-fast memory built directly onto the chip called cache. It stores copies of data the CPU uses most frequently so it doesn't have to go all the way to RAM every time.

How This All Connects — Running a Program

The Most Fundamental Relationship in Networking

Everything on the internet is built on one simple relationship — one device asks for something, another device provides it. The one that asks is the client. The one that provides is the server.

What is a Client?

A client is any device or application that initiates a request to get something — a webpage, a file, data, a video stream.

The word "client" doesn't refer to a type of hardware. It refers to a role. Your laptop is a client when you browse the web. Your phone is a client when you open Instagram. Even a server can act as a client when it requests data from another server.

What is a Server?

A server is any device or application that listens for incoming requests and responds to them. The word comes from "to serve" — it serves data to whoever asks.

Again — "server" is a role, not a type of hardware. A server is usually a powerful computer in a data center running 24/7, but technically any computer can act as a server.

The Key Difference — Who Starts the Conversation

The most important distinction: clients always initiate, servers always wait.

A server never randomly reaches out to a client. It sits there listening until a client knocks. When a client sends a request, the server wakes up, processes it, responds, and goes back to waiting. This is called a request–response model.

One Machine Can Be Both

Client and server are roles, not fixed identities. A single machine can play both roles simultaneously:

This is how almost every web application works — your browser talks to an app server, which in turn talks to a database server. The app server is simultaneously a server (to you) and a client (to the database).

Client vs Server — Full Comparison

How a Server Handles Thousands of Clients at Once

When you visit google.com, millions of other people are doing the same thing at that exact moment. How does one server handle all of them?

The answer is that it's never really just "one server." Large-scale services use:

What is an Operating System?

An Operating System (OS) is software that acts as the middleman between hardware and applications. Every computer — laptop, phone, server — needs an OS. Without it, hardware is just silicon and metal with no idea what to do.

Think of the OS as the manager of a building. The hardware is the building itself (floors, electricity, elevators). Applications are the tenants. The OS manages everything in between — allocating resources, handling requests, making sure tenants don't interfere with each other.

What Does the OS Actually Do?

The OS has six core jobs it performs constantly behind the scenes:

The Kernel — The Core of the OS

Inside every OS is a component called the kernel — the innermost, most privileged piece of software. The kernel runs directly on the hardware and has total control.

Applications never talk directly to hardware. They make requests to the OS via an interface called system calls (syscalls). The OS then carries out the action on their behalf. This is a critical security boundary — it prevents badly written or malicious apps from corrupting the system.

The Three OS Families You Need to Know

In networking and Cloudflare conversations, you'll encounter three OS families constantly:

OS Relevance to Networking

The OS plays a direct role in every network connection. When your browser wants to load a webpage, here's what actually happens at the OS level:

This is why networking concepts like ports, sockets, and IP addresses are OS-level concepts — not just application concepts. The OS manages all of this on behalf of every application running on the machine.

What is a Process?

When you run a program — a browser, a web server, a database — the OS doesn't just "run" it as a static thing. It creates a process — a live, running instance of that program, with its own slice of CPU time, its own chunk of RAM, and its own identity on the system.

The key distinction: a program is a file sitting on disk (like chrome.exe). A process is that program actively running in memory, doing work.

You can run the same program multiple times — each instance becomes a separate process. Open three browser windows? That might be three separate processes, each with its own memory.

Process IDs (PIDs)

Every process gets a unique number from the OS called a PID (Process ID). The OS uses this to track and manage processes — to kill one, prioritise one, or monitor its resource use.

On this server: the web server (nginx) has PID 891, the database (MySQL) has PID 1024. The OS tracks them separately, gives each their own RAM allocation, and can kill either independently.

Threads — Processes Within a Process

A process can spawn multiple threads — lightweight sub-units of execution that share the same memory but can run concurrently on different CPU cores.

This is how a web server handles thousands of simultaneous visitors — one process, many threads, each handling one request at a time.

What is a Port?

Now here's the bridge between processes and networking.

A server machine has one IP address. But it might be running dozens of processes simultaneously — a web server, a database, an SSH server, a mail server. When a network packet arrives at that IP address, how does the OS know which process it's meant for?

The answer is ports.

A port is a numbered endpoint — a logical channel — that a process listens on. When a packet arrives, the OS reads the port number and routes it to the correct process.

The Most Important Port Numbers

Ports range from 0 to 65,535. They're divided into three ranges:

Well-Known Ports You Must Know

Sockets — IP + Port Together

A port alone doesn't identify a unique connection. What uniquely identifies a connection is the combination of IP address + port on both ends — called a socket.

The four values together — client IP, client port, server IP, server port — uniquely identify every network connection on the internet. The OS tracks millions of these simultaneously.

Ephemeral Ports — The Client Side

You know servers listen on well-known ports (80, 443, etc.). But what port does the client use?

When your browser opens a connection to a website, the OS automatically assigns a temporary random port (between 49152–65535) to that connection. This is an ephemeral port — it exists only for the duration of that connection and is released when it closes.

How a Server Listens on a Port

When a server process wants to accept connections, it goes through these steps with the OS:

Everything in Module 1 is foundation. Before moving to Module 2 — Physical Networking — make sure these concepts are solid. You will see every single one of them again throughout this curriculum.

Before Anything Can Be Networked — Bits Must Travel

In Module 1 we learned that all data is ultimately 1s and 0s. But how do those 1s and 0s actually move from one device to another? They need a physical medium to travel through. The oldest and most common medium is copper wire — carrying bits as electrical signals.

How Electricity Carries Bits

Copper wire conducts electricity. By varying the voltage (the strength of the electrical signal) on a wire, we can encode binary data:

The sender raises voltage for a 1 and drops it for a 0, in rapid pulses. The receiver reads these voltage changes and reconstructs the binary data. This is the essence of electrical communication.

What is an Ethernet Cable?

The most common copper networking cable is an Ethernet cable — the cable with the plastic clip you plug into a laptop or router. It looks simple from outside but has a precise internal structure:

Inside every Ethernet cable are 8 copper wires arranged in 4 twisted pairs. The twisting is not decorative — it serves a critical purpose.

Why Are the Wires Twisted?

When electrical current flows through a wire, it creates a small magnetic field around it. This magnetic field can interfere with neighbouring wires — causing errors in the signal. This interference is called crosstalk.

Twisting the two wires of each pair together causes their magnetic fields to cancel each other out. The interference from one wire is neutralised by its twisted partner. The result: a much cleaner signal with far fewer errors.

Signal Degradation — Why Distance Matters

Electrical signals weaken as they travel along copper wire. This is called signal attenuation. The longer the cable, the weaker the signal arrives at the other end. Beyond a certain distance, the signal is too weak to reliably read — errors occur.

This is why Ethernet has a maximum distance of ~100 metres per cable segment. Beyond that, the signal needs to be regenerated by a switch or repeater. In large buildings, you'll find network closets every 100 metres or so for exactly this reason.

Ethernet Cable Categories (Cat Standards)

Not all Ethernet cables are equal. They come in categories (Cat) that define their maximum speed and bandwidth capacity:

The higher the category, the tighter the twist, the better the shielding, and the higher the frequency the cable can handle — all translating to higher speeds.

The RJ45 Connector

The plastic clip at the end of every Ethernet cable is called an RJ45 connector. It has 8 pins — one for each of the 8 wires inside. When you plug it in, each pin makes contact with a corresponding port on the device, completing the electrical circuit.

Full Path — Bits Travelling Over Copper

The NIC (Network Interface Card) is the hardware component that does the conversion between binary data and electrical signals. We'll cover NICs in depth in Topic 2.4.

Real Example — Your Laptop Sending a Request to a Web Server

You open your laptop, plug in an Ethernet cable, and type cloudflare.com in your browser. Here's exactly what happens at the copper wire level:

Why Fiber?

Copper cable works well up to 100 metres. But what about connecting buildings across a city, countries across continents, or continents across oceans? Electrical signals can't travel thousands of kilometres — they degrade too quickly and can't practically cross oceans.

The solution: use light instead of electricity. Light travels at roughly 200,000 km/second through glass — fast enough to cross an ocean in under 100ms. This is fiber optic technology.

How Fiber Optic Works

A fiber optic cable carries bits as pulses of light:

At the sending end, a laser or LED converts electrical signals from the NIC into pulses of light. At the receiving end, a photodetector converts those light pulses back into electrical signals. The glass strand in between just carries the light.

Total Internal Reflection — Why Light Stays in the Cable

The most important concept in fiber optics is total internal reflection. Without it, light would just leak out the sides of the glass strand and disappear.

The fiber has two layers — a glass core where light travels, and a glass cladding surrounding it with a slightly lower refractive index. When light hits the boundary between core and cladding at a shallow enough angle, it reflects completely back into the core. It never escapes — it just keeps bouncing its way along the cable, even around gentle bends, until it reaches the other end.

Anatomy of a Fiber Optic Cable

Single-Mode vs Multi-Mode Fiber

There are two types of fiber, and they're used in different contexts:

Submarine Cables — Fiber Crossing Oceans

The internet's backbone is built on submarine fiber optic cables laid on the ocean floor. This is not metaphor — these are real physical cables running under the Atlantic, Pacific, and Indian Oceans carrying the vast majority of international internet traffic.

Key things to note about submarine cables:

• The fiber bundle is roughly the thickness of a garden hose yet carries terabits of data per second
• The copper layer carries electrical power to repeaters/amplifiers placed every ~100km that boost the light signal so it doesn't degrade over thousands of km
• Steel wires provide mechanical strength to survive ocean floor pressure and currents
• There are 400+ submarine cable systems globally. When one is cut (ships' anchors are the most common cause), traffic automatically reroutes through other cables via BGP within seconds. True outages are rare and mostly affect regions with very few cable connections (e.g. small island nations)
• Cloudflare's 330+ PoPs are interconnected via these cables. A Mumbai user always hits the Mumbai PoP first (~5ms) — never London. Cloudflare then carries traffic to the origin server over its own private backbone, not the public internet

Copper vs Fiber — Full Comparison

Wireless — No Cable Needed

Copper and fiber both require a physical cable between devices. WiFi eliminates the cable by transmitting bits through the air as radio waves — the same physical phenomenon used by FM radio, TV broadcasts, and mobile phones, just at different frequencies.

How Radio Waves Carry Bits

A radio wave is an electromagnetic wave that oscillates (vibrates) at a specific frequency. WiFi encodes 1s and 0s by varying properties of these waves — such as their amplitude, frequency, or phase. The receiving device's antenna picks up these variations and decodes them back into bits.

WiFi Frequencies — 2.4 GHz vs 5 GHz vs 6 GHz

WiFi operates on specific radio frequency bands. Each has different characteristics — understanding these explains why WiFi behaves differently in different situations.

WiFi Standards — The 802.11 Family

WiFi versions are defined by the IEEE 802.11 standard. Each new generation improves speed, capacity, and efficiency:

How a WiFi Connection Works

Key WiFi Concepts

WiFi vs Ethernet vs Fiber — Where Each Fits

The Problem — Multiple Devices on One Network

Once you have more than two devices that need to communicate, you need a central piece of hardware to connect them all together. Historically there were two options: a hub or a switch. Understanding the difference explains why switches completely replaced hubs — and why it matters for how networks work today.

The Hub — Broadcast Everything

A hub is the simplest possible network device. When a packet arrives on any port, the hub does one thing: copy it out to every single other port simultaneously. No intelligence, no selectivity — everyone gets everything.

This causes three serious problems:

The Switch — Send Only Where Needed

A switch solves all three problems with one key capability: it learns which device is on which port and sends packets only to the correct destination port.

How a Switch Learns — The MAC Address Table

A switch doesn't come pre-programmed with device locations. It learns them dynamically by observing traffic:

Hub vs Switch — Full Comparison

Beyond the Basics

In Topic 2.4 we covered what a switch does — directs traffic only to the correct port using a MAC address table. Now let's go deeper into exactly how that works, what happens in edge cases, and the concepts you'll encounter in real network conversations.

The MAC Address Table — In Detail

The MAC address table (also called the CAM table — Content Addressable Memory) is the switch's lookup database. Every entry has three pieces of information:

The Age column is important — entries don't stay forever. If a device stops sending traffic, its entry ages out and is removed. This prevents stale entries from clogging the table when devices disconnect or move to different ports.

What Happens When the Switch Doesn't Know Where to Send?

Three scenarios cause a switch to flood — send a packet out every port except the one it arrived on:

Full Packet Forwarding Decision Flow

VLANs — Virtual LANs

A VLAN (Virtual Local Area Network) lets you logically divide one physical switch into multiple isolated networks. Devices on different VLANs cannot communicate directly — even if they're plugged into the same physical switch.

VLANs are widely used in enterprise networks to:

• Isolate departments (HR can't access Finance servers)
• Separate guest WiFi from corporate network
• Reduce broadcast traffic — broadcasts only go to devices in the same VLAN
• Improve security without buying separate physical switches

Managed vs Unmanaged Switches

Switch vs Router — The Fundamental Difference

A switch connects devices within the same network using MAC addresses. A router connects different networks together using IP addresses. This is the most important distinction in networking.

What a Router Actually Does

A router receives a packet, reads the destination IP address, consults its routing table, and forwards the packet toward its destination — one hop at a time. The packet may pass through 15–20 routers before reaching its destination.

The Routing Table

Every router has a routing table — a list of known network destinations and which direction (next hop) to send traffic for each. This is the router's decision-making engine.

When a packet arrives, the router compares the destination IP against every route in the table and picks the most specific match (longest prefix match). The last entry — 0.0.0.0/0 — is the default route: "if nothing else matches, send it here." This is typically the ISP gateway — the on-ramp to the internet.

Static vs Dynamic Routing

The internet runs on dynamic routing — specifically BGP (Border Gateway Protocol), which we'll cover in Module 4. Your home router uses a simple static default route pointing to your ISP.

NAT — What the Home Router Also Does

Your home router does something critical beyond just routing: NAT (Network Address Translation). Your ISP gives you one public IP address. But you have many devices. NAT lets all of them share that one IP.

TTL — Time to Live

Every IP packet has a field called TTL (Time to Live) — a counter that starts at 64 or 128 and decrements by 1 at each router hop. When TTL reaches 0, the router discards the packet and sends an error back to the sender.

This prevents packets from looping forever if there's a routing mistake. It's also what makes traceroute work — it sends packets with TTL=1, then TTL=2, etc., and maps each hop by watching where the "TTL expired" errors come from.

What is a MAC Address?

Every network interface card (NIC) — whether in a laptop, phone, server, or router — is permanently assigned a unique identifier at the factory called a MAC address (Media Access Control address).

It looks like this: 00:1A:2B:3C:4D:5E

Six pairs of hexadecimal digits separated by colons. 48 bits total. Globally unique — no two network interfaces in the world share the same MAC address.

MAC Address Structure

The first half (OUI — Organizationally Unique Identifier) identifies the manufacturer. The second half uniquely identifies the specific device. This is how 00:1A:2B always means Intel, F4:5C:89 always means Apple, etc.

MAC Address vs IP Address

Why MAC Addresses Only Work Locally

MAC addresses are a Layer 2 concept — they only have meaning on a local network segment. When your packet leaves your local network through a router, the router strips the Ethernet frame (which contains the MAC address) and creates a new one for the next hop. The MAC address changes at every router hop — the IP address does not.

Real Example — Your Laptop to Cloudflare

When your laptop sends a request to cloudflare.com:

• Your laptop puts your NIC's MAC as source and your router's MAC as destination in the Ethernet frame
• Your home router receives it, strips the Ethernet frame, creates a new frame with its own MAC as source and the next router's MAC as destination
• This repeats at every router until Cloudflare's server receives it with a completely different set of MACs than when you started
• The IP addresses (192.168.1.5 → 104.21.5.10) never change throughout the entire journey

MAC Addresses in Security

MAC addresses appear in security contexts you'll encounter as a Cloudflare SE:

The Problem ARP Solves

We now know switches use MAC addresses and routers use IP addresses. But here's the gap: when your laptop wants to send a packet to your router at IP 192.168.1.1 — how does it know the router's MAC address to put in the Ethernet frame?

It doesn't — until it asks. That asking process is ARP.

How ARP Works

The ARP Cache

Once your laptop learns a MAC address via ARP, it stores it locally in an ARP cache (ARP table) so it doesn't have to ask again for every packet:

ARP in the Real World

Every time your laptop connects to a new network — at home, at a coffee shop, at a customer's office — the first thing it does before sending any real traffic is ARP for the default gateway (router) to learn its MAC address. This happens automatically and invisibly in milliseconds.

Module 2 covered how bits physically travel across networks. These concepts underpin every product conversation involving network architecture, traffic flow, and security.

Why Network Types Matter

Not all networks are the same size or scope. The type of network determines who owns it, how fast it is, what hardware it uses, and how it connects to other networks. In Module 2 we already used "LAN" and "internet" — now let's define all of them properly.

LAN — Local Area Network

A network confined to a single physical location — a home, an office floor, a building. You own it and control it entirely.

MAN — Metropolitan Area Network

A network spanning a city or campus — larger than a LAN but smaller than a WAN. Often owned by a city government, university, or ISP.

WAN — Wide Area Network

A network spanning multiple cities, countries, or continents. No single organization owns the whole thing — it's built by leasing infrastructure from ISPs and telecom providers.

The Internet

The internet is not one network — it's a network of networks. Millions of LANs, MANs, and WANs owned by different organizations, all interconnected using agreed-upon protocols (primarily TCP/IP and BGP).

No single entity owns the internet. Your ISP owns the last mile to your home. Backbone providers own transcontinental fiber. IXPs (covered in Module 4) are the physical meeting points where these networks exchange traffic.

How They Nest Together

Full Comparison

What is an IP Address?

An IP address is the logical address assigned to a device on a network. Unlike a MAC address (burned into hardware), an IP address is assigned by the network and can change. It tells routers where to deliver packets — globally.

IPv4 Structure

An IPv4 address is a 32-bit number, written as four decimal numbers (called octets) separated by dots. Each octet is 8 bits, so ranges from 0 to 255.

Network Part vs Host Part

Every IP address has two parts — the network part (which network is this?) and the host part (which device on that network?). A subnet mask tells you where the split is. We'll go deep on this in Topic 3.7.

IPv4 Address Classes (Historical)

Originally IPv4 addresses were divided into classes. You don't configure these today — modern networking uses CIDR — but you'll hear the terms, so know them:

IPv4 Exhaustion

With only ~4.3 billion possible addresses and billions of devices, IPv4 addresses ran out. The last blocks were allocated around 2011. Solutions:

Why IPv6?

IPv4 gave us ~4.3 billion addresses. The internet has billions of devices — phones, laptops, servers, IoT sensors, smart TVs. We ran out. IPv6 was designed to solve this permanently.

IPv6 Structure

An IPv6 address is 128 bits — written as 8 groups of 4 hexadecimal digits separated by colons:

IPv6 Shorthand Rules

Full IPv6 addresses are long. Two rules shorten them:

IPv4 vs IPv6 — Comparison

Public IP Addresses

A public IP is globally unique and routable on the internet. When your browser connects to 104.21.5.10 (Cloudflare), that's a public IP. Any device on the internet can theoretically reach it.

Public IPs are assigned and managed by IANA (Internet Assigned Numbers Authority) → regional registries (ARIN, RIPE, APNIC) → ISPs → you.

Private IP Addresses

Private IPs are reserved ranges that are not routable on the internet. Routers on the public internet drop packets destined for private IPs. They are used only within local networks.

Why Subnetting?

Imagine a company with 1,000 employees in 5 departments. If they put everyone on one flat network:

• A broadcast from one device goes to all 1,000 devices — network congestion
• HR can access Finance servers directly — security problem
• Hard to manage and troubleshoot

Subnetting solves this by dividing one large network into smaller sub-networks. Each department gets its own subnet — isolated, manageable, and secure.

Subnet Masks

A subnet mask is a 32-bit number that tells you which part of an IP address is the network and which part is the host. It always has a block of 1s followed by a block of 0s:

Wherever the mask has 255 (all 1s in binary) = network part. Wherever 0 (all 0s in binary) = host part. So 255.255.255.0 means: first 3 octets are network, last octet is host.

CIDR Notation

Writing out full subnet masks is verbose. CIDR (Classless Inter-Domain Routing) notation replaces them with a slash and a number — the number of 1-bits in the mask:

Practical Subnetting Example

A company has the network 10.0.0.0/8 and wants to create separate subnets for 4 departments:

Each department is now on its own subnet. Without VLANs and routing rules between them, they cannot directly communicate — exactly like the HR/Finance VLAN example from Module 2.

CIDR in the Real World

CIDR isn't just for internal networks — it's how IP blocks are allocated on the internet:

• Cloudflare owns 104.16.0.0/12 — a block of ~1 million IPs
• Your ISP might give your company 203.0.113.0/24 — 254 public IPs
• A /32 is a single host route — used in BGP to advertise one specific IP
• A /0 means "everything" — the default route (the entire internet)

The Problem NAT Solves

Your ISP gives you one public IP address. But you have 10 devices at home — laptop, phone, tablet, smart TV, gaming console. All need internet access simultaneously. NAT makes this possible by letting all devices share that one public IP.

How NAT Works — Step by Step

The NAT Table

Types of NAT

NAT and Cloudflare

When Cloudflare sees traffic from a customer's website visitor, the source IP is the visitor's public IP after NAT — not their private home IP. This is what Cloudflare uses for:

• IP-based firewall rules ("block traffic from this IP range")
• Rate limiting per IP ("max 100 requests per minute per IP")
• Bot detection (comparing IP reputation)
• Geo-blocking (IP → country lookup)

This also means all devices behind a home NAT look like the same IP to Cloudflare — which is why rate limiting by IP can sometimes inadvertently affect multiple users sharing one public IP (e.g. a corporate office).

The Problem DHCP Solves

Every device on a network needs four pieces of configuration to communicate:

Without DHCP, every device would need manual configuration. DHCP automates this entirely — you plug in a device and it gets all four automatically within seconds.

The DORA Process — How DHCP Works

The acronym DORA: Discover → Offer → Request → Acknowledge. After ACK, the device is fully configured and can communicate on the network.

DHCP Lease

IPs assigned by DHCP are not permanent — they're leases with an expiry time (typically 24 hours for home networks, 8 hours for corporate). Before expiry, the device renews the lease. If not renewed (device left the network), the IP goes back into the pool and can be reassigned to another device.

Default Gateway — The Way Out

When your laptop wants to send a packet somewhere, it first checks: is the destination on my local network or somewhere else?

• Same network (e.g. 192.168.1.x) → send directly, no router needed
• Different network (e.g. 104.21.5.10) → send to the default gateway

The default gateway is your router's LAN IP address — typically 192.168.1.1. It's the "exit door" off your local network. Every device gets it automatically via DHCP.

Routing Tables — Deep Dive

We touched on routing tables in Topic 2.6. Now let's go deeper. Every router — from your home router to a Cloudflare backbone router — makes every forwarding decision based on its routing table.

Longest Prefix Match

When multiple routes match a destination, the router picks the most specific one — the one with the most network bits (longest prefix):

Static vs Dynamic Routing — Expanded

Why This Matters for an SE

As a Cloudflare SE, you'll regularly need to diagnose connectivity issues — is the problem at the DNS layer? Is it routing? Is it the origin server? Is it within Cloudflare? These three commands will be your first tools every time.

ping — Is the Host Reachable?

ping sends ICMP Echo Request packets to a destination and waits for a reply. It tests basic connectivity and measures round-trip latency.

traceroute — Where is the Problem?

traceroute (Mac/Linux) or tracert (Windows) reveals every router hop between you and the destination. Invaluable for diagnosing where in the path things break.

When a hop shows high latency or * * *, that's where to investigate. If all hops before Cloudflare are fast but Cloudflare's hop is slow — the issue may be at Cloudflare's edge or the origin.

nslookup / dig — Is DNS Working?

These tools query DNS servers directly. Essential for diagnosing whether a domain resolves correctly and which IP it resolves to.

Systematic Troubleshooting Approach

When a customer says "my site isn't working," work from bottom to top of the stack:

What is an ISP?

An ISP (Internet Service Provider) is the company that gives you access to the internet — AT&T, Comcast, Verizon, BT, Jio. They own the physical infrastructure (cables, routers, data centers) that connects you to the global internet and charge you for access.

ISP Tiers — How They're Organised

ISPs aren't all equal. They're organised in a hierarchy based on how they connect to the rest of the internet:

Peering vs Transit

The Last Mile

The last mile is the final connection between your ISP's network and your home or office. It's called "last mile" because it's literally the last segment of delivery — often the most expensive and slowest part of the entire internet path.

The Internet Backbone

The internet backbone is the collection of high-speed, high-capacity data routes that carry the majority of the internet's traffic across long distances — between cities, countries, and continents. It's owned by Tier 1 ISPs and large network operators.

The backbone consists of:

• Terrestrial fiber — fiber optic cables buried underground or strung along power lines, connecting cities within countries and continents
• Submarine cables — fiber optic cables laid on the ocean floor, connecting continents
• Core routers — extremely high-performance routers at major network hubs that can process millions of packets per second

Submarine Cables — The Physical Internet

Most people imagine the internet as wireless. The reality: ~99% of international internet traffic travels through submarine cables. Satellites (even Starlink) handle only a tiny fraction of global internet traffic.

Key Facts About Submarine Cables

Who Owns Submarine Cables?

Historically: Tier 1 ISPs and telecom companies (AT&T, NTT, Orange). Today: tech giants are building their own:

• Google — owns or co-owns ~20 submarine cables (Dunant, Curie, Grace Hopper, etc.)
• Meta — owns cables connecting data centers globally
• Microsoft + Facebook — co-own MAREA (Virginia to Spain, 160 Tbps)
• Cloudflare — does not own submarine cables but leases capacity and has points of presence at nearly every major cable landing station

What Happens When a Cable is Cut?

The most common cause: ship anchors dragging across the ocean floor. It happens several times per year. The consequence depends on redundancy:

• Single cable cut → BGP reroutes traffic through other cables automatically within seconds. Most users notice nothing.
• Multiple cuts in same region → congestion on backup routes, higher latency, some slowdowns
• Region with one cable (e.g. Tonga 2022) → near-total internet outage for weeks until cable is repaired

Cable repair ships are a real profession — specialist vessels with underwater robots that physically splice broken cables on the ocean floor.

What is an IXP?

An IXP (Internet Exchange Point) is a physical location — usually a data center — where multiple networks (ISPs, CDNs, cloud providers, content companies) connect directly to each other and exchange traffic.

Without IXPs, traffic between two ISPs would have to travel through a third-party transit provider (expensive, slower). At an IXP, they plug directly into the same switch and exchange traffic for free — or at much lower cost.

Why IXPs Matter

Major IXPs Globally

What is a Data Center?

A data center is a purpose-built facility housing computing infrastructure — servers, networking equipment, storage — operated 24/7. Every website, app, and cloud service runs out of a data center somewhere.

What's Inside a Data Center

Data Center Tiers

Colocation vs Cloud

Autonomous Systems (AS)

The internet is not one big network — it's tens of thousands of individual networks operated by different organisations. Each of these independently managed networks is called an Autonomous System (AS).

Every AS is assigned a unique ASN (Autonomous System Number) by IANA. Examples:

An AS announces to the world: "I own these IP address ranges." For example, Cloudflare announces it owns 104.16.0.0/12. This is how the rest of the internet knows where to send traffic destined for Cloudflare IPs.

BGP — Border Gateway Protocol

BGP (Border Gateway Protocol) is the routing protocol that connects all autonomous systems together. It is the protocol that makes the internet work as a cohesive whole. Without BGP, individual networks would have no way to know how to reach each other.

BGP's job: exchange routing information between ASes — "I know how to reach these networks, you should send traffic for them to me."

How BGP Works

BGP Hijacking

BGP has no built-in authentication — any AS can announce ownership of any IP prefix. BGP hijacking is when a malicious (or misconfigured) AS announces prefixes it doesn't own, redirecting traffic intended for another network.

Famous examples: in 2010, China Telecom briefly announced ~40,000 IP prefixes it didn't own — briefly rerouting 15% of global internet traffic through China. In 2019, a misconfigured ISP in Nigeria accidentally rerouted Google traffic through China Telecom.

Modern mitigation: RPKI (Resource Public Key Infrastructure) — cryptographically verifies that an AS is authorised to announce a given IP prefix. Cloudflare was one of the first to deploy RPKI broadly.

Putting It All Together

You now know about routers, BGP, ISPs, and IXPs. Let's trace exactly what happens when you send a packet from your laptop in Texas to a Cloudflare server.

TTL in Action

Each router hop decrements the TTL by 1. A packet from your laptop starts at TTL=64. After 5 hops through routers, TTL=59 when it reaches Cloudflare. Running traceroute cloudflare.com from Texas would show exactly these hops.

The Full Internet Architecture — How It All Fits Together

Every concept from Modules 2, 3, and 4 connects into this single picture:

Latency — How Fast a Packet Travels

Latency is the time it takes for a packet to travel from source to destination. Measured in milliseconds (ms). Also called round-trip time (RTT) when measuring the full there-and-back journey.

What Causes Latency?

Real-World Latency Numbers

Bandwidth — How Much Data Flows

Bandwidth is the maximum capacity of a network link — how much data can flow through it simultaneously. Measured in bits per second (Mbps, Gbps, Tbps).

Bandwidth vs Throughput

Throughput is the actual data transferred per second — always less than or equal to bandwidth. Bandwidth is the pipe size; throughput is what actually flows through it.

What is Anycast?

Anycast is a network addressing method where the same IP address is advertised from multiple locations simultaneously. When a packet is sent to an anycast IP, the internet's routing (BGP) automatically delivers it to the nearest location advertising that IP.

Compare the four addressing types:

How Anycast Works with BGP

Cloudflare runs servers in 330+ cities. All of them advertise the same IP prefix (e.g. 104.16.0.0/12) via BGP. When your packet is destined for 104.21.5.10:

Why Anycast is Powerful

Real Example — Cloudflare's 1.1.1.1 DNS

Cloudflare's public DNS resolver 1.1.1.1 is anycast. That single IP is advertised from all 330+ Cloudflare PoPs simultaneously. When your laptop queries 1.1.1.1, BGP routes the packet to the nearest Cloudflare PoP — could be 5ms away. This is how it became the world's fastest DNS resolver.

The Problem CDNs Solve

Imagine a company based in New York with a single origin server there. A user in Singapore visits their website:

How a CDN Works

What Can Be Cached?

CDN Benefits Beyond Speed

• Origin offload — most requests served from cache, reducing load on the origin server
• DDoS resilience — CDN absorbs traffic spikes at the edge
• Global availability — even if origin goes down briefly, cached content may still be served
• Lower bandwidth costs — serving cached content from edge is cheaper than origin egress

What is Cloud Computing?

Cloud computing means accessing computing resources — servers, storage, databases, networking — on-demand over the internet rather than owning physical hardware. You pay for what you use, like a utility bill.

The Three Cloud Service Models

Public vs Private vs Hybrid Cloud

What Problem Does a VPN Solve?

Before VPNs: a company with offices in New York and London needed a dedicated private leased line between them (MPLS or similar) — expensive, inflexible. Employees working from home couldn't access internal systems at all.

VPNs solved this by creating an encrypted tunnel over the public internet, making it behave like a private network — without the dedicated hardware.

How a VPN Works

VPN Limitations — Why Zero Trust Replaces Them

Traditional VPNs work but have serious problems at scale:

What is a Protocol?

A protocol is a set of agreed-upon rules that define how two devices communicate. Without protocols, every manufacturer would invent their own communication method and devices from different vendors would never be able to talk to each other.

Think of it like human language — English works because both speakers agree on the same grammar and vocabulary. Protocols are the "language" computers agree to use.

Protocols define:

The OSI Model — Why It Exists

Networking is complex. A single web request involves dozens of different technologies — WiFi, IP routing, TCP connections, TLS encryption, HTTP. Without a framework, it would be chaos.

The OSI Model (Open Systems Interconnection) was created by the ISO in 1984 as a conceptual framework that divides all networking functions into 7 distinct layers, each with a specific job. Each layer only talks to the layer directly above or below it.

The OSI model doesn't describe actual protocols in use — it's a reference model for understanding and categorising network behaviour. Its value: when something breaks, you can immediately narrow down which layer has the problem.

The 7 Layers

The Layers You'll Use Most in Cloudflare Context

The Practical Model

The OSI model is a conceptual framework. The TCP/IP model is the practical one — it's what the internet actually runs on. It was developed by DARPA in the 1970s and has 4 layers instead of 7, collapsing some of the OSI layers that are rarely distinct in practice.

Key Difference — Why TCP/IP Collapsed L5/L6/L7

In the OSI model, Session (L5), Presentation (L6), and Application (L7) are theoretically separate. In practice, most protocols handle all three — HTTP handles session management and TLS handles presentation (encryption). So TCP/IP just calls it all "Application."

In Cloudflare conversations, people use both models interchangeably. The most common reference is OSI — specifically L3, L4, and L7. You'll rarely hear "L1" or "L6" in a product conversation.

What Travels at Each Layer

How Data Gets Wrapped as It Travels Down the Stack

As data moves from the Application layer down to the Physical layer, each layer wraps the data with its own header — adding addressing and control information needed at that layer. This process is called encapsulation. At the receiving end, each layer strips off its header — this is decapsulation.

Why This Matters for Cloudflare

Cloudflare sits in the path of every request and operates at multiple layers simultaneously:

• L1/L2 — Receives raw frames from the network, handles Ethernet/fiber connectivity at PoPs
• L3 — Reads IP headers for routing decisions, DDoS filtering (Magic Transit), geo-blocking by IP
• L4 — Reads TCP/UDP headers for port-based rules, Spectrum product, Magic Firewall
• L6 — Terminates TLS — decrypts HTTPS so L7 inspection can happen
• L7 — Reads HTTP headers and body for WAF rules, Bot Management, caching, rate limiting

This is why Cloudflare can inspect a WAF rule on User-Agent header (L7) while simultaneously enforcing an IP block (L3) and a rate limit by port (L4) — all on the same packet, in the same PoP, in microseconds.

What TCP Does

TCP is the reliable delivery protocol at Layer 4. When your browser loads a webpage, it uses TCP to make sure every byte of the HTML, CSS, and images arrives correctly — in order, without gaps, without corruption.

TCP provides three guarantees: ordered delivery (packets arrive in sequence), reliable delivery (lost packets are retransmitted), and error checking (corrupted data is detected and discarded).

The Three-Way Handshake — How TCP Connections Start

Before any data is exchanged, TCP establishes a connection with a 3-step process:

Only after the handshake completes does the browser send the HTTP request. This is why the first connection to a website takes slightly longer — the handshake adds one round-trip of latency before any data flows.

Key TCP Concepts

Sockets — How Applications Use TCP

Applications don't talk to TCP directly — they use the OS abstraction called a socket. A socket is the combination of an IP address and a port that uniquely identifies one end of a connection. A full TCP connection is identified by 4 values:

The OS tracks thousands of simultaneous socket connections — each identified by this unique 4-tuple. This is how your browser can have 10 tabs open to different sites while keeping all their data streams separate.

UDP — User Datagram Protocol

UDP is TCP's counterpart at Layer 4 — but with the opposite philosophy. Where TCP prioritises reliability, UDP prioritises speed. It sends packets and doesn't care if they arrive.

TCP vs UDP — When to Use Which

Why UDP for Streaming and Gaming?

If you're watching a live video stream and a packet is lost — there's no point retransmitting it. By the time it arrives, that frame is already 500ms in the past. Better to just show a slightly glitchy frame and keep playing. TCP's retransmission would cause freezing. UDP's "accept the loss" approach is better for real-time media.

UDP DDoS — Why UDP is Exploited

UDP has no handshake — so an attacker can send packets with a spoofed source IP (fake sender address). This enables amplification attacks:

• Attacker sends a small UDP request (e.g. DNS query) to a public server, spoofing the victim's IP as the source
• The DNS server sends a large response to the victim's IP
• With thousands of servers, attacker can amplify a 1 Gbps attack into 100+ Gbps hitting the victim

Common amplification targets: DNS (up to 50x amplification), NTP (up to 556x), Memcached (up to 51,000x). Cloudflare blocks these at L3/L4 before they reach customers.

ICMP — Internet Control Message Protocol

ICMP is not a data transfer protocol — it's a diagnostic and error-reporting protocol. It operates at Layer 3 alongside IP and is used by routers and hosts to communicate network conditions.

Many firewalls block ICMP — which is why you sometimes see * * * in traceroute output even when the path is working fine.

The Problem DNS Solves

Computers communicate using IP addresses — 104.21.5.10. Humans remember names — cloudflare.com. DNS is the system that bridges this gap: it translates human-readable domain names into machine-readable IP addresses.

Without DNS, you'd need to memorise IP addresses for every website you visit. With DNS, you type a name and the internet figures out the address for you — automatically, in milliseconds.

Why DNS is Critical Infrastructure

DNS is the very first step of every internet connection. Before your browser can connect to any website, it must resolve the domain name to an IP address. If DNS fails — nothing works. Not email, not websites, not apps. DNS is often described as the "phone directory of the internet" — without it, you know the name but can't find the number.

This is also why DNS is such a high-value attack target — taking down DNS takes down everything that depends on it.

Anatomy of a Domain Name

Domain names are read right to left — the most significant part is on the right. Each section separated by a dot is called a label.

FQDN — Fully Qualified Domain Name

A FQDN is the complete domain name including the root dot (which is normally invisible). For example: blog.cloudflare.com. — note the trailing dot. The root (.) is the very top of the DNS hierarchy.

Common TLDs

The DNS Hierarchy

DNS is not a single server or database — it's a distributed, hierarchical system spread across thousands of servers globally. No single server knows everything. Instead, each level knows about the next level down.

The Three Server Types

DNS Resolvers — The Middlemen

A recursive resolver (also called a recursive nameserver or DNS resolver) is the server your device talks to when it needs to resolve a domain. It does the legwork of querying the hierarchy on your behalf — asking root, then TLD, then authoritative — and returns the final answer to you.

What Happens When You Type cloudflare.com

DNS resolution is a multi-step process. Most of the time it's instant because of caching — but understanding the full uncached flow is essential.

Where Caching Happens

The full recursive lookup above only happens when nothing is cached. In practice, most DNS queries are answered from cache at one of these levels:

What is TTL?

TTL (Time to Live) is a value in seconds attached to every DNS record that tells resolvers how long they can cache the answer before they need to ask again. It's set by whoever manages the authoritative DNS for that domain.

TTL Tradeoffs

DNS Propagation

When you change a DNS record, the old answer is still cached at resolvers around the world for up to the TTL duration. This is why "DNS propagation" takes time — each resolver must wait for its cached copy to expire before fetching the new answer. With a 24-hour TTL, some users might see the old IP for up to 24 hours after you make a change.

The Most Important DNS Records

CNAME vs A Record — Key Distinction

How Customers Onboard to Cloudflare via DNS

When a customer signs up for Cloudflare, the first thing they do is point their domain's NS records to Cloudflare. This transfers authoritative control of their DNS to Cloudflare.

Orange Cloud vs Grey Cloud

In the Cloudflare dashboard, every DNS record has a cloud icon that controls whether traffic is proxied through Cloudflare or goes directly to the origin:

What Cloudflare's DNS Returns

When a record is orange cloud (proxied), Cloudflare's authoritative DNS does not return the origin's real IP — it returns Cloudflare's Anycast IP instead. The origin IP is never exposed to the public internet. This is a key security benefit — attackers can't bypass Cloudflare by finding and directly hitting the origin IP.

The Problem DNSSEC Solves

Standard DNS has no authentication — a resolver has no way to verify that the answer it receives is genuine. An attacker who can intercept or tamper with DNS responses could redirect users to malicious servers — even though the domain name looks correct. This attack is called DNS spoofing or cache poisoning.

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records. Resolvers can verify these signatures to confirm the answer came from the legitimate authoritative server and hasn't been tampered with.

How DNSSEC Works

Chain of Trust

DNSSEC Limitations

DNSSEC proves that a DNS answer is authentic — but it does not:

• Encrypt DNS queries — responses are still readable in transit (that's DoH/DoT's job)
• Guarantee the destination is trustworthy — it only guarantees the DNS answer is genuine
• Protect against all DNS attacks — only against spoofing/tampering of DNS data

The Problem — Plain DNS is Unencrypted

Standard DNS queries travel in plaintext over UDP port 53. This means:

• Your ISP can see every domain you look up
• Anyone on the same network (coffee shop WiFi) can intercept your DNS queries
• Governments and network operators can log and censor DNS at the network level

DNSSEC (Topic 6.8) prevents tampering but doesn't hide the query. DoH and DoT solve the privacy problem by encrypting the DNS query itself.

DoT — DNS over TLS

DNS queries wrapped in a TLS connection on port 853. Encrypts queries but uses a dedicated port — ISPs and firewalls can easily detect and block port 853, making it easy to enforce their own DNS.

DoH — DNS over HTTPS

DNS queries sent as HTTPS requests over port 443 — the same port as all other HTTPS web traffic. Completely indistinguishable from regular browser traffic. Much harder to block without breaking the entire HTTPS web.

Why DNS is a High-Value Attack Target

DNS is infrastructure — it underpins everything. Attacking DNS can redirect users, deny service, or intercept traffic at massive scale without ever touching the target's servers directly.

DNS Cache Poisoning

An attacker injects a false DNS record into a resolver's cache. Any user that resolver serves then gets the fake answer — redirecting them to a malicious server. Classic man-in-the-middle at the DNS layer.

Prevention: DNSSEC, randomised source ports and transaction IDs, filtering at the resolver level.

DNS Amplification DDoS

The most common UDP amplification attack. Attacker sends small DNS queries to open resolvers with the victim's IP spoofed as the source. Resolvers send large responses to the victim. Amplification factor up to 50x — a 1 Gbps attack becomes 50 Gbps.

Prevention: ISP-level BCP38 filtering (blocks spoofed source IPs), Cloudflare's network-level DDoS protection absorbs at the edge.

DNS Hijacking

Attacker compromises either the registrar account (changing NS records), the authoritative nameserver, or the resolver — redirecting all DNS queries for a domain to attacker-controlled servers. More targeted than cache poisoning — affects the entire domain, not just cached entries.

Prevention: Registrar lock (prevents unauthorised NS changes), multi-factor auth on registrar accounts, DNSSEC.

DNS Tunneling

Attacker encodes data inside DNS queries and responses to exfiltrate data or establish a covert command-and-control channel through firewalls that allow DNS traffic. DNS is often allowed through firewalls even when other protocols are blocked.

Prevention: Cloudflare Gateway inspects DNS query patterns and blocks anomalous tunneling behaviour.

DNS-based DDoS on Authoritative Servers

Flood of DNS queries targeting an authoritative nameserver — overwhelming it so it can't respond to legitimate queries. Effectively takes the domain offline for everyone.

Prevention: Cloudflare's authoritative DNS is Anycast — attack traffic is distributed across 330+ PoPs globally. No single server receives the full volume.

What is HTTP?

HTTP (HyperText Transfer Protocol) is the protocol that browsers and servers use to exchange web content. It defines how a client requests a resource and how a server responds. Every webpage, API call, and file download you've ever made on the web used HTTP.

HTTP sits at Layer 7 (Application) of the OSI model — the very top. It doesn't care about how packets are routed or whether TCP or UDP delivers them — it just defines the format of requests and responses.

HTTP is Stateless

One of the most important properties of HTTP: every request is independent. The server has no memory of previous requests from the same client. Each request must contain all the information the server needs to respond.

This means if you load a webpage that has 50 images — that's 51 separate HTTP requests (1 for the HTML + 50 for images). The server treats each one independently, with no knowledge of the others.

This simplicity is why HTTP scaled to power the entire internet — but it also creates challenges for things like login sessions (solved by cookies, covered in 7.7).

HTTP vs HTTPS

HTTPS is HTTP + TLS. The HTTP request/response format is identical — TLS just encrypts it in transit. We'll go deep on TLS in Module 8.

Anatomy of a URL

Every web resource is identified by a URL (Uniform Resource Locator). URLs have a precise structure — each part serves a specific purpose:

What are HTTP Methods?

An HTTP method (also called an HTTP verb) tells the server what action to perform on the requested resource. When your browser loads a page, it sends a GET request. When you submit a form, it sends a POST. When an API updates an existing record, it uses PUT (full replace) or PATCH (partial update).

Methods are fundamental to how web applications work — and they're used extensively in WAF rules, API security, and rate limiting.

The Core Methods

Safe vs Unsafe vs Idempotent

Methods have two important properties that affect how they're treated by caches, proxies, and security tools:

Real Example — A Single Web Page Uses Multiple Methods

When you use a web app like a task manager:

Same URL, different methods = completely different operations

The HTTP Request

When your browser wants a resource, it sends an HTTP request. Every HTTP request has the same structure: a request line, headers, an empty line, and an optional body.

The Request Line

The first line of every request has three parts: Method + Path + HTTP Version

The HTTP Response

The server's reply follows the same structure: a status line, headers, and a body containing the actual content.

The Status Line

The first line of every response has: HTTP Version + Status Code + Reason Phrase

Request vs Response — Key Differences

What are Status Codes?

Every HTTP response includes a 3-digit status code that tells the client what happened with their request. Status codes are grouped into 5 classes based on the first digit:

The Codes You Must Know

Cloudflare-Specific Status Codes

Cloudflare has its own set of error codes in the 5xx range that you'll encounter constantly in support conversations:

What are HTTP Headers?

Headers are key-value metadata attached to every HTTP request and response. They tell the server and client important context about the communication — what format the content is in, how to cache it, who is making the request, what authentication is being used, and much more.

Headers are invisible to end users but are the primary thing Cloudflare's WAF, Bot Management, and other products inspect to make security decisions.

Request Headers — What the Client Sends

Response Headers — What the Server Sends Back

Custom Headers

Beyond standard headers, applications and platforms define their own. Convention: custom headers are prefixed with X- (though this is no longer required by spec):

The Evolution Problem

HTTP was designed in 1991 for a simple web of text documents. Modern websites load 50–200 resources (HTML, CSS, JS, images, fonts, API calls). Each version of HTTP was created to solve the performance bottlenecks of the previous one.

HTTP/1.1 — One Request at a Time

HTTP/1.1 (1997) was a major improvement over HTTP/1.0 — it introduced persistent connections (keep the TCP connection open for multiple requests instead of reopening it every time). But it had one critical flaw:

Head-of-Line Blocking: Within a single connection, requests must complete in order. If request #1 is slow, requests #2, #3, #4 all wait — even if the server is ready to serve them. The solution was to open multiple TCP connections (browsers open 6 per domain), but this is wasteful and still limited.

HTTP/2 — Multiplexing Over One Connection

HTTP/2 (2015) solved head-of-line blocking at the HTTP layer by introducing multiplexing — multiple requests and responses flow simultaneously over a single TCP connection as independent streams. No waiting in line.

HTTP/2 also introduced header compression (HPACK) — repeated headers (like User-Agent or Host) are sent once and referenced by index on subsequent requests, dramatically reducing overhead.

HTTP/3 & QUIC — Solving the Final Bottleneck

HTTP/2 multiplexed at the HTTP layer but still used TCP underneath. TCP itself has head-of-line blocking — if one TCP packet is lost, all streams wait for it to be retransmitted, even those that don't need that data.

QUIC is a new transport protocol built on UDP that reimplements TCP's reliability (retransmission, ordering) in userspace, with independent stream handling — a lost packet only blocks the stream it belongs to, not others. HTTP/3 runs on top of QUIC.