Networking for DevOps¶

By Sameer Alam · Updated 14 September 2026

A large share of production incidents come down to networking: a DNS record that didn't update, an expired certificate, a load balancer timeout shorter than the application's, a security group that blocks one port. This track explains how traffic actually moves, so you can reason about those failures instead of guessing.

What You'll Learn¶

• How IP addresses, subnets, routes, TCP connections, and ports work together
• How DNS resolution works end to end, and why it breaks in confusing ways
• What happens during an HTTP request and a TLS handshake
• How load balancers and reverse proxies route, health-check, and time out traffic
• A layered method and toolkit for diagnosing any "it can't connect" problem

The Path of a Request¶

sequenceDiagram
    autonumber
    participant C as Client
    participant D as DNS resolver
    participant L as Load balancer
    participant A as App server
    C->>D: shop.example.com?
    D-->>C: 203.0.113.10
    C->>L: TCP handshake to :443
    C->>L: TLS handshake (SNI: shop.example.com)
    C->>L: HTTP GET /checkout
    L->>A: forward to healthy backend 10.0.2.15:8080
    A-->>L: 200 OK
    L-->>C: 200 OK

Each step can fail independently, and each failure has a different symptom. The chapters follow this path.

Read in This Order¶

1. TCP/IP, Ports, and Sockets — addressing and CIDR, routing, NAT, TCP vs UDP, connection states, and MTU
2. DNS — the resolution chain, record types, TTLs and caching, Linux resolvers, and Kubernetes DNS quirks
3. HTTP and TLS — requests and status codes, HTTP/2 and HTTP/3, the TLS handshake, certificates, and common TLS errors
4. Load Balancers and Reverse Proxies — L4 vs L7, algorithms, health checks, timeouts, client IPs, and 502/503/504
5. Network Troubleshooting Toolkit — a layer-by-layer method with dig, curl, ss, mtr, openssl, and tcpdump

Already Covered Elsewhere¶

Next¶

Start with TCP/IP, Ports, and Sockets.