Computer Networking & System Design for DevOps

This chapter establishes the foundational principles of computer networking and system design, bridging the gap between physical infrastructure and high-level cloud architectures. We will explore how data physically travels across the globe via submarine cables, how IP addressing and subnetting segment networks, and how the OSI and TCP/IP models govern data transmission. Finally, we will apply these concepts to design a scalable, secure microservices-based application architecture.

1. The Physical Internet: Submarine Cables vs. Satellites

Many users assume that global internet traffic is primarily transmitted wirelessly via satellites. In reality, over 99% of international data is transmitted through physical cables laid on the ocean floor, known as submarine fiber-optic cables.

Real-Life Analogy: Satellites vs. Ocean Cables

To understand why satellites are not the primary medium for global internet traffic, consider the physics of distance and resource allocation:

• The Satellite Approach (e.g., Starlink): Sending a signal from Pune to a satellite in low Earth orbit (LEO) or geostationary orbit, and then back down to a server in New York, requires massive electromagnetic transit distances. Rocket launches, fuel, and atmospheric interference make this highly inefficient and expensive for high-throughput global traffic.
• The Submarine Cable Approach: Fiber-optic cables use total internal reflection to transmit data at the speed of light through glass fibers. Laying these cables across the ocean floor avoids atmospheric degradation and provides massive, uninterrupted bandwidth.

Note: You can visualize this global network using the interactive Submarine Cable Map, which shows how landing stations in coastal cities (such as Mumbai and Cochin in India) connect continents.

2. The Global to Local Network Hierarchy

The internet is not a single cloud; it is a hierarchical network of networks. The path from a global data center to your home router consists of several distinct tiers:

• Wide Area Network (WAN): Large-scale networks spanning countries or continents. Tier 1 Internet Service Providers (ISPs) invest billions in maintaining the physical submarine cables and terrestrial backbones.
• Internet Exchange Point (IXP): Physical locations where Tier 1 providers, content delivery networks (CDNs), and regional ISPs connect to exchange traffic directly, reducing latency and costs.
• Metropolitan Area Network (MAN): A network covering a larger geographic area than a LAN (such as a city or large campus), managed by regional ISPs.
• Local Area Network (LAN): The private network inside your home or office, managed by your local router.

3. Network Performance Metrics: Latency, Bandwidth, Jitter, and Packet Loss

To diagnose and optimize systems as a DevOps engineer, you must understand the four primary metrics of network performance:

Real-Life Analogy: The "Stuck" Video Call

When you are on a video call and the other person's video freezes or stutters, you are experiencing Jitter and Packet Loss.

• If they say "Hello... [silence] ...World" all at once, the latency varied (Jitter).
• If words are completely missing, those data packets were dropped entirely (Packet Loss).

4. Core Networking Hardware: Routers, Switches, and Hubs

Local and enterprise networks rely on three primary hardware devices to direct traffic:

1. Hub (Layer 1 - Physical)

A non-intelligent device that connects multiple physical lines. When a packet arrives at one port, it is copied and broadcasted to all other ports. This creates high network congestion and security risks.

2. Switch (Layer 2 - Data Link)

An intelligent device used inside local networks and data centers. It maintains a MAC Address Table to map physical ports to specific devices. When a packet arrives, the switch forwards it only to the destination port.

3. Router (Layer 3 - Network)

A device that routes data packets between different networks (e.g., connecting your home LAN to the public internet). Routers read IP addresses to determine the optimal path for data transit.

Note on Data Center Cooling: Data centers house thousands of high-density server racks containing switches and routers. These systems generate massive heat. To combat cooling costs, companies like Microsoft have experimented with underwater data centers (e.g., Project Natick), utilizing ocean water as a natural heat sink.

5. Hands-on Network Path Analysis: AWS EC2 & Traceroute

To understand how data hops across the physical internet, we can launch an EC2 instance in an AWS region (e.g., Oregon, us-west-2) and trace its network path to a target domain.

Step 1: Connect to your EC2 Instance

# Set secure permissions for your private key
chmod 400 networking-practice.pem

# SSH into the remote instance
ssh -i "networking-practice.pem" ubuntu@ec2-54-187-12-34.us-west-2.compute.amazonaws.com

Step 2: Install and Run traceroute

The traceroute utility tracks the path that packets take from your instance to a destination server, showing each intermediate router ("hop").

# Update package index and install traceroute
sudo apt-get update
sudo apt-get install -y traceroute

# Trace the route to google.com
traceroute google.com

Example Output Analysis

traceroute to google.com (142.250.72.14), 30 hops max, 60 byte packets
 1  ec2-us-west-2-route.amazonaws.com (172.31.0.1)  0.521 ms  0.489 ms  0.412 ms
 2  100.64.16.45 (100.64.16.45)  1.210 ms  1.180 ms  1.150 ms
 3  99.83.117.12 (99.83.117.12)  2.450 ms  2.410 ms  2.390 ms  # AWS Edge Network
 4  142.250.72.14 (sea09s28-in-f14.1e100.net)  3.890 ms  3.810 ms  3.750 ms # Destination (Google)

Each numbered line represents a hop. If a hop displays asterisks (* * *), it indicates that an intermediate router timed out or blocked ICMP packets for security reasons.

6. CDNs, Edge Computing, and AWS Global Infrastructure

When hosting an application globally, routing all traffic to a single central data center introduces high latency for distant users. To solve this, cloud providers use hierarchical infrastructure:

• AWS Region: A physical geographic location containing multiple, isolated, and physically separate data centers called Availability Zones (AZs). AWS has over 39 regions globally.
• Availability Zone (AZ): One or more discrete data centers with redundant power, networking, and connectivity. Each region has a minimum of 3 AZs to ensure high availability.
• Edge Location: Small, localized deployments used by Content Delivery Networks (CDNs) like AWS CloudFront to cache static content (images, HTML, stylesheets) closer to the end-user, reducing latency.

Real-Life Analogy: Apple Stores vs. Authorized Dealers

• AWS Region = Flagship Apple Store: A massive, central hub (e.g., in BKC Mumbai) containing all inventory and repair facilities.
• Availability Zone = Local Authorized Dealers (Unicorn Stores): Multiple physical stores spread across a city (Pune, Bangalore) that provide redundant access to Apple products.
• Edge Location = Local Retail Outlets: Small kiosks that only stock the most popular items (cached assets) for immediate pickup.

7. Internet Addressing: IPv4 vs. IPv6

Every device connected to the internet must have a unique address. The Internet Protocol (IP) defines how these addresses are structured.

Comparing IPv4 and IPv6

Because the global population and the number of connected devices (IoT, smartphones, laptops) far exceed 4.3 billion, the world is transitioning to IPv6 to prevent IP address exhaustion.

8. Subnetting, CIDR Math, and IP Allocation

To prevent wasting public IP addresses and to secure networks, we partition larger networks into smaller, isolated sub-networks called Subnets. This is managed using CIDR (Classless Inter-Domain Routing) notation.

The CIDR Formula

The number of IP addresses in a CIDR block is calculated using the formula:

Where $n$ is the subnet mask prefix (the number of fixed network bits).

CIDR Block Calculations

• /32 Block:

Used to target a single, specific host.

• /30 Block:

Used for point-to-point connections.

• /16 Block:

Standard size for a large Virtual Private Cloud (VPC).

• /0 Block:

Represents the entire public internet (0.0.0.0/0).

Reserved IP Addresses

In any standard subnet, two IP addresses are automatically reserved and cannot be assigned to hosts:

1. Network Address (First IP): Identifies the network itself (e.g., 192.168.1.0).
2. Broadcast Address (Last IP): Used to send packets to all hosts on the subnet (e.g., 192.168.1.255).

AWS Specific Note: AWS reserves five IP addresses in every subnet:

• .0: Network address.
• .1: VPC router address.
• .2: DNS server address.
• .3: Future AWS use.
• .255: Network broadcast address.

9. Domain Name System (DNS) Resolution Architecture

Computers communicate using IP addresses, but humans prefer readable names (e.g., trainwithshubham.com). The Domain Name System (DNS) acts as the internet's phone book, translating domain names into IP addresses.

DNS Resolution Flow

Real-Life Analogy: The Yellow Pages / Telephone Directory

Before smartphones, if you wanted to call a local business, you opened a physical directory (the Yellow Pages). You looked up the business name (Domain) to find their phone number (IP Address).

Security Context: Domain Spoofing & RBI Regulations

Because anyone can buy a domain name (e.g., purchasing icici-netbanking.tech to mimic icici.com), malicious actors use domain spoofing for phishing. To combat this, the Reserve Bank of India (RBI) mandated that banks migrate to the highly secure, verified top-level domain .bank.in or .bank, where ownership is strictly verified by regulatory authorities.

10. How Data Moves: The OSI vs. TCP/IP Reference Models

To standardize network communications, the industry uses reference models. The theoretical OSI Model has seven layers, while the practical TCP/IP Model condenses these into four.

Layer-by-Layer Breakdown

11. Deep Dive into Layer 4: TCP vs. UDP & The 3-Way Handshake

The Transport Layer manages how data is delivered between hosts. It relies on two primary protocols:

1. TCP (Transmission Control Protocol)

TCP is a connection-oriented protocol that guarantees reliable, ordered delivery of data packets. It is used for web browsing (HTTP/S), SSH, and email (SMTP).

The TCP 3-Way Handshake

Before any data can be transmitted via TCP, a connection must be established:

2. UDP (User Datagram Protocol)

UDP is a connectionless, lightweight protocol. It does not perform handshakes, guarantee packet delivery, or maintain packet order. It is used for real-time applications like live video streaming, DNS lookups, and gaming.

12. Network Security, Firewalls, and Port Management

Securing a network requires controlling traffic flow based on direction, IP addresses, and ports.

• Ingress (Inbound): Traffic entering your network or server from the outside.
• Egress (Outbound): Traffic leaving your network or server to access external resources.

Firewalls and Security Rules

Firewalls act as barriers, filtering traffic based on defined rules. In Linux, we use UFW (Uncomplicated Firewall), and in AWS, we use Security Groups.

# Allow HTTP traffic (Port 80)
sudo ufw allow 80/tcp

# Allow HTTPS traffic (Port 443)
sudo ufw allow 443/tcp

# Restrict SSH (Port 22) to a specific admin IP address
sudo ufw allow from 203.0.113.50 to any port 22 proto tcp

# Enable the firewall
sudo ufw enable

Common Network Ports and Protocols

13. Virtual Private Clouds (VPC) & Secure Subnet Architecture

A Virtual Private Cloud (VPC) is an isolated private network within a cloud provider (like AWS). To secure production applications, we divide the VPC into Public and Private subnets.

• Public Subnet: Contains resources that must be directly accessible from the public internet (e.g., Load Balancers, Web Servers). It is connected to an Internet Gateway (IGW).
• Private Subnet: Contains isolated resources that must never be directly exposed to the public internet (e.g., Database Servers, Backend APIs).
• NAT Gateway (Network Address Translation): Placed in the public subnet, it allows instances in the private subnet to securely download updates from the internet without exposing their private IP addresses to inbound public traffic.

14. System Design Foundations: Monoliths, Microservices, and Scaling

System design is the process of defining the architecture, modules, interfaces, and data flow for an application to satisfy specified requirements under scale.

Microservices Architecture for "DevBoard" (Task Tracker)

Below is the system design for a scalable, AI-integrated project tracking application:

Key Architectural Decisions

1. Decoupled Databases: User authentication data is stored in a structured PostgreSQL database, while unstructured task data and AI summaries are stored in a flexible MongoDB database.
2. gRPC for Internal Communication: While the frontend communicates with the Go backend via standard REST APIs, the Go backend communicates with the Python AI service using gRPC (Google Remote Procedure Call) over HTTP/2 for ultra-low latency.
3. JWT Authentication: A stateless JSON Web Token (JWT) service handles secure user sessions.

Scaling Strategies: Horizontal vs. Vertical

• Vertical Scaling (Scale Up): Adding more power (CPU, RAM) to an existing single server. It has hard hardware limits and introduces a single point of failure.
• Horizontal Scaling (Scale Out): Adding more servers to your pool. This is highly resilient and is managed dynamically using container orchestrators like Kubernetes.

Summary and Key Takeaways

• The physical internet is grounded in ocean-floor fiber-optic cables, not satellites, due to latency, bandwidth, and cost constraints.
• Bandwidth measures capacity, while Latency measures speed. Upgrading bandwidth does not fix high-latency routing issues.
• The OSI model is a 7-layer theoretical framework, while the TCP/IP model is a 4-layer practical implementation used in modern operating systems.
• TCP guarantees packet delivery via a 3-Way Handshake (SYN, SYN-ACK, ACK), whereas UDP prioritizes speed over reliability.
• CIDR notation determines network size using the formula $2^{32-n}$. Larger subnets use smaller prefix numbers (e.g., /16 has 65,536 IPs).
• AWS subnets reserve 5 IP addresses, while standard networking reserves 2 (Network and Broadcast addresses).
• DNS translates human-readable domains into IP addresses using a hierarchical lookup process (Root -> TLD -> Authoritative).
• VPCs isolate cloud environments by separating public-facing resources (in public subnets with Internet Gateways) from sensitive backends (in private subnets using NAT Gateways).
• System design prevents scaling failures. Modern architectures leverage microservices, load balancers, and horizontal scaling to handle millions of concurrent users.