Networking Fundamentals: Protocols, Devices & Architecture

Your laptop just sent a packet across three continents in 40 milliseconds. You didn't configure a route. You didn't negotiate a handshake. You just clicked a link. That invisibility is the greatest trick networking ever pulled — and the most dangerous one for anyone building, securing, or debugging modern infrastructure.

The OSI model gets taught as academic layer cake. In practice, it's a troubleshooting map. Layer 1 (Physical) is cables, optics, and RF — where signal loss kills throughput before logic ever enters the picture. Layer 2 (Data Link) is MAC addresses, VLANs, and switching loops. Layer 3 (Network) is IP addressing and routing decisions. Layer 4 (Transport) is TCP reliability versus UDP speed. Layers 5-7 collapse into the application payload.

A switch builds a MAC address table by inspecting source addresses on ingress frames. It forwards based on destination MAC — flooding unknown unicasts, broadcasting ARP requests, and dropping frames with no matching entry. VLANs segment broadcast domains logically. Trunks carry tagged frames between switches using 802.1Q. Spanning Tree Protocol (STP) prevents loops by blocking redundant paths, but modern designs favor routed access layers and MLAG/vPC to use all links actively.

Routers move packets between networks. They consult a routing table populated by connected interfaces, static routes, and dynamic protocols (OSPF, IS-IS, BGP). Each hop decrements TTL, recalculates the checksum, and forwards based on longest prefix match. ECMP spreads load across equal-cost paths. Policy-based routing and VRFs isolate traffic flows without physical separation.

TCP guarantees ordered, reliable delivery via three-way handshake, sequence numbers, acknowledgments, and retransmission timers. Flow control (window scaling) and congestion control (CUBIC, BBR) prevent collapse. UDP skips all state — fire-and-forget for DNS, VoIP, gaming, and QUIC. ICMP carries error messages and reachability tests. ARP and NDP resolve Layer 3 to Layer 2 addresses on IPv4 and IPv6 respectively.

Zero Trust starts at the packet level. 802.1X authenticates devices before port authorization. MACsec encrypts Ethernet frames hop-by-hop. IPsec and WireGuard tunnel traffic across untrusted paths. ACLs and firewall policies enforce least privilege at L3/L4. Microsegmentation extends policy to workload identity, not just IP. DNS filtering, TLS inspection, and flow telemetry (NetFlow, sFlow, IPFIX) close the visibility gap.

Three-tier (core, distribution, access) still works for campuses. Leaf-spine (Clos) dominates data centers — every leaf connects to every spine, enabling non-blocking ECMP. EVPN-VXLAN overlays stretch Layer 2 over Layer 3 fabric, decoupling tenant segmentation from physical topology. SD-WAN abstracts transport (MPLS, broadband, 5G) behind application-aware policies. Cloud networking mirrors on-prem constructs: VPCs, transit gateways, and service meshes.