Part 4: Application Layer, Web & Advanced

1. HTTP: Methods & Status Codes

• Methods: GET (read, no body), POST (create/submit), PUT (replace entirely), PATCH (partial update), DELETE (remove), HEAD (headers only), OPTIONS (capabilities/CORS).
• Status codes (memorize the classes):
  • 1xx informational · 2xx success (200 OK, 201 Created, 204 No Content)
  • 3xx redirection (301 permanent, 302 temporary, 304 Not Modified for caching)
  • 4xx client error (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests)
  • 5xx server error (500, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout)
• 401 vs 403: 401 = not authenticated (who are you?); 403 = authenticated but not allowed (you lack permission).

HTTP/1.1 vs HTTP/2 vs HTTP/3

	HTTP/1.1	HTTP/2	HTTP/3
Multiplexing	No (one request per connection)	Yes (multiple streams)	Yes
Problem	Head-of-line blocking at the connection	HOL blocking at TCP level	Solved via QUIC over UDP
Transport	TCP	TCP	QUIC (UDP)
Benefit	Baseline	Faster, compressed headers (HPACK)	Lowest latency, no TCP HOL blocking

Key point: HTTP/2 fixes application HOL blocking but still sits on TCP; HTTP/3 uses QUIC over UDP to eliminate TCP-level head-of-line blocking — great for mobile/streaming.

Statelessness, Cookies & Sessions

• HTTP is stateless — each request is independent; the server forgets you between requests.
• Cookies: small data the server sets and the browser sends back on every request (Set-Cookie header). Carries a session ID (or auth token).
• Sessions: server-side state keyed by the session ID from the cookie — the server remembers login, cart, etc.
• Statelessness benefit: easy horizontal scaling (any server can serve any request); state is pushed to client or a shared store (e.g., Redis).

2. DNS: Recursive vs Iterative

• Recursive resolution: the resolver itself queries each server down the chain and returns the final answer to the client (the client makes one request).
• Iterative resolution: the resolver queries, gets “ask this next server,” and keeps querying until the answer — the root → TLD → authoritative chain.

Client → [Recursive resolver]
           → Root server (iterative)
           → TLD server .com (iterative)
           → Authoritative server (iterative: gives the IP)
Client ← final answer

Record types: A/AAAA (IPv4/IPv6), CNAME (alias), MX (mail server), TXT (verification/SPF), NS (name server).

3. Email & File Transfer Protocols

• SMTP (port 25/587): sending email between mail servers and from client to server.
• POP3 (port 110): downloads mail to the client and usually deletes it from the server — one device only.
• IMAP (port 143): syncs mail, keeps it on the server — multiple devices, folders, state — the modern choice.
• FTP (port 21 + data port): plain file transfer; SFTP = file transfer over SSH (encrypted); TFTP = trivial, connectionless, UDP, used for network boot/config.

Rule of thumb: SMTP sends, POP3/IMAP receive; IMAP (server keeps state) over POP3 (client pulls); SFTP (secure) over FTP (plaintext).

4. L4 vs L7 Load Balancing

• Layer-4 (transport) load balancer: routes based on IP + TCP/UDP port only — fast, protocol-agnostic, doesn’t inspect content. Good for raw throughput.
• Layer-7 (application) load balancer: inspects the actual HTTP request (URL, headers, cookies) — enables path-based routing, SSL termination, caching, sticky sessions. Slower but far more flexible.

	L4	L7
Operates on	IP + port	HTTP content
Speed	Fastest	Slower
Features	None	Path routing, TLS, caching, sticky sessions
Use case	TCP/UDP throughput	Web apps, microservices

• Forward vs reverse proxy: a forward proxy sits in front of clients (outbound — corporate filtering); a reverse proxy sits in front of servers (inbound — load balancing, TLS, caching).

5. Diagnostic Utilities: Your “Eyes” on the Network

• ping (ICMP): The binary test for connectivity. If it fails, check physical links or L3 routing. If it succeeds, the issue is higher up (Port blocking, Firewall, or Application crash).
• nslookup / dig: Used to troubleshoot DNS. If you can ping an IP but not a URL, your DNS resolution is failing.
• netstat: Displays active TCP/UDP connections. Use this to identify which applications are listening on specific ports or to spot “Socket Exhaustion” (where a server runs out of ephemeral ports).
• traceroute / tracert: Maps the path hop-by-hop. It helps pinpoint exactly where a packet is being dropped or where latency is spiking.

---

6. Common “Real-World” Failure Scenarios

• The “APIPA” Address: If a client has an IP in the 169.254.x.x range, it failed to reach the DHCP server. Action: Check the DHCP scope, VLAN tagging, or the physical cable to the server.
• “Socket Exhaustion”: An application reports connection failures despite a healthy network. This usually means the server has hit its limit for concurrent connections due to TIME_WAIT states. Action: Tune OS kernel parameters or deploy a Load Balancer.
• CRC Errors: If an interface reports “CRC Errors” or “Input Errors,” the physical layer is corrupted. Action: Check for bad cabling, EMI (cables too close to power lines), or a failing SFP/transceiver.
• VoIP “VLAN Mismatch”: A phone keeps resetting. Action: Ensure the switch port is configured with a Voice VLAN so the phone and the PC behind it are logically separated.

---

7. Automation and “Infrastructure as Code” (IaC)

• Why Automate? Manual CLI changes are slow, inconsistent, and audit-proof. IaC treats network configs like software code (version-controlled, tested, and repeatable).

• Python Libraries for Networking:

• Netmiko/Paramiko: Used to SSH into hundreds of devices automatically to execute commands or pull backups.

• Scapy: Allows for raw packet manipulation. Used for custom network scanning, testing firewall behaviors, or mapping subnets.

• Ansible: A powerful tool for “pushing” configurations to your entire fleet at once, ensuring every switch has the exact same security policy.

• Git: The “Source of Truth.” Always store your configuration files in a Git repository to track historical changes and allow for instant rollbacks if a configuration breaks the network.

---

8. Advanced Operational Concepts

• In-Band vs. Out-of-Band (OOB) Management:

• In-Band: Managing devices via the production network. If the network goes down, you lose management.

• Out-of-Band: Managing devices via a dedicated, physically separate network (e.g., console ports). This is mandatory for critical infrastructure.

• Stateful vs. Stateless Firewalls:

• Stateless: Looks only at packet headers (Source/Dest/Port).

• Stateful: Tracks the “session state.” It understands that an incoming packet is a legitimate response to an outgoing request.

• Port Mirroring (SPAN/TAP): Mirroring traffic from a production port to a “destination” port for sniffing/analysis (using tools like Wireshark) without interrupting live traffic.