Terms

One address advertised from several locations at once, with the routing system delivering each packet to whichever instance is nearest. Used to put a service close to its callers without giving it a different address in each place.

Network traffic types multicast unicast

A single, hardened, logged entry point into a network zone. It is only a bastion if it is the only path in; if the zone is reachable around it, it is a jump box with extra steps.

Zero-trust architecture

Delivery to every host on a segment at once. IPv4 has it; IPv6 removed it entirely and uses multicast groups instead, which is why an IPv6 network is quieter than an IPv4 one of the same size.

Network traffic types multicast unicast

Writing the network/host boundary as an explicit prefix length — the /24 in 203.0.113.0/24 — instead of inferring it from an address class. It replaced classful addressing in the 1990s and is what every current router actually uses.

Subnetting, CIDR, and VLSM subnet-mask supernetting

Moving a CPU from running one process to running another: the kernel saves the outgoing process’s state, picks the next one, sets its time slice, and returns to user mode. Fast enough that every program appears to run at once.

Linux abstraction layers kernel time-slice

Each layer wrapping the data it receives from the layer above with its own header, and sometimes a trailer, before handing it down. The receiver unwraps it in reverse. This is why the words segment, packet, and frame describe the same data at different depths.

The OSI model protocol-data-unit

A shell variable marked for inheritance by child processes, using export. It does not write anything to disk and is not permanent — permanence comes from a startup file setting it again each time a shell starts.

The shell and the command line shell-variable path

The small integer a process uses to refer to an open stream. Every process starts with three: 0 for standard input, 1 for standard output, 2 for standard error. Redirection is the shell repointing them before the program runs.

Streams, redirection, and pipes standard-streams

One of the eight 16-bit groups an IPv6 address is written in, four hex digits each. The IPv6 counterpart to IPv4’s octet.

IPv6 addressing octet

The last 64 bits of an IPv6 address, identifying an interface on its link. EUI-64 is one way to build it — derived from the MAC address — but modern systems prefer identifiers that are stable per network and not derived from hardware, because embedding a serial number in every packet is a privacy problem.

IPv6 addressing

The core of the operating system: it loads at startup, schedules the CPU, manages memory, drives hardware, and services the system calls processes make. It owns memory that no user process may touch, which is why a misbehaving program can crash itself without taking down the machine.

Linux abstraction layers system-call user-space

An address valid only on one link, with no gateway and no routing. In IPv4 it is the 169.254 fallback a host self-assigns when DHCP does not answer — which makes it a diagnostic signal. In IPv6 every interface has one permanently, and routing protocols use them.

IPv4 addressing IPv6 addressing unique-local-address

Hardware in modern CPUs that lets the kernel give each process a private, contiguous-looking virtual address space regardless of how the physical memory is actually arranged.

Linux abstraction layers kernel virtual-memory

Delivery to a group of interested interfaces rather than to one host or to everybody. IPv6 leans on it heavily: neighbour discovery asks a solicited-node group rather than shouting at the whole segment, which is the structural improvement over ARP.

Network traffic types broadcast unicast anycast

One of the four 8-bit groups an IPv4 address is written in, each shown in decimal from 0 to 255. Called an octet rather than a byte because the standards predate the byte being reliably eight bits everywhere.

IPv4 addressing hextet

The environment variable listing, in order, the directories the shell searches for the program a command names. Position matters: a directory early in the list can shadow a system command with something else of the same name.

The shell and the command line environment-variable

A connection joining one process’s standard output to the next one’s standard input, with nothing touching the disk. Pipes are what make many small single-purpose tools add up to work none of them was written for.

Streams, redirection, and pipes file-descriptor standard-streams

The component sitting in the traffic path that carries out an access decision made elsewhere. In the zero-trust model it is deliberately separate from the policy engine that decides — deciding and enforcing are different jobs.

Zero-trust architecture bastion-host

The name for the data at a given layer: bits at the physical layer, a frame at the data link layer, a packet at the network layer, a segment or datagram at the transport layer. Saying which one you mean says which information is available to you.

The OSI model encapsulation

A filesystem with nothing on a disk behind it — the kernel presenting its own state through the file interface so that ordinary tools work on it. /proc and /sys are the two you meet first, which is why cat works on kernel state.

The Linux filesystem hierarchy kernel

A permission bit making a program run as its owner rather than as the user who launched it. It is how an ordinary user can change their own password in a file they cannot write, and it is why an unexpected setuid binary is worth investigating.

File permissions and links umask

A named value belonging to one shell, set with NAME=value and gone when that shell exits. It becomes an environment variable — visible to child processes — only when exported.

The shell and the command line environment-variable

The three streams every process starts with: standard input, standard output, and standard error. Results go to output and diagnostics to error, which is what lets you pipe a command’s results somewhere without also piping its complaints there.

Streams, redirection, and pipes file-descriptor pipe

The value marking where an address stops being network and starts being host. In binary it is always a run of ones followed by a run of zeros. A host applies it with a bitwise AND to decide whether a destination is local or belongs to someone else.

Subnetting, CIDR, and VLSM cidr vlsm

Expressing several adjacent networks as one shorter prefix, to keep routing tables smaller than the number of allocations. Blocks only aggregate when they are contiguous and the aggregate starts on a multiple of its own size.

Subnetting, CIDR, and VLSM cidr

A small file whose contents are a path to something else. Its own permission bits are meaningless — access is decided by the target — and because it stores a path rather than a reference to the data, deleting the target leaves the link pointing at nothing.

File permissions and links

A request from a user process asking the kernel to do something only the kernel can. Opening, reading, and writing files are all system calls, and so are fork() and exec() — which is how every process other than the first one comes to exist.

Linux abstraction layers kernel user-space

The window of CPU time the kernel gives a process before considering whether to run something else. Rotating between processes this way is multitasking, and it runs fast enough that a sequence of turns reads as simultaneity.

Linux abstraction layers context-switch

The mask of permission bits removed from newly created files and directories. It subtracts from 666 for files and 777 for directories, so a new file never gets execute permission no matter what you set — a deliberate safety property.

File permissions and links setuid

One sender, one recipient. The ordinary case, and the pattern almost all traffic uses.

Network traffic types multicast broadcast anycast

IPv6’s counterpart to the RFC 1918 private ranges — addresses that route inside a site and never on the internet. A site generates a random identifier so that two networks merging later are unlikely to collide. Not a security boundary; simply not routed off-site.

IPv6 addressing link-local-address

The memory the kernel allocates to user processes, and everything running in it. The boundary between it and kernel space is the reason a crashing program takes only itself down.

Linux abstraction layers kernel system-call

An address space that looks private and contiguous to a process regardless of how the underlying physical memory is arranged. The MMU is the hardware that makes it possible.

Linux abstraction layers memory-management-unit

Splitting one network into subnets of different sizes to match what each segment actually needs. Allocate the largest block first, or the later ones have no correctly aligned boundary to start on.

Subnetting, CIDR, and VLSM subnet-mask cidr

Encapsulating layer 2 frames inside UDP and carrying them over a routed network, which raises the segment identifier from 12 bits to 24. The larger consequence is architectural: two hosts can share a layer 2 domain without sharing a physical one.

Software-defined networking

A model that stops treating network location as evidence of authorisation. Identity is verified continuously and no position on the network grants trust by itself; the practical goal is that one compromised host is not a path to everything else.

Zero-trust architecture policy-enforcement-point