Terms

One address advertised from several locations at once, with the routing system delivering each packet to whichever instance is nearest. Used to put a service close to its callers without giving it a different address in each place.

Network traffic types multicast unicast

A single, hardened, logged entry point into a network zone. It is only a bastion if it is the only path in; if the zone is reachable around it, it is a jump box with extra steps.

Zero-trust architecture

Delivery to every host on a segment at once. IPv4 has it; IPv6 removed it entirely and uses multicast groups instead, which is why an IPv6 network is quieter than an IPv4 one of the same size.

Network traffic types multicast unicast

Writing the network/host boundary as an explicit prefix length — the /24 in 203.0.113.0/24 — instead of inferring it from an address class. It replaced classful addressing in the 1990s and is what every current router actually uses.

Subnetting, CIDR, and VLSM subnet-mask supernetting

Each layer wrapping the data it receives from the layer above with its own header, and sometimes a trailer, before handing it down. The receiver unwraps it in reverse. This is why the words segment, packet, and frame describe the same data at different depths.

The OSI model protocol-data-unit

One of the eight 16-bit groups an IPv6 address is written in, four hex digits each. The IPv6 counterpart to IPv4’s octet.

IPv6 addressing octet

The last 64 bits of an IPv6 address, identifying an interface on its link. EUI-64 is one way to build it — derived from the MAC address — but modern systems prefer identifiers that are stable per network and not derived from hardware, because embedding a serial number in every packet is a privacy problem.

IPv6 addressing

An address valid only on one link, with no gateway and no routing. In IPv4 it is the 169.254 fallback a host self-assigns when DHCP does not answer — which makes it a diagnostic signal. In IPv6 every interface has one permanently, and routing protocols use them.

IPv4 addressing IPv6 addressing unique-local-address

Delivery to a group of interested interfaces rather than to one host or to everybody. IPv6 leans on it heavily: neighbour discovery asks a solicited-node group rather than shouting at the whole segment, which is the structural improvement over ARP.

Network traffic types broadcast unicast anycast

One of the four 8-bit groups an IPv4 address is written in, each shown in decimal from 0 to 255. Called an octet rather than a byte because the standards predate the byte being reliably eight bits everywhere.

IPv4 addressing hextet

The component sitting in the traffic path that carries out an access decision made elsewhere. In the zero-trust model it is deliberately separate from the policy engine that decides — deciding and enforcing are different jobs.

Zero-trust architecture bastion-host

The name for the data at a given layer: bits at the physical layer, a frame at the data link layer, a packet at the network layer, a segment or datagram at the transport layer. Saying which one you mean says which information is available to you.

The OSI model encapsulation

The value marking where an address stops being network and starts being host. In binary it is always a run of ones followed by a run of zeros. A host applies it with a bitwise AND to decide whether a destination is local or belongs to someone else.

Subnetting, CIDR, and VLSM cidr vlsm

Expressing several adjacent networks as one shorter prefix, to keep routing tables smaller than the number of allocations. Blocks only aggregate when they are contiguous and the aggregate starts on a multiple of its own size.

Subnetting, CIDR, and VLSM cidr

One sender, one recipient. The ordinary case, and the pattern almost all traffic uses.

Network traffic types multicast broadcast anycast

IPv6’s counterpart to the RFC 1918 private ranges — addresses that route inside a site and never on the internet. A site generates a random identifier so that two networks merging later are unlikely to collide. Not a security boundary; simply not routed off-site.

IPv6 addressing link-local-address

Splitting one network into subnets of different sizes to match what each segment actually needs. Allocate the largest block first, or the later ones have no correctly aligned boundary to start on.

Subnetting, CIDR, and VLSM subnet-mask cidr

Encapsulating layer 2 frames inside UDP and carrying them over a routed network, which raises the segment identifier from 12 bits to 24. The larger consequence is architectural: two hosts can share a layer 2 domain without sharing a physical one.

Software-defined networking

A model that stops treating network location as evidence of authorisation. Identity is verified continuously and no position on the network grants trust by itself; the practical goal is that one compromised host is not a path to everything else.

Zero-trust architecture policy-enforcement-point