8 — Networking, Domains, TLS, CDN & Security

Networking, Domains, Certificates: companion note 1 Networking, Domains, Certificates and Production Security Companion study note to the deck“From packets to production hardening” What this note adds beyond the deck: the joins between the ninelayers, the reference num- bers you would otherwise stop and look up, and apath from symptom to command while the site is down. Md Ahbab Hamid Khan https://ahbab.dev/ 1 HOW TO READ THIS NOTE Read Sections 2 and 3 once, slowly, before youneed them. They build the map and hand you the numbers.Read Section 4 when a change worked in staging and failed inproduction, because that is a boundary problem, not a code problem.Read Section 5 when you are choosing a proxy, a cache tier ora certificate strategy, and you want the operational cost, not the feature list.Read Section 6 during an incident, from the top, withoutskipping.The deck tells you what each mechanism is. This note tells you what eachmechanism believes, and what happens when the layer next to it believessomething else. Rule of thumb One idea carries the whole note: almost every incident in this space is amismatch between two layers that each thought they were correct. So when youdebug, do

Networking, Domains, Certificates: companion note 2 Client socket Recursive resolver TCP handshake CDN edge cache TLS termination Reverse proxy Ingress and service App worker Datastore or cache 1 name 2 address 3 anycast 4 decrypt 5 forward 6 route 7 dispatch 8 query edge tier, someone else’s TCP stack cluster tier, your TCP stack Figure 1: Nine hops, nine owners. Each dashed group terminates a connection ofits own, so each keeps its own timeouts and its own idea of who the client is.The joins between groups are where mismatches live. Table 1: What each hop owns, and what it can break with no help from any otherlayer. Hop State it owns What it alone can break Typical time Client socket Connect timeout, happy eyeballs or- der, keep-alive pool Sticks to a dead address, or prefers a broken IPv6 route 0 ms if pooled Resolver TTL countdown, negative cache Hands out the old address long after you changed it 1–40 ms TCP handshake SYN retries, MSS, path MTU Silent stall when a middlebox drops large packets 1 round trip CDN edge Cached bodies, cache key, Vary set Serves a stale or wrongly keyed copy to everyone 1–20 ms TLS termination Chain, private key, SNI map, ALPN list Presents the wron

Networking, Domains, Certificates: companion note 3 3.1 Network and transport Table 2: Transport facts that set the floor on every response time. Item Value Why you care DNS 53 UDP and TCP UDP first, TCP when the answer is truncated DNS over TLS 853 TCP Blocked ports here look like total name failure HTTP 80 TCP Needed for redirects and for ACME http-01 HTTPS 443 TCP, 443 UDP for QUIC HTTP/3 needs the UDP port open both ways Ethernet MTU 1500 bytes Tunnels shrink it, typically to 1400–1460 TCP MSS 1460 bytes on a 1500 MTU 1500 minus 20 IP minus 20 TCP TCP handshake 1 round trip Paid once per new connection TLS 1.3 full 1 round trip TLS 1.2 costs 2, so version matters on mobile TLS 1.3 resumed 0 round trips Only if the ticket is still valid at that node Same rack 0.1–0.5 ms typical A proxy hop should never cost more Same city 2–10 ms typical Multi-AZ chatter adds up quickly Cross continent 60–90 ms typical Each extra round trip is a visible pause Mobile radio adds 30–60 ms typical Round trips hurt more than bytes here Reading note: Ports and round trip counts are fixed by specification. Every latencyfigure is typical, measured warm, and will differ on your path. Figure 2 splits a re