The core layers:

1. Hardware - Hardware layer comprises of physical components of a computer, such as: Motherboard, CPU, RAM, Hard drive, SSD, network interfaces, peripheral devices.

2. Kernel - the core that manages hardware and processes : CPU scheduling, memory management, device drivers, and system calls. Everything else runs on top of it.

3. System libraries - Acts as a bridge between the user/application space and the kernel. They provide standard programming interfaces so developers do not need to write low level machine code.

4. Shell - the interface between user and the kernel. When the user type's a command, the shell interprets it and asks the kernel to do the work. Bash is the most common shell, which is why almost every DevOps script is a bash script.

5. User Space (Applications) - Here is where the user programs, server applications run.

File system hierarchy — Linux treats almost everything as a file, organized under a single root ( / ):

/          - root of the entire filesystem
/bin       - essential command binaries
/etc       - system-wide configuration files
/home      - user home directories
/var       - variable data: logs, caches, spool files
/usr       - user programs and libraries
/opt       - optional/third-party software 
/tmp       - temporary files, cleared on reboot

Processes - every running program is a process with a unique PID. We can see them live:

bash

ps aux
top

Why this mattered for me specifically: when my Jenkins EC2 instance ran out of disk space , understanding that /var is where logs and build artifacts pile up (not /home) is what let me find and fix the problem quickly instead of guessing.

What I learned: Once we understand the Linux architecture it is then easier to know where things live and how the shell talks to the kernel.

DNS (Domain Name System)

Domain Name System (DNS) is like a phonebook but for the internet. It maps website names (human readable) to IP addresses (machine readable).

How DNS works

• User Input: You enter a domain name (e.g., www.google.com) in the browser.

• Local Cache Check: The browser or OS checks if this IP address is stored in its cache. The IP address may be saved in the cache if you have already visited the website.

• DNS Resolver Query: If the IP address is not found in the local cache, the request is then sent to a DNS resolver.

• Root Server Query: The resolver queries a root server, which points to the correct TLD server.

• TLD Server Response: The TLD server points the resolver in the direction of the authoritative server for the domain.

• Authoritative Server Response: The real IP address is returned by the authoritative server.

• Final Response: The browser establishes a connection with the server once the resolver returns the IP to the user.

Misconfigured DNS is one of source of 'it works locally but not in the production'

Firewall and Security Groups

A firewall controls and monitors the incoming and outgoing traffic based on some pre-defined rules. It protects a private network from unauthorized access, malware or attacks.
Firewalls can be hardware based or software based or both.

There are 4 types of firewalls:

1. Packet filtering firewall - A type of firewall that only provides basic security. It checks packet headers like IP, ports and protocols. It does not check the data inside the packets.

2. Stateful Inspection Firewall - It is also called a dynamic packet filtering firewall. It monitors the state of active network connections and makes filtering decisions based on the traffic context, not just individual packets.
   When a connection is established, the firewall creates an entry in a state table that records information such as:

   • Source IP address

   • Destination IP address

   • Source and destination port numbers

   • Protocol (TCP, UDP, etc.)

   • Connection state (e.g., SYN_SENT, ESTABLISHED, FIN_WAIT)

   The firewall then examines incoming and outgoing packets and checks whether they belong to a legitimate, established session.

3. Proxy Firewall - Also called as an application level gateway, acts as the middleman between user and destination server. Inspects traffic at the application layer.
   It also hides internal IP addresses from external servers.
   Instead of allowing your computer to connect directly to a website or server. The proxy firewall receives the request, examines it, and then makes a separate request to the destination on the user's behalf.

   User → Proxy Firewall → Internet Server
   

4. Circuit Level Gateway - It is a type of firewall that monitors and controls network connections between a user and an external server. It works at the Session Layer of the OSI model.

5. Next Generation Firewall - It is a more advanced firewall that combines traditional firewall features with additional security capabilities, such as:

• Deep packet inspection

• Application awareness and control

• Intrusion prevention systems (IPS)

• Malware detection

• User-based policies

• It not only checks IP addresses and ports but can also identify applications, inspect packet contents, and detect threats.

6. Web Application Firewall - A Web Application Firewall (WAF) is a firewall specifically designed to protect web applications and websites from malicious HTTP/HTTPS traffic.

7. Host-Based Firewall

• Installed directly on an individual computer or server.

• Controls incoming and outgoing traffic for that specific device.

Example: Windows Defender Firewall.

8. Network-Based Firewall

• Protects an entire network.

• Usually placed between an internal network and the internet.

• Controls traffic entering and leaving the network.

Security Groups - A security group is a virtual, instance-level firewall used in cloud computing to control inbound and outbound traffic for specific resources like virtual machines.
E.g., A security group acts as a virtual firewall around the EC2 instance it controls what traffic can reach it, by port and by source.

Inbound rule example:
Type: SSH       Port: 22    Source: my IP only
Type: HTTP      Port: 80    Source: 0.0.0.0/0 (anywhere)
Type: Custom TCP  Port: 8080  Source: 0.0.0.0/0 (Jenkins UI)

For me, I had done everything correct the first time while installing Jenkins on my EC2 instance but couldn't just open the Jenkins UI and then I understood that port 8080 was not configured or open in the security groups. So I just went and edited the inbound security rules and opened the port and voila Jenkins UI was accessible.

Troubleshooting Commands

ping google.com

Sends small packets to a host and waits for a reply, measuring response time. Tells us if the host is reachable at all, at a basic network level. What it does not tell us if a specific service on it is working, a host can respond to ping while its web server is completely down.

curl -I https://example.com

Sends an HTTP request and shows just the response headers (-I = headers only, no body). It also tells us if the actual web service is responding, not just the machine. This is the step up from ping, we are now checking the application layer, not just "is the machine alive."

netstat -tulpn

It lists which ports are currently listening on the machine, and which process owns each one. Flags:
-t = TCP
-u = UDP
-l = listening ports only
-p = show the process name/PID
-n = show numeric ports instead of resolving service names.
It also tells us if the service is actually running and bound to the port we expect.
I used this constantly to confirm Jenkins or Tomcat was actually listening before assuming a network problem.

nslookup example.com

nslookup Queries DNS and shows what IP a domain resolves to. It also tells us is DNS resolution the actual problem, separate from connectivity.

traceroute example.com

It shows us every network hop between our machine and the destination. Also tells where the connection is actually failing on the network.

The debugging order that I learnt:

1. ping - To check if the host is reachable.

2. nslookup - Check if ping fails on a domain name.

3. netsat -tulpn - Check if the service is actually listening on the port on the target machine.

4. Security group / firewall rules - Check if the port is open for the service.

5. curl -I - To check if the application layer is actually responding.

My Learnings:
Networking troubleshooting isn't random guessing of what could have went wrong. I learnt a systematic way of troubleshooting if a service or an application is down. Also it was helpful to understand why and how security groups are maintained. Importantly I understood that it is not just about memorizing commands, trouble shooting is like problem solving where we have to break down the problem into possible scenarios and then work on each one step by step until we find the cause of it and fix it.

A few weeks ago I started learning computer networking from scratch - from physical internet (Devices, LAN,WAN,MAN, etc.), internet addressing, OSI model, TCP/IP model, DNS, Network Security, VPC.
But in this series I am only going to go over the topics that are really important for learning DevOps.

Let's start it with an example to try to understand what we are actually trying to learn before we jump to the models.

Lets say I place an order for an item on amazon --> the seller receives my order --> the item is packed --> the delivery person brings it to my home.

1. The Amazon app is where I choose and order the product.

2. Amazon records my order and delivery address.

3. The warehouse packs the correct item.

4. The delivery system makes sure it reaches me reliably.

5. The delivery person follows the correct route, and finally, the package physically travels from the warehouse to my home.

Computer network works in a similar way. Data travel's from one device to another, often across multiple networks, routers, switches, servers, and even continents.
For this communication to actually work we have two very important models.

• The OSI Model

• The TCP/IP Model

With the help of these models we can understand how data moves from one layer to another from a source to destination. Each layer has a specific responsibility and works with the layers above and below it. This makes networking easier to understand and troubleshoot.

The OSI Model

The OSI (Open Systems Interconnection) Model divides network communication into seven layers.

Starting from the top:

1. Physical Layer - responsible for transmitting raw data bits through physical network hardware.

2. Data Link Layer - handles communication between devices on the same local network. It uses Mac addresses to identify network interfaces.

3. Network Layer - Responsible for moving data between different networks. This layer handles IP addressing, routing and packet forwarding.

4. Transport Layer - responsible for delivering data between applications. Two important protocols that operate at this layer are TCP and UDP.

5. Session Layer - manages communication sessions between two systems. It is responsible for establishing a session, maintaining a session and terminating a session.

6. Presentation Layer - responsible for how data is formatted and represented. Encryption, Decryption, Compression and Data formatting are its responsibilities.

7. Application Layer - network services interact with applications used by the user on the application layer. It provides protocols that applications use to communicate over a network.
   E.g. HTTP/HTTPS, DNS, FTP, SMTP, SSH.

The TCP/IP Model

Unlike the OSI model the TCP/IP model has only four layers.

• Application Layer - Applications interact with the network. It also handles data formatting, provides encryption for secure communication and manage sessions to track ongoing connections. Which means the application, presentation and session layer from the OSI model becomes the application layer in the TCP/IP model.

• Transport - Ensures reliable and efficient delivery of data between devices, managing segmentation, ordering, and retransmission as needed.

• Internet - Responsible for addressing, packaging, and routing data packets so they can travel across networks and reach the correct destination device.

• Network Access - Responsible for physically transmitting data over network hardware, including cables, switches, and wireless connections. It handles how data is formatted as well. Which also means the data link and physical layer from the OSI model becomes the Network access layer in the OSI model.

IP Addressing

IP addressing is like assigning an address to a device on the network.
From our amazon example, just like the we need an address to get our item delivered to, a network needs an IP address to know where the data needs to go.
E.g. My Laptop IP - 192.168.1.10

An IP address has two parts -

1. Network Portion - This identifies the network.
   2. Host Portion - This identifies a specific device within that network

E.g. 192.168.1.10/24
Here, 192.168.1 --> network portion and .10 --> host portion

The most common IP addressing system is IPv4.

IPv4 Address

192.168.1.10 --> This is how an IPv4 address looks like. It consists of four octets and each octet has a value from 0 - 255.

Subnet

A smaller network created from a larger network is called a subnet.

E.g. Imagine a three-sided building called Marine Heights.

Marine Heights has 30 apartments on a single floor. Initially, you can think of the entire building as one large network.

Now, the building committee decides to divide the building into three separate wings:

• Marine Heights – Wing A

• Marine Heights – Wing B

• Marine Heights – Wing C

Instead of having one large section with 30 apartments, each wing now contains 10 apartments.

This makes it easier to identify which section of the building a particular apartment belongs to.

For example:

Marine Heights
│
├── Wing A
│   ├── Apartment 1
│   ├── Apartment 2
│   └── ...
│
├── Wing B
│   ├── Apartment 11
│   ├── Apartment 12
│   └── ...
│
└── Wing C
    ├── Apartment 21
    ├── Apartment 22
    └── ...

This is similar to subnetting.

• Marine Heights = The original large network

• Each wing = A subnet

• Each apartment = A device or host with an IP address

Subnetting takes one large network and divides it into smaller, more organized networks.

For example, instead of having one network, we can divide it into smaller subnets.

The same way that splitting Marine Heights into Wing A, Wing B, and Wing C makes the building easier to organize, subnetting makes a large network easier to manage, organize, and control.

Ports

A port identifies a specific service on a device. The IP gets you to the machine; the port gets you to the right application on it.

Some commonly used ports while working in DevOps are:

My take aways: A huge amount of "networking" in cloud/DevOps work isn't deep protocol theory it's knowing that an IP gets you to a machine, a port gets you to a service on that machine, and TCP vs UDP is about whether you need delivery guaranteed.

Resources for reference:

https://youtu.be/xN3BKHji12I?si=tTupCvhrLIlu-4GU

https://youtu.be/fQbBPa0ADvs?si=55S3zFNOZ36WKd46

All the images in the blog are AI generated.