DNS
DNS resolves names to IP addresses through a hierarchy: root servers → TLD servers (.com) → the domain's
authoritative nameservers.
dig example.comQueries DNS and shows the full resolution detail — the standard first tool for a DNS problem.
dig +short example.comPrints just the resolved IP address, no extra detail.
nslookup example.comSimpler DNS lookup, available on more systems than dig by default.
dig example.com MXQueries a specific record type — here, mail exchange records.
Common record types
A — hostname to IPv4. AAAA — hostname to IPv6. CNAME — alias to another hostname. MX — mail servers for a domain. TXT — arbitrary text, often used for domain verification and SPF/DKIM. NS — the authoritative nameservers for a domain.
HTTP / HTTPS
curl -I https://example.comFetches only response headers — status code, server, caching headers — without downloading the body.
curl -v https://example.comShows the full request/response exchange including the TLS handshake, for debugging connection-level problems.
Idempotent methods
GET, PUT, DELETE and HEAD are defined as idempotent — repeating the same request has the same effect as doing it once. POST and PATCH are not — a retried POST can create a duplicate resource, which is why safe retry logic needs either an idempotency key or a genuinely idempotent method.
TCP/IP
A TCP connection is established with a three-way handshake: SYN → SYN-ACK → ACK. Each end then tracks the connection's sequence numbers to guarantee ordered, reliable delivery — the property TCP trades latency for, versus UDP's fire-and-forget model.
ss -tulpnLists listening TCP/UDP sockets and the process holding each one.
ss -tan state establishedLists only established TCP connections, filtering out listening sockets.
CIDR & Subnetting
CIDR notation (10.0.0.0/16) combines a network address with a prefix length denoting how many leading bits are
fixed — the rest are available for host addresses.
Quick CIDR reference
/32 — a single host. /24 — 256 addresses (254 usable). /16 — 65,536 addresses. /8 — 16.7 million addresses.
Each step down by one bit doubles the address space; each step up halves it.
A typical AWS VPC design: a /16 VPC (e.g. 10.0.0.0/16) subdivided into /24 subnets per AZ per tier — public,
private, and database — giving room to grow within each without re-addressing the whole VPC.
BGP
Border Gateway Protocol is how autonomous systems (ISPs, cloud providers, large networks) exchange routing information across the internet — it's what makes "the internet" a network of networks rather than one flat network. Relevant to DevOps mainly through BGP-based failover (Anycast, some multi-region load balancing setups) and understanding why a route can flap or a provider outage can partition traffic unevenly.
Load Balancing & Reverse Proxies
Load balancer
Distributes traffic across multiple backend instances of the same service, for scale and failover. Operates at L4 (TCP/UDP, e.g. a network load balancer) or L7 (HTTP-aware routing, e.g. an application load balancer).
Reverse proxy
Sits in front of one or more backend services, forwarding client requests to them — often also handling TLS termination, caching, compression and request routing by path/host. A load balancer is a reverse proxy specialized for distributing load across replicas of one service.
Common algorithms: round robin (even rotation), least connections (favor the least-busy backend), IP hash (same client consistently routes to the same backend — simple session affinity without shared session storage).
Nginx as a Reverse Proxy
server {
listen 443 ssl;
server_name example.com;
location / {
proxy_pass http://backend:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_read_timeout 60s;
}
}nginx -tTests configuration syntax without reloading — always run before reload on a production host.
nginx -s reloadReloads configuration without dropping existing connections.
TLS / SSL
openssl s_client -connect example.com:443 -servername example.comOpens a raw TLS connection and prints the certificate chain — the standard way to inspect what a server is actually presenting.
openssl x509 -in cert.pem -noout -datesPrints a certificate's validity window (notBefore/notAfter) from a local file.
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddateChecks a live server's certificate expiry date directly, without downloading the cert file first.
TLS handshake, briefly
Client and server negotiate a protocol version and cipher suite, the server presents its certificate (verified against a trusted CA chain), and both sides derive a shared symmetric key for the actual encrypted session — the asymmetric handshake exists only to bootstrap that faster symmetric encryption.
See TLS Certificate Expired and DNS Not Resolving for step-by-step diagnostic sequences.