Introduction to Computer Networks

A computer network is a collection of interconnected devices — computers, phones, servers, switches, routers — that can exchange data with each other. The internet is the world's largest computer network, used by roughly 5.5 billion people and millions of autonomous systems. Yet it is built from the same fundamental principles as the two-device network you'd create by connecting two laptops with a single cable.

A brief history Background — Not on exam

ARPANET (1969) was one of the first packet-switched wide-area networks, funded by the US Department of Defense. It connected four sites (UCLA, SRI, UCSB and the University of Utah) and demonstrated that decentralised, fault-tolerant networking was feasible. The modern internet grew directly from ARPANET, with TCP/IP replacing the original NCP protocol in 1983 — often called "Flag Day". By 1991 Tim Berners-Lee had invented the World Wide Web on top of the existing internet, making it accessible to general users. Today's internet carries traffic on the order of hundreds of exabytes per month according to industry estimates.

What is a network protocol?

All communication activity on the internet is governed by protocols. A network protocol defines the format and order of messages exchanged between two or more communicating entities, as well as the actions taken on transmission or receipt of a message or other event.

Every protocol consists of three essential pillars:

Component	What it defines	Real-world example
Syntax	The structure, format, and encoding of the data fields — bit offsets, field sizes, delimiter characters.	An IPv4 header places the 4-bit Version in bits 0–3, or HTTP requires CRLF (`\r\n`) to delimit header lines.
Semantics	The precise meaning of each field or value — what action it requests or what condition it reports.	HTTP status `404` signifies "Resource Not Found", or a TCP `SYN=1` flag requests a new connection establishment.
Timing / Sequencing	Speed matching, event sequencing, and the order in which entities may transmit.	A client must await a server's `SYN-ACK` before transmitting application payload data; retransmission timeouts (RTO).

Human communication analogy: When you meet an acquaintance on the street, you execute an unspoken protocol: "Hello" → "Hello" → "Do you know what time it is?" → "It is 2:30 PM". If one party speaks an unrecognised language (syntax mismatch) or answers before a question is asked (timing failure), the interaction collapses. On the internet, standard protocols are codified by the IETF (Internet Engineering Task Force) in open specifications known as RFCs (Request for Comments).

What is the Internet? Structure, Edge, and Core

The internet can be understood from two perspectives:

Nuts-and-bolts perspective: A global interconnection of hundreds of thousands of heterogeneous networks connecting billions of computing devices (hosts/end systems), linked by optical fibre, copper cable, radio channels, and packet switches (routers and link-layer switches).
Services perspective: A distributed communications infrastructure that provides services to applications — the World Wide Web, streaming media, real-time gaming, financial ledgers, and cloud computation.

Architecturally, the internet is partitioned into the network edge and the network core:

Network Edge: End systems (clients, servers, smartphones, IoT sensors) running application-layer software, connected to the internet through access networks (fibre-to-the-home / FTTH, cable DOCSIS, cellular 4G/5G, Wi-Fi).
Network Core: The interconnected mesh of high-speed packet routers and optical switches that transport packets from source access networks to destination access networks across regional and intercontinental distances.

The global ISP hierarchy and peering

No single organisation owns the internet. Instead, it is an interconnected federation of commercial and non-profit networks organised hierarchically:

Tier 1 ISPs (e.g. Lumen, AT&T, Arelion (formerly Telia Carrier), NTT, Tata Communications): National and intercontinental backbone networks. Tier 1 providers connect directly to all other Tier 1 networks on a settlement-free peering basis — exchanging traffic without paying transit fees.
Tier 2 ISPs: Regional or national providers that purchase transit from Tier 1 backbones to reach the global internet, while peering with other Tier 2 providers to exchange regional traffic locally.
Tier 3 / Access ISPs: Local retail providers connecting residential homes and enterprise offices to the internet.
IXPs (Internet Exchange Points): Physical carrier-neutral facilities housing high-capacity switches where hundreds of ISPs, content delivery networks (Cloudflare, Akamai), and content giants (Google, Netflix, Meta) directly interconnect to exchange traffic (peering) at line rate, bypassing paid transit fees and slashing latency.

Note on modern internet topology: The classical three-tier hierarchy is a conceptual simplification. Today, massive content and cloud providers (Google, Meta, Microsoft, Netflix, Amazon) construct their own extensive private submarine and terrestrial backbones and peer directly with access networks at hundreds of IXPs worldwide. As a result, a huge fraction of global traffic bypasses Tier 1 transit altogether, making the modern internet topology significantly flatter.

Observing the network: Introduction to Wireshark

Theoretical network models become tangible when you can inspect the actual bits travelling across your network interface controller (NIC). Wireshark is the world's pre-eminent open-source packet analyzer.

Wireshark captures network frames using platform-level packet capture drivers (libpcap on Linux and macOS, Npcap on Windows). By default, a network card operates in standard mode, ignoring frames addressed to MAC addresses other than its own. Wireshark can switch the NIC into promiscuous mode, instructing the card to pass every frame traversing the physical wire or Wi-Fi channel directly up to the operating system for inspection.

On a switched network, even in promiscuous mode you only see your own traffic plus broadcast/multicast and flooded unknown-unicast frames, because switches direct unicast traffic exclusively to the destination host's switch port. On Wi-Fi, you need monitor mode (RFMON) to see frames transmitted by other stations. Wireshark enables promiscuous mode by default on most setups.

The Three-Pane Wireshark interface

Packet List pane (top): Displays a table of every captured packet with packet number, relative timestamp, source IP, destination IP, protocol name, frame length in bytes, and high-level summary info.
Packet Details pane (middle): Displays a collapsible protocol tree illustrating the complete encapsulation hierarchy of the selected packet:
Frame → Ethernet II → Internet Protocol Version 4 → Transmission Control Protocol → Hypertext Transfer Protocol. Clicking any header field automatically highlights its exact byte offsets in the pane below.
Packet Bytes pane (bottom): Displays the raw hexadecimal representation of the packet alongside its ASCII translation, showing the exact bytes that crossed the physical wire.

Capture filters vs. Display filters

A frequent beginner trap is confusing Wireshark's two distinct filtering languages:

Capture filters (BPF syntax): Configured before initiating packet capture. Evaluated in the kernel by libpcap; unmatching packets are discarded immediately, saving RAM and disk space on saturated links. Example: host 192.168.1.1 and tcp port 443.
Display filters (Wireshark syntax): Applied after capture to hide or highlight packets in the GUI without deleting them from the capture file. Extremely rich protocol awareness. Example: http.response.code == 200 && ip.dst == 192.168.1.50.

Practical Wireshark workflows

Choosing a capture interface: When Wireshark opens, the home screen presents a list of available network interfaces alongside live sparkline traffic activity graphs. Select the interface actively carrying network traffic — typically eth0 or en0 for wired Ethernet, or wlan0 / en0 for Wi-Fi. Avoid loopback (lo0) unless debugging local inter-process sockets.
"Follow TCP Stream": Rather than manually piecing together individual TCP segments, right-click any TCP packet in the packet list and select Follow → TCP Stream. Wireshark extracts all payload bytes in both directions, reassembles them in sequence order, and displays the complete application-layer conversation in a clean window (red text for client requests, blue text for server responses).

Legality and ethics of packet sniffing

Packet analysis captures raw communication data, which may contain unencrypted credentials, authentication tokens, and private messages. Always capture traffic only on your own local machine, your own personal devices, or on networks where you have explicit written authorisation to monitor packets. Unauthorised interception of third-party network traffic is illegal under wiretapping and computer misuse laws in most countries. For hands-on packet inspection exercises in a safe learning environment, see the Wireshark lab in Chapter 9 (Hands-on Labs).

What is a network for?

Networks exist to share resources and enable communication:

Resource sharing: printers, file servers, databases, compute (cloud computing).
Communication: email, instant messaging, video calls, social media.
Remote access: SSH into a server, accessing a corporate VPN, streaming services.
Distributed computing: multiple machines collaborating on one problem (Hadoop, Kubernetes workloads).

Network types by scale

Type	Scale	Example	Typical technology
PAN — Personal Area Network	~10 m	Phone + headphones + smartwatch	Bluetooth, USB
LAN — Local Area Network	Building / campus	Office floor, university campus	Ethernet (802.3), Wi-Fi (802.11)
MAN — Metropolitan Area Network	City	Cable TV network, city Wi-Fi	Fibre, DOCSIS
WAN — Wide Area Network	Countries / global	The internet, corporate WAN	MPLS, leased lines, undersea cables

Nice-to-know: Net neutrality

Net neutrality is the principle that Internet Service Providers (ISPs) must treat all data traversing their networks equally, without blocking, throttling, or granting paid prioritisation to specific websites, services, or applications. Under net neutrality, an ISP cannot degrade a streaming competitor's traffic or charge content creators extra fees for "fast-lane" delivery to end users. It remains an active policy and legal debate globally, with rules differing significantly by jurisdiction — for example, the European Union legally protects net neutrality under its Open Internet Regulation (Regulation (EU) 2015/2120), while regulatory frameworks in other nations have alternated between deregulation and oversight.

Circuit switching vs. packet switching

Early telephone networks used circuit switching: before a call, a dedicated physical path was reserved end-to-end through the network. Every intermediate switch allocated resources (a time slot or frequency band) for that call. The bandwidth was guaranteed but entirely wasted during silences. If a node failed, the call dropped — you had to dial again.

The internet uses packet switching. Data is chopped into small, independently addressed chunks called packets. Each packet carries its destination address and is routed independently through the network. Different packets of the same conversation may take different paths and arrive out of order — the receiver reassembles them. Multiple flows share each link (statistical multiplexing), so capacity is used far more efficiently. A node failure simply causes packets to reroute.

Worked comparison: Why statistical multiplexing wins for bursty traffic

In a circuit-switched network, link capacity is partitioned among connections using one of two fundamental techniques:

FDM (Frequency-Division Multiplexing): The frequency spectrum of the link is divided into narrow, non-overlapping bands, each dedicated exclusively to a specific connection for its entire duration.
TDM (Time-Division Multiplexing): Time is divided into recurring frames of fixed duration, and each frame is partitioned into fixed time slots. Each connection is allocated a dedicated recurring slot.

Consider the classic numeric comparison (Kurose & Ross):

Suppose users share a 1 Mbps (1,000 kbps) link. Each user generates data at 100 kbps when active, but is active only 10% of the time (typical of bursty web browsing):

With Circuit Switching (TDM/FDM): Each user must be reserved a dedicated 100 kbps slice at all times, regardless of whether they are active. The 1 Mbps link can support at most:
1,000 kbps ÷ 100 kbps = 10 simultaneous users.
Even when all 10 users are idle (which occurs 90% of the time), an 11th user cannot be admitted and is blocked.
With Packet Switching: Bandwidth is allocated dynamically on demand. If 35 users share the link, the probability that 11 or more users are simultaneously active (exceeding the 1 Mbps aggregate link capacity) can be computed using the binomial distribution:
P(X ≥ 11) = Σ_{k=11}^{35} [35! / (k!(35−k)!)] × 0.1^k × 0.9^(35−k) ≈ 0.0004 (0.04%).
Because there is a 99.96% probability that 10 or fewer users are transmitting simultaneously, packet switching supports 3.5× as many users on the exact same physical cable with virtually identical performance.

A third historical model, message switching (store-and-forward at each node, like telegrams), predates packet switching but is essentially a special case with no size limit on "packets."

Three independent flows share one physical link. Each packet carries a destination address; the network routes them independently.

Key performance metrics — with worked examples

Latency (end-to-end delay) is the time for one packet to travel from source to destination. It has four additive components:

Propagation delay = distance ÷ propagation speed. Light in fibre travels at roughly 2 × 10⁸ m/s (≈ 0.67c). A 6,000 km transatlantic cable has a one-way propagation delay of 6,000,000 m ÷ 200,000,000 m/s = 30 ms. Round-trip (ping) is therefore ≥ 60 ms — no software optimisation can reduce this physical floor.
Transmission delay = packet size (bits) ÷ link bandwidth (bps). Sending a 1,500-byte (12,000-bit) packet over a 100 Mbps link takes 12,000 ÷ 100,000,000 = 0.12 ms. The same packet over a 10 Mbps link takes 1.2 ms.
Processing delay = time for a router to examine the IP header, look up the routing table, and decide which output port to use. Typically microseconds on modern hardware.
Queuing delay = time spent waiting in a router's output buffer. Zero when the network is idle; can be hundreds of milliseconds when a link is saturated. This is the most variable and difficult-to-predict component. Bufferbloat is a known problem where oversized router buffers cause high but hidden queuing delays for interactive traffic.

Traffic Intensity: Predicting queuing delay and packet loss

The magnitude of queuing delay is governed by how fast data arrives at an output link relative to its transmission rate, captured by the dimensionless metric Traffic Intensity:

Traffic Intensity = (L × a) / R

where L is the packet size in bits, a is the average packet arrival rate (packets per second), and R is the link transmission rate (bits per second). The product L × a represents the average bit arrival rate (bps). The behavior of the queue falls into three distinct regimes:

La / R ≈ 0: Arrivals are sparse and separated. Packets rarely arrive while another packet is being transmitted; average queuing delay is near zero.
La / R → 1 (approaching 1): Packets arrive in bursts faster than the queue can consistently clear. As traffic intensity approaches 1, packets wait behind multiple predecessors, and average queuing delay grows exponentially.
La / R > 1: Bits arrive faster than the link can drain them. In an ideal queue with infinite buffer capacity, the queue length grows without bound. In real-world routers with finite memory buffers, the buffer fills completely and packet loss occurs via tail-drop (newly arriving packets are discarded).

Total latency example: A packet of size L = 1,500 bytes (12,000 bits) crossing 10 routers (which means 11 store-and-forward links in series). On a 1 Gbps link, the transmission delay per link is 12,000 bits ÷ 10⁹ bps = 0.012 ms. With each router adding 0.1 ms processing delay and 0.5 ms average queuing delay, on a path with 80.0 ms propagation delay:

Propagation    :  80.0 ms   (physical distance — cannot be reduced)
Transmission   :   0.13 ms  (11 links × 0.012 ms — store-and-forward per link)
Processing     :   1.0 ms   (10 routers × 0.1 ms)
Queuing        :   5.0 ms   (10 routers × 0.5 ms average)
─────────────────────────────
Total one-way  : ~86.1 ms   (80.0 + 0.13 + 1.0 + 5.0 = 86.13 ms)

Bandwidth is the maximum rate at which a link can transfer data, measured in bits per second (bps). Common values: 100 Mbps (Fast Ethernet), 1 Gbps (Gigabit Ethernet), 10/25/100/400 Gbps (data-centre). Bandwidth is a property of the link, not the protocol or application.

Throughput is the actual end-to-end data delivery rate seen by the application. It is always ≤ the bottleneck link bandwidth (the narrowest link on the path) and is further reduced by:

Protocol overhead (TCP/IP headers, TLS overhead, retransmissions).
TCP's slow-start and congestion control (it doesn't use full bandwidth immediately).
Packet loss forcing retransmissions.
TCP receive window limits if the window is not large enough: max throughput = window size ÷ RTT. A 65,535-byte window on an 80 ms RTT path caps throughput at 65,535 × 8 ÷ 0.08 ≈ 6.5 Mbps regardless of link speed. The TCP window scaling option (RFC 7323) allows windows up to 1 GB to fix this.

Bottleneck link worked example: Suppose a web server connects via link rate R_s = 100 Mbps to an ISP core network, which connects to a home client via access link R_c = 20 Mbps. Assuming the high-speed core backbone has virtually unlimited shared capacity, the end-to-end throughput is constrained by the bottleneck link:
Throughput = min(R_s, R_c) = min(100 Mbps, 20 Mbps) = 20 Mbps.
Downloading a 50 MB (400,000,000 bits) file across this path therefore requires:
Transfer time = 400,000,000 bits ÷ 20,000,000 bps = 20 seconds.

Bandwidth-Delay Product (BDP): The product of link transmission rate R and propagation delay d_prop (or RTT for a round-trip path):

BDP = R × d_prop   (or R × RTT for a round-trip pipe)

BDP measures the capacity of the link "pipe" — the maximum volume of bits that can be physically in flight inside the transmission medium at any moment. For instance, a 1 Gbps transatlantic link with a 30 ms one-way propagation delay holds:
BDP = 10⁹ bps × 0.03 s = 30,000,000 bits = 3.75 MB.
At any given instant, up to 3.75 MB of optical pulses are traveling simultaneously through the submarine fibre. For a transport protocol like TCP to fully saturate this link without stalling, its transmission window must be sized to match the round-trip BDP (R × RTT).

Packet loss is expressed as a percentage of sent packets. Even 0.1% loss noticeably degrades TCP throughput because the sender must retransmit and reduce its congestion window. The Mathis formula (simplified, constant C ~ 1.22 omitted for simplicity) gives max TCP throughput ≈ MSS ÷ (RTT × √loss_rate). At 1% loss and 50 ms RTT with 1460-byte MSS, throughput ≈ 1460 × 8 ÷ (0.05 × √0.01) ≈ 2.3 Mbps — far below what the link can carry.

Jitter is the variation in packet delay. It matters enormously for real-time applications: VoIP and video conferencing can tolerate 50–150 ms of latency but cannot tolerate high jitter without a playback buffer, which itself adds latency. This is why Quality of Service (QoS) mechanisms prioritise interactive traffic.

Store-and-forward vs. cut-through switching

In store-and-forward switching (used by all IP routers and most managed switches), the device receives the complete frame/packet, verifies its CRC, and only then forwards it. This adds one full transmission delay per hop but allows error detection.

Cut-through switching starts forwarding as soon as the destination address is read (after the 6-byte destination MAC address has been read), reducing latency by almost one full transmission delay per hop. Used in high-performance data-centre switches where the error rate is low and latency is critical.

Multi-packet pipelining across N store-and-forward links

When transmitting a multi-packet message across a series of store-and-forward links, transmissions overlap across hops — a property known as packet pipelining. For P packets of size L sent across N identical store-and-forward links in series, each having transmission rate R (ignoring propagation, processing, and queuing delays):

d_total = (N + P − 1) × (L / R)

Explanation:

The 1st packet takes N × (L / R) to cross all N links to reach the destination.
Because intermediate routers pipeline transmissions — Router 1 begins transmitting Packet 2 onto Link 2 at the exact instant Packet 1 begins transmitting onto Link 3 — each subsequent packet arrives at the destination exactly 1 × (L / R) after the preceding one.
The remaining (P − 1) packets therefore add exactly (P − 1) × (L / R) to the completion time.

Worked example: Sending a 15,000-byte file split into P = 10 packets of L = 1,500 bytes (12,000 bits) across N = 3 links of R = 10 Mbps:

Transmission delay per link: L / R = 12,000 bits ÷ 10,000,000 bps = 0.0012 s = 1.2 ms.
1st packet arrives at destination: N × (L / R) = 3 × 1.2 ms = 3.6 ms.
Remaining 9 packets arrive pipelined at 1.2 ms intervals: (10 − 1) × 1.2 ms = 9 × 1.2 ms = 10.8 ms.
Total time: d_total = (3 + 10 − 1) × 1.2 ms = 12 × 1.2 ms = 14.4 ms (substantially faster than sending the unpacketized 15,000-byte message or unpipelined sequential transmission of 10 × 3.6 ms = 36 ms).

Key takeaways

The internet uses packet switching — packets share links via statistical multiplexing.
Latency has four components: propagation (physics), transmission (link speed), processing (router speed), queuing (congestion).
Propagation delay is a physical floor — you cannot route faster than the speed of light.
Throughput ≤ bottleneck link bandwidth; TCP window size ÷ RTT is another common ceiling.
Jitter (delay variation) matters for real-time applications like VoIP and gaming.
Even 0.1% packet loss measurably reduces TCP throughput.
Network protocols define syntax, semantics, and timing/order. The internet is a network of networks structured into edge (hosts) and core (routers), tied together across Tier 1/2/3 ISPs and IXPs.
Wireshark captures raw frames using promiscuous mode; its three panes show packet list, encapsulation details, and raw hex/ASCII bytes.