Network Fundamentals

Extending a single-machine login gate into SSO across subdomains makes key distribution the easy part — state is the hard one. This records the problems from running one gate on three machines: why replay protection became per-site, how a second copy of the key produced “gate passes, application returns 401”, how an allowlist preservation rule in a deploy script silently switched login off, and why comparing generated codes manufactures phantom failures.

After putting a two-factor gate in front of a self-hosted file manager, I asked what the gate actually protected. It protected the interface, not the files — the same bytes were reachable by two URLs, and while verifying that I found the gate had never been in the request path at all. This covers the audit, two nginx traps in the patch, and the edge cache that kept serving for nearly a year after the origin was closed.

Every port looks open when you scan from the machine itself, and nothing outside can connect. This covers why local probing is guaranteed to mislead, why a control port is not optional, and a full measurement run: public IPv4 that is not CGNAT, ports 80 and 443 filtered rather than closed, a real IPv6 address with inbound entirely dropped, and why an AAAA record must not come from an echo service.

Someone told me a subdomain had no SSL certificate. It did — a wildcard covered it. But the investigation surfaced something worse: that subdomain served its mail login page over plain HTTP, password field and all, with no redirect. Plus two things that sent me the wrong way: openssl failing on every target at once, and DNS enumeration being meaningless behind a transparent proxy.

Decode safe SOCKS5 CONNECT bytes and compare local-DNS and proxy-side hostname resolution boundaries.

Compare round robin and load-aware queue selection while reasoning about health checks and retry boundaries.

Use an RFC 9111 shared-cache model to calculate MISS, HIT, and 304 revalidation latency and correctness boundaries.

An RFC-based explanation of CONNECT tunnels, encrypted HTTPS payloads, and modeled first-request latency.

A reproducible guide to forward proxies, reverse proxies, tunnels, TLS boundaries, and latency segments.

Understand TLS 1.3 message flights, certificate authentication, ephemeral key agreement, and handshake latency with a safe teaching model.