Networking, IP & Security Glossary

Plain-English definitions for the networking, IP, DNS, VPN and security terms that come up across this site — each one linked to a page that explains it in full.

150 terms, from anycast to zero trust. Every entry has a short definition and a "learn more" link to the tool page or article on this site that covers it. Jump to a letter, or browse the whole list.

See also the full list of tools and the blog.

A

A recordDNS

A DNS record that maps a domain name to an IPv4 address.

AAAA recordDNS

A DNS record that maps a domain name to an IPv6 address — the IPv6 counterpart of an A record.

AES (Advanced Encryption Standard)TLS & crypto

The symmetric cipher used almost everywhere for bulk encryption — TLS sessions, disk encryption, messaging — with key sizes of 128, 192 or 256 bits.

Alpine LinuxDevOps

A very small Linux distribution built on musl libc and BusyBox, with the apk package manager. Popular as a Docker base image because it keeps containers tiny.

ARP (Address Resolution Protocol)LAN & Wi-Fi

The protocol a device uses to find the MAC address that goes with a known IP on its local network, by broadcasting “who has this address?” and caching the reply.

ARPANETConnectivity

The US research network of the late 1960s and 1970s that pioneered packet switching and, when it adopted TCP/IP in 1983, became the seed of the internet.

ASN (Autonomous System Number)Routing

The number that identifies an autonomous system in BGP, e.g. AS15169 for Google. WHOIS on an IP shows which ASN announces it.

Authoritative name serverDNS

The server that holds the real DNS records for a domain and gives the definitive answer for it, rather than a cached copy.

Autonomous System (AS)Routing

A network, or group of networks, run under one routing policy — typically an ISP, a large company or a cloud provider. Each is identified by an AS number.

B

BandwidthPerformance

The maximum rate a connection can move data, measured in bits per second. It sets the ceiling on speed but says nothing about delay.

Base64Encoding & tokens

A scheme that represents binary data using 64 printable characters, so it can travel safely through systems built for text, such as email and JSON. It is encoding, not encryption.

bcryptPasswords & auth

A password-hashing function built to be slow, with a tunable cost factor and a built-in salt, so that stolen password databases are expensive to crack.

BGP (Border Gateway Protocol)Routing

The protocol that stitches the internet together by exchanging reachability information between large networks, choosing paths by the list of networks each route crosses.

Bitcoin address types (P2PKH, P2SH, SegWit, Taproot)Crypto addresses

The formats a Bitcoin address can take: legacy P2PKH (starts 1), script P2SH (starts 3), native SegWit (bc1q) and Taproot (bc1p). Each encodes where funds can be spent.

Bogon IP addressIP addressing

An address from a block that has not been allocated for use on the public internet. A packet claiming a bogon source is almost always spoofed and is dropped at well-run borders.

Bot detectionBrowser & device

Telling automated clients from human visitors, using the User-Agent, request patterns, IP reputation and browser checks — to block scraping and abuse while letting search crawlers in.

Broadcast addressSubnetting

The last address in a subnet, with every host bit set to one. A packet sent to it is delivered to every host on that subnet.

Brute-force attackAttacks & defense

Trying every possible password or key in turn until one works. Length is the best defence: each extra character multiplies the number of attempts required.

BusyBoxDevOps

A single small executable that provides stripped-down versions of around 200 common Unix commands, used where disk space is scarce — embedded devices and minimal containers.

C

Cable internet (DOCSIS)Connectivity

Internet over the coaxial cabling built for cable TV, using the DOCSIS standard. Fast download, weaker upload, and capacity shared with the neighbourhood.

Cache-ControlHTTP headers

The header that tells browsers and proxies whether a response may be stored, for how long, and whether it must be revalidated before reuse.

Certificate Authority (CA)TLS & crypto

A trusted organisation that verifies a domain or company and issues a signed certificate for it. Browsers ship with a list of CAs they trust.

CGNAT (carrier-grade NAT)IP addressing

NAT run by the ISP so hundreds of subscribers share a single public IPv4 address. It saves addresses but breaks inbound connections and makes an IP less identifying.

ChecksumTransport & packets

A short value computed from a block of data and sent alongside it, so the receiver can recompute it and detect accidental corruption. Used in IP, TCP, UDP and file verification.

CIDR notation (Classless Inter-Domain Routing)Subnetting

Writing a network as an address plus a slash and the number of network bits, e.g. 192.168.1.0/24. It replaced the rigid Class A/B/C system with flexible block sizes.

CNAME recordDNS

A DNS alias that points one name at another name, which is then resolved in its place. Often used to point www at a hosting provider's domain.

Content-Security-Policy (CSP)HTTP headers

A response header that tells the browser which sources of scripts, styles, images and frames a page may load, sharply limiting the damage of a cross-site scripting flaw.

Cryptographic hash functionTLS & crypto

A one-way function that turns any input into a fixed-length digest. The same input always gives the same digest, but you cannot work backwards or easily find two inputs that collide.

CryptojackingAttacks & defense

Secretly using someone else's servers, PCs or browsers to mine cryptocurrency, stealing their electricity and compute while slowing everything down.

D

Data breachAttacks & defense

An incident where information is accessed or taken by someone not authorised to have it — often followed by that data being sold or leaked.

Daylight saving time (DST)Browser & device

The seasonal one-hour clock change some regions apply. The tz database encodes exactly when each region starts and ends it, including past rule changes.

DDoS (distributed denial of service)Attacks & defense

A denial-of-service attack launched from many machines at once — often a botnet — so the flood is larger and harder to filter than from a single source.

Denial of Service (DoS)Attacks & defense

An attack that overwhelms a service with traffic or requests, or exploits a flaw to crash it, so legitimate users cannot get through.

Device pixel ratio (DPR)Browser & device

How many physical pixels map to one CSS pixel. A ratio of 2 means a 400-pixel-wide element actually uses 800 hardware pixels, keeping text sharp.

DHCP (Dynamic Host Configuration Protocol)LAN & Wi-Fi

The service that automatically hands a joining device its IP address, subnet mask, gateway and DNS servers, on a lease that must be renewed.

DicewarePasswords & auth

A method for building passphrases by rolling dice to pick words from a numbered list, so each word is truly random and its strength can be calculated.

Dictionary attackAttacks & defense

Guessing passwords from a curated list of common words, names and previously leaked passwords, plus simple variations — far faster than pure brute force against human-chosen passwords.

Digital certificateTLS & crypto

A signed file that binds a public key to an identity, such as a domain name, and is vouched for by a Certificate Authority. It is what a browser checks to trust an HTTPS site.

DNS (Domain Name System)DNS

The internet's directory: it translates a human name like example.com into the IP address a browser needs to connect, using a worldwide hierarchy of servers.

DNS resolver (recursive resolver)DNS

The server your device asks to resolve a name. It walks the DNS hierarchy on your behalf, caches the answer, and hands back the final IP address.

DNS spoofing (cache poisoning)Attacks & defense

Feeding a resolver a forged DNS answer so users of a name are sent to an attacker's server instead of the real one.

DNSSECDNS

An extension that adds digital signatures to DNS records so a resolver can verify an answer really came from the domain owner and was not forged in transit.

Docker base imageDevOps

The starting filesystem layer a container image is built on — a minimal OS like Alpine, a language runtime, or nothing at all. A smaller base means faster pulls and less to attack.

DSL (Digital Subscriber Line)Connectivity

Internet over the copper of an existing phone line. Each line is dedicated, but speed falls off sharply with distance from the exchange.

Dynamic DNS (DDNS)DNS

A service that updates a domain's DNS record automatically whenever the host's IP changes, so a home server on a dynamic address stays reachable by name.

Dynamic IP addressIP addressing

An address the ISP or a DHCP server assigns for a limited time and may change later. Most home connections use one.

E

EncryptionTLS & crypto

Turning readable data into a scrambled form that only someone with the right key can turn back. Protects data both in transit and stored at rest.

End-to-end encryptionTLS & crypto

Encryption where only the sender and the intended recipient hold the keys, so not even the service passing the messages can read them.

Entropy (bits of entropy)Passwords & auth

A measure of how unpredictable a secret is, in bits. Each extra bit doubles the number of guesses needed; a passphrase of a few random words reaches a strong 60-80 bits.

F

Fiber internetConnectivity

Internet delivered over glass strands carrying pulses of light. It offers the highest speeds, is usually symmetric, and is unaffected by distance the way copper is.

File shredding (secure deletion)Attacks & defense

Overwriting a file's data before removing it so it cannot be recovered. On modern SSDs, full-disk encryption or the drive's secure-erase command is more reliable.

FirewallAttacks & defense

A barrier that filters network traffic against a set of rules, allowing wanted connections and blocking the rest. It can run on a router, a server or the endpoint itself.

G

Geo-blocking (geo-restriction)VPN & proxy

Limiting what content a visitor can see based on the country their IP maps to — used for streaming catalogues, sports blackouts and legal compliance.

H

HMAC (hash-based message authentication code)TLS & crypto

A hash of a message combined with a secret key. Anyone with the key can check that the message is intact and came from a party who also knows the key.

HSTS (Strict-Transport-Security)HTTP headers

A response header instructing the browser to only ever contact this site over HTTPS for a set period, even if a user types http:// or clicks an insecure link.

HTTP (Hypertext Transfer Protocol)Web & protocols

The request-and-response protocol browsers and servers use to exchange web pages, images and API data. Each request names a method, a URL and a set of headers.

HTTP headersHTTP headers

Key-value lines sent with every request and response, carrying metadata such as content type, caching rules, cookies and security policy — everything except the body itself.

HTTP status codesWeb & protocols

Three-digit results describing how a request went: 2xx success, 3xx redirect, 4xx client error (404 not found), 5xx server error.

HTTP/3 & QUICWeb & protocols

The latest HTTP version, running over QUIC — a transport built on UDP that keeps TCP-like reliability but sets up faster and survives a change of network.

HTTPSWeb & protocols

HTTP carried inside a TLS-encrypted connection, so the content cannot be read or altered in transit and the server's identity is verified by a certificate.

I

IANA time zone database (tz database)Browser & device

The canonical list of time zones and their historical rules, with identifiers like America/New_York. Operating systems and languages use it to convert and display local time.

IDS / IPS (intrusion detection / prevention system)Attacks & defense

Systems that watch traffic for attack patterns. An IDS alerts; an IPS sits inline and can drop the malicious traffic before it reaches the target.

Internet Protocol (IP)IP addressing

The network-layer protocol that gives every device an address and forwards packets between networks. It makes no promise that a packet arrives — that is left to TCP or the app.

Internet speed testPerformance

A timed transfer of data to and from a nearby server to estimate your download rate, upload rate and ping at that moment.

IP addressIP addressing

The numeric label that identifies a device on a network so traffic can be routed to it. Written as four numbers for IPv4 (203.0.113.7) or eight hex groups for IPv6.

IP geolocationIP addressing

Estimating the country, region, city and ISP behind an IP address by looking it up in a commercial database. It is an approximation, not a precise location.

IP lookupIP addressing

Checking what is known about an address by combining three queries: registry WHOIS for ownership, reverse DNS for a hostname, and a GeoIP database for approximate location.

IP maskingVPN & proxy

Hiding your real public IP behind another address — a VPN server's or a proxy's — so the sites you visit record that address instead of yours.

IP spoofingIP addressing

Forging the source address in a packet's header to hide the real origin or impersonate another host — common in denial-of-service floods and reflection attacks.

IPsec (Internet Protocol Security)VPN & proxy

A suite that secures IP traffic itself, adding authentication and encryption at the packet level. It underpins many site-to-site and always-on VPNs.

IPv4IP addressing

The original IP addressing scheme: 32-bit addresses written as four dotted decimals, giving about 4.3 billion possible addresses — not enough for today's internet.

IPv6IP addressing

The newer IP addressing scheme with 128-bit addresses written in hex, e.g. 2001:db8::1. The address space is vast enough that network address translation is no longer needed.

ISP (Internet Service Provider)Connectivity

The company that connects you to the internet and assigns your public IP address. WHOIS records on that address name the ISP that owns the block.

J

JitterPerformance

The variation in latency from one packet to the next. Steady delay is fine; jittery delay causes stutter in voice, video and games even when the average looks good.

JWT (JSON Web Token)Encoding & tokens

A compact token of three Base64URL parts — header, payload of claims, and signature. Servers issue one at login and trust it later by checking the signature, without a database lookup.

L

LAN (local area network)LAN & Wi-Fi

The private network inside a home or office — the devices behind one router, able to talk to each other directly without going out to the internet.

LatencyPerformance

The time it takes a packet to travel to a destination and back, usually in milliseconds. Low latency matters more than raw bandwidth for calls, gaming and responsiveness.

M

MAC addressLAN & Wi-Fi

The 48-bit hardware identifier burned into a network interface, e.g. 00:1A:2B:3C:4D:5E. It only has meaning on the local segment; routers do not carry it across networks.

Mainnet vs testnetCrypto addresses

Mainnet is the live blockchain where coins have real value; testnet is a parallel network with worthless coins for development. Address prefixes mark which one they belong to.

MalwareAttacks & defense

Any software written to harm or gain unauthorised control of a system — an umbrella term covering viruses, worms, trojans, spyware and ransomware.

Man-in-the-middle attackAttacks & defense

An attacker who secretly sits between two parties, relaying and possibly altering their traffic while each believes it is talking directly to the other. TLS is designed to stop it.

Mbps (megabits per second)Performance

The usual unit for connection speed. Note it is mega*bits*, not bytes — divide by 8 for a download figure in megabytes per second.

MD5TLS & crypto

An old 128-bit hash. It is broken for security — attackers can craft collisions — so use it only for non-security checks like spotting an accidental download error.

Multi-factor authentication (MFA)Passwords & auth

Authentication that combines two or more independent factors from different categories: something you know, something you have, and something you are.

Multi-signature wallet (multisig)Crypto addresses

A wallet that needs several private keys to authorise a spend, e.g. 2 of 3. It removes the single point of failure of one lost or stolen key.

MX recordDNS

A DNS record naming the mail servers that accept email for a domain, each with a priority number so senders try them in order.

N

NAT (Network Address Translation)LAN & Wi-Fi

The router function that rewrites private LAN addresses to one shared public address on the way out, and back again on the way in, so many devices share a single IP.

Network addressSubnetting

The first address in a subnet, with every host bit set to zero. It names the block itself and is not assigned to a device.

NmapAttacks & defense

The standard open-source tool for network discovery and security auditing: host discovery, port scanning, service and OS detection, and scripted checks.

P

PacketTransport & packets

The unit data is broken into for a network. Each packet has a header with control fields (addresses, length, checksum) followed by a slice of the payload.

Packet capture (pcap)DevOps

Recording raw network traffic to a file for later analysis. .pcap and .pcapng are the standard formats, readable by Wireshark, tcpdump and many others.

Packet lossPerformance

The share of packets that never arrive and must be resent or given up on. Even 1-2% badly hurts video calls and online play.

Passkeys (FIDO2)Passwords & auth

A password replacement: your device holds a private key and unlocks it with your fingerprint, face or PIN to sign in. Nothing guessable or reusable is ever sent to the site.

PassphrasePasswords & auth

A secret made of several unrelated words, e.g. “correct horse battery staple”. Long enough to resist guessing yet far easier to remember and type than a random character string.

Password managerPasswords & auth

An app that generates, stores and fills a unique strong password for every account, so you only have to remember one master secret.

PhishingAttacks & defense

Fraudulent messages that impersonate a trusted sender to trick you into revealing a password, approving a login, or opening malware. Spear phishing targets a specific person.

PingPerformance

A quick round-trip time measurement to a host, and the utility that sends it. “My ping is 20 ms” means packets come back in about 20 milliseconds.

Port (network port)Transport & packets

A 16-bit number that identifies which service on a host a packet is for — 443 for HTTPS, 22 for SSH. The IP address gets you to the machine; the port gets you to the program.

Port forwardingPerformance

A router rule that sends connections arriving on a chosen external port to a specific device and port on the LAN — used to reach a game host, camera or server from outside.

Port scanAttacks & defense

Probing a host across a range of ports to learn which services are running and reachable. A normal first step for both defenders auditing themselves and attackers.

Private IP ranges (RFC 1918)IP addressing

Blocks reserved for local networks and never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Home routers hand out addresses from these.

Proxy serverVPN & proxy

A middleman that makes web requests on your behalf and returns the responses. Unlike a VPN it usually handles one app's traffic and may not encrypt it.

PTR recordDNS

A DNS record that maps an IP address back to a hostname — the record a reverse DNS lookup returns. Mail servers check it to judge whether a sender looks legitimate.

Public key / private keyTLS & crypto

A matched pair where one key is shared freely and the other kept secret. Data encrypted with one can only be undone with the other, which also enables digital signatures.

Public vs private IPIP addressing

Your device holds a private address that only works inside your local network; your router shares one public address, visible to the internet, for everything behind it.

Q

QoS (Quality of Service)Performance

Router settings that prioritise some traffic over others — putting a video call ahead of a background download — so important flows stay smooth when the line is busy.

R

RansomwareAttacks & defense

Malware that encrypts a victim's files or whole systems and demands payment, usually in cryptocurrency, for the decryption key.

Regular expression (regex)Encoding & tokens

A pattern language for matching text — finding, extracting or validating strings such as an IP address, email or date against a set of rules.

Reverse DNS (rDNS)DNS

Looking up the hostname published for an IP address, the opposite of a normal name-to-address query. It relies on PTR records in the in-addr.arpa zone.

S

SaltPasswords & auth

A random value added to a password before hashing, unique per user, so identical passwords hash differently and attackers cannot use precomputed lookup tables.

Screen resolutionBrowser & device

The number of pixels a display shows, as width by height. The browser may report a smaller logical figure than the panel's physical pixels on high-density screens.

SHA-2 (SHA-256, SHA-384, SHA-512)TLS & crypto

The current family of secure hash functions, named by output size. SHA-256 is the default choice for certificates, checksums and blockchain work.

Social engineeringAttacks & defense

Manipulating people rather than machines — through pretexting, urgency or authority — to get them to hand over information or access.

SSH (Secure Shell)Web & protocols

An encrypted protocol for logging into a remote machine's command line and for tunnelling other traffic. It replaced Telnet, which sent everything in the clear.

SSH tunneling (port forwarding)VPN & proxy

Wrapping another connection inside an SSH session so it travels encrypted. Local forwarding exposes a remote service locally; dynamic forwarding turns SSH into a SOCKS proxy.

SSID (Service Set Identifier)LAN & Wi-Fi

The broadcast name of a Wi-Fi network — what you pick from the list to join. A hidden network simply stops advertising it.

SSL (Secure Sockets Layer)TLS & crypto

TLS's predecessor, now retired for being insecure. The name survives out of habit — an “SSL certificate” is really a TLS certificate.

Static IP addressIP addressing

An address that is fixed and does not change between connections. Useful for servers, remote access and allowlists; usually a paid option from an ISP.

Subnet (subnetwork)Subnetting

A slice of a larger IP network, carved out so a group of hosts shares one address range. Subnetting keeps broadcast traffic contained and lets you apply rules per segment.

Subnet maskSubnetting

A 32-bit value that marks which bits of an address name the network and which name the host. 255.255.255.0 means the first three octets are the network.

Supernetting (route aggregation)Subnetting

Combining several adjacent networks into one shorter CIDR prefix so routers can advertise a single route instead of many, keeping global routing tables smaller.

Symmetric vs asymmetric encryptionTLS & crypto

Symmetric encryption uses one shared secret key and is fast; asymmetric uses a public/private key pair and solves key distribution. TLS uses asymmetric to set up, symmetric to carry data.

T

TCP (Transmission Control Protocol)Transport & packets

The transport protocol that turns IP's unreliable packets into an ordered, error-checked byte stream. It sets up a connection, retransmits losses and controls sending rate.

TCP/IPTransport & packets

The family of protocols the internet runs on, named after its two core members. Often described as four layers: link, internet, transport and application.

Three-way handshakeTransport & packets

The SYN, SYN-ACK, ACK exchange that opens a TCP connection, letting both sides agree they are ready and sync their starting sequence numbers.

ThrottlingPerformance

An ISP deliberately slowing a particular kind of traffic — streaming, torrents, a specific service — below the speed the line could deliver.

TLS (Transport Layer Security)TLS & crypto

The protocol that encrypts and authenticates a connection so data cannot be read or tampered with in transit. It is the S in HTTPS and secures email, VPNs and more.

TLS handshakeTLS & crypto

The opening exchange of a TLS connection where the two sides agree on a cipher, the server proves its identity with a certificate, and they derive a shared session key.

Tor (The Onion Router)VPN & proxy

A free network that routes your traffic through three volunteer relays, each peeling one layer of encryption, so no single hop knows both who you are and where you are going.

TraceroutePerformance

A diagnostic that lists each router hop between you and a destination, with the round-trip time to each, so you can see where a path slows down or breaks.

TTL (Time To Live)Transport & packets

A countdown in a packet's IP header, decremented by each router; at zero the packet is discarded, preventing loops. DNS records use the same name for how long an answer may be cached.

Two-factor authentication (2FA)Passwords & auth

Requiring a second proof of identity at login in addition to the password — typically a code from an app or a tap on a security key — so a stolen password alone is not enough.

U

UDP (User Datagram Protocol)Transport & packets

A lightweight transport that fires off independent packets with no connection, ordering or delivery guarantee. Its low overhead suits DNS, voice, video and games.

URL encoding (percent-encoding)Encoding & tokens

Replacing characters that are unsafe or reserved in a URL with a percent sign and their byte value, so a space becomes %20 and & becomes %26.

User-Agent stringBrowser & device

A line of text a browser or app sends with each request, naming its product, version, rendering engine and operating system — used for compatibility, analytics and bot detection.

UTC offsetBrowser & device

How far a local time is ahead of or behind Coordinated Universal Time, written like +05:30 or -08:00. It can shift during the year where daylight saving applies.

UUID (Universally Unique Identifier)Encoding & tokens

A 128-bit value written as 32 hex digits in five groups, used to label things uniquely without a central authority. Also called a GUID.

UUID v4Encoding & tokens

A UUID generated from random bits. With 122 random bits the chance of two ever colliding is negligible, which is why it is the common choice for database keys and request IDs.

V

VLAN (virtual LAN)LAN & Wi-Fi

A logically separate network running over shared physical switches. Devices on different VLANs cannot reach each other without a router, even on the same cabling.

VLSM (variable-length subnet masking)Subnetting

Using different subnet mask lengths within one network so each segment gets only as many addresses as it needs, instead of wasting a fixed block on every link.

VPN (Virtual Private Network)VPN & proxy

An encrypted tunnel between your device and a VPN server. Sites then see the server's IP and location, and anyone on your local network sees only unreadable traffic.

VPN detectionVPN & proxy

How streaming and banking sites spot VPN or proxy use — mainly by matching your IP against known lists of datacenter and VPN-provider address ranges — and then block or challenge it.

VPN exit node (VPN server)VPN & proxy

The point where a VPN tunnel ends and your traffic decrypts and enters the internet under that server's IP address. Its country is the location websites see.

W

WebSocketWeb & protocols

A connection that starts as an HTTP request, then upgrades to a persistent two-way channel so server and browser can push messages to each other instantly — used for chat and live feeds.

WHOISIP addressing

The registry record showing who an IP block or domain is registered to — the owning organisation, its network range, and an abuse contact for reporting attacks.

Wi-Fi QR codeLAN & Wi-Fi

A QR code holding a WIFI: string with the network name, security type and password. A phone camera reads it and joins the network without typing anything.

WiresharkDevOps

The leading free tool for capturing packets off a network interface and inspecting them protocol by protocol, down to individual header fields.

WPA2 / WPA3LAN & Wi-Fi

The current Wi-Fi security standards. WPA2 has protected home networks since 2004; WPA3 strengthens the handshake against offline password guessing.

X

XSS (cross-site scripting)Attacks & defense

Injecting attacker-controlled JavaScript into a page other users view, so it runs with their session. A Content-Security-Policy header is a key defence.

Z

Zero trustPasswords & auth

A security model that trusts nothing by default — not even traffic already inside the network. Every request must prove identity and meet policy before it is allowed.

Back to top ↑