Read each term where it’s used
In Augment’s notes, a marked term shows its definition when you hover or tap it, and each page ends with the terms it introduces.
In Augment’s notes, a marked term shows its definition when you hover or tap it, and each page ends with the terms it introduces.
185 terms from Networks, each defined in a sentence or two, with the part of the syllabus where you first meet it. 57 of them are HL only, and marked.
A message from the receiver confirming that data has arrived, which in TCP gives the sequence number of the next byte the receiver expects.
The symmetric block cipher standardised by the US National Institute of Standards and Technology (NIST) in 2001, which encrypts data in 128-bit blocks using a key of 128, 192 or 256 bits.
The top layer of the TCP/IP model, which holds the protocols that programs use to exchange data for a particular service.
Encryption that uses a mathematically related pair of keys, in which data encrypted with one key of the pair can only be decrypted with the other.
The gradual loss of strength of a signal as it travels through a transmission medium, which limits how far it can go before it must be amplified or regenerated.
The maximum amount of data that a link can carry per second, measured in bits per second.
A list of items, such as IP addresses, ports, websites or devices, that are explicitly blocked, with everything not on the list allowed by default.
A distributed, append-only record of transactions, grouped into blocks that each contain a cryptographic hash of the previous block and are copied across many nodes in a peer-to-peer network.
A network of devices infected with malware that an attacker controls remotely, usually through a command-and-control server, without the owners' knowledge.
The set of devices that receive a broadcast sent by any device in the set; a router marks its boundary.
An attack that tries every possible key or password in turn until the correct one is found.
A topology in which all nodes share a single cable, the backbone, so every transmission reaches every node.
The sequence of certificates from a website's certificate through any intermediate certificates to a root certificate, in which each certificate is signed by the one above it and the root is already trusted by the device.
A value calculated from a block of data and sent with it, so that the receiver can repeat the calculation and detect whether the data was corrupted in transit.
A way of writing an IP network as an address followed by a slash and the number of bits in its network part.
The unreadable data produced by encrypting plaintext.
A method of communication in which a dedicated path with a fixed capacity is set up between two devices before any data is sent and reserved for them until the communication ends.
A device, or a program running on one, that requests a service or resource from a server.
A networking model in which central servers store resources and provide services, and clients send requests to the servers and receive responses.
The part of a network in which a transmission from one device can collide with a transmission from another.
Two or more computing devices connected by a transmission medium so that they can exchange data and share resources.
The condition in which more traffic is sent across a link or device than it can carry, causing delays and lost packets.
A group of servers in many locations that store copies of content and deliver each request from the server nearest the user.
A set of rules a website sends to the browser in an HTTP header, stating which sources of scripts, styles and other content the browser may load and run for that site.
The state in which, after a change in the network, every router has received the updates and recalculated its routes, so that all routing tables agree on the new topology; convergence time is how long this takes.
An attack in which a website includes untrusted input in a page without encoding it, so that a script supplied by the attacker runs in other users' browsers with the trusted site's permissions.
Interference in which the signal carried by one wire or pair of wires is picked up by an adjacent wire or pair in the same cable.
An algorithm that turns input of any length into a fixed-length value (a digest) in such a way that the same input always gives the same digest, any change to the input gives a completely different digest, and the input cannot practically be worked out from the digest.
The corruption of two transmissions that are sent at the same time on a shared medium, so that both must be sent again.
The principle that data is subject to the laws of the country in which it is physically stored or processed.
Techniques and services that keep a service available during a DDoS attack, such as rate limiting, filtering traffic through a scrubbing service and spreading load across a large distributed network.
A security strategy that uses several independent layers of protection, so that an attack that defeats one layer is stopped or detected by another.
An attack that makes a service unavailable to its legitimate users by overloading it with traffic or requests, or by exploiting a flaw that makes it crash.
The period for which a DHCP server allows a client to use an assigned IP address before the client must renew it or give it up.
A server that automatically assigns IP addresses and other network settings to devices from a pool of addresses, each for a limited lease period.
An electronic document, digitally signed by a certificate authority, that binds a public key to the identity of its owner, such as a website's domain name, for a stated period.
The shared networks, data centres, services and connected devices that other systems and organisations rely on to store, process and transmit data.
A value created by processing a digest of a message with the sender's private key, which anyone holding the sender's public key can check to confirm who sent the message and that it has not been changed.
A denial-of-service attack in which the traffic comes from many devices at once, usually the members of a botnet, so that it cannot be stopped by blocking a single source.
A group of networked computers that coordinate their actions by passing messages, so that together they appear to users as a single system.
A server that receives a client's DNS query and finds the answer, from its cache or by querying root, top-level domain and authoritative servers in turn, before returning it to the client.
A human-readable name that identifies a server or group of servers on the internet and is translated into an IP address before data can be sent.
The hierarchical, distributed system of servers that translates domain names into the IP addresses that computers use to find each other.
An application-layer protocol that automatically gives a device joining a network its IP address, subnet mask, default gateway and DNS server address, taken from a pool managed by a DHCP server.
An IP address that is assigned automatically by a DHCP server for a limited lease period and may change when the lease ends or the device reconnects.
A method of routing in which routers exchange information about the networks they can reach and use it to build and update their routing tables automatically, so that routes change when the network changes.
Processing data on or near the device that produces it, at the "edge" of the network, in place of sending it all to a distant cloud data centre.
Unwanted electrical noise induced in a transmission medium by nearby electrical equipment or radio signals, which can corrupt the data being carried.
Scanning incoming email for spam, phishing and malware, and blocking, quarantining or labelling suspicious messages before they reach users.
The process in which each layer of the TCP/IP model, on the sending host, wraps the data from the layer above with its own header (and sometimes a trailer), with the reverse process, de-encapsulation, removing each layer's header on the receiving host.
A network protocol that encrypts the data it carries and authenticates the other party, so that intercepted traffic cannot be read or altered undetected.
The process of converting readable data into an unreadable form using an algorithm and a key, so that only someone with the correct key can convert it back (decryption).
A secret value, usually a long string of bits, that controls how an encryption algorithm transforms plaintext into ciphertext and back.
The family of standards (IEEE 802.3) for cabled local area networks, which defines the cables, connectors, signals and frame format that devices use to exchange data.
Automatically switching a service to a standby server, link or device when the active one fails.
The ability of a system to keep working correctly, possibly at reduced performance, when one or more of its components fail.
A cable that carries data as pulses of light along thin strands of glass or plastic, guided by total internal reflection.
A server that stores files centrally and lets authorised users on the network open, save and share them.
A hardware device or software program that monitors the network traffic entering and leaving a network or device and allows or blocks it according to a set of security rules.
A condition on fields of network traffic, such as direction, source or destination IP address, protocol and port, paired with an action that allows or denies the traffic that matches it.
The unit of data at the network interface layer, made of a header with source and destination MAC addresses, the packet being carried, and a trailer with an error-checking value.
A network node that connects two networks and passes traffic between them, translating between different protocols or formats where the networks use different ones.
One step in a packet's journey, from one router (or host) to the next device along the route.
HTTP sent through an encrypted connection created by Transport Layer Security (TLS), so that requests and responses cannot be read or altered in transit and the server's identity is checked.
A three-digit number in an HTTP response that reports the result of the request, with the first digit giving its class (2 for success, 3 for redirection, 4 for a client error, 5 for a server error).
A central connecting device that repeats every signal it receives out of all its other ports, without reading any addresses.
A topology that combines two or more basic topologies, such as star networks joined to each other through a mesh or star backbone.
The application-layer protocol of the World Wide Web, in which a client sends a request for a resource and a server returns a response containing a status code and, usually, the resource.
A network protocol that sends data, including login details, without encryption or without checking the identity of the other party, so that it can be read or altered in transit.
The global system of interconnected computer networks that exchange data using the TCP/IP family of protocols.
The TCP/IP layer that gives each host a logical IP address and moves packets from the source host to the destination host across any number of networks, with routers choosing the path.
Everyday physical objects fitted with processors, sensors and network connections so that they can collect and exchange data without a person operating them.
The protocol at the internet layer of the TCP/IP model that gives each host a logical address and carries data between hosts, across any number of networks, as independently addressed packets.
An organisation that connects its customers' devices and networks to the internet, usually for a fee.
A system that monitors network traffic or device activity for signs of attack and alerts administrators, without blocking the traffic itself.
A system placed in the path of network traffic that detects signs of attack and blocks or drops the malicious traffic automatically.
A logical numeric address, assigned by software, that identifies a network interface on an IP network and the network it belongs to.
Version 4 of the Internet Protocol, which uses 32-bit addresses written in dotted decimal notation as four numbers from 0 to 255.
The depletion of the pool of unallocated IPv4 addresses, so that new devices and networks can no longer be given new public IPv4 addresses freely.
Version 6 of the Internet Protocol, which uses 128-bit addresses written as eight groups of four hexadecimal digits separated by colons.
The difficulty of getting a shared secret key to both parties of a symmetric encryption system without anyone else obtaining it, especially when they can only communicate over an insecure network.
The secure handling of cryptographic keys throughout their life, including how they are generated, stored, distributed, used, rotated, revoked and destroyed.
Spreading incoming requests across several servers that provide the same service, so that no single server is overloaded.
A network that connects devices within a small geographic area, typically one building or site, and is usually owned and managed by a single organisation.
A 48-bit identifier assigned to a network interface, used to deliver data between devices on the same local network.
A wireless security measure in which an access point allows (whitelist) or refuses (blacklist) connections from devices according to their MAC address.
A server that sends email to other mail servers, receives email for its own users and stores it until they collect it.
Software designed to damage, disrupt or gain unauthorised access to a computer system.
An attack in which the attacker secretly places themselves between two communicating parties, relaying their messages so that they can read or alter the traffic while both parties believe they are talking directly to each other.
A topology in which nodes are connected to several other nodes, giving multiple paths between them; in a full mesh every node is linked directly to every other node.
A wide area wireless network in which the coverage area is divided into cells, each served by a base station, so that devices keep their connection while moving between cells.
A device that converts digital data from a network into a signal suited to a particular transmission line (modulation) and converts incoming signals back into digital data (demodulation).
Authentication that requires two or more independent factors from different categories: something the user knows (a password), something the user has (a phone or security key) and something the user is (a fingerprint or face).
A technique in which a router rewrites the private source IP address of each outgoing packet to its own public IP address, records the mapping in a translation table, and uses the table to send each reply back to the right private device.
The hardware component that connects a device to a network, converting data into signals for the transmission medium and receiving signals addressed to the device.
The bottom layer of the TCP/IP model, which moves data across a single physical link between two directly connected devices, using MAC addresses and turning frames into signals on the medium.
Any device attached to a network that can send, receive or forward data.
Dividing a network into smaller, separate parts, called segments, so that traffic between them can be limited and controlled.
The arrangement of the nodes in a network and the links that connect them.
A firewall that, in addition to stateful inspection, examines the contents of packets to identify the application and user behind the traffic and to block known attack patterns.
A group of exactly 8 bits; an IPv4 address is made of four octets.
A seven-layer reference model of network communication (physical, data link, network, transport, session, presentation, application), used mainly to describe and compare networking functions.
Converting characters that have a special meaning in the destination format, such as <, > and " in HTML, into harmless equivalents before untrusted data is inserted into a page, so that the data is displayed as text and never run as code.
A small unit of data sent across a network, made up of a header holding control information and a payload holding part of the data being transmitted.
A firewall technique that examines each packet's header fields, such as IP addresses, protocol and port, on their own and compares them with the rules, without considering earlier packets or the packet's contents.
The control information at the start of a packet, such as the source and destination addresses, sequence number and time to live, that lets the network deliver the packet and the receiver put the data back together.
A method of sending data across a network in which the data is split into packets that are each routed independently, possibly by different paths, and reassembled in order at the destination.
A database query whose SQL text is fixed in advance with placeholders, and whose input values are sent to the database separately as data, so that the input can never change the structure of the query.
A set of rules an organisation enforces for passwords, such as minimum length, a ban on common or previously breached passwords, no reuse across systems and a limit on failed login attempts.
An update released by a software developer to fix a bug or security vulnerability in a program that is already in use.
The part of a packet that carries the actual data being transmitted, as opposed to the control information in the header.
A networking model in which each computer, called a peer, acts as both client and server, sharing resources directly with other peers without depending on a central server.
An authorised, simulated attack on an organisation's systems, carried out by security professionals to find vulnerabilities before real attackers do.
A short-range network, typically a few metres across, that connects the devices of one person.
A social-engineering attack that uses fraudulent messages, usually emails or text messages, that appear to come from a trusted source, in order to trick the recipient into revealing information, sending money or installing malware.
Data in its original, readable form, before encryption or after decryption.
A 16-bit number from 0 to 65,535 that identifies a particular program or service on a host, so that the transport protocol can deliver incoming data to it.
A form of NAT in which many private devices share one public IP address, each connection being given a different public port number so that replies can be told apart.
An IP address from a range reserved for use inside private networks, which is not routed on the public internet and can be reused by any number of separate networks.
The key of an asymmetric key pair that is kept secret by its owner, used to decrypt data encrypted with the matching public key and to create digital signatures.
An agreed set of rules that defines the format, order and meaning of the messages exchanged between devices, and the actions taken on sending and receiving them.
A server that acts as an intermediary between clients and other servers, forwarding the clients' requests and returning the responses.
An IP address that is globally unique and can be routed across the internet, assigned to an organisation or customer by an internet service provider or regional internet registry.
The key of an asymmetric key pair that is shared openly, used by others to encrypt data for the key's owner or to verify the owner's digital signatures.
Malware that encrypts a victim's files or locks the device and demands payment, usually in cryptocurrency, for the key to restore them.
Putting the payloads of received packets back together in the order given by their sequence numbers to rebuild the original data, after any missing packets have been sent again.
The inclusion of extra components or paths that are not needed for normal operation but take over when a component fails.
An organisation that allocates blocks of IP addresses to internet service providers and other organisations within one region of the world.
A topology in which each node is connected to exactly two others, forming a closed loop around which data travels from node to node.
A network device that connects two or more networks and forwards packets between them, choosing where to send each packet according to its destination IP address.
The process of selecting a path for packets across one or more networks and forwarding them, router by router, towards their destination.
A set of rules that routers follow to share information about the networks they can reach and to calculate the best routes from that information.
A table stored in a router that lists destination networks and, for each one, the next hop and the interface to use to forward packets towards it.
The ability of a system to handle growth, in users, devices or data, without a major redesign or a serious loss of performance.
Relying on the secrecy of a system's design or details, rather than on a sound security mechanism, to protect it.
The unit of data at the transport layer, made of a transport header (with port numbers and, for TCP, a sequence number) and a piece of application data.
The number carried by each TCP segment that gives the position, in the stream of bytes sent, of the first byte of data in that segment.
A computer, or a program running on one, that provides a service or resource to other devices over a network when they request it.
A temporary symmetric key created for a single connection or session and discarded when it ends.
A component whose failure stops the whole system, or a large part of it, from working.
Phishing aimed at a specific person or organisation, using personal details such as names, job titles and current projects to make the message convincing.
Malware that secretly monitors a user's activity, such as keystrokes, browsing or location, and sends the information to a third party.
An attack in which input containing SQL syntax is entered into an application that inserts it directly into a database query, so that the input changes the meaning of the query and can read, alter or delete data.
A topology in which every node is connected by its own link to a single central device, usually a switch, through which all traffic passes.
A firewall technique that records each connection opened from inside the network in a state table and allows an inbound packet only if it belongs to a connection already in the table.
An IP address that is configured manually, or permanently reserved for one device, so that it stays the same until an administrator changes it.
A method of routing in which a network administrator enters the routes in each router's routing table manually, and the routes do not change unless the administrator changes them.
A 32-bit number, with 1s in the positions of the network part of an IP address and 0s in the positions of the host part, used to find the network an address belongs to.
Dividing one IP network into several smaller networks, called subnets, by lengthening the network part of the address with a longer subnet mask.
A network device that connects devices within a LAN and forwards each unit of data only to the port leading to its destination, using the destination MAC address.
Encryption in which the same secret key is used both to encrypt the plaintext and to decrypt the ciphertext, so the sender and receiver must both hold that key.
A four-layer model of how data is communicated across the internet, in which the application, transport, internet and network interface layers each perform one part of the job and use the services of the layer beneath them.
The exchange of three messages, SYN, SYN-ACK and ACK, that opens a TCP connection and lets each side choose and confirm its starting sequence number.
A counter in a packet's header that each router reduces by one; when it reaches zero the packet is discarded, which stops packets from circulating for ever.
The sequence of messages at the start of a TLS connection in which the client and server agree the protocol version and algorithms, the server proves its identity with its certificate, and both sides establish a shared session key.
A connection-oriented transport protocol that delivers a stream of data between two programs reliably and in order, by numbering the data, acknowledging what arrives and resending what is lost.
The physical path, such as a copper cable, an optical fibre or the air, along which signals carrying data travel from one device to another.
The time taken to send a given amount of data over a link, calculated as the size of the data in bits divided by the bandwidth in bits per second.
The TCP/IP layer that provides communication between programs on two hosts, using port numbers to identify the programs and, with TCP, splitting data into numbered segments and ensuring reliable, ordered delivery.
A protocol that creates an encrypted, authenticated connection between two programs across a network, using certificates and asymmetric cryptography to set up the connection and symmetric encryption for the data.
Malware disguised as legitimate software, which the user installs willingly and which then carries out hidden harmful actions.
Carrying a network packet inside another packet, usually encrypted, so that it can cross a network that would otherwise not carry it privately or at all.
A cable made of pairs of insulated copper wires twisted around each other, which carries data as electrical signals and is the standard medium for wired Ethernet LANs.
A text address that identifies a resource on the web and how to retrieve it, made up of the protocol, the domain name of the server, and the path to the resource.
Software that is missing an available security update and therefore still contains a vulnerability that is publicly known and may already be exploited.
A connectionless transport protocol that sends each message as an independent unit, with no handshake, no acknowledgements, no retransmission and no guarantee of order.
A logical network created by configuring switches, so that a group of devices behaves as one separate LAN and broadcast domain whatever their physical location or switch.
An encrypted connection across a public network, usually the internet, that lets a remote device or network communicate as if it were directly connected to a private network.
Malware that inserts copies of itself into other files or programs and runs when an infected file is opened, so it spreads only when users share and open infected files.
Adding a VLAN identifier to each Ethernet frame sent across a trunk link between switches, so that frames from several VLANs can share one link and stay separated.
The transmission of voice calls as data packets over an IP network such as the internet, instead of over the traditional telephone network.
A weakness in hardware, software, configuration or human behaviour that an attacker could use to gain unauthorised access, steal or change data, or disrupt a service.
A login process that an attacker can pass without being the genuine user, because the evidence it asks for is easy to guess, steal or bypass.
A server that stores or generates web pages and other web content and sends them to clients in response to HTTP or HTTPS requests.
A list of items, such as IP addresses, ports, applications or devices, that are explicitly permitted, with everything not on the list blocked by default.
The family of standards (IEEE 802.11) for wireless local area networks, in which devices exchange data with a wireless access point by radio.
A family of security standards (WPA2, WPA3) that authenticate devices joining a wireless network and encrypt the traffic between the devices and the access point.
A network that connects devices and smaller networks across a large geographic area, spanning cities, countries or continents, usually over transmission links owned by telecommunications companies.
A network device that sends and receives Wi-Fi radio signals, connecting wireless devices to a wired LAN.
Sending data through the air as electromagnetic waves, usually radio or microwaves, between antennas, without a physical cable.
A system of linked documents and other resources, identified by URLs and transferred over the internet using HTTP or HTTPS.
Standalone malware that copies itself across a network by exploiting vulnerabilities, without needing to attach to a file or be opened by a user.
An attack that uses a vulnerability unknown to the software's developer, so no patch exists and the developer has had "zero days" to fix it.
Manipulating people into breaking normal security procedures, such as revealing passwords or granting access, by exploiting trust, fear, urgency or helpfulness.