Modules

DNS is the first hop of every request and the quietest place for outages to hide: a recursive resolver walking root→TLD→authoritative, a TTL that's too low (latency) or too high (stale failover), a negatively-cached NXDOMAIN that outlives a fresh deploy, DNSSEC that authenticates but never encrypts. Adjust the query type, TTL, resolver location and security toggles and watch resolution, caching and security cascade. Validated against BIND 9.20.29 and glibc 2.44.

lib/ns/query.c (BIND named)

From SYN to FIN — the complete lifecycle of a TCP connection, traced through the Linux kernel. Learn why packet loss cascades into application latency, why HTTP/2 head-of-line blocking is a TCP problem not an HTTP problem, and how congestion control shapes every connection.

net/ipv4/tcp_input.c

Every HTTPS connection you have ever debugged starts here. TLS 1.3 cut the handshake from two round trips to one, deleted RSA key transport outright, and added a 0-RTT mode that trades replay safety for latency. This module walks the real BoringSSL state machine, the HKDF key schedule, X.509 chain validation and the record layer that carries every byte afterwards.

ssl/ssl_lib.cc (BoringSSL handshake entry)

One TCP connection, many streams. HTTP/2 removed the per-connection bottleneck that shaped a decade of frontend workarounds, then quietly deprecated its own priority scheme. This module builds the frame-level model you need to read an h2 trace: how bytes become frames, why HPACK makes the second request cheap, and which of the two flow-control windows is actually stalling you.

lib/nghttp2_session.c

The finite state machine governing every BGP peering session. Understand why 'Active' means the session is failing, how hold timers create silent blackholes, and what happens when a BGP peer goes down.

bgpd/bgp_fsm.c

The four messages every BGP session is built from — OPEN, UPDATE, KEEPALIVE, NOTIFICATION. Go past 'BGP works': dissect each packet field by field, see why KEEPALIVE runs at hold-time/3, and learn what a NOTIFICATION code 6/3 actually tells you at 3am. Validated against FRRouting's bgpd/bgp_packet.c.

bgpd/bgp_packet.c

The ordered decision process every router runs to pick one winning route — the single most important thing to understand when debugging why traffic takes the path it does. Pit two routes against each other on Weight, LOCAL_PREF, AS_PATH length and MED, and watch exactly which step decides the winner. The trap: the steps are ranked, not summed. Validated against FRRouting bgpd/bgp_route.c (bgp_path_info_cmp).

bgpd/bgp_route.c

iBGP has no loop prevention inside the AS, so it forbids a router from re-advertising an iBGP-learned route to another iBGP peer — which forces a full mesh: n*(n-1)/2 sessions, 4,950 of them in a 100-router AS. Route Reflection lifts that rule safely by stamping ORIGINATOR_ID and CLUSTER_LIST for loop detection. Change the topology and watch the session count and failure domain move. Validated against FRRouting bgpd/bgp_route.c + bgpd/bgp_attr.c and RFC 4456.

bgpd/bgp_route.c

OSPF floods link-state advertisements so every router builds an identical map of the area, then each runs Dijkstra over it to compute routes. When a link fails, convergence is a pipeline — flood the change, wait the SPF timer, run SPF, install the RIB, program the FIB — and each stage costs more as the topology grows. Change the topology and SPF timer and watch the flooding scope and convergence time move. Validated against FRRouting ospfd/ospf_flood.c, ospf_spf.c, ospf_route.c and RFC 2328.

ospfd/ospf_flood.c

NAT and connection tracking sit on the packet path of every Linux box, and most outages blamed on 'the firewall' are really conntrack: a full table dropping new flows, an exhausted SNAT port range, MASQUERADE's per-packet route lookup, or asymmetric routing that hides the return packet from conntrack. Adjust the NAT type, connection rate, table size, port range and timeout and watch the table, port space and correctness cascade. Validated against Linux v6.12.93 netfilter.

net/netfilter/nf_conntrack_core.c

Five systems, one address bar. This module composes the DNS, TCP, TLS and HTTP modules into a single timeline so you can see where time to first byte actually goes — and which of the phases a cache hit, a reused connection or a CDN edge makes disappear entirely. The lesson is subtraction: most performance work is not making a phase faster, it is arranging for the phase not to happen.

resolv/res_send.c (glibc stub resolver)

The HTML parser is the component every page waits on. This module follows bytes through tokenization and tree construction, then shows what interrupts that walk: a <script> with no async or defer stops the tokenizer mid-document — and that stop is what creates the preload scanner that races ahead to fetch markup the parser has not reached — while a stylesheet decides whether anything may paint. The lesson is that parse order is execution order, and where you put a tag is a scheduling decision.

third_party/blink/renderer/core/html/parser/html_tokenizer.cc (tokenizer state machine)

How Blink turns a pile of stylesheets into one computed style per element. Specificity is a packed 24-bit integer whose fields saturate rather than carry, !important inverts the origin order instead of adding to it, and a stylesheet that arrives after <body> stops blocking paint while still blocking scripts. Every behaviour here is read from Chromium 154 source, not from the spec's prose.

third_party/blink/renderer/core/css/css_selector.cc

What actually happens between a <script> tag and a responsive page. V8 defers most function bodies rather than skipping them, building no AST until first call; a long task is not descheduled, it runs to completion because interrupts are only handled at checkpoints the running code reaches; optimized code is thrown away when a guard fails; and a FinalizationRegistry callback is a posted task, not a destructor. Read from V8 15.4 and Chromium 154 source, not from blog-post folklore.

src/parsing/parser.cc

How Blink turns a mutated DOM back into pixels: style recalculation, layout, compositing inputs, paint, and rasterization on the compositor. Verified against Chrome 154 Blink and cc source, including the phases the usual mental model leaves out.

third_party/blink/renderer/core/dom/document_lifecycle.h

A load balancer is a scheduler with a stale view of the world. This module builds the model you need when traffic is distributed but latency is not: what least-conn actually orders on, why a failing backend keeps serving for seconds after it broke, which of the two maxconn numbers queues rather than refuses, and what a stick table really keys on. Verified against HAProxy v3.4.6.

src/lb_fwlc.c

A reverse proxy is two connections pretending to be one. This module builds the model you need when the proxy is the thing that broke: what worker_processes auto actually resolves to, why worker_connections is not a client limit, which shared-memory zone runs out first, and why the rate limiter has to live outside the worker. Verified against nginx release-1.30.5, with Envoy v1.39.1 cited only where the architectures genuinely differ.

src/core/nginx.c

A connection pool is a queue you cannot see, in front of a limit you did not set. Build the model you need when the database is idle and the application is timing out: what pool_size is counted per, which of three limits binds first, why session pooling sizes for open sessions rather than for work, and what really happens to prepared statements in transaction mode — the opposite of the advice in circulation. Verified against PgBouncer 1.26.0, pgx 5.11.0 and PostgreSQL 18.6.

src/main.c

What a CDN actually does with your request, read out of two cache implementations that disagree with each other by default. Varnish coalesces concurrent misses on the same key onto one backend fetch without being asked; nginx does not, because proxy_cache_lock is off. Both facts are one grep apart in real source, and everything people believe about "the CDN protects my origin" turns on which of the two is in front of it.

bin/varnishd/builtin.vcl

IPSec is two protocols wearing one name: IKEv2 negotiates keys in userspace, the kernel moves the packets. That split explains most of what confuses people — why a tunnel can be 'up' with nothing passing, why ESP hides your payload but not who you are talking to, and why a dead peer blackholes traffic for minutes after the link dropped. This module walks strongSwan's IKEv2 state machine, the CHILD_SA it installs into the kernel, and the retransmission arithmetic that sets how long you wait.

src/libcharon/sa/ike_sa.c (IKE_SA state, DPD, NAT-T port float)

Certificate failures are rarely cryptographic. They are bookkeeping: a chain the server forgot to send, a name the verifier short-circuited past, a revocation check that was never a check, a pin computed over the wrong bytes. This module reads the two libraries that decide — OpenSSL's X.509 verifier and BoringSSL's TLS transport — which disagree: the same parameter, depth, permits a chain one certificate longer in one than the other. Which tree a fact came from is the whole difference.

crypto/x509/x509_vfy.c

Post-quantum cryptography has already shipped, and whether your connection uses it was decided by a default you never set. The two libraries this module reads disagree: one offers a hybrid group first, the other's default list has none. Worse, one of them prefers post-quantum signatures when signing and refuses them when verifying. The algorithms are finished; the deployment is a configuration question with four separate answers.

crypto/ml_kem/ml_kem.c

A route hijack is not an attack on BGP. It is BGP working exactly as specified, because the protocol has no idea who owns a prefix. RPKI is the fix, and in the router this module reads it fails open twice: with no cache configured, validation is simply off, and with a stale one every prefix comes back in a fourth state the RFC never names. There is no enforce switch. Enforcement is a route-map you write.

bgpd/bgp_rpki.c

A firewall rule is not a filter the kernel consults. It is an entry in a list that a hook function walks in order, taking the first match — and which list gets walked was decided by the routing lookup before any rule was read. This module is about that ordering: why INPUT and FORWARD are mutually exclusive outcomes rather than two places to put a rule, why a table is really just a priority number, and why INVALID is not a connection state at all.

net/netfilter/core.c

Where a flood is actually absorbed, and what each layer charges for absorbing it. Reads the SYN-queue admission test, SYN cookies and their real cost, the amplification ceiling a stock resolver imposes on itself, the two rate limiters that ship in pinned source, and the difference between a drop in the driver and a drop once the packet already has an sk_buff.

net/core/dev.c