Protocol Glossary
Precise definitions for networking and protocol terms. Every entry is grounded in the original RFC or specification.
90
Terms
http
networking
Latency
Latency is the time delay between a request being sent and the first byte of a response being received. Measured in milliseconds. Network latency is dominated by the speed of light over physical distance (1ms per 100km), plus queuing and processing delays.
Bandwidth
Bandwidth is the maximum rate of data transfer across a network path, measured in bits per second (Mbps, Gbps). High bandwidth allows large files to transfer quickly. Bandwidth is often confused with latency – a high-bandwidth connection can still have high latency.
Round-Trip Time (RTT)
Round-Trip Time (RTT) is the time for a packet to travel from source to destination and a response to return. RTT determines how many round trips fit in a given time window. TCP handshakes, TLS negotiations, and DNS lookups each consume RTTs before data can flow.
CIDR (Classless Inter-Domain Routing)
CIDR notation expresses an IP address range using a base address and a prefix length (e.g., 192.168.1.0/24). The /24 means the first 24 bits are fixed – the network address – leaving 8 bits for hosts (256 addresses). CIDR replaced the old fixed class system (Class A/B/C) to allow more flexible IP allocation.
Packet
A packet is a unit of data transmitted over a network. Each packet contains a header (source/destination addresses, protocol info, sequence numbers) and a payload (the actual data). IP packets are limited by MTU – typically 1500 bytes on Ethernet. Larger messages are split into multiple packets.
Frame
A frame is a Layer 2 (data link) unit of data that includes a header with MAC addresses, the payload (an IP packet), and a trailer with error-checking CRC. Ethernet frames have a maximum size of 1518 bytes. Frames are addressed by MAC, not IP – they do not cross router boundaries.
Socket
A socket is a communication endpoint identified by an IP address and port number pair. A TCP connection is uniquely identified by a 5-tuple: (protocol, src IP, src port, dst IP, dst port). Applications create sockets to send and receive data – the OS manages the underlying protocol state.
Encapsulation
Encapsulation is the process of wrapping data with protocol headers as it moves down the network stack. Application data becomes a TCP segment, which becomes an IP packet, which becomes an Ethernet frame. Each layer adds its own header without understanding the layers above or below.
Multiplexing
Multiplexing allows multiple logical streams to share a single connection or channel. HTTP/2 multiplexes many requests over one TCP connection using stream IDs. Port numbers multiplex connections at the transport layer. Without multiplexing, each request needs its own connection – wasting resources.
Congestion
Network congestion occurs when traffic exceeds link or buffer capacity, causing packet loss and increased latency. TCP congestion control algorithms (Cubic, BBR, Reno) dynamically adjust sending rate to avoid overwhelming the network. Persistent congestion degrades all traffic on the shared path.
Flow Control
Flow control prevents a fast sender from overwhelming a slow receiver. TCP uses a receive window (rwnd) advertised by the receiver to limit in-flight data. If the receiver's buffer fills, it shrinks rwnd to zero, pausing the sender until the application drains the buffer.
ACK (Acknowledgment)
ACK (acknowledgment) is a TCP flag confirming receipt of data. The ACK number indicates the next byte the receiver expects. Delayed ACKs batch confirmations for efficiency (typically every 2 segments or 200ms). Missing ACKs trigger retransmission – the sender assumes data was lost.
SYN (Synchronize)
SYN is a TCP flag used to initiate a connection via the three-way handshake: SYN, SYN-ACK, ACK. The SYN packet carries the client's initial sequence number (ISN). SYN floods are a classic DDoS attack that exhausts server connection tables by sending SYNs without completing handshakes.
FIN (Finish)
FIN is a TCP flag used to gracefully close a connection. TCP close is a four-way process: FIN from initiator, ACK from peer, FIN from peer, ACK from initiator. The TIME_WAIT state after closing lasts 2*MSL (typically 60s) to handle delayed packets – this can exhaust ports on busy servers.
MTU (Maximum Transmission Unit)
MTU is the largest packet size a network link can carry without fragmentation. Ethernet MTU is 1500 bytes. If a packet exceeds the path MTU, it is fragmented (IPv4) or dropped with ICMP Packet Too Big (IPv6). Path MTU Discovery (PMTUD) finds the lowest MTU along a route.
MSS (Maximum Segment Size)
MSS is the largest TCP payload (excluding headers) that can be sent in a single segment. MSS is negotiated during TCP handshake and derived from MTU: MSS = MTU - IP header (20) - TCP header (20). For 1500-byte Ethernet MTU, MSS is 1460 bytes. MSS avoids IP fragmentation by keeping segments within link MTU.
ARP (Address Resolution Protocol)
ARP resolves IP addresses to MAC addresses on local networks. When a host needs to send a packet to an IP on the same subnet, it broadcasts an ARP request. The target responds with its MAC address. ARP has no authentication – ARP spoofing enables man-in-the-middle attacks on LANs.
NAT (Network Address Translation)
NAT translates private IP addresses to public IP addresses at a router boundary. NAT allows many devices to share one public IP. It breaks end-to-end connectivity – inbound connections require port forwarding. Carrier-grade NAT (CGNAT) adds another translation layer, complicating VoIP and gaming.
VLAN (Virtual LAN)
A VLAN segments a physical switch into multiple isolated broadcast domains using 802.1Q tags. Devices in different VLANs cannot communicate without a router (inter-VLAN routing). VLANs provide security isolation, reduce broadcast traffic, and enable network segmentation without separate physical infrastructure.
Subnet
A subnet is a logical division of an IP network defined by a subnet mask (e.g., /24 = 255.255.255.0). Hosts within a subnet communicate directly via ARP without routing. Hosts in different subnets must send traffic through a router. Subnetting reduces broadcast domains and enables hierarchical IP allocation.
Gateway (Default Gateway)
A default gateway is the router a host sends packets to when the destination is not on the local subnet. Every host needs a default gateway to reach the internet or other networks. If the gateway is unreachable, all off-subnet communication fails – even if the host has a valid IP and DNS.
Routing Table
A routing table is a data structure in a router or host that maps destination network prefixes to next-hop addresses and interfaces. Longest prefix match determines which route applies. Routes come from static configuration, DHCP (default route), or dynamic protocols (BGP, OSPF). An empty routing table means no connectivity.
BGP Peering
BGP peering is a TCP session on port 179 between two routers that exchange routing information. eBGP peers are in different autonomous systems (inter-provider). iBGP peers are in the same AS (intra-network). Peering requires explicit configuration on both sides – BGP does not auto-discover neighbors.
Anycast
Anycast assigns the same IP address to multiple servers in different locations. Routers direct traffic to the nearest instance based on BGP path selection. CDNs, DNS root servers, and DDoS mitigation services use anycast to serve users from the closest point of presence – reducing latency and distributing load geographically.
Unicast
Unicast is one-to-one communication where a packet is sent from one source to one specific destination. Most internet traffic is unicast – HTTP requests, SSH sessions, email delivery. Unicast requires the sender to know the destination IP address. Contrast with multicast (one-to-many) and broadcast (one-to-all).
Multicast
Multicast is one-to-many communication where a single packet is delivered to all members of a group simultaneously. The network replicates packets at branch points rather than the sender duplicating them. Used for IPTV, stock market feeds, and cluster discovery. Requires IGMP (hosts) and PIM (routers).
Broadcast
Broadcast sends a packet to all hosts on a network segment simultaneously. The IPv4 broadcast address (e.g., 192.168.1.255 for /24) delivers to every host on the subnet. ARP, DHCP discovery, and NetBIOS use broadcast. Excessive broadcasts cause broadcast storms. IPv6 eliminated broadcast entirely in favor of multicast.
Half-Duplex
Half-duplex allows communication in both directions but only one direction at a time. Walkie-talkies are half-duplex – one party talks while the other listens. Original Ethernet hubs were half-duplex with CSMA/CD collision detection. Modern switched Ethernet is full-duplex. WiFi remains half-duplex on each channel.
Full-Duplex
Full-duplex allows simultaneous bidirectional communication – both endpoints can send and receive at the same time. Modern switched Ethernet is full-duplex, eliminating collisions entirely. A 1 Gbps full-duplex link provides 1 Gbps in each direction simultaneously (2 Gbps aggregate).
Throughput
Throughput is the actual data transfer rate achieved on a network connection, measured in bits per second. Throughput is always less than bandwidth due to protocol overhead, congestion, packet loss, and retransmissions. TCP throughput is bounded by: min(rwnd, cwnd) / RTT.
Jitter
Jitter is the variation in packet arrival times. If packets arrive at inconsistent intervals (5ms, 12ms, 3ms, 20ms), jitter is high. VoIP and video streaming are sensitive to jitter – inconsistent delivery causes choppy audio and video stuttering. Jitter buffers smooth out variation at the cost of added latency.
Packet Loss
Packet loss occurs when transmitted packets fail to reach their destination. Causes include congestion (buffer overflow), CRC errors (physical layer noise), and intentional drops (QoS policing, firewall rules). TCP retransmits lost packets automatically. UDP does not – the application must handle loss.
Fragmentation
IP fragmentation splits packets larger than the link MTU into smaller fragments for transmission, reassembled at the destination. Fragmentation hurts performance – any single lost fragment requires retransmitting the entire original packet. IPv6 does not allow router fragmentation; only endpoints can fragment.
Reassembly
Reassembly is the process of reconstructing the original IP packet from fragments at the destination host. The receiver buffers fragments until all pieces arrive, then combines them using offset fields. If any fragment is missing after a timeout (typically 30-60s), all received fragments are discarded.
Checksum
A checksum is a value computed from packet data used to detect transmission errors. TCP, UDP, and IP headers include checksums. The receiver recomputes the checksum on arrival – if it does not match, the packet is silently discarded. Checksums detect accidental corruption but not malicious tampering (use HMAC for that).
CRC (Cyclic Redundancy Check)
CRC is an error-detection code used at Layer 2 to verify frame integrity. Ethernet uses CRC-32 in the Frame Check Sequence (FCS) trailer. CRC detects burst errors up to 32 bits long with 99.99% probability. NICs that receive frames with bad CRC discard them silently – incrementing an interface error counter.
Retransmission
TCP retransmission resends packets that were lost or not acknowledged within a timeout period. Fast retransmit triggers after 3 duplicate ACKs (indicating a gap). Timeout-based retransmission (RTO) fires after a calculated delay. Excessive retransmissions indicate network congestion or path problems.
Sliding Window
The sliding window is TCP's mechanism for sending multiple packets before requiring acknowledgment. The window size determines how much data can be in-flight simultaneously. Without windowing, the sender waits for each ACK before sending the next segment – wasting bandwidth on high-latency links.
Three-Way Handshake
The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a connection between client and server. It synchronizes sequence numbers, negotiates options (MSS, window scale, SACK, timestamps), and costs exactly 1 RTT before data can flow. TLS adds 1-2 more RTTs on top.
Four-Way Teardown
TCP four-way teardown (FIN, ACK, FIN, ACK) gracefully closes a connection. Each side independently signals it has no more data (FIN) and acknowledges the other's FIN. The initiator enters TIME_WAIT for 2*MSL (60-120s) after close, consuming a socket until the timer expires.
Keep-Alive
Keep-alive has two meanings: TCP keep-alive sends periodic probes on idle connections to detect dead peers (default: 2 hours). HTTP keep-alive (Connection: keep-alive) reuses a TCP connection for multiple requests, avoiding repeated handshake overhead. Both reduce connection churn but serve different purposes.
Parity Bit
A parity bit is the simplest error detection code – a single bit added to make the total number of 1-bits even (even parity) or odd (odd parity). Parity detects all single-bit errors but cannot detect even numbers of flipped bits. Used in serial communication (RS-232) and RAM (ECC memory uses extended Hamming codes).
Hamming Code
Hamming codes are error-correcting codes that can detect 2-bit errors and correct 1-bit errors by placing parity bits at power-of-2 positions. ECC RAM uses Hamming(72,64) – 64 data bits with 8 check bits. The Hamming distance between two codewords determines error detection and correction capability.
Forward Error Correction (FEC)
FEC adds redundant data to transmissions so the receiver can reconstruct lost or corrupted packets without retransmission. Used in satellite links, QUIC, video streaming, and 5G radio. FEC trades bandwidth for reliability – sending 10% extra data can recover from 10% packet loss without any round trips.
Load Balancer
A load balancer distributes incoming traffic across multiple backend servers to prevent any single server from becoming overwhelmed. Layer 4 (TCP) load balancers route by IP/port. Layer 7 (HTTP) load balancers can route by URL path, headers, or cookies. Health checks remove failed backends automatically.
Reverse Proxy
A reverse proxy sits in front of backend servers, accepting client connections and forwarding requests to appropriate backends. Unlike a forward proxy (client-side), a reverse proxy is server-side and invisible to clients. Provides TLS termination, caching, compression, rate limiting, and security filtering. Nginx, Caddy, and Envoy are common reverse proxies.
Forward Proxy
A forward proxy sits between clients and the internet, making requests on behalf of clients. Corporate proxies (Squid, Zscaler) filter outbound traffic, enforce policies, and cache content. Clients must be configured to use the proxy. Forward proxies provide anonymity, content filtering, and bandwidth savings.
CDN (Content Delivery Network)
A CDN distributes content across geographically dispersed edge servers so users receive data from the nearest location. Reduces latency (no cross-continent round trips), offloads origin traffic, and absorbs DDoS attacks. Cloudflare, Fastly, and AWS CloudFront serve from 200+ global PoPs.
Edge Computing
Edge computing runs application logic at CDN edge locations (200+ PoPs) rather than centralized data centers. Cloudflare Workers, Deno Deploy, and Fastly Compute execute code within milliseconds of users. Eliminates origin round trips for dynamic content. Limited by: no persistent connections, short execution time, restricted APIs.
Service Mesh
A service mesh is a dedicated infrastructure layer for service-to-service communication in microservices. Sidecar proxies (Envoy) handle mTLS, retries, circuit breaking, and observability transparently – without application code changes. Istio, Linkerd, and Consul Connect are the major implementations.
Sidecar Proxy
A sidecar proxy is a helper container deployed alongside each application container in Kubernetes. It intercepts all inbound and outbound network traffic, applying policies (mTLS, retries, rate limits) without application modification. Envoy is the dominant sidecar proxy, used by Istio, AWS App Mesh, and Consul Connect.
Circuit Breaker
A circuit breaker stops calling a failing downstream service after a threshold of errors, preventing cascade failures. States: Closed (normal flow), Open (all calls fail-fast without attempting), Half-Open (limited test calls to check recovery). Prevents a slow/failing service from consuming all caller resources and propagating failure upstream.
Rate Limiting
Rate limiting restricts the number of requests a client can make in a time window. Prevents abuse (brute force, scraping), protects backend resources, and ensures fair usage. Algorithms: fixed window, sliding window, token bucket, leaky bucket. Return HTTP 429 Too Many Requests with Retry-After header when limits are exceeded.
Backpressure
Backpressure is a flow control mechanism where a slow consumer signals the producer to slow down, preventing buffer overflow and data loss. TCP's receive window is backpressure. In streaming systems (Kafka, reactive streams), backpressure propagates upstream – if the database is slow, the entire pipeline slows instead of dropping data.
Connection Pooling
Connection pooling maintains a cache of pre-established database or HTTP connections that are reused across requests instead of creating new ones. Eliminates TCP handshake + TLS negotiation overhead per request. Critical for performance – a PostgreSQL connection takes ~100ms to establish but <1ms to reuse from pool.
DNS Round-Robin
DNS round-robin distributes traffic by returning multiple A records for a domain, cycling their order with each query. The simplest load distribution method – no dedicated load balancer needed. Limitations: no health checking (dead servers stay in rotation), unequal distribution (DNS caching), and no session affinity.
Health Check
A health check is a periodic probe that determines whether a service instance is able to handle traffic. Load balancers, orchestrators (Kubernetes), and service meshes use health checks to route traffic only to healthy instances. Types: liveness (is the process alive?), readiness (can it serve requests?), and startup (has it finished initializing?).
Graceful Degradation
Graceful degradation allows a system to continue operating with reduced functionality when components fail, rather than failing completely. A site with a failed recommendation engine still shows products. A service with a failed cache still queries the database (slower but functional). Requires identifying which features are optional.
Blue-Green Deployment
Blue-green deployment maintains two identical production environments. Traffic routes to 'blue' (current). New version deploys to 'green' (idle). After validation, traffic switches from blue to green instantly (DNS change or load balancer swap). Rollback is instant – switch back to blue. Doubles infrastructure cost during deployment.
Canary Release
A canary release routes a small percentage of production traffic (1-10%) to the new version while the majority stays on the current version. If the canary shows elevated errors or latency, it is rolled back before affecting most users. Less infrastructure cost than blue-green but requires traffic splitting capability.
Failover
Failover is the automatic transfer of traffic from a failed primary system to a standby replica. Database failover promotes a replica to primary. DNS failover routes to a backup IP. Load balancer failover removes failed backends. Recovery time (RTO) depends on detection speed and promotion mechanism – seconds for load balancer, minutes for database.
High Availability (HA)
High availability is a system design that minimizes downtime by eliminating single points of failure. Measured in 'nines' – 99.9% (8.7h downtime/year), 99.99% (52min/year), 99.999% (5min/year). Requires: redundant components, automatic failover, health monitoring, and tested recovery procedures.
Disaster Recovery (DR)
Disaster recovery is the plan and infrastructure for restoring service after catastrophic failure (region outage, data center loss, ransomware). Defined by RPO (how much data loss is acceptable) and RTO (how quickly service must resume). DR requires cross-region replication, tested runbooks, and regular drills.
RPO and RTO
RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time – how far back you can roll back. RTO (Recovery Time Objective) is the maximum acceptable downtime – how quickly you must be back online. RPO=0 means zero data loss (synchronous replication). RTO=0 means zero downtime (active-active). Both cost exponentially more as they approach zero.
web
protocols
Handshake
A handshake is the initial exchange of messages between two parties to establish a connection, agree on parameters, and authenticate before data transfer begins. TCP uses a 3-way handshake (SYN/SYN-ACK/ACK). TLS uses its own handshake on top of TCP. QUIC integrates both into a single handshake.
Stateless
A stateless protocol treats every request as independent – no information from previous requests is retained on the server. HTTP is stateless by design. Each request must contain all information needed to process it. Cookies, sessions, and JWTs are mechanisms layered on top of HTTP to simulate statefulness.
dns
DNS Resolution
DNS resolution is the process of translating a human-readable domain name (example.com) into an IP address that computers use to route connections. A full resolution involves: recursive resolver → root nameserver → TLD nameserver → authoritative nameserver. Cached results skip most steps.
TTL (Time to Live)
TTL has two meanings in networking: in DNS, it is the number of seconds a record is cached before resolvers must re-query. In IP packets, it is a hop counter that prevents packets from circulating forever. DNS TTL controls cache freshness. IP TTL prevents routing loops.
tls
TLS Termination
TLS termination is the practice of decrypting TLS traffic at a load balancer or reverse proxy rather than at the application server. The proxy handles certificate management, cipher negotiation, and CPU-intensive cryptographic operations. Backend traffic between proxy and application runs over HTTP (or re-encrypted with a simpler internal cert).
Certificate Pinning
Certificate pinning restricts which TLS certificates a client accepts for a specific domain, beyond standard CA validation. The client stores expected certificate hashes and rejects connections presenting different certs – even if CA-signed. Pins prevent MITM via compromised CAs but cause outages if pins are not rotated before certificate renewal.
Cipher Suite
A cipher suite is the combination of algorithms negotiated during a TLS handshake: key exchange (ECDHE), authentication (RSA/ECDSA), bulk encryption (AES-256-GCM), and integrity (SHA-384). TLS 1.3 simplified suites to just AEAD cipher + hash, removing key exchange from the suite name since ECDHE is mandatory.
Key Exchange
Key exchange is the process of establishing a shared secret between client and server over an insecure channel. TLS uses ephemeral Diffie-Hellman (DHE/ECDHE) – both parties contribute randomness, and eavesdroppers cannot derive the shared key. ECDHE with Curve25519 or P-256 is the modern standard. Static RSA key exchange has no forward secrecy.
Perfect Forward Secrecy (PFS)
Perfect Forward Secrecy guarantees that compromise of long-term keys does not decrypt past sessions. PFS requires ephemeral key exchange (DHE/ECDHE) – each session uses unique keys that are destroyed after use. If the server's private key is stolen tomorrow, previously captured traffic remains encrypted. TLS 1.3 mandates PFS.
Certificate Authority (CA)
A Certificate Authority issues and signs TLS certificates that browsers and operating systems trust. CAs verify domain ownership (DV), organization identity (OV), or extended validation (EV) before signing. The CA system relies on ~150 root certificates pre-installed in trust stores. Let's Encrypt automated DV issuance, issuing 400M+ active certificates.
OCSP (Online Certificate Status Protocol)
OCSP is a protocol for checking whether a TLS certificate has been revoked in real-time. Instead of downloading entire CRL lists, clients query the CA's OCSP responder for a single certificate's status (good/revoked/unknown). OCSP stapling lets the server fetch and cache the response, avoiding client-side privacy leaks and latency.
CRL (Certificate Revocation List)
A CRL is a signed list of revoked certificate serial numbers published periodically by a CA. Clients download CRLs to check if a presented certificate has been revoked. CRLs are large (megabytes), updated infrequently (hours to days), and rarely checked by browsers. OCSP and short-lived certificates are the modern replacements.
SNI (Server Name Indication)
SNI is a TLS extension that sends the requested hostname in the ClientHello message, allowing one IP address to serve multiple TLS certificates. Without SNI, each HTTPS site needs its own IP. SNI is sent in cleartext – Encrypted Client Hello (ECH) encrypts it to prevent network observers from seeing which site is being accessed.
ALPN (Application-Layer Protocol Negotiation)
ALPN is a TLS extension that negotiates the application protocol (HTTP/1.1, h2, h3) during the TLS handshake, eliminating an extra round trip. The client lists supported protocols in ClientHello; the server selects one in ServerHello. HTTP/2 requires ALPN – browsers will not use h2 without it. Also used for ACME tls-alpn-01 validation.
security
HSTS (HTTP Strict Transport Security)
HSTS is an HTTP response header that instructs browsers to only connect via HTTPS for a specified duration. Once set, the browser refuses HTTP connections to that domain – even if the user types http://. HSTS prevents SSL-stripping MITM attacks. The preload list hardcodes HSTS into browsers, protecting even the first visit.
CORS (Cross-Origin Resource Sharing)
CORS is a browser mechanism that controls which origins (domains) can make requests to your API. Without CORS headers, browsers block cross-origin XMLHttpRequest and fetch() calls. The server responds with Access-Control-Allow-Origin to permit specific origins. Misconfigured CORS (Allow-Origin: *) can expose APIs to credential theft.
CSP (Content Security Policy)
CSP is an HTTP header that restricts which resources (scripts, styles, images, frames) a page can load. CSP mitigates XSS by preventing execution of inline scripts and scripts from unauthorized origins. A strict CSP (script-src 'nonce-random') blocks injected JavaScript even if an attacker finds an injection point.
XSS (Cross-Site Scripting)
XSS is a vulnerability where an attacker injects malicious JavaScript into a web page viewed by other users. Stored XSS persists in the database (comments, profiles). Reflected XSS arrives via URL parameters. DOM-based XSS executes entirely client-side. XSS enables session hijacking, credential theft, and defacement.
CSRF (Cross-Site Request Forgery)
CSRF tricks a user's browser into making authenticated requests to a site where the user is logged in. An attacker's page includes a form or image that submits to the target site – the browser automatically attaches the user's cookies. Prevention: anti-CSRF tokens, SameSite cookies, and checking Origin/Referer headers.
SQL Injection
SQL injection occurs when user input is concatenated directly into SQL queries without parameterization. Attackers inject SQL syntax to read unauthorized data, modify records, or execute system commands. The fix is simple and absolute: use parameterized queries (prepared statements) for every database interaction. No exceptions.
Man-in-the-Middle (MITM)
A man-in-the-middle attack intercepts communication between two parties, reading or modifying traffic without either party's knowledge. TLS prevents MITM by authenticating the server via certificates and encrypting the channel. MITM succeeds when: TLS is absent (HTTP), certificate validation is disabled, or the attacker controls a trusted CA.
Replay Attack
A replay attack captures and retransmits valid authentication data to gain unauthorized access. An attacker records a successful login or API request and replays it later. Prevention: timestamps with short validity windows, nonces (single-use tokens), sequence numbers, and challenge-response protocols that produce unique values per session.
DNS Spoofing
DNS spoofing injects forged DNS responses to redirect victims to attacker-controlled servers. Cache poisoning targets recursive resolvers – a single poisoned cache entry redirects all clients using that resolver. DNSSEC cryptographically signs DNS records to prevent spoofing. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt queries.
ARP Poisoning
ARP poisoning (ARP spoofing) sends forged ARP replies on a local network to associate the attacker's MAC address with another host's IP. This redirects traffic intended for the victim (usually the gateway) through the attacker, enabling man-in-the-middle attacks. Defense: Dynamic ARP Inspection (DAI) on managed switches.