You are designing a new VPC for Flipkart's product search service. Someone asks: "Should we use 10.0.0.0/16 or 10.0.0.0/24?" If you cannot answer that immediately, every VPC you design in your career will have addressing mistakes that cannot be fixed without a full rebuild. IP addressing is the foundation of every cloud network. Everything in AWS - your EC2 instances, RDS databases, Lambda functions in a VPC, ECS tasks, and Kubernetes pods - gets an IP address. How those addresses are organized determines whether your network is scalable, routable, and secure.
Your application calls `api.payments.razorpay.com`. Somewhere between that function call and a TCP connection to a server, a name becomes an IP address. When DNS breaks, everything breaks - and you need to know exactly what is happening to fix it. **DNS (Domain Name System)** is a globally distributed database that maps human-readable names to IP addresses. It works as a hierarchy: your browser asks a resolver, which asks root servers, which direct it to the authoritative name server for that domain.
Swiggy's order service sends a request to the payment service. That request travels through TCP. When it fails - timeout, connection refused, packet loss - the symptoms are different for each failure mode. Cloud engineers who understand TCP can diagnose these failures. Those who do not spend hours guessing. **TCP/IP** is the protocol stack that powers almost all internet and cloud communication. IP handles addressing and routing. TCP handles reliable, ordered delivery with retransmission.
Every API call your application makes uses HTTP. Understanding what happens at the HTTP layer - headers, status codes, methods - is fundamental to debugging application issues, configuring load balancers, and reading access logs.
Security groups are stateful virtual firewalls that control traffic to and from AWS resources. Every EC2 instance, RDS database, ECS task, and Lambda in a VPC has at least one security group. Misconfiguring them is the most common cause of "I can't connect" issues in AWS.
Work through these steps to practice networking debugging. You need two EC2 instances in the same VPC - a "web" instance in a public subnet and a "db" instance in a private subnet. 1. From your local machine, verify the public instance is reachable: ```bash nc -zv <web-instance-public-ip> 22 ## Expected: Connection to xx.xx.xx.xx 22 port [tcp/ssh] succeeded! ``` 2. SSH into the web instance and try to reach the db instance on port 5432: ```bash ssh -i cloud-lab-key.pem ubuntu@<web-public-ip> ## From inside the web instance: nc -zv 10.0.10.50 5432 ## If this hangs -> security group on db instance is blocking ## If "Connection refused" -> port 5432 not listening on db instance ``` 3. Check the db instance's security group via AWS CLI: ```bash aws ec2 describe-security-groups \ --filters "Name=tag:Name,Values=db-security-group" \ --region ap-south-1 \ --query 'SecurityGroups[0].{ID:GroupId,Rules:IpPermissions}' ``` 4. From the web instance, run a DNS lookup to validate internal DNS works: ```bash ## Resolve the private DNS name of the db instance dig ip-10-0-10-50.ap-south-1.compute.internal ## Should return 10.0.10.50 ## Confirm the VPC DNS resolver is at VPC CIDR + 2 cat /etc/resolv.conf ## nameserver 10.0.0.2 ``` 5. Test HTTP connectivity and inspect headers: ```bash ## Test your ALB endpoint curl -v https://your-alb-dns.ap-south-1.elb.amazonaws.com/health ## Look for these in the response: ## < HTTP/1.1 200 OK ## < X-Amzn-Trace-Id: Root=1-... ``` **Expected result:** You can reach the web instance on port 22, the web instance can reach the db instance on port 5432 (once security groups are correct), and DNS resolves internal hostnames correctly. ---
You are designing a new VPC for Flipkart's product search service. Someone asks: "Should we use 10.0.0.0/16 or 10.0.0.0/...
Your application calls api.payments.razorpay.com. Somewhere between that function call and a TCP connection to a server,...
Swiggy's order service sends a request to the payment service. That request travels through TCP. When it fails - timeout...
Every API call your application makes uses HTTP. Understanding what happens at the HTTP layer - headers, status codes, m...
Security groups are stateful virtual firewalls that control traffic to and from AWS resources. Every EC2 instance, RDS d...
Work through these steps to practice networking debugging. You need two EC2 instances in the same VPC - a "web" instance...
Command Purpose dig @8.8.8.8 domain.com Query Google's DNS for a record dig +trace domain.com Trace full DNS resolution ...
Aligns directly with DevOps, Site Reliability (SRE), and Platform Engineering job descriptions.