A series in 12 parts
There is a half of networking that no one teaches application developers: the half that happens on one machine. Not routing, not DNS, not what happens to a packet in flight — what happens in the few microseconds between a signal arriving at a network card and a function running in your server.
This series builds that picture from the bottom up, one layer at a time, and never asks you to take a layer on faith. The goal is not completeness. The goal is a model good enough to reason with — to look at a latency spike, a dropped connection, or a strange read() and know where on the path to look.
The argument
Everything in the series hangs off these. Hold them, and most of the specifics can be re-derived rather than memorised — which is the difference between knowing the stack and being able to think with it.
01
Every boundary between two things is a queue, and every queue is finite. Most questions reduce to which one filled up.
02
Work happens in execution contexts you do not control, asynchronously with your code. Always ask who is running right now.
03
Buffers have owners. A handoff is a transfer of ownership; a copy is what happens at a trust boundary.
04
Read a header, decide who gets this, strip it, pass it up. The NIC and your router table are doing the same move.
05
Every stage can say slow down, and each layer says it differently. Confusing behaviour is usually two of them interacting.
06
Packets are destroyed on the way up. The stream is an illusion, and re-finding the message boundaries is your job.
The series · 12 of 12 published
Post one tells the whole journey badly. Everything after it goes back and fixes one thing that post one got wrong.
The whole journey once, simplified to the point of being slightly false — and a list of the lies it tells.
Every stage from the wire to your route handler, simplified to the point of being false — and a list of the falsehoods.
“What actually happens between the request leaving the network and my function running?”
Two ideas application developers have never needed: who is running this code, and who owns this memory.
Hardware interrupt, softirq, kernel thread, your process — and what "the kernel handles it for you" actually means.
“If my code is not running, who is doing the work?”
DMA, ring buffers, descriptors, and the rule that explains every copy in the stack: buffers have owners.
“Who owns this buffer right now, and what does handing it over cost?”
From a voltage on a pair of wires to bytes sitting in a queue with your socket’s name on them.
From a voltage on a pair of copper wires to a frame in RAM, and everything the card decides without asking the CPU.
“How does a signal become bytes, and how much of that is the CPU's problem?”
Hard IRQ, softirq, NAPI polling, and coalescing — the design that makes ten gigabits per second survivable.
“Why does my server spend so much time in system CPU, and why is it not one interrupt per packet?”
Demultiplexing as the same move repeated: read a header, decide who gets this, strip it, pass it up.
“Ten thousand connections arrive on port 443 — how does each one reach the right place?”
Where packets stop existing, why framing becomes your problem, and how your process gets woken up.
Where packets stop existing, why a read can return one and a half requests, and how the receive window pushes back.
“Why is framing my problem if TCP already guarantees ordering?”
How your process gets woken: blocking reads, readiness with epoll, completion with io_uring, and the last link from the NIC to your event loop.
“What is my event loop actually doing while it waits?”
Bytes in a buffer become a parsed request and a function call — and the anticlimax is the point.
“How much of "handling a request" is actually my framework doing something?”
Sending is not receiving in reverse — and every failure you have ever seen, explained by one picture.
Your write returns before anything leaves the machine. What happens after it returns is where the latency lives.
“My write returned instantly — so why did the client wait forty milliseconds?”
One diagram of the queue ladder, and every failure you have ever seen located on it.
“Where on this path is my problem, and which counter proves it?”
Containers, TLS, QUIC, and kernel bypass — four places the picture changes, and how to re-derive it each time.
“Does any of this still hold inside a container, or over QUIC?”