Most backend engineers can describe a three-way handshake and would struggle to say what their service's connection ceiling is, why a retry made an incident worse, which of six filtering layers dropped a packet, or what a capture of a slow request would show. Those gaps are not academic. They are the reason a timeout is set below the retransmission timer's floor, the reason a pool holds connections a load balancer discarded an hour ago, the reason a service reaches its ephemeral port limit at a tenth of the traffic it was sized for, and the reason an incident spends a week on speculation that a capture would have settled in ten minutes.

This course works through the network from the bottom. It starts with what a frame and a packet actually contain, how addressing and subnetting decide where a packet goes, and what a switch and an address resolution cache do on the local segment. It then takes the transport layer apart: the connection lifecycle and every state a socket passes through, flow control and the congestion window, when a connectionless transport is the right choice, and what QUIC changed by moving the transport into user space. Names and trust follow, with resolution traced end to end through every cache, the certificate handshake byte by byte, and mutual authentication with the rotation problem that makes it operationally hard.

The middle of the course is the layer most services live at. HTTP/1 and HTTP/2 with the head-of-line blocking each has, streaming to a browser over three different mechanisms, gRPC and its encoding on the wire, and keepalive, pooling and the timeout hierarchy that has to be reconciled from the client to the database. Then how traffic reaches a server at all: the difference between balancing at the transport and the application layer, address translation and what it does to source addresses and logs, anycast and global routing, and what a content network terminates at its edge.

The last third is performance and failure. Latency, bandwidth and the delay product with the arithmetic done in real numbers. Loss, retransmission and the way a small loss rate becomes a visible tail. The connection ceiling, the four-tuple and port exhaustion. Then the three skills an incident needs: reading a packet capture, diagnosing a connection failure by ordered elimination, and knowing which attacks the application can defend against and which require capacity upstream of your link.

Every lesson names the settings it discusses together with their defaults, works the arithmetic with real numbers, and prefers the failure case to the happy path. The test applied throughout is whether a section could have been written without reading the RFC or the kernel source. If it could, it is not deep enough.

By the end you will be able to state your service's connection ceiling and which layer sets it, choose a timeout from a measured distribution rather than a round number, read a capture well enough to name a problem or clear the network of blame, work through a connection failure in minutes instead of days, and say which of your defences would do nothing at all against a saturated link.