LAYER 7: APPLICATION
  Protocols: HTTP/S, FTP, SMTP, DNS, SSH, DHCP
  What it does: User-facing services and application data
  Example: Your browser requesting a webpage

LAYER 6: PRESENTATION
  Protocols: SSL/TLS, JPEG, MPEG, ASCII
  What it does: Encryption, compression, encoding

LAYER 5: SESSION
  Protocols: NetBIOS, RPC, PPTP
  What it does: Establishes, manages, terminates sessions

LAYER 4: TRANSPORT
  Protocols: TCP, UDP
  What it does: End-to-end delivery, error checking, ports
  TCP segment | UDP datagram

LAYER 3: NETWORK
  Protocols: IP, ICMP, OSPF, BGP
  What it does: Routing, logical addressing (IP)
  IP packet

LAYER 2: DATA LINK
  Protocols: Ethernet, Wi-Fi (802.11), PPP, ARP
  What it does: Node-to-node, MAC addresses, switches
  Frame

LAYER 1: PHYSICAL
  Standards: RJ45, fiber optic, coaxial, radio waves
  What it does: Bits on wire/air, voltage levels, timing
  Bits

TCP (Transmission Control Protocol):
  ✅ Reliable — guaranteed delivery
  ✅ Ordered — arrives in sequence
  ✅ Error checking — retransmits lost packets
  ❌ Slower — overhead of handshake + acknowledgments
  Used for: HTTP, HTTPS, SSH, FTP, email

TCP 3-Way Handshake:
  Client → SYN → Server
  Client ← SYN-ACK ← Server
  Client → ACK → Server
  (Connection established)

UDP (User Datagram Protocol):
  ✅ Fast — no handshake, no guarantees
  ✅ Low latency
  ❌ No guarantee of delivery or order
  Used for: DNS, VoIP, video streaming, online games

TCP Header fields:
  Source port | Dest port | Sequence # | Ack #
  Flags (SYN/ACK/FIN/RST) | Window size | Checksum

IPv4: 32-bit dotted decimal (x.x.x.x)  — ~4.3 billion addresses
IPv6: 128-bit hex (2001:db8::1)        — 340 undecillion addresses

Private IP ranges (RFC 1918 — not routed on internet):
  10.0.0.0    — 10.255.255.255      (/8  — Class A)
  172.16.0.0  — 172.31.255.255      (/12 — Class B)
  192.168.0.0 — 192.168.255.255     (/16 — Class C)

Subnet Mask:
  192.168.1.100 / 24   → subnet: 192.168.1.0, hosts: 192.168.1.1-254
  /24 = 256 addresses (254 usable)
  /16 = 65,536 addresses
  /8  = 16,777,216 addresses

CIDR Notation:
  192.168.1.0/24 = 192.168.1.0 to 192.168.1.255

Special addresses:
  127.0.0.1       = localhost (loopback)
  0.0.0.0         = all interfaces
  255.255.255.255 = broadcast
  169.254.x.x     = link-local (APIPA — when DHCP fails)

1. User types: www.bitwithbite.com
2. Browser checks local DNS cache
3. OS checks /etc/hosts file
4. Query sent to Recursive Resolver (ISP or 8.8.8.8)
5. Resolver checks its cache
6. Resolver queries Root DNS server (13 root server clusters)
7. Root says: .com nameserver is at x.x.x.x
8. Resolver queries .com TLD nameserver
9. TLD says: bitwithbite.com is at y.y.y.y (authoritative)
10. Resolver queries authoritative nameserver
11. Returns A record: 123.456.789.0
12. Browser connects to that IP

Common DNS Record Types:
  A      → domain to IPv4        bitwithbite.com → 1.2.3.4
  AAAA   → domain to IPv6        bitwithbite.com → 2001::1
  CNAME  → alias to another name www → bitwithbite.com
  MX     → mail server           → mail.bitwithbite.com
  TXT    → text records           SPF, DKIM, domain verification
  NS     → name servers           who answers for this domain
  SOA    → start of authority
  PTR    → reverse lookup (IP → domain)

HTTP Methods:
  GET     → Read (safe, idempotent)
  POST    → Create (not idempotent)
  PUT     → Replace (idempotent)
  PATCH   → Partial update
  DELETE  → Delete (idempotent)
  HEAD    → GET without body (check headers)
  OPTIONS → Allowed methods (CORS preflight)

HTTP Status Codes:
  1xx Informational: 100 Continue, 101 Switching Protocols
  2xx Success:       200 OK, 201 Created, 204 No Content
  3xx Redirect:      301 Moved Permanently, 302 Found, 304 Not Modified
  4xx Client Error:  400 Bad Request, 401 Unauth, 403 Forbidden, 404 Not Found
  5xx Server Error:  500 Internal Error, 502 Bad Gateway, 503 Unavailable

HTTP/1.1 vs HTTP/2 vs HTTP/3:
  HTTP/1.1: 1 request per TCP connection (head-of-line blocking)
  HTTP/2:   Multiplexing — multiple requests on 1 connection
  HTTP/3:   Uses QUIC (UDP-based) — faster, better mobile

HTTPS = HTTP + TLS encryption
  TLS handshake → certificate validation → session key → encrypted

# View rules
iptables -L -n -v

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Block everything else
iptables -A INPUT -j DROP

# Rate limit (DDoS protection)
iptables -A INPUT -p tcp --dport 80 -m limit --limit 100/min -j ACCEPT

Internet
    ↓
Internet Gateway
    ↓
VPC (10.0.0.0/16)
  ├── Public Subnet (10.0.1.0/24)
  │     └── Load Balancer / NAT Gateway
  ├── Private Subnet (10.0.2.0/24)
  │     └── App Servers (EC2)
  └── Private Subnet (10.0.3.0/24)
        └── Database (RDS)