How Machines Talk

01IPv4 RFC 791Private ranges RFC 1918

Addresses and ports

An IP address finds a machine. A port finds one program on that machine. So 198.51.100.7:443 means “the program on port 443 of machine 198.51.100.7”.

Your side of a connection gets a port too. The operating system picks a free one at random. This is an ephemeral port. One connection is four numbers: your IP, your port, their IP, their port. A program holds its end of a connection as a socket.

Three kinds of address to know

• 127.0.0.1, also called localhost or loopback, is the machine itself. Traffic to it never leaves the machine. A program that listens on it can only be reached from the same machine.
• 0.0.0.0 means “every network this machine is on”. A program that listens on it accepts connections from anywhere that can reach the machine.
• 10.x.x.x, 172.16.x.x to 172.31.x.x, and 192.168.x.x are private. They work inside a home or cloud network, never on the public internet. Your router uses NAT (network address translation) to swap your private address for its one public address on the way out. NAT is also why nobody on the internet can start a connection to your laptop.

Try it: lsof -iTCP -sTCP:LISTEN -n -P lists every program that listens on your Mac, with its address and port.

02TCP RFC 9293UDP RFC 768

TCP and UDP

IP alone moves single packets with no promises. A packet can arrive late, out of order, twice, or not at all. TCP and UDP sit on top of IP and make different trade-offs.

03RFC 1034 and 1035Port 53

DNS

People use names. Packets need IP addresses. DNS (the Domain Name System) turns one into the other. It is a tree of servers, and each server only knows the next step down.

Try it: dig +trace api.example.com prints every hop. dig +short api.example.com prints only the answer.

04HTTP semantics RFC 9110Ports 80 and 443

HTTP

HTTP is the language of requests and replies on the web. HTTP/1.1 is plain text, so you can read it line by line. HTTP/2 and HTTP/3 carry the same meaning in a binary form.

HTTP is stateless. The server forgets you after each reply. Cookies and tokens bring “who you are” back with every request.

Safe means the request changes nothing on the server. Idempotent means that if you send it twice, the effect is the same as if you sent it once. This matters a lot when a request times out and you want to retry. See section 11.

05TLS 1.3 RFC 8446Port 443

TLS and HTTPS

HTTPS is HTTP inside TLS. TLS gives three things. Privacy: nobody on the path can read the data. Integrity: nobody can change it without being caught. Identity: you are talking to the real api.example.com.

Encryption alone is not enough. If you encrypt to the wrong party, you hand your secrets to them. The certificate chain links the site's key to a root CA that ships with your operating system or browser. That is how the browser knows the key belongs to the name.

06RFC 4251 to 4254Port 22

SSH

SSH (Secure Shell) gives you an encrypted connection to a remote machine. You use it for a shell, to copy files (scp, rsync), for git push, and for tunnels. It makes two trust checks, one in each direction. Your laptop checks the server. Then the server checks you.

The two trust lists

A key pair is two linked keys. The private key makes signatures. The public key can check them, but it cannot make them. So you can give your public key to every server and keep the private key on your laptop.

ssh-keygen -t ed25519 -C "ada@laptop"   # make a key pair
ssh-copy-id ada@server.example.com       # add your public key to the server
ssh -v ada@server.example.com            # connect and print every step

~/.ssh/config saves typing. With this file, ssh db-box hops through the bastion by itself:

Host bastion
  HostName bastion.example.com
  User ada
  IdentityFile ~/.ssh/id_ed25519

Host db-box
  HostName 10.0.2.15        # private IP, only the bastion can reach it
  User ada
  ProxyJump bastion

A bastion (or jump host) is the one machine that accepts SSH from the internet. Everything else stays private behind it.

07Port forwarding RFC 4254 section 7SOCKS5 RFC 1928

SSH tunnels

One SSH connection can carry other connections inside it. This is a tunnel. Use it to reach a port that you cannot reach directly, such as a database inside a private network.

In all three modes, your laptop dials the SSH server. The modes differ only in which end listens and which end makes the last hop.

ssh -N -L 5433:db.internal:5432 ada@bastion.example.com
# then, in another terminal:
psql -h localhost -p 5433 -U app app

ssh -N -R 8080:localhost:3000 ada@bastion.example.com
# the bastion needs "GatewayPorts yes" in sshd_config,
# or it listens on its own 127.0.0.1 only

ssh -N -D 1080 ada@bastion.example.com
# then:
curl --socks5-hostname localhost:1080 http://grafana.internal:3000

How to read the spec

-L 5433:db.internal:5432 reads as: listen on 5433 here, then send to db.internal:5432 as the far end sees it. -R 8080:localhost:3000 is the mirror image: listen on 8080 there, send to localhost:3000 as your laptop sees it.

Build an -L command

ssh -N -L 5433:db.internal:5432 ada@bastion.example.com
# then point your app at localhost:5433

08Forward proxyReverse proxyVPN

Proxies and VPNs

A proxy is a middleman that makes connections for someone else. The important question is: for whom?

09Remote procedure callIdea first written down in RFC 707

RPC

RPC (remote procedure call) lets your code call a function that runs on another machine, as if it were a local function. A piece of code called a stub hides the network. A library gives you the stub, or a tool generates it.

The same call in code. You write two pieces, and the stubs do the rest:

-- in Postgres
create function add(a int, b int) returns int
language sql as $$ select a + b $$;

// in your app
const { data } = await supabase.rpc('add', { a: 2, b: 3 })   // data === 5

# on the wire
POST https://xyz.supabase.co/rest/v1/rpc/add
{"a":2,"b":3}

A gRPC service is defined in a .proto file. A tool generates the client and server stubs in each language from it:

service Calc {
  rpc Add (AddRequest) returns (AddReply);
}
message AddRequest { int32 a = 1; int32 b = 2; }
message AddReply   { int32 sum = 1; }

RPC or REST?

REST fits data that looks like records. RPC fits actions that do not map to one record. Many APIs mix both. Supabase does: tables are REST, functions are RPC.

10JSON RFC 8259Protocol Buffers

Serialization

Memory holds objects. Networks carry bytes. Serialization turns an object into bytes. Deserialization turns the bytes back into an object. Both ends must agree on the format. Here is the same user, { id: 42, name: "Ada" }, in two formats.

How to read the protobuf bytes, with the schema message User { int32 id = 1; string name = 2; }:

• 08 is field 1, type “number”. The byte is (field << 3) | type, so (1 << 3) | 0 = 8.
• 2A is the value 42.
• 12 is field 2, type “length then bytes”: (2 << 3) | 2 = 18, which is 12 in hex.
• 03 says 3 bytes follow. 41 64 61 is “Ada” in ASCII.

Traps that bite in practice

• Big integers. A JavaScript number is exact only up to 2⁵³ − 1 (9,007,199,254,740,991). A larger Postgres bigint loses digits in JSON.parse. Send big IDs as strings.
• Dates. JSON has no date type. Send ISO 8601 strings with a time zone, such as "2026-10-22T14:05:00Z".
• Missing fields. JSON.stringify drops fields that are undefined. So {a: undefined} becomes {}, which is not the same as {"a": null}.
• Schema changes. Protobuf survives new fields if you never reuse a field number. A JSON reader breaks if you rename a key that it expects.

11Idempotent methods RFC 9110 section 9.2.2

Retries and idempotency

A call times out. Did the server do the work? The client cannot know. Maybe the request was lost. Maybe the server did the work and the reply was lost. From the client's side, both look the same.

To make the receiver idempotent, the client makes one unique key per operation, and sends the same key on every retry. The server stores the key with the result. A unique constraint does the hard part:

insert into charges (idempotency_key, amount_cents)
values ('7f3a...', 2000)
on conflict (idempotency_key) do nothing
returning id;
-- no row back means: already done. Look up the saved result and return it.

Back off between retries. Wait longer after each failure (1 s, 2 s, 4 s) and add a random part, called jitter. Without jitter, every client that failed at the same moment retries at the same moment, and they all hit the server together again.

12WebSocket RFC 6455Server-sent events: HTML standard

Push and pull

HTTP is request, then reply. The server cannot speak first. When the server has news, there are four common ways to get it to the client. The dashed green lines show when new data appears on the server.

13Concurrency models

Processes, threads, async

A program that must do many jobs at once can split the work in three ways. First, two words. Concurrency means many jobs are in progress at the same time. Parallelism means many jobs run at the same instant, on different CPU cores. Async gives you concurrency on one core. Threads and processes can give you both.

14Event loops: HTML standard

The event loop

JavaScript runs your code on one thread. The event loop decides what runs next. It keeps two waiting lines. Microtasks are promise callbacks and the code after an await. Tasks are timers, network events and clicks. The rule: run one task to the end, then run every microtask, then take the next task.

What does this script print? Guess first, then step through it.

• Code after await runs later, as a microtask. Other code can run and change your data in between.
• A long synchronous loop blocks everything. No clicks, no timers and no network replies are handled until it ends. In a server, every user waits.

15PostgreSQL explicit lockingSELECT ... FOR UPDATE

Race conditions and locks

A race condition happens when the result depends on who goes first. The classic form is check, then act: read a value, decide, then write. Between the read and the write, someone else can change the value. Here, two workers sell the last ticket.

Queues: take a job without waiting

Workers that pull jobs from a table should not wait on each other. SKIP LOCKED makes each worker skip rows that another worker holds. Each worker gets a different job, and nobody waits.

select id from jobs
where status = 'queued'
order by created_at
limit 1
for update skip locked;

The same bug on one JavaScript thread

Async code has no threads to fight, but await opens a gap between check and act:

// Two callers can both pass the check before either one finishes.
if (!cache[id]) {
  cache[id] = await loadUser(id);
}

// Fix: store the promise at once, with no await between check and write.
cache[id] ??= loadUser(id);
return cache[id];

··Reference

Glossary

Backoff

Waiting longer after each failed retry, often with a random part (jitter).

Bandwidth

How many bytes per second a link can carry.

Bastion

Also called a jump host. The one machine that accepts SSH from the internet. You hop through it to reach private machines.

Certificate authority (CA)

A trusted party that signs certificates. Your operating system ships a list of root CAs.

Connection pool

A set of open database connections that many requests share.

Ephemeral port

The random port your side of a connection gets.

Fingerprint

A short hash of a public key, used to compare keys by eye.

Handshake

The first messages of a connection, where both sides agree on settings.

Idempotent

Doing it twice has the same effect as doing it once.

Latency

How long one message takes to arrive. Round-trip time (RTT) is there and back.

Lock

A marker that says “mine for now”. Others wait, or skip.

Loopback

127.0.0.1, the machine's address for itself.

Microtask

A callback that runs as soon as the current task ends, before the next task.

NAT

Network address translation. A router swaps private addresses for its one public address.

Port forwarding

Sending connections that arrive at one port on to another address. SSH tunnels are one kind.

Serialization

Turning an object in memory into bytes, and back.

Socket

A program's end of a connection: an address, a port and a protocol.

SOCKS

A simple proxy protocol. The app tells the proxy where to connect. ssh -D speaks it.

Stub

Code that makes a remote call look like a local one.

TTL

Time to live. How long a cached answer stays valid.

All IP addresses come from the ranges set aside for documentation (RFC 5737). Names, keys and fingerprints are examples.