09 · Networks

This chapter is the floor that dissolves the boundary of the single machine — everything above it can address something that is not itself.

How do machines that share nothing agree to talk?

In October 1986, two sites four hundred yards apart stopped being able to talk to each other. Van Jacobson recorded the numbers: between Lawrence Berkeley Laboratory and the University of California at Berkeley — "separated by 400 yards and two IMP hops" — throughput fell from 32 Kbps to 40 bps (Jacobson & Karels, SIGCOMM '88). A factor of a thousand, across a distance a person could walk in four minutes. Nothing had broken. No cable was cut, no machine had failed, no attacker was present. The network had simply become so busy retransmitting the packets it was already failing to deliver that it left no room to deliver anything. It had eaten itself, and it would do so repeatedly for the next two years.

That episode is the best introduction to this floor, because it shows what kind of thing a network is. Not a wire. An agreement — with no authority to enforce it.

The agreement starts with a decision made twice, independently, in the early 1960s. The telephone system worked by circuit switching: reserve a path end to end, hold it for the duration, and the conversation gets a private wire. Paul Baran at RAND, designing a communications system that could survive the loss of much of itself, proposed instead that messages be chopped into standard blocks that each find their own way and be reassembled at the far end (On Distributed Communications, RM-3420-PR, 1964). Donald Davies, at Britain's National Physical Laboratory, arrived at the same design for a different reason — computer traffic is bursty, and a reserved circuit sits idle most of the time — and gave the blocks the name that stuck: packets. Packet switching trades a guarantee for a statistic: no conversation is promised a path, all conversations share all paths, and they share well precisely because none talks continuously. The first message on the resulting ARPANET went from UCLA toward Stanford Research Institute on 29 October 1969; the operator typed the first two letters of "LOGIN" and the far end crashed (Kleinrock's account).

The second structural decision is layering — the tower recapitulated inside one chapter. Each layer takes a job from above, does one part of it, and hands the rest down, knowing nothing of the implementation beneath. The formal version is the seven-layer OSI Basic Reference Model, standardized in 1984 (ISO/IEC 7498-1); the version the world runs is smaller and messier, four layers written down after the fact in RFC 1122 (1989). Keep that embarrassment in mind: the model designed by committee is the one taught in courses, and the model grown by implementers is the one carrying this sentence to you.

What makes the grown one work is the shape of its middle. The Internet Protocol offers almost nothing: it will attempt to deliver a packet toward an address, and it may drop it, duplicate it, delay it, or deliver it out of order without apology. Every network technology beneath can be different — fiber, radio, satellite, copper — and every application above can be different, and they meet at one deliberately impoverished layer. The principle behind that poverty was named by Jerome Saltzer, David Reed and David Clark: a function "can completely and correctly be implemented only with the knowledge and help of the application standing at the end points … providing that questioned function as a feature of the communication system itself is not possible" (end-to-end arguments, 1981/1984). Put the intelligence at the edges. A network that tried to guarantee delivery would still not spare an application from checking, and would tax every application that did not care.

So reliability is built on top of unreliability, by the endpoints, and that is TCP. Vint Cerf and Robert Kahn's 1974 design (IEEE Trans. Comm. COM-22(5): 637–648) numbers every byte, acknowledges what arrives, and retransmits what does not, manufacturing an ordered, gap-free stream out of a medium that promises none of those things. The ARPANET switched over to it wholesale on 1 January 1983, a date fixed two years in advance in RFC 801 — the last time the network was small enough to be changed on a single day.

Which returns us to 1986, because retransmission is exactly the behavior that ate the network. A sender that responds to congestion by trying harder makes congestion worse; ten thousand senders doing so collapse the commons. There is no central regulator to prevent it — no one owns the internet, and no one can be told to slow down. Jacobson's fix, which is still in the bones of every connection you make, was to have each sender infer the state of the whole from what it can see locally: treat a lost packet as evidence of congestion, cut your sending rate sharply, then probe upward again gently. Congestion control is voluntary restraint by parties who cannot see each other, and it holds because the alternative is that nobody gets anything. It is the most consequential piece of distributed politeness ever deployed.

The same structure — no authority, only agreement — governs how things are found. The Domain Name System, specified by Paul Mockapetris in 1983 and refined in RFCs 1034 and 1035 (1987), turns names into addresses by delegation: each zone is trusted to answer for the names beneath it. Routing between networks runs on BGP (RFC 4271), in which each network announces which addresses it can reach and its neighbors believe it. On 24 February 2008, Pakistan Telecom, complying with an order to block YouTube domestically, announced a route to a slice of YouTube's addresses more specific than YouTube's own — and because more specific wins, and because its upstream provider passed the claim on, the world's traffic to YouTube went to Pakistan for roughly two hours (RIPE NCC). Nothing was hacked. The system worked as designed, and the design assumes honesty.

On top of all this sits one application among many, proposed at CERN in March 1989 as a way to keep track of documents (Berners-Lee) and released to the public domain on 30 April 1993. For most people the Web is the network — which is what a well-built floor looks like from above.

Connections

Below: chapter 03 sets the physical ceiling on any channel and supplies the error-detecting codes every layer uses; chapters 04 and 05 provide the machine and the operating system that actually move the bytes. Above: chapter 10 takes the machines connected here and asks what it means for them to agree on anything, a far harder question than making them talk; chapter 08 is often on the far side of one of these connections; chapter 11 is the one this floor keeps needing, since DNS and BGP were built for a network of colleagues.

Open questions

The end-to-end argument is under steady pressure: firewalls, address translators and content delivery networks all put intelligence back in the middle, and QUIC moved transport out of the kernel to escape the middle's grip. Is the narrow waist still the architecture, or a memory of one? Second: BGP's trust problem has had a technical answer for years — cryptographic validation of route origins — and deployment remains partial, which makes it less a research question than a study in why coordination fails when no one can be compelled. Third: congestion control now runs many algorithms at once, some far more aggressive than others, on a commons that assumed roughly equal restraint. What holds an agreement together when the parties no longer agree?

Go deeper

• J. H. Saltzer, D. P. Reed & D. D. Clark, "End-to-End Arguments in System Design," ACM TOCS 2, no. 4 (1984): 277–288 — the shortest route to understanding why the Internet is shaped as it is; MIT PDF.
• Van Jacobson & Michael J. Karels, "Congestion Avoidance and Control," SIGCOMM '88 — PDF.
• Larry Peterson & Bruce Davie, Computer Networks: A Systems Approach — the systems-first textbook, kept current and free at systemsapproach.org. For the classic course treatment, Kurose & Ross, Computer Networking: A Top-Down Approach, 9th ed., 2025.