The Runtime Theory
NetworkingIn production

Sockets and the Network Stack

Recording in progress
#sockets#kernels#networking

Between the application's write and the wire sit kernel queues and protocol processing. We follow a send: the syscall copies bytes into the socket's send buffer, TCP segments them, the device driver queues them, and the NIC transmits — then trace the receive path in reverse, through the receive queue to recvfrom.

Topics covered:

  • The socket: the file descriptor and its send and receive buffers
  • Syscall boundaries: where the application copy ends and the kernel begins
  • Segmentation and checksum offload to the NIC
  • The receive path: interrupt, softirq, and the socket's receive queue
  • Blocking vs. non-blocking: what EAGAIN and poll and epoll observe
  • Why loopback traffic never touches a NIC at all

Related articles

More in Networking

08:56
networking

HTTP/3 and QUIC Explained

The transport protocol that replaces TCP — multiplexing without head-of-line blocking, connection migration, and 0-RTT.

Watch
05:20
networking

The Full Lifecycle of an HTTP Request

Watch a single request travel from a browser through DNS, TCP, TLS, HTTP, a load balancer, a server, and a database — with live packet-level tracing.

Watch
In production
networking

IP Routing Explained

How a packet travels from host to host — longest-prefix matching in forwarding tables, next-hop resolution, and what actually changes at every router along the way.

Details
In production
networking

Load Balancing Protocols

Layer 4 vs. layer 7 balancing, NAT rewrites, and health checks — the actual packet and request flows that distribute traffic across a backend pool.

Details
In production
networking

Congestion Control Visualized

How TCP probes for available bandwidth — slow start, congestion avoidance, and packet loss as the signal that tells senders when to back off.

Details
In production
networking

HTTP/2 and HTTP/3

Streams, frames, and the transports underneath — what HTTP/2 multiplexing changes at the application layer and what moving to QUIC changes at the transport layer.

Details
In production
networking

TLS Handshake Explained

The cryptographic negotiation inside TLS 1.3 — key exchange, certificate validation, and the single round trip that encrypts everything after it.

Details
In production
networking

DNS Resolution Visualized

Follow a query from stub resolver to authoritative server — cache hits, recursive walking, TTL expiry, and the exact packet flow that turns a hostname into an IP.

Details
In production
networking

TCP Three-Way Handshake Explained

SYN, SYN-ACK, ACK — the exact packets that open a TCP connection, the sequence numbers that synchronize both directions, and what each side actually stores.

Details

Depth, delivered weekly

One technical dispatch a week — articles and episode notes before they go public.

One technical dispatch per week. No noise.