The TC flag marks an incomplete answer; the corresponding TCP exchange retrieves the complete records.

DNS needs a working TCP path when a UDP answer is truncated

DNS supports both UDP and TCP. A server sets the TC flag when a response is truncated for the available message space. A client receiving that flag must handle the incomplete result, commonly by retrying over TCP. This is about the DNS response limit in use, not proof that the physical network cannot carry any larger UDP datagram. ...

November 19, 2026 · 6 min · XB Field Notes
Title card with three panels labeled Observe, Decide, and Act.

NAT shares an address by keeping distinct connection mappings

Network Address Translation changes addressing information as packets cross a boundary. The familiar many-clients-to-one-address arrangement uses network address and port translation: the router keeps mappings that distinguish simultaneous flows. A remote TCP server may see one source IP while seeing different source ports. That shared address identifies a translation boundary, not necessarily one computer, account, or person. ...

November 18, 2026 · 6 min · XB Field Notes
Generic title card with connected boxes labeled OBSERVE, DECIDE, and ACT beside the message: Loopback stays in its namespace.

Loopback returns to the caller’s network namespace

Loopback addresses let a process communicate through its local IP stack without sending the exchange over a physical network link. IPv4 reserves 127.0.0.0/8 for loopback; 127.0.0.1 is the familiar member. IPv6 uses ::1. On Linux, the relevant local networking context is a network namespace. Two processes on the same physical machine can therefore have different answers to what counts as their own loopback service. ...

November 17, 2026 · 5 min · XB Field Notes
Title card about IPv6 neighbor discovery, with generic Observe, Decide, and Act panels linked by arrows.

IPv6 resolves neighbors with ICMPv6 before the TCP connection can work

An IPv6 host on an Ethernet link needs a link-layer destination before it can send a frame to a neighbor. Neighbor Discovery performs that address-resolution work using ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages. It also covers functions beyond IPv4 ARP, including router discovery and neighbor reachability detection. Calling it merely “ARP with longer addresses” hides dependencies that matter when configuring an IPv6 network. ...

November 16, 2026 · 6 min · XB Field Notes
Observe, decide, and act panels beside the headline: ARP resolves the IPv4 next hop.

ARP maps an IPv4 next hop to a link-layer address

IPv4 forwarding chooses a next hop, but Ethernet still needs a destination MAC address. Address Resolution Protocol (ARP) asks the local link which interface owns an IPv4 address, then caches the answer as a neighbor entry. The mapping is learned rather than permanent, so it can age out, be refreshed after a move, or be forged by another host on the same broadcast domain. ...

November 15, 2026 · 5 min · XB Field Notes
Title card with connected panels labeled OBSERVE, DECIDE, and ACT.

Path MTU discovery can fail while handshakes and small requests still work

The path MTU is the smallest link MTU along a particular route. A sender cannot determine it solely from its own interface’s MTU because an intermediate link may carry smaller packets. Classic IPv4 Path MTU Discovery sends packets with Don’t Fragment set and uses ICMP fragmentation-needed feedback to reduce the estimated packet size. A working route and a working size estimate are separate requirements. ...

November 14, 2026 · 6 min · XB Field Notes
Observe, decide and act boxes beside the message: TIME-WAIT tracks connection tuples.

TIME-WAIT protects a connection incarnation, not exclusive ownership of a port

TIME-WAIT is a TCP state retained after certain orderly connection closures. It gives the closing exchange time to complete if the final acknowledgment must be repeated and helps prevent delayed segments from an earlier connection incarnation being confused with a later one. The relevant identity includes both endpoint addresses and ports. A TIME-WAIT entry is not simply a universal lock on one local port number. ...

November 13, 2026 · 5 min · XB Field Notes
Observe, decide and act boxes beside the message: Each TCP sender chooses its policy.

TCP congestion control belongs to each sender, and peers can use different algorithms

TCP congestion control limits how a sender injects data into a network that has finite shared capacity. Its congestion window constrains outstanding data, while pacing, when used, controls how transmissions are distributed over time. The receiver’s advertised window imposes a separate flow-control limit. These mechanisms interact, but they describe different constraints and should not be collapsed into one ambiguous sending-speed setting. ...

November 12, 2026 · 6 min · XB Field Notes