Cloudflare has 300+ Points of Presence (PoPs) globally. When you make a request to a Cloudflare-protected site, you don’t connect to a server in a specific city — you connect to the nearest Cloudflare PoP, wherever that is. This works via anycast: multiple servers worldwide share the same IP address, and BGP routing delivers your packets to the geographically closest one. PoP placement and anycast are the foundation of how CDNs achieve global low latency.
DNS was designed in 1983 with no authentication. A recursive resolver has no way to verify that the answer it receives actually came from the authoritative nameserver. This creates attack surface: an attacker who can inject a forged DNS response can redirect traffic for any domain to any IP. DNSSEC adds cryptographic signatures to DNS responses. Understanding the attacks first explains why DNSSEC exists.
DNS Cache Poisoning The Kaminsky attack (2008): DNS queries use UDP, which is connectionless.
DNS returns an IP address. It doesn’t have to return the same IP address every time. The authoritative nameserver can return different IPs based on where the query originated, which backend is healthy, or how much traffic each backend should receive. DNS-based traffic routing uses this flexibility to implement geographic routing, load balancing, and failover without changing a line of application code.
GeoDNS The recursive resolver’s IP address reveals the approximate location of the client (or at least the ISP).
Every system design interview starts with a client making a request. Before that request reaches your load balancer, DNS has already run. DNS translates api.example.com into an IP address. It’s a globally distributed read-heavy system that handles 3.5 trillion queries per day. Understanding how resolution works explains why DNS changes take time to propagate and how DNS-based traffic routing is possible.
The Resolution Chain A DNS query for api.example.com follows a chain of four server types:
A temperature sensor in a factory sends a reading every 30 seconds. It runs on a microcontroller with 256KB of RAM and a 2G cellular connection. It can’t maintain a persistent HTTP connection. It can’t handle TLS handshakes with 10KB certificates. IoT devices require a protocol built for constrained environments. MQTT is that protocol, and device registration is the first problem you solve before any data flows.
MQTT Basics MQTT is a publish/subscribe protocol over TCP, designed for low-bandwidth, high-latency, unreliable networks.
Video conferencing runs over UDP, not TCP. TCP retransmits lost packets, which adds latency: waiting for a retransmit before playing the next frame makes real-time audio and video stutter. UDP drops lost packets. The application must handle loss itself — and must do so in under 20ms to stay imperceptible. Packet loss concealment is the set of techniques for making packet loss invisible or inaudible to users.
Why UDP TCP’s retransmission is fine for file transfer: it doesn’t matter if a packet arrives 200ms late as long as it arrives.
A two-person WebRTC call is peer-to-peer: Alice sends video directly to Bob and vice versa. A ten-person call can’t work the same way: each participant would need to send 9 video streams and receive 9 streams, consuming 9x the upload bandwidth of a one-to-one call. Group video calls require a media server. There are two architectures: SFU (Selective Forwarding Unit) and MCU (Multipoint Control Unit). The choice determines server cost, client CPU usage, and call quality.
Two browsers want to send video directly to each other. They can’t just open a TCP connection: they’re behind NAT, firewalls, and don’t know each other’s public IP addresses. WebRTC solves peer-to-peer media transport. But before peers can connect, they need a signaling server to exchange connection metadata. WebRTC handles the media; signaling handles the handshake.
The Signaling Problem WebRTC is transport-agnostic about signaling: it doesn’t specify how peers find each other or exchange connection parameters.
Get started with YANC (Yet Another Network Controller) on Linux. Step-by-step setup guide for yanc filesystem and yanc-of-adapter with OpenFlow switches.
Turn your PC into a web server using WampServer. Complete tutorial for setting up Apache with or without a router, including port forwarding and configuration.