Networking glossary
Plain-English definitions for the terms used throughout the task comparisons. Jump in from here, or click a term link inside any task.
VLAN
A virtual LAN — one physical network split into several logically separate ones.
A VLAN lets a single switch or port carry traffic for multiple isolated subnets by tagging each Ethernet frame with a VLAN ID (802.1Q). Devices on different VLANs can't talk to each other unless something routes between them — that's the whole point. Confusion usually starts at the boundary: whether a port expects tagged or untagged frames for a given VLAN, which is exactly what access vs. trunk mode controls.
Trunk vs. Access Port
Access ports carry one untagged VLAN; trunk ports carry several, tagged.
An access port is what a normal client device plugs into — it belongs to exactly one VLAN and the switch strips the tag before the frame leaves. A trunk port carries multiple VLANs at once, each frame tagged with its VLAN ID, and connects switches, routers, or hypervisors to each other. Getting this wrong in either direction is a classic outage: an access port fed tagged frames just drops them, and a trunk missing a VLAN from its allowed list silently blackholes that VLAN's traffic.
See also VLAN
DHCP
The protocol that automatically hands a device an IP address, gateway, and DNS servers.
A DHCP server owns a pool of addresses for a subnet and leases one to each client that asks, along with options like the default gateway and DNS servers. Without it, every device needs a manually typed IP — fine for a router, unworkable for a hundred laptops. A "DHCP reservation" (static lease) pins one specific MAC address to always get the same IP, giving you predictability without hand-configuring the client.
See also Default GatewayDNS
DNS
Translates names like example.com into the IP addresses computers actually use.
DNS is the phonebook of the internet — and of your own network, if you run internal DNS for local device names. There's a difference worth knowing: what a device itself uses to resolve names for its own operations (updates, licence checks, NTP lookups) is often configured separately from what it hands out to DHCP clients. Mixing those up is a common source of "the internet works but the box's own features are broken" tickets.
See also DHCP
NTP
Keeps a device's clock accurate by syncing it to a time server.
Network Time Protocol sounds boring until it breaks something: certificate validation, IPsec tunnel negotiation, and SAML logins all depend on the device's clock being roughly correct, and they fail with confusing, unrelated-looking errors when it isn't. Devices with no battery-backed clock lose the time entirely on power loss and need NTP working before anything time-sensitive will.
NAT (Source NAT)
Rewrites private IP addresses to a public one so internal devices can reach the internet.
Your laptop's 192.168.x.x address isn't routable on the public internet, so the router rewrites (translates) it to its own public WAN address as traffic leaves, and translates the reply back on the way in. This is source NAT / masquerade — the everyday kind that makes home and office internet access work at all. It's a different mechanism from destination NAT, which exposes an internal server to the outside world instead of hiding internal clients from it.
See also Port Forwarding (Destination NAT)Subnet / CIDR Notation
Port Forwarding (Destination NAT)
Exposes an internal server to the outside world by redirecting a public port to it.
Port forwarding — destination NAT — takes traffic arriving at the firewall's public IP on a given port and redirects it to a specific internal host and port, so something like a self-hosted web server or game server can be reached from outside. Every vendor splits this into two halves — the translation rule and a permit rule — and they disagree about whether that permit rule needs to match the address before or after translation, which is the single most common reason a port forward "looks right" and does nothing.
See also NAT (Source NAT)
Firewall Rule / Policy
A statement that permits or denies traffic matching specific criteria.
A firewall rule matches traffic by some combination of source, destination, port, and protocol, and either allows or drops it. The two big philosophical splits across vendors: whether there's an implicit deny at the end (nothing is allowed unless a rule says so) or an implicit allow (everything passes unless a rule blocks it), and whether rules are matched against interfaces, zones, or a flat ordered list. Assuming the wrong model is the single most common reason a "correct-looking" rule doesn't behave as expected.
See also Zone-Based Firewall
Zone-Based Firewall
Groups interfaces into named zones and writes policy between zones instead of individual ports.
Instead of writing a separate rule per interface or IP range, a zone-based model groups interfaces (LAN, WAN, DMZ, Guest, etc.) into zones and evaluates traffic by which zone it entered and which zone it's headed to. It scales better as a network grows, but it's a real mental-model shift for anyone used to a flat ordered rule list — the rule that matters is the zone pair, not the position in a list.
See also Firewall Rule / Policy
Static Route
A manually configured instruction: "to reach this network, send traffic to this next hop."
A static route is the simplest way to tell a router about a network it doesn't already know — you type the destination prefix and the next-hop gateway or interface, and it's used until you remove it or a dynamic protocol overrides it. It doesn't react to the network changing; if the next hop goes down, a plain static route usually stays installed and pointing at a dead path unless you've added gateway health-checking.
Default Gateway
The device a host sends traffic to when it doesn't know a more specific route.
Every device on a subnet is configured (usually via DHCP) with a default gateway — typically the router — so that traffic bound for anywhere outside the local subnet has somewhere to go. It's really just a static route to "everywhere" (0.0.0.0/0): the catch-all a router walks through when nothing more specific matches in its own routing table.
See also Static Route
Administrative Distance
A per-source trust ranking routers use to pick between conflicting routes to the same destination.
If a router learns about the same destination network from two different sources — say, a manually typed static route and OSPF — administrative distance decides which one wins: lower numbers are more trusted. A connected interface beats a static route, which usually beats OSPF, which beats a route learned from a less-trusted protocol. The actual default numbers differ meaningfully between vendors, which matters if you're recreating a design that depends on specific values.
See also Static RouteOSPF
OSPF
A dynamic routing protocol that lets routers automatically discover and advertise networks to each other.
Open Shortest Path First is a link-state routing protocol: routers exchange information about directly connected networks and compute the best path to everything else themselves, so you don't have to hand-type a static route for every destination. It's overkill for a home network and standard for anything with more than a couple of routers, since it automatically reroutes around a failed link instead of leaving a dead static route in place.
See also Static RouteAdministrative Distance
IPsec
A standards-based protocol suite for encrypting and authenticating traffic between two networks or devices.
IPsec builds an encrypted tunnel by negotiating in two phases — Phase 1 sets up a secure channel between the two gateways, Phase 2 negotiates the actual traffic-encrypting session. It's genuinely interoperable between different vendors' equipment, which is why it's the default choice for site-to-site VPNs — but the model around it (route-based vs. policy-based) differs enough between platforms that mismatched assumptions are the most common reason a tunnel comes up but never passes traffic.
See also VPN
VPN
An encrypted tunnel that makes a remote network or device appear to be on the local network.
A Virtual Private Network extends a private network across the internet, encrypted, so traffic looks like it's traveling on a trusted local link even though it's crossing the public internet. The two common shapes are site-to-site (permanently connects two networks, e.g. an office and a data center) and remote-access (lets an individual user's laptop or phone join the network from anywhere) — they solve different problems and usually use different configuration entirely, even on the same box.
See also IPsec
ARP
The protocol that maps an IP address to the physical MAC address of the device that owns it.
Address Resolution Protocol answers a very local question: "who has this IP address, and what's their hardware address?" — necessary because Ethernet delivers frames by MAC address, not IP. A device's ARP table is a live cache of recently-resolved IP-to-MAC mappings; an incomplete or stale entry is a classic first symptom of a device that's unreachable, on the wrong VLAN, or has a duplicate IP.
See also MAC Address
MAC Address
The unique hardware address burned into (or assigned to) a network interface.
A Media Access Control address is a 48-bit identifier, usually written as six hex pairs, that uniquely identifies a network interface at Layer 2. Switches build a MAC address table mapping which MAC is seen on which port, which is how they know where to send a frame without flooding it everywhere — and it's the standard way to physically locate a device: get its MAC from ARP or DHCP, then look up which switch port that MAC is on.
See also ARP
Subnet / CIDR Notation
A range of IP addresses grouped together, written as an address plus a prefix length like /24.
A subnet is a contiguous block of IP addresses that share the same network portion, treated as one broadcast domain. CIDR notation (e.g. 192.168.1.0/24) expresses the size of that block as a prefix length — the number of bits that are fixed for the network — instead of a separate subnet mask; /24 is 256 addresses (255.255.255.0), /16 is 65,536, and so on. Getting the prefix wrong is one of the most common configuration mistakes on this entire site: a route, DHCP pool, or firewall rule scoped to the wrong-sized subnet either misses hosts it should cover or includes ones it shouldn't.
See also Default GatewayVLAN
SSID
The network name broadcast by a wireless access point — what shows up in a Wi-Fi picker.
A Service Set Identifier is just the human-readable name of a wireless network. One physical access point radio can broadcast several SSIDs at once, each mapped to its own VLAN and security settings — a common design puts a trusted SSID on the main LAN and a guest SSID on an isolated VLAN with no access to internal devices.
See also WPA2 / WPA3
WPA2 / WPA3
The security/encryption standards that protect a Wi-Fi network from eavesdropping and unauthorized access.
WPA2 and WPA3 are the current generations of Wi-Fi security, replacing the long-broken WEP. WPA3 is meaningfully stronger and resistant to offline password-guessing attacks that work against WPA2, but plenty of older IoT devices, printers, and budget hardware only support WPA2 — which is why mixed WPA2/WPA3 modes exist, and why a device suddenly failing to join a newly "upgraded" SSID is a very common support call.
See also SSID
Access Point (AP)
The hardware radio that actually broadcasts Wi-Fi and connects wireless clients to the wired network.
An access point bridges wireless clients onto the wired LAN. It can be a dedicated device (common on controller-managed platforms) or built into a router/firewall as a single radio. Where client traffic actually goes after it hits the AP — straight onto the local VLAN, or backhauled through a central controller/firewall for inspection — is a real design decision with real performance and visibility trade-offs, not just a checkbox.
See also SSID
VRF
A way to run multiple completely separate routing tables on one device at the same time.
Virtual Routing and Forwarding lets a single router maintain several independent routing tables, so two networks with even overlapping IP ranges can coexist on the same box without ever being able to route to each other unless explicitly connected. It's common for keeping a management network genuinely isolated from the network it manages, or for multi-tenant designs where customer networks must never leak into one another.
See also Static Route