Glossary

`proxy_read_timeout`: nginx's limit on the time between two reads from the backend, 60 s by default. In a WebSocket tunnel it closes a connection where the backend sends nothing for that long.; WebSockets through proxies
`tcp_retries2`: The Linux sysctl that decides when a connection with unacknowledged data gives up. The default is 15, which gives at least 924.6 seconds.; Lost packets and retransmission
`tcp_tw_reuse`: The sysctl that lets a new outgoing connection take over a 4-tuple still in TIME_WAIT. The default, 2, allows it only for loopback traffic.; Ports, sockets and TIME_WAIT
`TCP_USER_TIMEOUT`: A socket option, in milliseconds: the longest time sent data may stay unacknowledged before the kernel closes the connection with ETIMEDOUT.; Lost packets and retransmission
0-RTT: Data a client sends in its very first flight, before any answer from the server, using keys from an earlier connection to the same server. RFC 9000: "0-RTT provides no protection against replay attacks".; HTTP/3 and QUIC
4-tuple: Source IP, source port, destination IP, destination port. Each TCP connection on a host needs a 4-tuple no other connection uses.; Ports, sockets and TIME_WAIT
Active health check: A probe the balancer sends on its own schedule, with no user request involved: a TCP connect, or an HTTP request like HAProxy's option httpchk.; Health checks
ALPN: A TLS extension where the client lists the protocols it speaks and the server picks one. curl offers h2,http/1.1, and the server answers h2 to choose HTTP/2.; HTTP/2
ALPN: A TLS extension, RFC 7301, that picks the application protocol inside the handshake. curl offered h2,http/1.1 and the server picked h2.; One request end to end
Alt-Svc: A response header that advertises another way to reach the same origin. h3=":443" means HTTP/3 on UDP port 443, and ma gives the number of seconds the offer stays fresh.; HTTP/3 and QUIC
Announcement: A BGP UPDATE message that tells a peer it can reach a prefix through the sender, with an AS_PATH listing the ASes the route passed through.; BGP and anycast
Anycast: RFC 4786: "making a particular Service Address available in multiple, discrete, autonomous locations". Each router sends packets for that address to the site its BGP routes pick.; BGP and anycast
ARP: Address Resolution Protocol (RFC 826): a broadcast request "who has this IP" and a reply "this IP is at this MAC", 28 bytes each on Ethernet.; ARP and MAC addresses
Authoritative server: A server that holds a zone, such as ns0.wikimedia.org for wikipedia.org, and answers for it from its own data.; How a name is resolved
Autonomous system: A network with one routing policy and a number, the ASN. Facebook is AS32934 and Cloudflare is AS13335.; BGP and anycast
Base chain: An nftables chain attached to a hook with a type and a priority, such as type filter hook forward priority filter. Lower priority numbers run first at the same hook.; Packet filtering with iptables and nftables
Blocking pool: A pool that caps connections in use at its size. A request that finds no free connection waits instead of opening a new one: urllib3 with block=True, Go with MaxConnsPerHost.; Connection pools
Bridge: A virtual switch in the kernel, such as docker0. Devices attached to it with master exchange Ethernet frames as if they were plugged into one switch.; Network namespaces
Broadcast: A frame sent to ff:ff:ff:ff:ff:ff, which every host on the local network receives.; ARP and MAC addresses
Cache key: What a cache uses to find a stored response. RFC 9111 sets the minimum to the method and the URI. nginx's default is $scheme$proxy_host$request_uri.; HTTP caching
Cache key: The value the cache uses to find a stored response. By default Fastly and Varnish use the URL (path and query) plus the Host header.; CDNs
Capture filter: The expression after the options, in the pcap-filter(7) language, such as tcp and host 192.168.128.2. tcpdump dumps only the packets for which it is true.; Reading tcpdump
cf-cache-status: A Cloudflare response header. HIT means "The resource was found in Cloudflare's cache."; One request end to end
Chunked transfer coding: A body sent as chunks, each one prefixed with its size in hexadecimal and a CRLF. A chunk of size 0 marks the end. A server uses it when it does not know the length in advance.; HTTP/1.1 on the wire
Client-side discovery: The caller reads the list of instances from the registry and chooses which one to connect to.; Service discovery
ClientHello: The first TLS message, sent by the client in clear text. It lists the TLS versions, cipher suites and key exchange groups the client supports, plus extensions such as SNI and ALPN.; The TLS 1.3 handshake
ClusterIP: The virtual IP address Kubernetes gives a Service, such as 10.96.0.20. kube-proxy rules on each node capture traffic to this address and port and rewrite it to a Pod.; Kubernetes Services and kube-proxy
CNAME: A record that makes its owner name an alias of another name, the canonical name. A name with a CNAME may hold no other record, apart from DNSSEC records.; DNS records
Congestion window (cwnd): The sender's own limit on unacknowledged data, in segments on Linux. It starts at 10 (TCP_INIT_CWND) and changes with every ACK and every loss.; Flow and congestion control
Connect timeout: How long a client waits for the TCP handshake to finish. Go's DefaultTransport dials with Timeout: 30 * time.Second and gives the TLS handshake 10 more seconds.; Timeouts
Connection ID: A number in each QUIC packet header, chosen by the receiver of the packet. The receiver finds the connection by this ID, whatever IP address and port the packet came from.; HTTP/3 and QUIC
Connection pool: A per-host list of open connections that a client library keeps between requests, so the next request can skip the TCP and TLS handshakes.; Connection pools
Connection-level balancing: A layer 4 balancer chooses a backend when a TCP connection opens and sends every byte of that connection to the same backend.; gRPC over HTTP/2
conntrack: The Linux connection tracking table. It holds one entry per flow with the original addresses and ports and the ones expected in replies, so NAT can apply to every packet of the flow.; NAT and conntrack
Content-Length: A header that gives the body size in bytes, in decimal. The receiver reads exactly that many bytes after the blank line that ends the headers.; HTTP/1.1 on the wire
CORS-safelisted method: The Fetch standard's list: GET, HEAD or POST. Other methods need a preflight.; CORS
Datagram: One UDP message. It arrives whole or not at all: the receiver gets the full message in one recv, or nothing.; UDP
Deadline: The point in time after which the client stops waiting for a call. gRPC sends it to the server as the grpc-timeout header, a duration left.; gRPC over HTTP/2
Default route: The route for 0.0.0.0/0, printed as default. It contains every address, with a prefix length of 0, so it is used only when no other route matches.; Routing tables
Drop: A verdict that discards the packet and sends nothing back. In nftables it ends the evaluation of the whole ruleset at once.; Packet filtering with iptables and nftables
Edge POP: A point of presence: one CDN location with cache servers, close to the users. A request lands on the nearest one, and only a miss goes further toward the origin.; CDNs
Endpoint: One backend of a Service, usually a Pod address and port such as 10.244.2.7:8080, listed in an EndpointSlice.; Kubernetes Services and kube-proxy
Ephemeral port: The source port the kernel picks for an outgoing connection when the program does not choose one, from ip_local_port_range: 32768 to 60999 by default.; Ports, sockets and TIME_WAIT
ETag: A validator: an opaque string the origin sends with a response, like "6acfc371-36ae". A cache sends it back in If-None-Match to ask whether its copy is still current.; HTTP caching
Exponential backoff: Each time the retransmission timer fires, the sender doubles the RTO before it arms the timer again.; Lost packets and retransmission
Flags: The TCP control bits, printed in brackets as letters: S SYN, F FIN, P PSH, R RST and . for ACK. [S.] is a SYN with an ACK.; Reading tcpdump
Flapping: A server that keeps switching between up and down, so the balancer keeps adding it to and removing it from the pool.; Health checks
Forwarded: The standard header from RFC 7239 that carries the same information in one field: Forwarded: for=192.0.2.43;proto=https;by=203.0.113.60.; Reverse proxies and forwarded headers
FQDN: Fully qualified domain name: a name ending in a dot, like api.github.com.. The stub resolver sends it as is and skips the search list.; resolv.conf, search and ndots
Frame: The unit Ethernet sends: a 14-byte header with the destination MAC, the source MAC and a type, then the packet.; What a request is made of
Frame: The unit HTTP/2 sends: a 9 byte header (length, type, flags, stream ID) and a payload. HEADERS carries the request headers, DATA the body, RST_STREAM cancels one stream.; HTTP/2
Handshake: The three packets that open a TCP connection: SYN from the client, SYN-ACK from the server, ACK from the client. Each side picks a first sequence number, and the other acknowledges it.; The TCP handshake
Happy Eyeballs: A client algorithm (RFC 8305) for dual-stack hosts: try IPv6 first, and start an IPv4 attempt if IPv6 has not connected after a short delay, about 250 ms.; IPv6 for IPv4 people
Happy Eyeballs: curl's docs: an algorithm that tries IPv6 and IPv4 "giving IPv6 a head-start". If IPv6 has not connected after the delay, an IPv4 attempt starts in parallel, and the first to connect wins.; One request end to end
Head-of-line blocking: On one HTTP/1.1 connection, a response must be fully sent before the next one starts, so a slow or large response delays every request queued behind it.; HTTP/1.1 on the wire
Hop: One router on the path. mtr finds each hop by sending probes with a TTL of 1, 2, 3 and so on, and reports loss and RTT per hop.; Where the time goes
Hop-by-hop header: A header meant for one connection only, such as Upgrade and Connection. A proxy does not forward it to the next server unless configured to.; WebSockets through proxies
Host bits: The bits after the prefix length. With n host bits, the prefix holds 2^n addresses.; IP addresses and CIDR
HPACK: The header compression of HTTP/2 (RFC 7541). A common header is sent as a one byte index into a 61 entry static table, and headers already sent on the connection go into a dynamic table of 4,096 bytes by default.; HTTP/2
ICMP black hole: A path where a router drops a packet that is too big, but its ICMP "fragmentation needed" message never reaches the sender, often because a firewall drops ICMP.; MTU and fragmentation
ICMP port unreachable: The reply a host sends when a UDP datagram reaches a port with no socket listening. Linux reports it on the sending socket as ECONNREFUSED.; UDP
Idle connection: A connection in the pool with no request in flight. Go closes one after IdleConnTimeout, 90 s in DefaultTransport.; Connection pools
Idle timeout: How long a keep-alive connection may sit with no request before its owner closes it. Go's http.Server calls it IdleTimeout, Node.js calls it keepAliveTimeout.; Timeouts
Intermediate certificate: A CA certificate that signs leaves and is itself signed by a root or another intermediate. The server must send it.; Certificate chains
IPv6 address: 128 bits, written as eight groups of four hex digits separated by colons. :: replaces one run of zero groups and may appear only once.; IPv6 for IPv4 people
Isolated pod: A pod selected by at least one NetworkPolicy for a direction (ingress or egress). In that direction it accepts only the connections some policy allows.; Kubernetes NetworkPolicy
Key share: The key_share extension: the client's public value for one or more key exchange groups, such as X25519. With the server's share, both sides compute the same secret without ever sending it.; The TLS 1.3 handshake
kube-proxy: The agent on every node that watches Services and EndpointSlices and writes the matching iptables, nftables or IPVS rules.; Kubernetes Services and kube-proxy
Layer 4 load balancer: A balancer that sees only TCP: source and destination IP and port. It picks a server when a connection opens and then copies bytes. HAProxy mode tcp.; Layer 4 and layer 7 load balancing
Layer 7 load balancer: A balancer that parses HTTP: method, path, headers, cookies. It can pick a server for each request. HAProxy mode http.; Layer 4 and layer 7 load balancing
Leaf certificate: The certificate for the server itself, first in the list the server sends. It holds the host names and the server's public key.; Certificate chains
Link-local address: An address in fe80::/10, valid only on one link. RFC 4291 requires every IPv6 interface to have one, and RFC 4861 requires a router to send its advertisements from its link-local address.; IPv6 for IPv4 people
Longest prefix match: The rule for choosing between routes that contain the destination: the one with the largest prefix length wins.; Routing tables
MAC address: The 6-byte hardware address of a network interface, like 56:2a:92:53:89:1c. The Ethernet header carries a destination MAC and a source MAC.; ARP and MAC addresses
MASQUERADE: An iptables SNAT target that rewrites the source to the address of the interface the packet leaves by, so the rule needs no fixed IP.; NAT and conntrack
MSS: Maximum segment size: the largest TCP payload a host accepts, sent in its SYN. For IPv4 it is the MTU minus 40 bytes (20 of IP header, 20 of TCP header), so 1460 on Ethernet.; MTU and fragmentation
MTU: Maximum transmission unit: the largest IP packet a link carries in one piece, headers included. Ethernet uses 1500 bytes.; MTU and fragmentation
MX: Mail exchange: a preference number and the name of a host that accepts mail for the owner name. Senders try the lowest preference value first.; DNS records
NAT: Network address translation: rewriting the source address (SNAT) or the destination address (DNAT) of packets as they cross a machine.; NAT and conntrack
ndots: An option in /etc/resolv.conf. A name with fewer dots than ndots goes through the search list before it is tried as written. The glibc default is 1; Kubernetes sets 5.; resolv.conf, search and ndots
Negative caching: Keeping an answer that says a name does not exist (NXDOMAIN) or has no record of the asked type (NODATA), so the next identical question is answered from the cache.; TTLs and caching
Neighbour table: The kernel's cache of IP to MAC mappings learned by ARP, shown by ip neigh, with a state like REACHABLE or STALE on each entry.; ARP and MAC addresses
Netfilter hook: A fixed point in the kernel's packet path where rules run, such as prerouting, input, forward, output and postrouting. iptables and nftables both attach their rules to these hooks.; Packet filtering with iptables and nftables
Network address: The first address of a prefix, with every host bit at 0. 100.68.0.18/18 and 100.68.0.0/18 name the same network.; IP addresses and CIDR
Network namespace: A separate copy of the kernel network stack, with its own network devices, routes, firewall rules and ports. A process belongs to exactly one and inherits it from its parent.; Network namespaces
Network plugin: The CNI plugin that wires pod networking, such as Calico or Cilium. It watches NetworkPolicy objects and enforces them on each node.; Kubernetes NetworkPolicy
Next hop: The router a packet is handed to, shown as via 172.17.0.1. A route with no via means the destination is on that link and gets the packet directly.; Routing tables
nf_conntrack_max: The sysctl that caps the number of entries in the conntrack table. nf_conntrack_count shows how many are in use.; NAT and conntrack
NodePort: A port from 30000 to 32767 by default, opened on every node, that leads to the same Service.; Kubernetes Services and kube-proxy
Origin: Scheme, host and port of a page, like https://example.org. The browser sends it in the Origin header of a cross-origin request.; CORS
Origin shield: One designated POP that every other POP sends its misses to. Fastly: "visitor requests from across the global network funnel through a single, designated shield POP".; CDNs
Packet: The unit IP routes: a header of at least 20 bytes with the source and destination IP addresses, a TTL and a protocol number, then the segment.; What a request is made of
Passive health check: A verdict drawn from real traffic. Envoy calls it outlier detection: a host that returns 5 consecutive 5xx responses is ejected for 30 s by default.; Health checks
Path MTU: The smallest MTU of all the links between two hosts. RFC 1191 defines it as "the minimum of the MTUs of each hop in the path".; MTU and fragmentation
Persistence: Sending the same client to the same server every time, also called sticky sessions. In HAProxy, by a cookie in mode http or balance source in mode tcp.; Layer 4 and layer 7 load balancing
Persistent connection: A TCP connection that carries several requests and responses one after the other. HTTP/1.1 keeps the connection open by default, unless a message carries Connection: close.; HTTP/1.1 on the wire
Ping frame: A WebSocket control frame with opcode 0x9. The other side "MUST send a Pong frame in response", opcode 0xA.; WebSockets through proxies
podSelector: A label selector. In spec it picks the pods the policy applies to, and {} picks every pod in the namespace. In a from or to entry it picks allowed peers.; Kubernetes NetworkPolicy
policyTypes: The list Ingress, Egress or both in a policy. It says which directions the policy isolates for the pods it selects.; Kubernetes NetworkPolicy
Pool size: How many idle connections the pool keeps per host: MaxIdleConnsPerHost in Go (default 2), maxsize in urllib3 (default 1), pool_maxsize in requests (default 10).; Connection pools
Prefix: An address followed by a slash and a number from 0 to 32, like 10.0.0.0/28. The number says how many leading bits name the network. This notation is called CIDR.; IP addresses and CIDR
Preflight: An OPTIONS request the browser sends before a request that is not CORS-safelisted, with Access-Control-Request-Method and Access-Control-Request-Headers.; CORS
Private address: An address in one of the three RFC 1918 blocks. Routers on the internet are expected to drop routes to them, so the same block can be reused in every company.; IP addresses and CIDR
Private cache: A cache used by one user, such as the browser's disk cache. Cache-Control: private allows this cache and forbids shared caches.; HTTP caching
Purge: An explicit removal of content from the cache before its TTL ends: one URL, every object tagged with a surrogate key, or the whole service.; CDNs
QUIC: A transport protocol over UDP (RFC 9000). It carries its own streams, retransmission, congestion control and TLS 1.3 handshake. HTTP/3 is HTTP mapped onto QUIC streams.; HTTP/3 and QUIC
Read timeout: How long one side waits for data from the other. nginx's proxy_read_timeout 60s counts between two reads from the backend, and Go's ReadTimeout covers reading the whole request.; Timeouts
Receive window (rwnd): The number of bytes the receiver says it can accept, sent in the 16-bit Window field of every segment and multiplied by the window scale factor.; Flow and congestion control
Recursive resolver: A server that finds the answer for its clients by asking other servers, then caches what it learns. Unbound, BIND and the resolvers of ISPs and public DNS services do this job.; How a name is resolved
Recursive resolver: The server your machine sends its questions to (your ISP's, 1.1.1.1, CoreDNS in a cluster). It asks the authoritative servers and keeps each answer in its cache for the TTL.; TTLs and caching
Referral: A reply with no answer and a list of NS records for a zone closer to the name. The root sends a referral to the org. servers.; How a name is resolved
Reject: A statement that sends an error back (an ICMP port unreachable by default, or a TCP RST with tcp reset) and then drops the packet.; Packet filtering with iptables and nftables
Relative sequence number: By default tcpdump subtracts the first sequence number it saw in a conversation, so the first data byte each way is 1. The -S option prints the raw numbers.; Reading tcpdump
Request-level balancing: A client library or an HTTP/2 proxy chooses a backend for each call, so one client's calls spread over several backends.; gRPC over HTTP/2
Resource record: One line of DNS data: an owner name, a TTL, a class (IN), a type and the data. www.kubernetes.io. 3600 IN CNAME kubernetes.io. is one.; DNS records
Retransmission: A segment sent again because no ACK came back for it in time. In tcpdump it shows as the same sender and the same seq range printed again.; Reading tcpdump
Reverse proxy: A server in front of your app that accepts client connections and opens its own connections to the app. In nginx, proxy_pass http://127.0.0.1:8000; makes a location a reverse proxy.; Reverse proxies and forwarded headers
rise and fall: HAProxy's two thresholds: fall 3 consecutive failed checks mark a server down, rise 2 consecutive passed checks mark it up.; Health checks
Routing table: The list of routes the kernel reads to decide where an outgoing packet goes. ip route prints it. Each route is a prefix and where to send packets for it.; Routing tables
RST: The reset flag. A host sends a segment with RST for a port where no socket listens. The client's kernel then fails connect() with ECONNREFUSED.; The TCP handshake
RTO: Retransmission timeout: how long the sender waits for an ACK before it sends the oldest unacknowledged segment again. Linux keeps it between 200 ms and 120 s.; Lost packets and retransmission
RTT: Round trip time: how long a packet takes to reach a host and the answer to come back. ping measured 256 ms to ftp.jaist.ac.jp and 339 ms to mirror.aarnet.edu.au.; Where the time goes
Same-origin policy: The browser rule that a script may read responses only from its own origin, unless the other server allows it with CORS headers.; CORS
SAN: Subject Alternative Name: the list of DNS names and IP addresses a certificate is valid for. Clients match the host name against this list.; Certificate chains
Search list: The search line of /etc/resolv.conf: domains the stub resolver appends to a name, one at a time, until one of them matches.; resolv.conf, search and ndots
Segment: The unit TCP sends: a header of at least 20 bytes with the two ports, sequence numbers and flags, then the application bytes.; What a request is made of
Server-side discovery: The caller connects to one fixed address, and a load balancer or proxy behind it reads the registry and chooses the instance.; Service discovery
Service registry: A database of running instances: service name, address, port and health. Consul and the Kubernetes API server both keep one.; Service discovery
Shared cache: A cache that serves many users: a CDN edge, or nginx with proxy_cache. A page it stores can reach anyone who asks for the same cache key.; HTTP caching
SLAAC: Stateless address autoconfiguration (RFC 4862): the router advertises a prefix, and the host adds its own 64-bit interface identifier to form a global address, with no DHCP server.; IPv6 for IPv4 people
Slow start: The phase where cwnd grows by one segment for each segment acknowledged, which doubles it every round trip.; Flow and congestion control
SNI: Server Name Indication, the server_name extension in the ClientHello. It names the host the client wants, so one IP address can serve many sites, each with its own certificate.; The TLS 1.3 handshake
SOA MINIMUM: The last number in a zone's SOA record. Since RFC 2308 it caps how long a negative answer from that zone may be cached.; TTLs and caching
SRV record: A DNS record of type 33 (RFC 2782) named _service._proto.name, whose answer holds a priority, a weight, a port and a target host name.; Service discovery
ssthresh: Slow start threshold: below it the sender is in slow start, above it cwnd grows by about one segment per round trip. A loss sets it to about half of cwnd.; Flow and congestion control
Stream: One request and its response inside an HTTP/2 connection, numbered by a 31 bit stream ID. Streams opened by the client use odd IDs: 1, 3, 5.; HTTP/2
Stream: One request and its response inside an HTTP/2 connection, with its own stream id. Each gRPC call uses one stream, and many streams share one TCP connection at the same time.; gRPC over HTTP/2
Stub resolver: The resolver in or next to the application. It sends every question, with the RD (recursion desired) bit set, to the servers in /etc/resolv.conf and waits for a full answer.; How a name is resolved
Stub resolver: The DNS client inside your program, glibc's on most Linux systems. It reads /etc/resolv.conf and sends queries to the nameserver listed there.; resolv.conf, search and ndots
Stub resolver: The resolver a program asks first. On this laptop, /etc/resolv.conf says nameserver 127.0.0.53, the stub of systemd-resolved, which forwards misses and caches answers.; One request end to end
SYN-SENT: The client state between sending the SYN and receiving the SYN-ACK. RFC 9293: "waiting for a matching connection request after having sent a connection request".; The TCP handshake
TC flag: The truncation bit in a DNS reply. It means the answer did not fit in the UDP datagram, and the client should ask again over TCP.; UDP
tcp_syn_retries: The Linux sysctl for how many times an unanswered SYN is sent again. Default 6. The kernel docs say the attempt then times out "after 131seconds", and the run in this chapter took 135.; The TCP handshake
Time to first byte: %{time_starttransfer}: the time until curl received the first byte of the response. It includes every earlier step and the server's own work.; Where the time goes
TIME_WAIT: The state of a socket on the side that closed first, after the last ACK. Linux keeps it 60 seconds (TCP_TIMEWAIT_LEN), and ss prints it as TIME-WAIT.; Ports, sockets and TIME_WAIT
TLS termination: The balancer decrypts TLS itself. A layer 7 balancer must do it to read HTTPS requests; a layer 4 balancer can pass the encrypted bytes through.; Layer 4 and layer 7 load balancing
Total timeout: A limit on the whole call: connect, redirects, headers and body. Go's http.Client{Timeout: 5 * time.Second} is one.; Timeouts
Trust store: The root certificates the client already has on disk, for example the 122 certificates in /etc/ssl/certs/ca-certificates.crt on the machine used for this chapter.; Certificate chains
Trusted proxy: An address you list as one of your own proxies, like nginx's set_real_ip_from 10.0.1.0/24;. Only a request arriving from a trusted proxy gets its forwarded header read.; Reverse proxies and forwarded headers
TTL: Time to live: one byte in the IP header. Each router lowers it by at least 1 and drops the packet when it reaches 0.; What a request is made of
TTL: Time to live: a number of seconds in each DNS record. RFC 1035 defines it as the interval "that the resource record may be cached before it should be discarded".; TTLs and caching
UDP: User Datagram Protocol (RFC 768): an 8 byte header with source port, destination port, length and checksum, then the data. The kernel sends each datagram once, with no connection set up first, and never learns whether it arrived.; UDP
Upgrade handshake: An HTTP/1.1 GET with Upgrade: websocket and Connection: Upgrade. A 101 Switching Protocols reply turns the TCP connection into a WebSocket.; WebSockets through proxies
veth pair: Two virtual Ethernet devices joined back to back: a packet sent on one is received at once on the other. The two ends can sit in different namespaces.; Network namespaces
Withdrawal: The Withdrawn Routes part of an UPDATE. It tells peers the prefix is no longer reachable through the sender, and they pass that on.; BGP and anycast
Write-out timer: A variable of curl -w such as %{time_connect}. Each one is the time in seconds from the start of the transfer until that step was done.; Where the time goes
X-Forwarded-For: A request header holding a comma-separated list of addresses. Each proxy appends the address of the peer it received the request from, so the last entry was added by the nearest proxy.; Reverse proxies and forwarded headers
Zone apex: The top name of a zone, written @ in a zone file. It always holds the zone's SOA record and its NS records.; DNS records