TCPIP Illustrated Vol. 1 (2nd Ed) (Kevin R. Fall, W. Richard Stevens)（Z-Library）

【One-Line Pitch】 A rigorous, packet-level tour of how the Internet actually works, from Ethernet frames and IP addressing up through ARP, DHCP, and the protocols that glue hosts to links. Best for engineers, students, and sysadmins who want to reason about real network behavior rather than memorize abstractions. 【Book Arc】 - **Opening (~0%–10%)**: Frames the whole stack — layered demultiplexing, how a received Ethernet frame is routed by type field to IPv4/ARP/IPv6, and the typographical conventions used throughout for command output and notes. - **Early (~10%–32%)**: Builds the addressing foundation: IPv4/IPv6 address architecture, classful history, unicast/broadcast/multicast/anycast, IPv4-embedded IPv6 formats, PA vs PI space, multihoming, and id/locator separation (Shim6, HIP). - **Early–Middle (~29%–42%)**: Moves down to the link layer — Ethernet frame sizing and collision/backoff behavior, bridges and switches with STP/RSTP port states and BPDUs, 802.11 Wi-Fi coordination functions, and PPP with CHAP/EAP authentication and NCPs. - **Middle (~42%–52%)**: Covers address resolution and host configuration — ARP operation, the arp command, duplicate address detection (ACD), gratuitous ARP, and the ongoing conflict-resolution process. - **Late (excerpts do not cover)**: Later chapters on UDP, IP fragmentation, broadcasting/multicasting (IGMP/MLD), and security are visible only in the table of contents; the excerpts do not detail their content. - **Ending (excerpts do not cover)**: The closing material is not represented in the sampled excerpts. 【Key Takeaways】 - **Demultiplexing is the organizing idea of the stack** (Opening): each layer carries an identifier (Ethernet type, IP protocol, port) so a receiver can hand a PDU to the right handler — this is the mental model the whole book builds on. - **IPv6 address representation is deliberately constrained** (Early): RFC 5952 rules (suppress leading zeros, maximize `::`, lowercase hex) exist because RFC 4291's flexibility caused real confusion. - **Address type determines reachability semantics** (Early): unicast, broadcast, multicast, and anycast behave differently, and most IPv4 space is unicast while most IPv6 space is unused. - **PA vs PI space is a scalability trade-off** (Early): provider-aggregatable addresses allow route aggregation but tie you to an ISP; provider-independent addresses survive ISP changes but fragment the routing table. - **Multihoming is an unsolved architectural tension** (Early): IP addresses serve as both identifiers and locators, and separating them (Shim6, HIP) is an active research direction rather than settled practice. - **Ethernet's frame size is a designed compromise** (Early): the 1518-byte maximum limits retransmission cost on CRC errors but caps MTU at 1500, forcing larger PDUs into many frames with fixed per-frame overhead. - **STP port roles are about failure containment** (Early): designated, alternate, and backup ports each play a distinct role in keeping the spanning tree loop-free and recoverable. - **Authentication protocols trade off exposure and complexity** (Middle): CHAP avoids sending secrets in the clear and resists replay, but remains vulnerable to man-in-the-middle; EAP generalizes this into a framework often paired with RADIUS. 【Reading Tips】 - Treat the early address-architecture chapters as the spine — if IPv4/IPv6 addressing and PA/PI concepts are shaky, later protocol chapters will feel arbitrary. - Skim the link-layer chapters (Ethernet, STP, 802.11, PPP) on a first pass, then deep-read the sections relevant to your environment; the detail is dense but not all of it is universally applicable. - Use the typographical conventions as a reading aid: bold input, plain output, and indented notes signal where the authors are showing real command behavior versus explaining theory. - Keep the table of contents open as a map — it reveals the full arc (UDP, fragmentation, IGMP/MLD, security) even where the excerpts are thin. - Take away the demultiplexing model and the identifier/locator distinction; these two ideas recur across nearly every chapter. 【Coverage Limits】 This guide is based on stratified excerpts covering roughly the first half of the book (addressing, link layer, ARP/DHCP-adjacent material); later chapters on UDP, fragmentation, broadcasting/multicasting, and security are visible only through the table of contents and are not summarized here.