Back to Details

network-engineering

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Network Engineering

网络工程

Comprehensive network engineering skill covering network design, troubleshooting, load balancing, DNS, and network security.
全面的网络工程技能，涵盖网络设计、故障排查、负载均衡、DNS与网络安全。

When to Use This Skill

适用场景

  • Designing network topologies
  • Troubleshooting connectivity issues
  • Configuring load balancers
  • DNS configuration and troubleshooting
  • SSL/TLS setup and debugging
  • Network security implementation
  • Performance optimization
  • CDN configuration
  • 设计网络拓扑
  • 调试连接问题
  • 配置负载均衡器
  • DNS配置与故障排查
  • SSL/TLS设置与调试
  • 实施网络安全
  • 性能优化
  • CDN配置

Network Architecture

网络架构

OSI Model Reference

OSI模型参考

LayerNameProtocolsTroubleshooting
7ApplicationHTTP, DNS, SMTPcurl, browser tools
6PresentationSSL/TLSopenssl
5SessionNetBIOS-
4TransportTCP, UDPnetstat, ss
3NetworkIP, ICMPping, traceroute
2Data LinkEthernetarp
1Physical-cable tester
层级名称协议故障排查工具
7应用层HTTP, DNS, SMTPcurl、浏览器工具
6表示层SSL/TLSopenssl
5会话层NetBIOS-
4传输层TCP, UDPnetstat, ss
3网络层IP, ICMPping, traceroute
2数据链路层Ethernetarp
1物理层-线缆测试仪

VPC/Network Design

VPC/网络设计

Subnet Strategy:
VPC CIDR: 10.0.0.0/16 (65,536 IPs)

Public Subnets (internet-facing):
  - 10.0.1.0/24 (AZ-a) - Load balancers, bastion
  - 10.0.2.0/24 (AZ-b)
  - 10.0.3.0/24 (AZ-c)

Private Subnets (application tier):
  - 10.0.11.0/24 (AZ-a) - App servers
  - 10.0.12.0/24 (AZ-b)
  - 10.0.13.0/24 (AZ-c)

Database Subnets (isolated):
  - 10.0.21.0/24 (AZ-a) - Databases only
  - 10.0.22.0/24 (AZ-b)
  - 10.0.23.0/24 (AZ-c)
Traffic Flow:
  • Internet → Load Balancer (public) → App (private) → DB (isolated)
  • NAT Gateway for private subnet outbound
  • VPC Endpoints for AWS services
子网策略：
VPC CIDR: 10.0.0.0/16 (65,536 IPs)

Public Subnets (internet-facing):
  - 10.0.1.0/24 (AZ-a) - Load balancers, bastion
  - 10.0.2.0/24 (AZ-b)
  - 10.0.3.0/24 (AZ-c)

Private Subnets (application tier):
  - 10.0.11.0/24 (AZ-a) - App servers
  - 10.0.12.0/24 (AZ-b)
  - 10.0.13.0/24 (AZ-c)

Database Subnets (isolated):
  - 10.0.21.0/24 (AZ-a) - Databases only
  - 10.0.22.0/24 (AZ-b)
  - 10.0.23.0/24 (AZ-c)
流量流向：
  • 互联网 → 负载均衡器（公网）→ 应用（私有子网）→ 数据库（隔离子网）
  • NAT Gateway用于私有子网出站流量
  • VPC Endpoints用于AWS服务

Load Balancing

负载均衡

Load Balancer Types

负载均衡器类型

TypeLayerUse Case
Application (ALB)7HTTP/HTTPS, path routing
Network (NLB)4TCP/UDP, static IP, high performance
Classic4/7Legacy
Gateway3Third-party appliances
类型层级适用场景
Application (ALB)7HTTP/HTTPS、路径路由
Network (NLB)4TCP/UDP、静态IP、高性能场景
Classic4/7遗留系统
Gateway3第三方设备

Health Checks

健康检查

yaml
undefined
yaml
undefined

ALB Health Check

ALB Health Check

health_check: path: /health protocol: HTTP port: 8080 interval: 30 timeout: 5 healthy_threshold: 2 unhealthy_threshold: 3 matcher: "200-299"
undefined
health_check: path: /health protocol: HTTP port: 8080 interval: 30 timeout: 5 healthy_threshold: 2 unhealthy_threshold: 3 matcher: "200-299"
undefined

Routing Strategies

路由策略

  • Round Robin: Equal distribution
  • Least Connections: Route to least busy
  • IP Hash: Sticky sessions by client IP
  • Weighted: Percentage-based distribution
  • Path-based: Route by URL path
  • Host-based: Route by hostname
  • 轮询（Round Robin）：均等分配流量
  • 最少连接（Least Connections）：路由至最空闲的节点
  • IP哈希（IP Hash）：基于客户端IP实现会话保持
  • 加权（Weighted）：基于百分比分配流量
  • 基于路径（Path-based）：按URL路径路由
  • 基于主机名（Host-based）：按主机名路由

DNS

DNS

Record Types

记录类型

TypePurposeExample
AIPv4 address
example.com → 192.0.2.1
AAAAIPv6 address
example.com → 2001:db8::1
CNAMEAlias
www → example.com
MXMail server
example.com → mail.example.com
TXTArbitrary textSPF, DKIM, verification
NSName serverDNS delegation
SRVService location
_sip._tcp.example.com
CAACertificate authorityRestrict CA issuance
类型用途示例
AIPv4地址映射
example.com → 192.0.2.1
AAAAIPv6地址映射
example.com → 2001:db8::1
CNAME别名映射
www → example.com
MX邮件服务器
example.com → mail.example.com
TXT任意文本记录SPF、DKIM、验证信息
NS域名服务器DNS委托
SRV服务定位
_sip._tcp.example.com
CAA证书颁发机构限制CA证书颁发

DNS Debugging

DNS调试

bash
undefined
bash
undefined

Query specific record type

Query specific record type

dig example.com A dig example.com MX dig example.com TXT
dig example.com A dig example.com MX dig example.com TXT

Query specific DNS server

Query specific DNS server

dig @8.8.8.8 example.com
dig @8.8.8.8 example.com

Trace DNS resolution

Trace DNS resolution

dig +trace example.com
dig +trace example.com

Check propagation

Check propagation

dig +short example.com @{dns-server}
undefined
dig +short example.com @{dns-server}
undefined

TTL Strategy

TTL策略

Record TypeRecommended TTL
Static content86400 (1 day)
Dynamic content300 (5 min)
Failover records60 (1 min)
Pre-migrationLower to 60
记录类型推荐TTL值
静态内容86400（1天）
动态内容300（5分钟）
故障转移记录60（1分钟）
迁移前降低至60

SSL/TLS

SSL/TLS

Certificate Types

证书类型

TypeValidationUse Case
DVDomain ownershipBasic sites
OVOrganization verifiedBusiness sites
EVExtended validationHigh-trust sites
Wildcard*.domain.comMultiple subdomains
SANMulti-domainMultiple specific domains
类型验证级别适用场景
DV域名所有权验证基础站点
OV组织验证商业站点
EV扩展验证高信任站点
Wildcard*.domain.com多子域名场景
SAN多域名多个特定域名场景

TLS Configuration

TLS配置

Recommended Settings:
  • TLS 1.2 and 1.3 only
  • Strong cipher suites (AEAD)
  • HSTS enabled
  • OCSP stapling
  • Certificate transparency
推荐设置：
  • 仅启用TLS 1.2和1.3
  • 使用强加密套件（AEAD）
  • 启用HSTS
  • 启用OCSP stapling
  • 启用证书透明度

Debugging SSL

SSL调试

bash
undefined
bash
undefined

Check certificate

Check certificate

openssl s_client -connect example.com:443 -servername example.com
openssl s_client -connect example.com:443 -servername example.com

Check certificate chain

Check certificate chain

openssl s_client -connect example.com:443 -showcerts
openssl s_client -connect example.com:443 -showcerts

Check expiration

Check expiration

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

Test TLS versions

Test TLS versions

openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -tls1_3
undefined
openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -tls1_3
undefined

Troubleshooting

故障排查

Connectivity Checklist

连接性检查清单

  1. Physical/Cloud layer: Is the instance running?
  2. Security groups: Are ports open?
  3. NACLs: Are subnets allowing traffic?
  4. Route tables: Is routing correct?
  5. DNS: Does name resolve?
  6. Application: Is service listening?
  1. 物理/云层面：实例是否正常运行？
  2. 安全组：端口是否开放？
  3. NACLs：子网是否允许流量通过？
  4. 路由表：路由是否正确？
  5. DNS：域名是否能解析？
  6. 应用：服务是否在监听端口？

Common Commands

常用命令

bash
undefined
bash
undefined

Check if port is listening

Check if port is listening

netstat -tlnp | grep :80 ss -tlnp | grep :80
netstat -tlnp | grep :80 ss -tlnp | grep :80

Test TCP connectivity

Test TCP connectivity

nc -zv hostname 443 telnet hostname 443
nc -zv hostname 443 telnet hostname 443

Check routes

Check routes

ip route traceroute hostname mtr hostname
ip route traceroute hostname mtr hostname

DNS resolution

DNS resolution

nslookup hostname dig hostname host hostname
nslookup hostname dig hostname host hostname

Network interfaces

Network interfaces

ip addr ifconfig
ip addr ifconfig

Active connections

Active connections

netstat -an ss -tuln
undefined
netstat -an ss -tuln
undefined

Performance Debugging

性能调试

bash
undefined
bash
undefined

Bandwidth test

Bandwidth test

iperf3 -c server-ip
iperf3 -c server-ip

Latency analysis

Latency analysis

ping -c 100 hostname | tail -1
ping -c 100 hostname | tail -1

MTU issues

MTU issues

ping -M do -s 1472 hostname
ping -M do -s 1472 hostname

Packet capture

Packet capture

tcpdump -i eth0 port 443
undefined
tcpdump -i eth0 port 443
undefined

Reference Files

参考文件

  • references/troubleshooting.md
     - Detailed troubleshooting workflows
  • references/troubleshooting.md
     - 详细故障排查流程

Integration with Other Skills

与其他技能的集成

  • cloud-infrastructure - For cloud networking
  • security-engineering - For network security
  • performance - For network optimization
  • cloud-infrastructure - 用于云网络管理
  • security-engineering - 用于网络安全
  • performance - 用于网络优化