4 Network Services and Modern Architectures
Learn how core network services provide name resolution, host configuration, address translation, time synchronization, and identity management, and how these services fit into cloud network routing and security.
and name resolution
is a distributed, hierarchical database that resolves names and provides other records. A client's asks servers for records; a server may answer from its cache or direct the query toward authoritative servers. Cached answers are retained for their .
records and troubleshooting
Common record types serve different purposes:
AandAAAAmap a name to an IPv4 or IPv6 address.CNAMEmaps an alias to another name.MXidentifies mail exchangers for a domain.NSidentifies authoritative name servers for a zone.PTRsupports reverse lookup from an address to a name.SOAstores key information about a zone.
An application requesting portal.example.net may receive an A or AAAA answer. If the answer is cached, the can return it without repeating the full lookup. normally uses port 53 over UDP; TCP is also used, including for some large responses and zone transfers.
If users can reach a server by IP address but not by hostname, check the client's configured server, the relevant record, and whether a stale cache or incorrect suffix is involved. Internal and public can intentionally return different answers for the same name; this is called split .
and automatic configuration
automatically supplies network settings, commonly an IP address, subnet mask, default gateway, servers, and lease duration. A server allocates addresses from a configured scope or pool. Reservations associate a device identifier with a predictable address, while exclusions keep specified addresses out of the dynamic pool.
A new client commonly uses the four-step exchange:
Discover: The client broadcasts to find servers.
Offer: A server offers an address and configuration.
Request: The client requests the offered configuration.
Acknowledge: The server confirms the lease.
uses UDP ports 68 and 67 for clients and servers, respectively. Client broadcasts ordinarily do not cross routers, so a forwards requests between a subnet and a remote server.
For example, a laptop joining a new office VLAN broadcasts a Discover and receives an address, gateway, and appropriate to that subnet. If it receives an incorrect gateway or no address, check the scope, VLAN, relay configuration, and available leases.
and address translation
changes IP address information as packets pass through a translating device. In common small-office and enterprise deployments, (Port Address Translation), also called overload, lets multiple private hosts share a public IPv4 address by tracking transport-layer ports. Private IPv4 ranges are reserved for private internets and are not globally routed on the public Internet.
For example, a workstation at 192.168.1.20 connects to a public website. The edge router translates the private source address—and typically the source port—to a public address and port, then uses its translation table to direct the reply back to the workstation.
is not a firewall: translation alone does not provide a complete security policy. It can complicate inbound connections, end-to-end communication, and troubleshooting because addresses seen on one side differ from those seen on the other. Static or port forwarding can make selected internal services reachable from outside, but should be paired with appropriate access controls.
and time synchronization
synchronizes clocks across networked systems using a hierarchy of time sources and servers. Accurate time supports event-log correlation, authentication, certificates, and distributed applications. commonly uses UDP port 123.
Organizations often configure clients to use approved internal time servers, which in turn synchronize with trusted upstream sources. A significantly out-of-sync clock can cause authentication failures or make incident timelines misleading. When troubleshooting, check the configured time source, network reachability, and clock offset.
Directory services and identity
A stores organized information about network objects—such as users, groups, computers, and services—and provides ways to search and manage it. is a protocol for accessing directory services. Microsoft Active Directory Domain Services (AD DS), for example, stores directory data and makes it available to users and administrators.
Directories commonly support centralized identity and access management. They can work alongside authentication protocols such as Kerberos and provide policy or group information to managed systems. is often essential to locating directory services, so a problem can appear to be a sign-in or domain-join problem.
commonly uses port 389, while protected with TLS is commonly associated with port 636. Implementations may require additional ports and protocols, so allow only traffic needed for their documented functions.
Cloud networks, routing, and security
Cloud providers offer logically isolated networks, often called a (Virtual Private Cloud) or VNet (Virtual Network), that customers configure much like routed networks. A cloud network is assigned address ranges, divided into subnets, and connected using route tables and gateways. Cloud networking commonly includes provider-managed , options, firewalls, load balancers, and private links to other networks. Depending on the provider's design, a can span availability zones while individual subnets are placed within a zone.
A chooses a next hop based on a traffic destination. A default route such as 0.0.0.0/0 sends unmatched IPv4 destinations to a specified gateway or other target. An internet gateway provides a route between a cloud network and the public Internet when routing and addressing permit it.
A public subnet generally refers, in provider-specific terminology, to a subnet whose includes a route to an internet gateway. That route alone does not guarantee that every host is publicly reachable; addressing and security rules also matter. A private subnet has no direct route for inbound Internet access, but may still have outbound Internet access through a gateway or another controlled path.
Traffic controls can apply at different scopes. In AWS, security groups apply to network interfaces and are stateful, while network ACLs apply at the subnet boundary and are stateless. Peering, VPNs, or dedicated connections can connect cloud networks to other cloud networks or on-premises infrastructure, subject to routing and security configuration.
For example, a web application can place its public-facing load balancer in a public subnet and application servers in private subnets. Route tables direct permitted outbound traffic from private subnets through a gateway, while security rules restrict which systems can reach the application servers. This reduces direct exposure without preventing necessary outbound updates.
Service ports and troubleshooting dependencies
Common service ports and transports include:
: port 53 over UDP and TCP for name and service-record lookups.
: UDP port 67 for the server and UDP port 68 for the client, for automatic network configuration.
: UDP port 123 for clock synchronization.
: port 389 over TCP or UDP for directory access.
LDAPS: TCP port 636 for over TLS.
Port numbers identify common service endpoints. Firewall requirements depend on the service, implementation, and use case. Across troubleshooting tasks, trace the dependency chain through client configuration, name resolution, routing, translation, and security policy.