DCNP key terms

A two-tier data center topology where every leaf switch connects to every spine switch, and spines connect only to leaves. It provides predictable, equal-cost paths between servers and scales horizontally by adding leaves or spines.

A multistage switching fabric in which any input can reach any output through multiple parallel middle-stage paths. Data center spine-leaf designs are a folded Clos, giving non-blocking bandwidth when oversubscription is controlled.

The ratio between the aggregate bandwidth available at a lower tier of the network and the bandwidth available toward the upper tier. A 3:1 ratio means downstream ports can demand three times what uplinks can carry at line rate.

Traffic that enters or leaves the data center, typically between clients on the internet or WAN and internal servers. It usually passes through border routers, firewalls, and load balancers.

Traffic between servers inside the data center, such as application-to-database or service-to-service calls. It dominates modern workloads and drives designs that favor flat, high-bandwidth fabrics over hierarchical aggregation.

An access-layer switch placed in the same rack as the servers it serves, aggregating their connections and uplinking to spine or aggregation switches. It shortens cabling and localizes server-to-switch failure domains.

Equal-cost multipathing: a routing technique that installs multiple next hops of identical cost for a destination and hashes each flow onto one of them. It spreads traffic across parallel spine links without spanning tree.

Selecting one path among equal-cost links by computing a hash over packet header fields, usually a five-tuple. All packets of a flow follow the same path, preserving ordering, but hash polarization or elephant flows can imbalance links.

A long-lived, high-volume traffic flow such as a storage replication or backup stream. Because hashing pins it to one path, it can saturate a single uplink while others idle, motivating dynamic load balancing.

A Layer 2 broadcast domain created by tagging Ethernet frames, letting one physical switch infrastructure carry multiple isolated segments. VLAN tags are 12 bits, supporting up to 4094 usable identifiers.

An Ethernet link that carries frames from multiple VLANs by inserting a four-byte tag with a VLAN identifier into each frame. The link between switches or between a switch and a hypervisor host is typically configured as a trunk.

The VLAN whose frames travel untagged on an 802.1Q trunk. Both ends must agree on it; a mismatch causes frames from one VLAN to be delivered into another, creating a bridging and security problem.

Multi-chassis link aggregation: two switches present one logical LAG to a server or downstream device while remaining independently managed. It provides link redundancy without spanning tree blocking and requires an inter-switch peer link.

Link Aggregation Control Protocol (IEEE 802.3ad): a negotiation protocol that bundles multiple physical links into one logical link, verifying that both ends agree on member ports and detecting misconfigurations before traffic is forwarded.

A Layer 2 protocol that blocks redundant links to prevent broadcast loops, electing a root bridge and a loop-free tree. In data centers it wastes bandwidth and converges slowly, which is why routed fabrics are preferred.

Virtual Extensible LAN: an overlay encapsulation that carries Layer 2 frames inside UDP/IP packets with a 24-bit VNI, supporting about 16 million segments across a routed underlay. Tunnel endpoints add and remove the outer header.

VXLAN Tunnel Endpoint: the device that encapsulates a frame into a VXLAN packet and decapsulates it on receipt. VTEPs can be software in a hypervisor or hardware in a leaf switch, and they map destinations to remote tunnel IPs.

VXLAN Network Identifier: a 24-bit value in the VXLAN header that identifies the overlay segment a frame belongs to. It plays the role VLAN tags play in classic Layer 2 but with far more segments.

Ethernet VPN: a BGP address family that distributes MAC and IP reachability, VTEP addresses, and multihoming information for overlay networks. It replaces flood-and-learn with a control plane, enabling efficient forwarding and fast convergence.

A BGP router that receives routes from clients and reflects them to other clients, removing the need for a full iBGP mesh. Data center fabrics commonly use redundant route reflectors on spine switches.

Border Gateway Protocol: a path-vector routing protocol used both between autonomous systems and inside large fabrics as a scalable underlay or overlay control plane. It carries attributes such as AS path and next hop.

The physical IP fabric that provides routed connectivity between devices. In overlay designs it only needs to deliver loop-free, equal-cost IP reachability, usually via BGP or OSPF plus ECMP.

A virtual network built on top of the physical underlay, using tunnels to carry tenant or segment traffic. It decouples logical topology and addressing from physical cabling and device placement.

Creating logical networks in software independent of the physical hardware, so multiple isolated virtual networks can share one infrastructure. It enables rapid provisioning and mobility of workloads without recabling.

A centralized software component that computes and programs network policy and forwarding state onto devices via southbound interfaces. It gives a global view of the network and abstracts device configuration.

The interface a controller exposes to applications, orchestration systems, or operators, typically REST-based. It lets higher-level software request network services without knowing device-level details.

The interface a controller uses to program network devices, such as NETCONF, RESTCONF, OpenFlow, or vendor APIs. It translates controller intent into device configuration or forwarding entries.

An operating model where the operator declares the desired outcome, such as which groups may communicate, and the system translates it into device configuration and continuously verifies it matches reality.

A function that bridges a VXLAN overlay segment to a VLAN or other network type, performing encapsulation and decapsulation. It connects virtualized workloads to legacy or external networks.

Enforcing security policy per workload or group rather than per subnet, so lateral movement inside a data center is restricted. Policies are usually distributed to hypervisor or host-based enforcement points.

A stateful set of allow rules applied to a group of workloads, evaluated at the workload's virtual interface. Membership is by label or attribute rather than IP address, so rules follow workloads as they move.

A firewall whose policy is enforced at each hypervisor or host rather than at a single chokepoint appliance. Traffic between virtual machines is filtered locally, avoiding hairpinning and scaling with the cluster.

A security model that grants no implicit trust based on network location and authenticates and authorizes every access. In data centers it implies segmentation, identity-based policy, and continuous verification.

Advertising the same IP prefix from multiple locations so routing delivers each client to the nearest instance. It provides load distribution and resilience for services such as DNS and DDoS scrubbing.

A network management protocol that uses YANG-modeled XML data to read and change device configuration in a structured, transactional way. RESTCONF offers similar capabilities over HTTP with JSON or XML.

A data modeling language that defines the structure, types, and constraints of configuration and state data exposed by network devices. It is the schema behind NETCONF and RESTCONF operations.

Managing network and compute configuration through version-controlled declarative files applied by tooling, rather than manual CLI changes. It enables review, repeatability, and rollback of changes.

An automated sequence that validates, tests, and deploys changes from a repository to production. Applied to networking, it can lint configurations, run lab tests, and push approved changes through controllers.

A push model in which devices periodically send structured operational data such as interface counters and queue depths to a collector. It gives near-real-time visibility at scale compared with polling via SNMP.

Simple Network Management Protocol: a polling and trap protocol for reading device counters and receiving alerts, using MIB object identifiers. It is widely supported but coarse-grained and slow compared with streaming telemetry.

Summaries of traffic conversations exported by routers and switches, containing addresses, ports, byte and packet counts, and timestamps. They support traffic analysis, capacity planning, and security investigations.

A standard protocol and message format for sending event logs from network devices to a central collector. Severity levels and timestamps allow correlation of faults across the fabric.

Maximum transmission unit: the largest payload a link can carry in one frame. Overlay encapsulation adds headers, so underlay MTU must be raised or large packets will fragment or be dropped.

A technique that uses ICMP fragmentation-needed messages to find the smallest MTU along a path, so senders size packets appropriately. Blackholed ICMP breaks it, a common cause of overlay connectivity failures.