Kako računalo izvodi programeHow a computer runs programsProcesor, memorija, procesi i jezgra koja među njima drži red.Processors, memory, processes and the kernel that keeps them in order.41 simulator41 simulatorsSklopovlje: procesor i memorijaProcessor and memory hardwareJezgra i sistemski poziviThe kernel and system callsProcesi i dretveProcesses and threadsUpravljanje memorijomMemory managementUređaji i ulaz/izlazDevices and input/outputŠto stroj može izračunatiWhat a machine can computeKako mreže prenose podatkeHow networks move dataOd jednog okvira na kabelu do paketa koji putuju kroz mnogo mreža.From one frame on a cable to packets routed across many networks.107 simulatora107 simulatorsSlojevi i put paketaLayers and the journey of a packetLokalne mreže i preklopniciLocal networks and switchesAdrese i podmrežeAddresses and subnetsUsmjeravanje među mrežamaRouting between networksPortovi, TCP i UDPPorts, TCP and UDPBežične mrežeWireless networksTraženje kvarova u mrežiFinding network faultsKako radi internetHow the internet worksImena, web, e-pošta i sigurne veze koje ih nose.Names, the web, e-mail and the secure connections underneath them.44 simulatora44 simulatorsImena: sustav imena domenaNames: the domain name systemWebThe webPutevi među davateljima uslugaRoutes between providersE-poštaE-mailSigurne vezeSecure connectionsVrijeme na mrežiTime on the networkSigurnost: povjerenje i napadiSecurity: trust and attacksKljučevi, lozinke i dozvole te kako ih napadači zaobilaze.Keys, passwords and permissions, and how attackers get around them.61 simulator61 simulatorsKriptografijaCryptographyDokazivanje identitetaProving who you areTko smije štoWho may do whatVatrozidi i zoneFirewalls and zonesKako napadi radeHow attacks workGdje žive podaci: diskovi i datotečni sustaviWhere data lives: disks and file systemsOd jednog diska do volumena, snimki i grozdova za pohranu.From a single disk to volumes, snapshots and storage clusters.53 simulatora53 simulatorsUnutar diskaInside a diskDatotečni sustaviFile systemsVolumeni i bazeniVolumes and poolsRAIDSnimke i kopiranje pri pisanjuSnapshots and copy-on-writeGrozdovi za pohranuStorage clustersKad nešto zakaže: zalihost i oporavakWhen things fail: redundancy and recoveryKopije, kvorumi, sigurnosne kopije i planovi koji čuvaju uslugu i podatke.Copies, quorums, backups and plans that keep a service and its data alive.71 simulator71 simulatorsDomene kvaraFailure domainsZalihosne komponenteRedundant componentsReplikacijaReplicationKvorum i dogovorQuorum and consensusSigurnosne kopijeBackupsPlaniranje za katastrofuPlanning for disasterPerformanse: zašto sustavi usporavajuPerformance: why systems get slowRedovi čekanja, predmemorije i granice koje određuju stvarnu brzinu.Queues, caches and limits that decide how fast things really go.57 simulatora57 simulatorsRedovi čekanja i opterećenjeQueues and loadParalelizam i njegove graniceParallelism and its limitsBrzina mrežeNetwork speedBrzina diskaDisk speedPritisak na memorijuMemory pressureKad ponestane kapacitetaRunning out of capacityNovac: koliko IT stvarno koštaMoney: what IT really costsProračun, ulaganja i rizik riječima financija: kapitalni izdaci, amortizacija, TCO, NSV.Budgets, investments and risk in the words finance uses: CapEx, depreciation, TCO, NPV.23 simulatora23 simulatorsKako financije knjiže kupnjuHow finance books a purchaseIsplati li se?Is it worth it?Koliko stvarno koštaWhat it really costsKupiti, unajmiti ili se pretplatitiBuy, lease or subscribeRizik izražen u novcuRisk in moneyPravila i dokazi: usklađenost i procedureRules and proof: compliance and proceduresRizik, pristupi, promjene, osobni podaci i incidenti onako kako ih traže GDPR, NIS2 i revizor.Risk, access, changes, personal data and incidents the way GDPR, NIS2 and the auditor ask for them.29 simulatora29 simulatorsPravila i dokaziRules and evidenceUpravljanje rizikomManaging riskTko smije štoWho may do whatPromjene i zakrpeChanges and patchesOsobni podaciPersonal dataKad nešto pođe po zluWhen something goes wrongUpravljanje Linux sustavimaRunning Linux systemsLjuska, dozvole, usluge, diskovi, mreža i kontejneri na Linuxu.The shell, permissions, services, disks, networking and containers on Linux.118 simulatora118 simulatorsLjuskaThe shellKorisnici i dozvoleUsers and permissionsPodizanje, usluge i dnevniciBoot, services and logsDiskovi i memorijaDisks and memoryMreža i vatrozidiNetworking and firewallsKontejneri i virtualni strojeviContainers and virtual machinesAutomatizacija, uvođenje i nadzorAutomation, deployment and monitoringUpravljanje Windows domenomRunning a Windows domainActive Directory, grupna pravila, DNS, DHCP i ažuriranja u Windows mreži.Active Directory, Group Policy, DNS, DHCP and updates in a Windows network.58 simulatora58 simulatorsActive DirectoryUčlanjenje i prijavaJoining and logging onGrupna pravila u WindowsimaWindows Group PolicyDNS i DHCP u domeniDNS and DHCP in a domainDozvole nad datotekama i administratorska pravaFile permissions and admin rightsDistribucija ažuriranjaDistributing updatesOporavak i visoka dostupnostRecovery and high availabilityRadiovalovi i signaliRadio waves and signalsSignali, sklopovi, modulacija i kako se radiovalovi šire.Signals, circuits, modulation and how radio waves travel.58 simulatora58 simulatorsValovi i signaliWaves and signalsSklopovi i anteneCircuits and antennasAntene i zračenjeAntennas and radiationModulacijaModulationKako se radiovalovi šireHow radio waves travelTko koristi koju frekvencijuWho uses which frequencyRad na setu: sigurnost i tko što radiWorking on set: safety and who does whatSigurnost, odjeli i snimateljski dan: tko što radi, kojim redom i kada se sve zaustavlja.Safety, departments and the shooting day: who does what, in what order, and when everything stops.12 simulatora12 simulatorsEkipa i odjeliCrew and departmentsSnimateljski danThe shooting daySigurnostSafetyStruja, svjetlo i toplinaPower, light and heatStativi, tereti i visinaStands, loads and heightZdravlje kroz dugi danHealth over a long dayRačunanje na papiruArithmetic on paperZbrajanje, oduzimanje, množenje i dijeljenje na papiru, u bilo kojoj bazi.Adding, subtracting, multiplying and dividing on paper, in any base.6 simulatora6 simulatorsBrojevi i mjesna vrijednostNumbers and place valueČetiri računske operacijeThe four operationsProvjeraCheckingZa predavačaFor the lecturerAlati za vođenje nastave.Tools for running a class.3 simulatora3 simulatorsVođenje nastaveRunning a class
Kako računalo izvodi programeHow a computer runs programs 41 simulator41 simulators
Procesor, memorija, procesi i jezgra koja među njima drži red.Processors, memory, processes and the kernel that keeps them in order.
Sklopovlje: procesor i memorijaProcessor and memory hardware9 simulatora9 simulatorsKako memorijska ćelija čuva bitHow a memory cell holds a bitKako se broj sprema u bajtoveHow a number is stored in bytesPriručne memorije koje dijele jezgreCaches shared between coresKamo blok ide u priručnu memorijuWhere a block goes in the cacheProtočna struktura i njezini hazardiThe pipeline and its hazardsKoliko brže s više procesoraHow much faster with more processorsJezgra i sistemski poziviThe kernel and system calls8 simulatora8 simulatorsOperacijski sustav po slojevimaThe operating system in layersUlazak u jezgruEntering the kernelPrekidiInterruptsPodizanje sustavaStarting the systemProcesi i dretveProcesses and threads9 simulatora9 simulatorsProcesi i njihova stanjaProcesses and their statesDretveThreadsRaspoređivanje procesoraProcessor schedulingMeđusobno isključivanje i sinkronizacijaMutual exclusion and synchronizationPotpuni zastojDeadlockUpravljanje memorijomMemory management6 simulatora6 simulatorsDodjela memorijeAllocating memoryStraničenje i virtualna memorijaPaging and virtual memoryKad memorije ponestaneWhen memory runs shortUređaji i ulaz/izlazDevices and input/output8 simulatora8 simulatorsProgramirani U/I, prekidi i DMAProgrammed I/O, interrupts and DMAUpravljački programiDevice driversZahtjevi prema disku i priručna memorija diskaDisk requests and disk cachesDatoteke na diskuFiles on a diskŠto stroj može izračunatiWhat a machine can compute5 simulatora5 simulatorsAutomati i jeziciAutomata and languagesKako regularni izraz pogađaHow a regular expression matches
Sklopovlje: procesor i memorijaProcessor and memory hardware 9 simulatora9 simulators
Kako memorijska ćelija čuva bitHow a memory cell holds a bit2 simulatora2 simulatorsKako se broj sprema u bajtoveHow a number is stored in bytes1 simulatorPriručne memorije koje dijele jezgreCaches shared between cores2 simulatora2 simulatorsKamo blok ide u priručnu memorijuWhere a block goes in the cache1 simulatorProtočna struktura i njezini hazardiThe pipeline and its hazards1 simulatorKoliko brže s više procesoraHow much faster with more processors3 simulatora3 simulators
Kako memorijska ćelija čuva bitHow a memory cell holds a bit 2 simulatora2 simulators
SRAM i DRAM ćelijaSRAM vs DRAM cellSRAM drži bit u bistabilu; DRAM u naboju koji curi i treba osvježavanjeSRAM holds a bit in a latch; DRAM in charge that leaks and must be refreshed
Rowhammer: smetnja među DRAM retcimaRowhammer: disturbance between DRAM rowsČeste aktivacije jednog retka prazne ćelije susjednih redaka prije osvježavanjaFrequent activations of one row drain the cells next to it before a refreshKako se broj sprema u bajtoveHow a number is stored in bytes 1 simulator
Priručne memorije koje dijele jezgreCaches shared between cores 2 simulatora2 simulators
Homogeni višejezgreni procesorHomogeneous multicoreUbrzanje na više jezgri, koherencija predmemorija (MESI) i lažno dijeljenjeSpeedup on many cores, cache coherence (MESI) and false sharing
Nuspojave sklopovlja: brzina, prostor, povjerenjeHardware side effects: speed, space and trustIspravni dijelovi ostavljaju tragove u dijeljenom stanju; optimizacija ih množiCorrect parts leave traces in shared state; optimising multiplies themKamo blok ide u priručnu memorijuWhere a block goes in the cache 1 simulator
Protočna struktura i njezini hazardiThe pipeline and its hazards 1 simulator
Koliko brže s više procesoraHow much faster with more processors 3 simulatora3 simulators
Amdahlov zakonAmdahl's lawUbrzanje ograničava dio programa koji se ne može ubrzatiSpeedup is limited by the part of a program that cannot be sped up
Amdahlov zakon na web poslužiteljuAmdahl's law on a web serverUbrzanje zahtjeva ograničavaju dijelovi koji nisu ubrzaniA request's speedup is limited by the parts that are not sped upHomogeni višejezgreni procesorHomogeneous multicoreUbrzanje na više jezgri, koherencija predmemorija (MESI) i lažno dijeljenjeSpeedup on many cores, cache coherence (MESI) and false sharingJezgra i sistemski poziviThe kernel and system calls 8 simulatora8 simulators
Operacijski sustav po slojevimaThe operating system in layers 3 simulatora3 simulators
Karta operacijskog sustavaOperating system mapoperacijski sustav u slojevimathe operating system in layers
Put jednog pozivaJourney of a callread() kroz cijeli sustavread() through the whole system
Tip 1 i tip 2, kontejneri i VM-oviType 1 vs type 2, containers vs VMsGdje sjede jezgra i hipervizorWhere the kernel and the hypervisor sitUlazak u jezgruEntering the kernel 2 simulatora2 simulators
PrekidiInterrupts 2 simulatora2 simulators
Podizanje sustavaStarting the system 2 simulatora2 simulators
Lanac podizanja sustavaThe boot chainFirmware → pokretač sustava → jezgra → initramfs → systemd: lanac predajaFirmware → boot loader → kernel → initramfs → systemd: a chain of hand-oversLanac podizanja sustavaThe boot chain › Lanac podizanja WindowsaThe Windows boot chainUEFI → Boot Manager → winload → jezgra → smss → winlogonUEFI → Boot Manager → winload → kernel → smss → winlogonProcesi i dretveProcesses and threads 9 simulatora9 simulators
Procesi i njihova stanjaProcesses and their states 2 simulatora2 simulators
DretveThreads 1 simulator
Raspoređivanje procesoraProcessor scheduling 3 simulatora3 simulators
Raspoređivanje procesoraProcessor schedulingFCFS, RR, SPN, SRT, HRRN, Feedback
Opterećenje sustavaLoad averageOpterećenje broji poslove u stanju R i D, a ne postotak procesoraLoad counts runnable and D-state tasks, not CPU percentOpterećenje sustavaLoad average › Dva posla na jednoj jezgriTwo tasks on one coreIsta brojka na manje jezgri: red dulji od kapacitetaThe same number on fewer cores: a queue longer than capacityMeđusobno isključivanje i sinkronizacijaMutual exclusion and synchronization 2 simulatora2 simulators
Međusobno isključivanje i sinkronizacijaMutual exclusion and synchronizationutrka, semafori, monitorirace conditions, semaphores, monitorsHomogeni višejezgreni procesorHomogeneous multicoreUbrzanje na više jezgri, koherencija predmemorija (MESI) i lažno dijeljenjeSpeedup on many cores, cache coherence (MESI) and false sharingPotpuni zastojDeadlock 1 simulator
Upravljanje memorijomMemory management 6 simulatora6 simulators
Dodjela memorijeAllocating memory 1 simulator
Straničenje i virtualna memorijaPaging and virtual memory 2 simulatora2 simulators
Kad memorije ponestaneWhen memory runs short 3 simulatora3 simulators
Predmemorija stranica i prljave stranicePage cache and dirty pagesPredmemorija je posuđena, ne izgubljena; zapisano čeka na diskPage cache is lent, not lost; what you write waits for the disk
Memorija, odlagalište i ubojica OOMMemory, swap and the OOM killer › Slobodno 0, a stroj nije bez memorijeFree is 0, and the machine is not out of memoryPredmemorija stranica se vraća: gleda se raspoloživo, ne slobodnoPage cache is given back: read available, not freeMemorija, odlagalište i ubojica OOMMemory, swap and the OOM killerPredmemorija se vraća, odlagalište daje mjesta, a OOM ubija najveći zbrojPage cache gives way, swap buys room, the OOM killer takes the top scoreUređaji i ulaz/izlazDevices and input/output 8 simulatora8 simulators
Programirani U/I, prekidi i DMAProgrammed I/O, interrupts and DMA2 simulatora2 simulatorsUpravljački programiDevice drivers2 simulatora2 simulatorsZahtjevi prema disku i priručna memorija diskaDisk requests and disk caches2 simulatora2 simulatorsDatoteke na diskuFiles on a disk2 simulatora2 simulators
Programirani U/I, prekidi i DMAProgrammed I/O, interrupts and DMA 2 simulatora2 simulators
Upravljački programiDevice drivers 2 simulatora2 simulators
Zahtjevi prema disku i priručna memorija diskaDisk requests and disk caches 2 simulatora2 simulators
Datoteke na diskuFiles on a disk 2 simulatora2 simulators
Što stroj može izračunatiWhat a machine can compute 5 simulatora5 simulators
Automati i jeziciAutomata and languages 2 simulatora2 simulators
DFA igra za razredDFA classroom gameRazred u rundama gradi deterministički konačni automat za zadani jezikA class builds a deterministic finite automaton for a given language in rounds
DFA, NFA, PDA i Turingov strojDFA, NFA, PDA and Turing machineAutomat čita ulaznu riječ znak po znak i prihvaća je ili odbijaAn automaton reads an input word symbol by symbol and accepts or rejects itKako regularni izraz pogađaHow a regular expression matches 3 simulatora3 simulators
Kako regularni izraz pogađaHow a regex matchesMatcher hoda po retku, vraća se unatrag i provjerava sidraThe matcher walks the input, backtracks, anchorsKako regularni izraz pogađaHow a regex matches › a|ab: prvi pogodak ili najduljia|ab: first match or longestVraćanje unatrag javlja prvi pogodak, POSIX najdulji od istog početkaBacktracking reports the first match, POSIX the longest from the same startKako regularni izraz pogađaHow a regex matches › (a+)+b: stotine pokušaja(a+)+b: hundreds of triesUgniježđeni kvantifikatori tjeraju matcher da isproba svaku podjelu retkaNested quantifiers make the matcher try every way to split the lineKako mreže prenose podatkeHow networks move data 107 simulatora107 simulators
Od jednog okvira na kabelu do paketa koji putuju kroz mnogo mreža.From one frame on a cable to packets routed across many networks.
Slojevi i put paketaLayers and the journey of a packet19 simulatora19 simulatorsModeli slojeva: OSI i TCP/IPLayer models: OSI and TCP/IPEnkapsulacijaEncapsulationŠto piše u okviru i zaglavljuWhat a frame and a header carryOd skoka do skokaFrom one hop to the nextOdakle dolazi kašnjenjeWhere delay comes fromBitovi na žiciBits on the wireOtkrivanje pogrešaka u prijenosuDetecting transmission errorsCrtanje mrežeDrawing a networkLokalne mreže i preklopniciLocal networks and switches22 simulatora22 simulatorsZajednički medij i kolizijeA shared medium and collisionsKolizijske i broadcast domeneCollision and broadcast domainsKako preklopnik učiHow a switch learnsVLAN-oviVLANsMulticast i IGMPMulticast and IGMPPetlje u preklopnoj mrežiLoops in a switched networkUdruživanje vezaBundling linksAdrese i podmrežeAddresses and subnets21 simulator21 simulatorsDijeljenje mreže na podmrežeSplitting a network into subnetsPronalaženje fizičke adrese susjedaFinding a neighbour's hardware addressIPv6 adreseIPv6 addressesAutomatska dodjela adreseGetting an address automaticallyPrevođenje adresa (NAT)Address translation (NAT)Usmjeravanje među mrežamaRouting between networks10 simulatora10 simulatorsTablica usmjeravanjaThe routing tableKako usmjernici uče puteveHow routers learn routesSažimanje putevaSummarising routesUsmjeravanje među davateljima uslugaRouting between providersVeličina paketa i fragmentacijaPacket size and fragmentationPortovi, TCP i UDPPorts, TCP and UDP18 simulatora18 simulatorsPortovi i socketiPorts and socketsOtvaranje i zatvaranje vezeOpening and closing a connectionIzgubljeni segmentiLost segmentsKoliko brzo veza šaljeHow fast a connection sendsBežične mrežeWireless networks14 simulatora14 simulatorsKanali i dijeljenje eteraChannels and sharing the airSpajanje na bežičnu mrežuJoining a wireless networkRadijske i mesh mrežeRadio and mesh networksTraženje kvarova u mrežiFinding network faults9 simulatora9 simulatorsDijagnostika po slojevimaTroubleshooting layer by layerŠto otkrivaju ping i praćenje putaWhat ping and path tracing tell youOtvoren, zatvoren ili filtriranOpen, closed or filteredAdresa, ruta i rezolver računalaA host's address, route and resolver
Slojevi i put paketaLayers and the journey of a packet 19 simulatora19 simulators
Modeli slojeva: OSI i TCP/IPLayer models: OSI and TCP/IP1 simulatorEnkapsulacijaEncapsulation2 simulatora2 simulatorsŠto piše u okviru i zaglavljuWhat a frame and a header carry4 simulatora4 simulatorsOd skoka do skokaFrom one hop to the next2 simulatora2 simulatorsOdakle dolazi kašnjenjeWhere delay comes from4 simulatora4 simulatorsBitovi na žiciBits on the wire1 simulatorOtkrivanje pogrešaka u prijenosuDetecting transmission errors2 simulatora2 simulatorsCrtanje mrežeDrawing a network3 simulatora3 simulators
Modeli slojeva: OSI i TCP/IPLayer models: OSI and TCP/IP 1 simulator
EnkapsulacijaEncapsulation 2 simulatora2 simulators
Enkapsulacija i dekapsulacijaEncapsulation and decapsulationSvaki sloj dodaje svoje zaglavlje na putu dolje i skida ga na putu goreEach layer adds its header going down and strips it coming up
Enkapsulacija na drugom i trećem slojuEncapsulation on layers 2 and 3Svako zaglavlje uzima bajtove: okvir raste ili paket unutra mora biti manjiEvery header takes bytes: the frame grows, or the packet inside must shrinkŠto piše u okviru i zaglavljuWhat a frame and a header carry 4 simulatora4 simulators
Građa Ethernet okviraAnatomy of an Ethernet framePolja okvira, najmanja duljina od 64 okteta, nadopuna i FCSThe frame's fields, the 64-octet minimum, padding and the FCS
Polja IPv4 zaglavljaIPv4 header fieldsČemu služi svako polje i koja se polja mijenjaju na putuWhat each field does and which fields change in transit
Zaglavlja protokolaProtocol headersEthernet, IPv4, IPv6, TCP i UDP zaglavlja jedno uz drugo, u istom mjeriluEthernet, IPv4, IPv6, TCP and UDP headers side by side, to one scale
Poredak okteta (endianness)EndiannessPoredak okteta u memoriji i na žiciByte order in memory and on the wireOd skoka do skokaFrom one hop to the next 2 simulatora2 simulators
Cijeli put: od adrese do straniceThe whole journey: from URL to pageDNS, ARP, TCP, TLS i HTTP redom, kroz stvarni putDNS, ARP, TCP, TLS, HTTP in order, across the real path
Što se mijenja na svakom skokuWhat changes at each hopMAC adrese mijenjaju se po skoku, IP adrese ostaju, TTL pada, zbroj se računaMACs change per hop, IPs stay, TTL drops, the checksum is recomputedOdakle dolazi kašnjenjeWhere delay comes from 4 simulatora4 simulators
Četiri vrste kašnjenjaFour kinds of delayKašnjenje prijenosa, širenja, obrade i čekanja u redu na jednom skokuTransmission, propagation, processing and queuing delay over one hopČetiri vrste kašnjenjaFour kinds of delay › Spora i brza vezaSlow and fast link10 Mb/s ili 1 Gb/s: mijenja se prijenos, širenje ostaje 0,49 ms10 Mb/s or 1 Gb/s: transmission changes, propagation stays 0.49 msČetiri vrste kašnjenjaFour kinds of delay › Blizu i dalekoNear and far100 m ili 7000 km vlakna: mijenja se širenje, prijenos ostaje isti100 m or 7000 km of fibre: propagation changes, transmission staysČetiri vrste kašnjenjaFour kinds of delay › Preko satelitaVia a satelliteGeostacionarni satelit: oko 239 ms u jednom smjeru samo od širenjaA geostationary satellite: about 239 ms one way from propagation aloneBitovi na žiciBits on the wire 1 simulator
Otkrivanje pogrešaka u prijenosuDetecting transmission errors 2 simulatora2 simulators
CRC i paritet: otkrivanje pogrešakaCRC and parity: error detectionCRC otkriva rafalne pogreške koje paritet promašiA CRC catches the burst errors that parity missesCRC i paritet: otkrivanje pogrešakaCRC and parity: error detection › Hammingov kod: ispravljanje pogreškeHamming code: correcting an errorParitetni bitovi pokazuju položaj promijenjenog bita i ispravljaju gaParity bits point at the flipped bit, and the receiver flips it backCrtanje mrežeDrawing a network 3 simulatora3 simulators
Crtač mrežne topologijeNetwork topology drafterMrežna topologija otkrivana korak po korak: lokacije, zone i uloge uređajaA network topology revealed step by step: sites, zones and device rolesCrtač mrežne topologijeNetwork topology drafter › Dvije lokacije preko internetaTwo sites over the InternetSjedište s DC-om, podružnica s RODC-om i IPsec tunel između njihHead office with a DC, a branch with an RODC, an IPsec tunnel between themCrtač mrežne topologijeNetwork topology drafter › Kampus: jezgra, distribucija, pristupCampus: core, distribution, accessRedundantni kampus u tri sloja: svaki pristupni preklopnik ima dva puta goreA redundant three-tier campus: every access switch has two ways upLokalne mreže i preklopniciLocal networks and switches 22 simulatora22 simulators
Zajednički medij i kolizijeA shared medium and collisions5 simulatora5 simulatorsKolizijske i broadcast domeneCollision and broadcast domains4 simulatora4 simulatorsKako preklopnik učiHow a switch learns2 simulatora2 simulatorsVLAN-oviVLANs4 simulatora4 simulatorsMulticast i IGMPMulticast and IGMP1 simulatorPetlje u preklopnoj mrežiLoops in a switched network4 simulatora4 simulatorsUdruživanje vezaBundling links2 simulatora2 simulators
Zajednički medij i kolizijeA shared medium and collisions 5 simulatora5 simulators
CSMA/CD: kolizija i odustajanjeCSMA/CD: collisions and backoffKolizije na dijeljenom mediju i kako ih slučajno odustajanje razrješavaCollisions on a shared bus and how random backoff resolves them
Kolizijske i broadcast domeneCollision and broadcast domains › Ured s koncentratoromOffice with a hubDeset računala na koncentratoru, pa na preklopnikuTen computers on a hub, then on a switch
CSMA/CA i RTS/CTSCSMA/CA and RTS/CTSWi-Fi izbjegava sudare koje ne može otkriti; RTS/CTS rješava skriveni čvorWi-Fi avoids collisions it can't detect; RTS/CTS fixes the hidden node
Nazivna propusnost i ostvarena brzinaNominal vs achieved throughputZaglavlja, polu-dupleks i ponovna slanja pojedu dio nazivne propusnostiOverhead, half duplex and retries eat the link rate
Disciplina na radiovezi: jedan kanal, mnogo glasovaRadio discipline: one channel, many voicesKanal nosi jedan glas: gužva na glavnom kanalu odgađa poziv „Stop!”A channel carries one voice: a crowded main channel delays the stopKolizijske i broadcast domeneCollision and broadcast domains 4 simulatora4 simulators
Kolizijske i broadcast domeneCollision and broadcast domainsKoncentrator, preklopnik i usmjernik dijele različite domeneHubs, switches and routers split different domainsKolizijske i broadcast domeneCollision and broadcast domains › Primjer 3 iz knjigeExample 3 from the bookUsmjernik između dviju mreža, koncentrator na preklopniku: prebroji domeneA router between two networks, a hub on the second switch: count the domainsKolizijske i broadcast domeneCollision and broadcast domains › Primjer 3 (b)Example 3 (b)Koncentrator zamijenjen preklopnikom: što se mijenja, a što neThe hub replaced by a switch: what changes and what does notKolizijske i broadcast domeneCollision and broadcast domains › Bez usmjernikaNo routerPreklopnik umjesto usmjernika spaja dvije broadcast domeneA switch instead of the router merges two broadcast domainsKako preklopnik učiHow a switch learns 2 simulatora2 simulators
Tablica MAC adresaMAC address tablePreklopnik uči izvorišne adrese, a nepoznato odredište preplavljujeA switch learns source addresses and floods an unknown destination
Lokalno ili udaljeno, pa ARPLocal or remote, then ARPRačunalo maskom bira odredište ili pristupnik i ARP-om traži njegovu MAC adresuThe host ANDs the mask, picks the target or the gateway, resolves its MACVLAN-oviVLANs 4 simulatora4 simulators
VLANPristupni priključak nosi jedan VLAN, trunk označava okvire i nosi sveAn access port carries one VLAN; a trunk tags frames and carries them allKolizijske i broadcast domeneCollision and broadcast domains › VLAN-ovi u mreži 1VLANs in network 1VLAN 10 i VLAN 20 dijele jedan preklopnik na dvije broadcast domeneVLAN 10 and VLAN 20 split one switch into two broadcast domains
Pristupni i trunk priključci, nativni VLANAccess and trunk ports, native VLANGdje okvir dobiva 802.1Q oznaku, a gdje je gubi802.1Q tags added and removed at trunk edges
Usmjeravanje između VLAN-ovaInter-VLAN routingUsmjernik na štapu ili sučelja VLAN-ova L3 preklopnikaRouter on a stick vs L3 switch VLAN interfaces (SVIs)Multicast i IGMPMulticast and IGMP 1 simulator
Petlje u preklopnoj mrežiLoops in a switched network 4 simulatora4 simulators
Razapinjuće stablo (STP)Spanning tree (STP) › Bez petlje nema olujeNo loop, no stormBez petlje broadcast stiže do svakog računala jednom i nestajeWithout a loop a broadcast reaches each host once and diesRazapinjuće stablo (STP)Spanning tree (STP) › Broadcast olujaBroadcast stormBez STP-a jedan broadcast u petlji preklopnika množi se zauvijekWithout STP one broadcast multiplies forever in a switched loopRazapinjuće stablo (STP)Spanning tree (STP)Izbor korijenskog mosta, uloge priključaka i koji priključak blokira petljuRoot bridge election, port roles, and which port blocks the loopRazapinjuće stablo (STP)Spanning tree (STP) › Usmjernik kao granica broadcastaA router bounds the broadcastUsmjernik ne prosljeđuje broadcast: oluja ostaje u svojoj mrežiA router does not forward a broadcast: the storm stays in its networkUdruživanje vezaBundling links 2 simulatora2 simulators
Udruživanje veza i raspodjela tokovaLink aggregation and flow hashingZašto jedan tok nikad ne premaši brzinu jedne članske vezeWhy one flow never exceeds one member link
Načini rada bondaBonding modesactive-backup, balance ili 802.3ad: što koji način rada žrtvujeactive-backup vs balance vs 802.3ad: what each gives upAdrese i podmrežeAddresses and subnets 21 simulator21 simulators
Dijeljenje mreže na podmrežeSplitting a network into subnets4 simulatora4 simulatorsPronalaženje fizičke adrese susjedaFinding a neighbour's hardware address4 simulatora4 simulatorsIPv6 adreseIPv6 addresses5 simulatora5 simulatorsAutomatska dodjela adreseGetting an address automatically3 simulatora3 simulatorsPrevođenje adresa (NAT)Address translation (NAT)5 simulatora5 simulators
Dijeljenje mreže na podmrežeSplitting a network into subnets 4 simulatora4 simulators
Podmrežna maskaSubnet maskMaska dijeli adresu na mrežni i host dio i odlučuje je li odredište blizuThe mask splits an address into network and host part and decides near or far
VLSM: podmreže različite veličineVLSM: subnets of different sizesJedan prostor, blokovi po mjeri: najveći prvo, svaki poravnat na svoju veličinuOne space, blocks cut to size: largest first, each aligned to its own size
Sažimanje putevaRoute summarisationSusjedni prefiksi u jednom zapisu, i što taj zapis pokriva viškaNeighbouring prefixes in one route, and what it over-covers
Adresni blok, rasponi i rastAddress block, ranges and growthOd bloka do raspona i adresa za lokacije i VLAN-ove, s prostorom za rastFrom a block to ranges and addresses for sites and VLANs, with room to growPronalaženje fizičke adrese susjedaFinding a neighbour's hardware address 4 simulatora4 simulators
Lokalno ili udaljeno, pa ARPLocal or remote, then ARPRačunalo maskom bira odredište ili pristupnik i ARP-om traži njegovu MAC adresuThe host ANDs the mask, picks the target or the gateway, resolves its MAC
IPv6 NDP umjesto ARP-aIPv6 NDP instead of ARPTraženje susjeda ide na multicast adresu traženog čvora, ne svimaNeighbour solicitation goes to the solicited-node multicast, not to allIPv6 NDP umjesto ARP-aIPv6 NDP instead of ARP › NDP: nitko ne odgovaraNDP: nobody answersTri NS-a u razmaku od 1 s, zatim „address unreachable”Three NSs 1 s apart, then "address unreachable"IPv6 NDP umjesto ARP-aIPv6 NDP instead of ARP › NDP i hop limit 255NDP and hop limit 255Oglas susjeda koji je prošao usmjernik odbacuje seA neighbour advertisement that crossed a router is droppedIPv6 adreseIPv6 addresses 5 simulatora5 simulators
Skraćivanje zapisa IPv6 adreseShortening IPv6 addressesVodeće nule van, najdulji niz nula-skupina postaje ::, i to samo jednomLeading zeros go, the longest run of zero groups becomes ::, and only once
IPv6 SLAAC: samododjela adreseIPv6 SLAAC: address autoconfigurationRS i RA, prefiks + identifikator sučelja, otkrivanje dvostruke adreseRS and RA, prefix + interface ID, duplicate address detectionIPv6 SLAAC: samododjela adreseIPv6 SLAAC: address autoconfiguration › EUI-64: identifikator iz MAC adreseEUI-64: the interface ID from a MACRazdvoji MAC, umetni ff:fe, obrni bit U/LSplit the MAC, insert ff:fe, flip the U/L bitIPv6 SLAAC: samododjela adreseIPv6 SLAAC: address autoconfiguration › Dvostruka IPv6 adresa (DAD)A duplicate IPv6 address (DAD)Vlasnik odgovara na probu, adresa se ne dodjeljujeThe owner answers the probe; the address is not assigned
Vrste IPv6 adresa i njihov dometIPv6 address types and their reachLink-local, GUA, ULA i multicast: prefiks određuje vrstu, vrsta dometLink-local, GUA, ULA and multicast: the prefix sets the type, the type the reachAutomatska dodjela adreseGetting an address automatically 3 simulatora3 simulators
DHCP: DORA i zakup adreseDHCP DORA and the leaseDiscover, offer, request, ack; obnavljanje na T1 i T2; istek dodjeleDiscover, offer, request, ack; renewal at T1 and T2; expiry
DHCP posrednik i giaddrDHCP relay and giaddrPosrednik prosljeđuje broadcast kao unicast i označava podmrežuA relay forwards broadcasts as unicast and tags the subnet
DHCP: scope, rezervacije i prednost opcijaDHCP scopes, reservations and option precedenceIsključenja, rezervacije i razine opcija: pobjeđuje najspecifičnijaExclusions, reservations and option levels: the most specific winsPrevođenje adresa (NAT)Address translation (NAT) 5 simulatora5 simulators
NAT: tablica prijevodaNAT: the translation tableZapis nastaje kad paket krene van; dolazni paket bez zapisa se odbacujeAn entry is made when a packet goes out; inbound with no entry is dropped
Prosljeđivanje portovaPort forwardingDolazni spoj do poslužitelja iza NAT-a: stalan zapis mijenja odredišteInbound connections to a server behind NAT: a fixed row rewrites the destination
Operatorski NAT: dva prijevodaCarrier-grade NAT: two translationsDva NAT-a, dijeljeni prostor 100.64/10 i zašto prosljeđivanje porta ne pomažeTwo NATs, the shared space 100.64/10, and why port forwarding failsProsljeđivanje portovaPort forwarding › Objava porta kontejneraPublishing a container port-p je pravilo DNAT na domaćinu: port domaćina vodi na adresu kontejnera-p is a DNAT rule on the host: the host's port leads to the container's address
Asimetričan put kroz NAT i vatrozidAsymmetric path through NAT and firewallOdgovor vraćen drugim putem uređaj sa stanjem ne prepoznajeReplies taking another path break stateful devicesUsmjeravanje među mrežamaRouting between networks 10 simulatora10 simulators
Tablica usmjeravanjaThe routing table3 simulatora3 simulatorsKako usmjernici uče puteveHow routers learn routes2 simulatora2 simulatorsSažimanje putevaSummarising routes1 simulatorUsmjeravanje među davateljima uslugaRouting between providers2 simulatora2 simulatorsVeličina paketa i fragmentacijaPacket size and fragmentation2 simulatora2 simulators
Tablica usmjeravanjaThe routing table 3 simulatora3 simulators
Statički i zadani putStatic and default routesZadani put hvata sve što ništa specifičnije ne hvata; petlju zaustavlja TTLThe default route catches what nothing more specific does; TTL ends a loop
Tablica usmjeravanjaRouting tableOd svih zapisa koji se podudaraju, pobjeđuje najdulji prefiksOf all the entries that match, the longest prefix winsŠto se mijenja na svakom skokuWhat changes at each hopMAC adrese mijenjaju se po skoku, IP adrese ostaju, TTL pada, zbroj se računaMACs change per hop, IPs stay, TTL drops, the checksum is recomputedKako usmjernici uče puteveHow routers learn routes 2 simulatora2 simulators
Vektor udaljenosti i brojanje do beskonačnostiDistance vector and count to infinityUsmjernici razmjenjuju tablice, loša vijest putuje sporo, podijeljeni horizontRouters swap tables, bad news travels slowly, split horizon helps
Stanje veze i Dijkstrin algoritamLink state and DijkstraPreplavljivanje LSA gradi jednu kartu, SPF bira puteveLSA flooding builds one map; SPF picks pathsSažimanje putevaSummarising routes 1 simulator
Usmjeravanje među davateljima uslugaRouting between providers 2 simulatora2 simulators
BGP: odabir putaBGP path selectionAS put, lokalna prednost i širenje prefiksa između autonomnih sustavaAS path, local preference, and how a prefix spreads between ASes
BGP: otmica prefiksa i provjera izvorištaBGP hijack and route origin validationSpecifičniji prefiks pobjeđuje; provjera izvorišta puta (ROA, ROV)A more-specific prefix wins; route origin validation (ROA, ROV)Veličina paketa i fragmentacijaPacket size and fragmentation 2 simulatora2 simulators
Fragmentacija i otkrivanje MTU-a putaFragmentation and path MTU discoveryFragmenti ili DF i ICMP „potrebna fragmentacija”, te crna rupa PMTUD-aFragments vs DF and ICMP "fragmentation needed", and the PMTUD black holeEnkapsulacija na drugom i trećem slojuEncapsulation on layers 2 and 3Svako zaglavlje uzima bajtove: okvir raste ili paket unutra mora biti manjiEvery header takes bytes: the frame grows, or the packet inside must shrinkPortovi, TCP i UDPPorts, TCP and UDP 18 simulatora18 simulators
Portovi i socketiPorts and sockets 4 simulatora4 simulators
Portovi i socketiPorts and socketspet vrijednosti razdvaja mnogo veza na jednom portu 443the 5-tuple keeps many connections apart on one port 443Portovi i socketiPorts and sockets › Dvije kartice, isti poslužiteljTwo tabs, one serveristi poslužiteljski socket, različit izvorni port: dvije vezethe same server socket, a different source port: two connectionsPortovi i socketiPorts and sockets › Isti par socketa je ista vezaThe same pair of sockets is one connectionSYN s portom koji već ima veza pada na postojeći redak, ne na novia SYN from a port already in a connection hits the existing row, not a new one
Dobro poznati portoviWell-known portsPortovi koje studenti susreću, složeni po uslugama, i tri raspona IANA-eThe ports students meet, grouped by service, and IANA's three rangesOtvaranje i zatvaranje vezeOpening and closing a connection 7 simulatora7 simulators
TCP: trostruko rukovanjeTCP: the three-way handshakeSYN, SYN+ACK, ACK: potvrda je redni broj + 1, jer SYN zauzima jedan brojSYN, SYN+ACK, ACK: the ack is seq + 1, because the SYN takes one number
TCP: stanja vezeTCP: connection statesStanja kroz koja socket prolazi, uživo: svaka strana ima svojeThe states a socket passes through, live: each end has its ownTCP: trostruko rukovanjeTCP: the three-way handshake › TCP: zatvaranje vezeTCP: closing a connectionFIN i ACK u svakom smjeru; TIME-WAIT drži strana koja je prva zatvorilaA FIN and an ACK in each direction; the end that closed first holds TIME-WAITTCP: trostruko rukovanjeTCP: the three-way handshake › TCP: poslužitelj prvi zatvara vezuTCP: the server closes firstIsti segmenti u zrcalu: TIME-WAIT je sad na poslužiteljuThe same segments mirrored: TIME-WAIT is now on the serverTCP: trostruko rukovanjeTCP: the three-way handshake › TCP: poluzatvorena vezaTCP: a half-closed connectionNakon svojeg FIN-a strana i dalje prima podatke; druga smije slatiAfter its FIN an end still receives data; the other end may still sendTCP: trostruko rukovanjeTCP: the three-way handshake › TCP: FIN i ACK u jednom segmentuTCP: FIN and ACK in one segmentTri segmenta umjesto četiri: iz FIN-WAIT-1 ravno u TIME-WAITThree segments instead of four: FIN-WAIT-1 straight to TIME-WAITTCP: trostruko rukovanjeTCP: the three-way handshake › TCP: istodobno zatvaranjeTCP: simultaneous closeFIN-ovi se mimoilaze: obje strane u CLOSING, pa obje u TIME-WAITThe FINs cross: both ends in CLOSING, then both in TIME-WAITIzgubljeni segmentiLost segments 3 simulatora3 simulators
TCP i UDP pri gubitkuTCP vs UDP under lossIsti niz: TCP šalje ponovno i zastaje, UDP gubi i nastavljaThe same stream: TCP retransmits and stalls, UDP drops and continues
TCP: gubitak i ponovni prijenosTCP: loss and retransmissionRTO, duple potvrde, brzi ponovni prijenosRTO, duplicate ACKs, fast retransmitTCP: gubitak i ponovni prijenosTCP: loss and retransmission › TCP: brzi ponovni prijenosTCP: fast retransmitTri duple potvrde, pa ponovno slanje prije isteka rokaThree duplicate ACKs, then a resend before the timeoutKoliko brzo veza šaljeHow fast a connection sends 4 simulatora4 simulators
Kontrola toka: prozor primateljaFlow control: the receiver's windowPrimatelj prozorom kaže koliko prima; pošiljatelj ne smije preko desnog rubaThe receiver's window says how much it takes; the sender stops at its right edge
Klizni prozor: veličina prozora i brzinaSliding window: window size and throughputBrzina je prozor / kružno vrijeme, a nikad više od brzine vezeThroughput is window / round-trip time, never more than the link's rate
Kontrola zagušenja u TCP-uTCP congestion controlSlow start, congestion avoidance i AIMD pila; Reno i CUBIC nakon gubitkaSlow start, congestion avoidance, the AIMD sawtooth; Reno and CUBIC after a lossNazivna propusnost i ostvarena brzinaNominal vs achieved throughputZaglavlja, polu-dupleks i ponovna slanja pojedu dio nazivne propusnostiOverhead, half duplex and retries eat the link rateBežične mrežeWireless networks 14 simulatora14 simulators
Kanali i dijeljenje eteraChannels and sharing the air 7 simulatora7 simulators
Wi-Fi kanali i preklapanjeWi-Fi channels and overlap2,4 GHz 1/6/11, širine kanala na 5 GHz, smetnje na istom kanalu2.4 GHz 1/6/11, 5 GHz channel widths, co-channel interference
Skriveni čvor i RTS/CTSThe hidden node and RTS/CTSDvije stanice koje se ne čuju sudaraju se na access pointuTwo stations out of range of each other collide at the access pointCSMA/CA i RTS/CTSCSMA/CA and RTS/CTSWi-Fi izbjegava sudare koje ne može otkriti; RTS/CTS rješava skriveni čvorWi-Fi avoids collisions it can't detect; RTS/CTS fixes the hidden node
Od odašiljača do prijamnika: proračun vezeFrom transmitter to receiver: the link budgetSnaga i dobici, minus gušenje puta i gubici: margina iznad osjetljivosti u dBPower plus gains, minus path loss and losses: the margin above sensitivity in dB
FDMA, TDMA i CDMAFDMA, TDMA and CDMATri načina da više korisnika dijeli jedan kanalThree ways to share one channel
QAM i OFDMQAM and OFDMVeća konstelacija prema šumu; nositelji koji se ne ometajuConstellation size against noise; subcarriers that do not interfere
Shannon-Hartleyev zakonThe Shannon–Hartley lawKapacitet kanala iz širine pojasa i omjera signal-šumChannel capacity from bandwidth and signal-to-noise ratioSpajanje na bežičnu mrežuJoining a wireless network 3 simulatora3 simulators
802.11: pridruživanje mreži korak po korak802.11 association step by stepSkeniranje, autentikacija, pridruživanje, pa rukovanje u četiri korakaScan, authenticate, associate, then the 4-way handshake
WPA2 i WPA3: rukovanje i što vidi promatračWPA2 and WPA3: the handshake and what an observer seesPorijeklo PMK-a, rukovanje u četiri koraka; WPA2-PSK se pogađa bez mreže, SAE nePMK origin, 4-way handshake, why WPA2-PSK can be cracked offline and SAE can't
Prelazak između access pointovaRoaming between access pointsO prelasku odlučuje klijent, a ne AP; ljepljivi klijentiThe client, not the AP, decides when to roam; sticky clientsRadijske i mesh mrežeRadio and mesh networks 4 simulatora4 simulators
Radijske mreže pod opterećenjemRadio networks under loadFiksni kanali, zajednički skup ili put preko releja: tko dođe na redFixed channels, a shared pool or a route through relays: who gets through
Kako poruka putuje kroz LoRa i mesh mrežeHow a message travels in LoRa and mesh networksTko prosljeđuje: gateway, svi čvorovi, samo repetitori ili svatko kao routerWho forwards: a gateway, every node, only repeaters, or everyone as a router
LoRa: cvrkuti i faktor širenjaLoRa: chirps and spreading factorFaktor širenja: vrijeme u eteru prema dometuSpreading factor: time on air against range
Packet radio i APRSPacket radio and APRSJedan zajednički kanal: osluškivanje, digipeateri i put WIDEn-NOne shared channel: carrier sense, digipeaters and WIDEn-N path aliasesTraženje kvarova u mrežiFinding network faults 9 simulatora9 simulators
Dijagnostika po slojevimaTroubleshooting layer by layer1 simulatorŠto otkrivaju ping i praćenje putaWhat ping and path tracing tell you2 simulatora2 simulatorsOtvoren, zatvoren ili filtriranOpen, closed or filtered3 simulatora3 simulatorsAdresa, ruta i rezolver računalaA host's address, route and resolver3 simulatora3 simulators
Dijagnostika po slojevimaTroubleshooting layer by layer 1 simulator
Što otkrivaju ping i praćenje putaWhat ping and path tracing tell you 2 simulatora2 simulators
Što znače odgovori na pingWhat ping answers meanEcho odgovor, kodovi nedostupnosti, istek TTL-a i što znači tišinaEcho reply, unreachable codes, time exceeded, and what silence means
Traceroute i TTLTraceroute and TTLPoruke o isteku TTL-a crtaju put, a zvjezdice nisu kvarTTL-exceeded replies map the path, and stars are not failuresOtvoren, zatvoren ili filtriranOpen, closed or filtered 3 simulatora3 simulators
TCP SYN: otvoren, zatvoren, filtriranTCP SYN: open, closed, filteredSYN dobije SYN+ACK, RST ili tišinu, i što koji odgovor dokazujeA SYN gets a SYN+ACK, an RST or nothing, and what each one provesTCP SYN: otvoren, zatvoren, filtriranTCP SYN: open, closed, filtered › TCP SYN: tri ishoda u pravoj snimciTCP SYN: three outcomes in a real captureSYN+ACK, RST+ACK i dva ponovljena SYN-a bez odgovoraSYN+ACK, RST+ACK and two repeated SYNs with no answerTCP SYN: otvoren, zatvoren, filtriranTCP SYN: open, closed, filtered › Vatrozid: odbaciti ili odbitiFirewall: drop or rejectTišina, ICMP 3/13 ili RST u ime hosta za isti blokirani portSilence, ICMP 3/13 or an RST in the host's name for the same blocked portAdresa, ruta i rezolver računalaA host's address, route and resolver 3 simulatora3 simulators
Adresa, ruta i rezolverAddress, route and resolverTri stvari koje stroj treba za mrežu, i traženje ruteThe three things a host needs, and the route lookupAdresa, ruta i rezolverAddress, route and resolver › Ime radi, ruta neThe name works, the route does notBez zadane rute: Network is unreachable, iako je ime razriješenoNo default route: Network is unreachable, though the name resolvedAdresa, ruta i rezolverAddress, route and resolver › Ime vodi na krivu adresuA name leads to the wrong addressStari redak u /etc/hosts odgovara prije DNS-a, i to bez upozorenjaA stale line in /etc/hosts answers before DNS, without a warningKako radi internetHow the internet works 44 simulatora44 simulators
Imena, web, e-pošta i sigurne veze koje ih nose.Names, the web, e-mail and the secure connections underneath them.
Imena: sustav imena domenaNames: the domain name system9 simulatora9 simulatorsRazrješavanje imenaResolving a namePredmemorije, TTL i istek zoneCaches, TTLs and zone expiryZone i prosljeđivanjeZones and forwardingKako klijent traži imeHow a client looks up a nameWebThe web15 simulatora15 simulatorsJedan web zahtjevOne web requestPrijava i sesijeLogging in and sessionsInačice HTTP-a i multipleksiranjeHTTP versions and multiplexingWeb predmemorije i rubna mjestaWeb caches and edgesObrnuti proxy i raspodjela opterećenjaReverse proxies and load balancingIsto podrijetlo i CORSSame origin and CORSPutevi među davateljima uslugaRoutes between providers3 simulatora3 simulatorsOdabir puta među mrežamaChoosing a path between networksJedna adresa na mnogo mjestaOne address in many placesOteti prefiksi i provjera izvorištaStolen prefixes and origin validationE-poštaE-mail4 simulatora4 simulatorsKako se poruka dostavljaHow a message is deliveredDokazivanje pošiljateljaProving who sent a messageSigurne vezeSecure connections11 simulatora11 simulatorsTLS rukovanjeThe TLS handshakeCertifikati i lanac povjerenjaCertificates and the chain of trustUdaljena ljuska i tuneliRemote shells and tunnelsVirtualne privatne mrežeVirtual private networksVrijeme na mrežiTime on the network4 simulatora4 simulatorsUsklađivanje satovaSynchronising clocksKad sat ne pokazuje točnoWhen a clock is wrong
Imena: sustav imena domenaNames: the domain name system 9 simulatora9 simulators
Razrješavanje imenaResolving a name 2 simulatora2 simulators
DNS: razrješavanje imenaDNS: name resolutionRezolver pita korijen, .hr i mjerodavni poslužitelj; računalo pita jednomThe resolver asks the root, TLD and authoritative servers; the host asks once
DNS: vrste zapisaDNS record typesA, AAAA, CNAME, MX, TXT i NS odgovaraju različito; CNAME ne smije na vrh zoneA, AAAA, CNAME, MX, TXT and NS resolve differently; no CNAME at the zone apexPredmemorije, TTL i istek zoneCaches, TTLs and zone expiry 2 simulatora2 simulators
DNS: TTL i selidba adreseDNS: TTL and the cutoverStari odgovor živi dok mu TTL ne istekne: TTL se snizuje prije selidbeOld answers live until their TTL expires: lower the TTL before you move
DNS: sekundarni poslužitelj i istek zoneDNS: the secondary and zone expirySekundarni je predmemorija s rokom: mrtvi primarni obori zonu, samo kasnijeA secondary is a cache with a timer: a dead primary takes the zone down laterZone i prosljeđivanjeZones and forwarding 3 simulatora3 simulators
DNS: vrste zona i opseg replikacijeDNS zone types and replication scopePrimarna, sekundarna, stub i zona u AD-u; opseg šuma, domena ili vlastitiPrimary, secondary, stub, AD-integrated; forest, domain or custom scope
Prosljeđivači, uvjetni prosljeđivači i root hintsForwarders, conditional forwarders, root hintsKamo DC šalje imena koja nisu njegovaWhere a DC sends names it doesn't ownDNS: sekundarni poslužitelj i istek zoneDNS: the secondary and zone expiry › DNS: dva primarna, dvije zoneDNS: two primaries, two zonesDva primarna su dvije zone: svaki mjerodavno odgovara iz svoje kopijeTwo primaries are two zones: each answers authoritatively from its own copyKako klijent traži imeHow a client looks up a name 2 simulatora2 simulators
Kako Windows klijent razrješava imeHow a Windows client resolves a namehosts, predmemorija, DNS sa sufiksima, LLMNR i NetBIOS; zašto kratko ime zakažeHosts file, cache, DNS with suffixes, LLMNR/NetBIOS; why a short name goes wrongAdresa, ruta i rezolverAddress, route and resolver › Ime vodi na krivu adresuA name leads to the wrong addressStari redak u /etc/hosts odgovara prije DNS-a, i to bez upozorenjaA stale line in /etc/hosts answers before DNS, without a warningWebThe web 15 simulatora15 simulators
Jedan web zahtjevOne web request3 simulatora3 simulatorsPrijava i sesijeLogging in and sessions2 simulatora2 simulatorsInačice HTTP-a i multipleksiranjeHTTP versions and multiplexing3 simulatora3 simulatorsWeb predmemorije i rubna mjestaWeb caches and edges2 simulatora2 simulatorsObrnuti proxy i raspodjela opterećenjaReverse proxies and load balancing3 simulatora3 simulatorsIsto podrijetlo i CORSSame origin and CORS3 simulatora3 simulators
Jedan web zahtjevOne web request 3 simulatora3 simulators
Jedna HTTP razmjenaOne HTTP exchangeRedak zahtjeva, polja zaglavlja, statusni kodovi i tijeloRequest line, headers, status codes, bodyCijeli put: od adrese do straniceThe whole journey: from URL to pageDNS, ARP, TCP, TLS i HTTP redom, kroz stvarni putDNS, ARP, TCP, TLS, HTTP in order, across the real path
Statusni kodovi HTTP-aHTTP status codesKlase i kodovi koji su važni: prva znamenka kaže čiji je problemThe classes and the codes that matter: the first digit says whose problemPrijava i sesijeLogging in and sessions 2 simulatora2 simulators
Kolačići i sjedniceCookies and sessionsProtokol bez stanja ipak te pamti; SameSiteA stateless protocol remembers you; SameSite
Prijava preko davatelja identiteta (OAuth)Log in with an identity provider (OAuth)Tko što vidi: preglednik, aplikacija, davatelj identitetaWho sees what: browser, app, identity providerInačice HTTP-a i multipleksiranjeHTTP versions and multiplexing 3 simulatora3 simulators
HTTP/1.1, HTTP/2 i HTTP/3HTTP/1.1 vs HTTP/2 vs HTTP/3Multipleksiranje i zastoj na čelu reda: TCP naspram QUIC-aMultiplexing, and head-of-line blocking at TCP vs QUICHTTP/1.1, HTTP/2 i HTTP/3HTTP/1.1 vs HTTP/2 vs HTTP/3 › Jedna HTTP/1.1 vezaOne HTTP/1.1 connectionZahtjevi zaredom na jednoj vezi: 800 ms; HTTP/2 ih multipleksira: 300 msRequests in a row on one connection: 800 ms; HTTP/2 multiplexes them: 300 msHTTP/1.1, HTTP/2 i HTTP/3HTTP/1.1 vs HTTP/2 vs HTTP/3 › Izgubljen segmentA lost segmentJedan gubitak zaustavi sve HTTP/2 tokove; u HTTP/3 čeka samo njegov tokOne loss stalls every HTTP/2 stream; in HTTP/3 only its own stream waitsWeb predmemorije i rubna mjestaWeb caches and edges 2 simulatora2 simulators
HTTP predmemoriranjeHTTP cachingCache-Control, ETag i 304: što drži preglednik, a što rubni poslužitelj CDN-aCache-Control, ETag and 304: what the browser and the CDN edge keep
Anycast i rubna mjesta CDN-aAnycast and CDN edgesJedna adresa na više mjesta; BGP bira najbližeOne address, many places; BGP picks the nearestObrnuti proxy i raspodjela opterećenjaReverse proxies and load balancing 3 simulatora3 simulators
Obrnuti proxy i raspodjela opterećenjaReverse proxy and load balancingKružno, najmanje veza, hash i kolačić; provjere ispravnostiRound robin vs least connections vs hash vs sticky; health checksObrnuti proxy i raspodjela opterećenjaReverse proxy and load balancing › Najmanje veza i spori poslužiteljLeast connections and a slow backendSpori b2 drži veze otvorene i dobiva 2 od 9 zahtjeva; kružno bi dobio 3The slow b2 keeps connections open and gets 2 of 9 requests; round robin gives 3Obrnuti proxy i raspodjela opterećenjaReverse proxy and load balancing › Provjera ispravnosti i 502Health checks and 502b2 otkaže u 4 s, isključen je tek u 8 s; do tada njegovi zahtjevi dobivaju 502b2 fails at 4 s and is marked down only at 8 s; until then its requests get 502Isto podrijetlo i CORSSame origin and CORS 3 simulatora3 simulators
Isto ishodište i CORSSame origin and CORSPravilo provodi preglednik, ne poslužitelj; prethodni zahtjevThe browser, not the server, enforces it; preflight
Skriptiranje među stranicama (XSS)Cross-site scripting (XSS)Pohranjeni i reflektirani XSS; kodiranje izlazaStored vs reflected XSS; output encodingKolačići i sjedniceCookies and sessionsProtokol bez stanja ipak te pamti; SameSiteA stateless protocol remembers you; SameSitePutevi među davateljima uslugaRoutes between providers 3 simulatora3 simulators
Odabir puta među mrežamaChoosing a path between networks 1 simulator
Jedna adresa na mnogo mjestaOne address in many places 1 simulator
Oteti prefiksi i provjera izvorištaStolen prefixes and origin validation 1 simulator
E-poštaE-mail 4 simulatora4 simulators
Kako se poruka dostavljaHow a message is delivered 1 simulator
Dokazivanje pošiljateljaProving who sent a message 3 simulatora3 simulators
SPF, DKIM i DMARCSPF, DKIM and DMARCTri provjere, poravnanje i ishod DMARC-aThree checks, alignment and the DMARC verdictSPF, DKIM i DMARCSPF, DKIM and DMARC › Krivotvoreni From:A spoofed From:SPF i DKIM prolaze za tuđu domenu, DMARC ne prolaziSPF and DKIM pass for another domain; DMARC failsSPF, DKIM i DMARCSPF, DKIM and DMARC › p=reject i dopisna listap=reject and a mailing listBez potpisa proslijeđena pošta pada, a lista odjavljuje čitateljeUnsigned forwarded mail fails, and the list unsubscribes readersSigurne vezeSecure connections 11 simulatora11 simulators
TLS rukovanjeThe TLS handshake 1 simulator
Certifikati i lanac povjerenjaCertificates and the chain of trust 6 simulatora6 simulators
Lanac povjerenja i rok valjanostiChain of trust and expiryKrajnji, posrednički, spremište povjerenja; nedostaje posrednik; satovi istekaLeaf, intermediate, root store; a missing intermediate; expiry clocksLanac povjerenja i rok valjanostiChain of trust and expiry › Nedostaje posrednički certifikatMissing intermediate certificatePoslužitelj šalje samo krajnji certifikat: nepoznat izdavateljThe server sends only the leaf: unknown issuerLanac povjerenja i rok valjanostiChain of trust and expiry › Satovi istekaExpiry clocks*.quillmoor.example na pet krajnjih točaka: nakon notAfter padaju sveOne wildcard on five endpoints: past its notAfter they all fail at onceLanac povjerenja i rok valjanostiChain of trust and expiry › Obnavljanje certifikata ACMEACME certificate renewalIzazov HTTP-01 ili DNS-01; obnavljanje na 90 dana po mjeraču vremenaHTTP-01 vs DNS-01 challenge, 90-day automationLanac povjerenja i rok valjanostiChain of trust and expiry › Krivi sat klijentaWrong client clockIstek mjeri sat klijenta: na poslužitelju se ništa ne mijenjaExpiry is measured by the client clock: nothing changes on the serverLanac povjerenja i rok valjanostiChain of trust and expiry › Opoziv: CRL ili OCSPRevocation: CRL vs OCSPKako klijent primijeti opozvan certifikat (ili ne); prilaganje statusaHow a revoked certificate is (or isn't) noticed; staplingUdaljena ljuska i tuneliRemote shells and tunnels 2 simulatora2 simulators
SSH: ključ poslužitelja i ključ korisnikaSSH host and user keysknown_hosts, prijava ključem ili lozinkom, upozorenje pri prvom spajanjuknown_hosts, key auth vs password, the first-connection warning
SSH: prosljeđivanje portaSSH port forwardinglokalno, udaljeno i dinamičko prosljeđivanjelocal, remote and dynamic forwardingVirtualne privatne mrežeVirtual private networks 2 simulatora2 simulators
WireGuard: rukovanje, AllowedIPs i roamingWireGuard: handshake, AllowedIPs and roamingRukovanje u jednom povratnom putu, usmjeravanje po ključu, adresa naučena u hoduA 1-RTT handshake, cryptokey routing, and an endpoint learned on the move
IPsec i IKE: tunel između dviju lokacijaIPsec and IKE: a site-to-site tunnelDvije razmjene IKE-a, tunelski i transportni način, ESPIKE's two exchanges, tunnel vs transport mode, ESPVrijeme na mrežiTime on the network 4 simulatora4 simulators
Usklađivanje satovaSynchronising clocks 2 simulatora2 simulators
NTP: pomak i kašnjenjeNTP offset and delayČetiri vremenske oznake daju pomak i kašnjenje; stratumFour timestamps give offset and delay; stratum
Vrijeme u domeniTime in a domainEmulator PDC-a je izvor, članovi slijede DC-ove, Kerberos pada nakon 5 minutaPDC emulator is the source, members follow DCs, Kerberos fails past 5 minutesKad sat ne pokazuje točnoWhen a clock is wrong 2 simulatora2 simulators
Lanac povjerenja i rok valjanostiChain of trust and expiry › Krivi sat klijentaWrong client clockIstek mjeri sat klijenta: na poslužitelju se ništa ne mijenjaExpiry is measured by the client clock: nothing changes on the server
Kerberos: karte i satoviKerberos: tickets and clocksAS daje TGT, TGS kartu za uslugu, AP otvara mapu; razlika satova to rušiAS gives a TGT, TGS a service ticket, AP opens the share; clock skew breaks itSigurnost: povjerenje i napadiSecurity: trust and attacks 61 simulator61 simulators
Ključevi, lozinke i dozvole te kako ih napadači zaobilaze.Keys, passwords and permissions, and how attackers get around them.
KriptografijaCryptography11 simulatora11 simulatorsKljučevi i šifriranjeKeys and encryptionFunkcije sažimanjaHash functionsPotpisi i certifikatiSignatures and certificatesKriptografija u protokolimaCryptography in protocolsDokazivanje identitetaProving who you are13 simulatora13 simulatorsSpremanje lozinkiStoring passwordsPrijava ključemLogging in with keysKarte i izazov-odgovorTickets and challenge-responsePrijava preko drugog servisaLogging in through another servicePrijava na mrežni priključakLogging in to a network portKako se odlučuje o prijaviHow a login is decidedTko smije štoWho may do what9 simulatora9 simulatorsBitovi dozvola i klase korisnikaPermission bits and classesKontrola pristupa po oznakamaLabel-based access controlTokeni i efektivni pristup na WindowsimaTokens and effective access on WindowsVatrozidi i zoneFirewalls and zones8 simulatora8 simulatorsKako se čitaju pravila vatrozidaHow firewall rules are readZone i DMZZones and the DMZOdbacivanje ili odbijanjeDropping or rejectingKako napadi radeHow attacks work22 simulatora22 simulatorsUnos koji postaje kodInput that becomes codePreljev međuspremnikaBuffer overflowKrivotvoreni pošiljatelji i puteviForged senders and routesPreplavljivanje žrtveFlooding a victimKretanje kroz Windows domenuMoving through a Windows domainNapadi kroz sklopovljeAttacks through hardwareUcjenjivački programi i sigurnosne kopijeRansomware and backups
KriptografijaCryptography 11 simulatora11 simulators
Ključevi i šifriranjeKeys and encryption 2 simulatora2 simulators
Simetrično i asimetrično šifriranjeSymmetric vs asymmetric encryptionProblem raspodjele ključa i kako ga javni ključevi rješavajuThe key distribution problem and how public keys solve it
Diffie–HellmanZajednička tajna preko javnog kanala: prvo miješanje boja, zatim brojeviA shared secret over a public channel: colour mixing, then numbersFunkcije sažimanjaHash functions 3 simulatora3 simulators
Funkcije sažimanjaHash functionsStalna duljina, lavinski učinak, cjelovitost i kolizije sažetkaFixed length, the avalanche effect, integrity and collisions of a hashFunkcije sažimanjaHash functions › Jedan znak, pola sažetkaOne character, half the digestabc → abd mijenja 122 od 256 bitova sažetkaabc → abd flips 122 of the 256 digest bitsFunkcije sažimanjaHash functions › Kolizija malog sažetkaA collision in a toy hashSažetak od 8 bitova ponavlja se već kod 22. porukeAn 8-bit digest repeats already at message 22Potpisi i certifikatiSignatures and certificates 2 simulatora2 simulators
Digitalni potpisDigital signaturesPotpis privatnim ključem, provjera javnim: svaka izmjena ga kvariSign with the private key, verify with the public key; tampering breaks itLanac povjerenja i rok valjanostiChain of trust and expiryKrajnji, posrednički, spremište povjerenja; nedostaje posrednik; satovi istekaLeaf, intermediate, root store; a missing intermediate; expiry clocksKriptografija u protokolimaCryptography in protocols 4 simulatora4 simulators
TLS 1.2 i 1.3: rukovanje jedno uz drugoTLS 1.2 vs 1.3: the handshakes side by sideRazmjena ključeva, certifikat i krugovi: 2 RTT za TLS 1.2, 1 RTT za TLS 1.3Key exchange, certificate and round trips: 2 RTT for TLS 1.2, 1 RTT for TLS 1.3WPA2 i WPA3: rukovanje i što vidi promatračWPA2 and WPA3: the handshake and what an observer seesPorijeklo PMK-a, rukovanje u četiri koraka; WPA2-PSK se pogađa bez mreže, SAE nePMK origin, 4-way handshake, why WPA2-PSK can be cracked offline and SAE can'tWireGuard: rukovanje, AllowedIPs i roamingWireGuard: handshake, AllowedIPs and roamingRukovanje u jednom povratnom putu, usmjeravanje po ključu, adresa naučena u hoduA 1-RTT handshake, cryptokey routing, and an endpoint learned on the moveIPsec i IKE: tunel između dviju lokacijaIPsec and IKE: a site-to-site tunnelDvije razmjene IKE-a, tunelski i transportni način, ESPIKE's two exchanges, tunnel vs transport mode, ESPDokazivanje identitetaProving who you are 13 simulatora13 simulators
Spremanje lozinkiStoring passwords4 simulatora4 simulatorsPrijava ključemLogging in with keys1 simulatorKarte i izazov-odgovorTickets and challenge-response2 simulatora2 simulatorsPrijava preko drugog servisaLogging in through another service1 simulatorPrijava na mrežni priključakLogging in to a network port2 simulatora2 simulatorsKako se odlučuje o prijaviHow a login is decided3 simulatora3 simulators
Spremanje lozinkiStoring passwords 4 simulatora4 simulators
Spremanje lozinkiStoring passwordsLozinka, sažetak, sol i spori sažetak: što napadač dobije i koliko pogađaPlain, hashed, salted, slow-hashed: what an attacker gets and how long it takesSpremanje lozinkiStoring passwords › Ista lozinka bez soliOne password, no saltBez soli dva korisnika s istom lozinkom imaju isti zapisWithout a salt two users with one password share a stored valueSpremanje lozinkiStoring passwords › Lozinka od 4 mala slovaA four-letter password456 976 pokušaja: brzi sažetak padne za 46 µs, spori za 46 s456,976 guesses: a fast hash falls in 46 µs, a slow one in 46 s
Zaključavanje računaAccount lockoutPrag, brojač na emulatoru PDC-a i zastarjela lozinka koja zaključa računThreshold, bad-password count at the PDC emulator, a stale password locking itPrijava ključemLogging in with keys 1 simulator
Karte i izazov-odgovorTickets and challenge-response 2 simulatora2 simulators
Kerberos: karte i satoviKerberos: tickets and clocksAS daje TGT, TGS kartu za uslugu, AP otvara mapu; razlika satova to rušiAS gives a TGT, TGS a service ticket, AP opens the share; clock skew breaks it
NTLM i KerberosNTLM vs KerberosIzazov-odgovor ili karta; prelazak na NTLM; zašto pass-the-hash radiChallenge-response vs tickets; NTLM fallback; why pass-the-hash worksPrijava preko drugog servisaLogging in through another service 1 simulator
Prijava na mrežni priključakLogging in to a network port 2 simulatora2 simulators
AAA i 802.1X: prijava na priključak mrežeAAA and 802.1X: logging in on a network portKlijent, autentikator i RADIUS poslužitelj; priključak se otvara tek nakon EAP-aSupplicant, authenticator, RADIUS server; the port opens only after EAPWPA2 i WPA3: rukovanje i što vidi promatračWPA2 and WPA3: the handshake and what an observer seesPorijeklo PMK-a, rukovanje u četiri koraka; WPA2-PSK se pogađa bez mreže, SAE nePMK origin, 4-way handshake, why WPA2-PSK can be cracked offline and SAE can'tKako se odlučuje o prijaviHow a login is decided 3 simulatora3 simulators
PAM: kontrolne oznake odlučuju o prijaviPAM: control flags decide a loginrequired, requisite, sufficient i optional zajedno odlučuju o prijavirequired, requisite, sufficient and optional together decide a loginPAM: kontrolne oznake odlučuju o prijaviPAM: control flags decide a login › required pa sufficient: uspjeh se zanemarujerequired, then sufficient: the success is ignoredNakon pada required modula uspjeh sufficient modula se zanemarujeAfter a required module fails, a sufficient success is ignoredPAM: kontrolne oznake odlučuju o prijaviPAM: control flags decide a login › pam_permit na vrhu: svatko ulazipam_permit on top: everyone gets inRedoslijed je važan: sufficient pam_permit prvi pušta bilo koju lozinkuOrder matters: sufficient pam_permit first lets any password inTko smije štoWho may do what 9 simulatora9 simulators
Bitovi dozvola i klase korisnikaPermission bits and classes 4 simulatora4 simulators
Devet bitova dozvola, oktalni zapis i umaskNine permission bits, octal notation and umaskDevet bitova u tri zapisa; umask briše bitove: 666 uz 077 daje 600Nine bits written three ways; umask clears bits: 666 with 077 gives 600
Tko smije: vlasnik, grupa, ostaliWho may: owner, group, otherVlasnik, grupa, ostali: odlučuje prva klasa koja odgovara; maska ACL-aOwner, group, other: the first class that matches decides; the ACL mask
NFS i root_squash: tko si, odlučuje poslužiteljNFS and root squash: the server decides who you areZahtjev nosi samo broj; poslužitelj ga preslikava, pa provjerava dozvoleA request carries only a number; the server maps it, then checks permissions
Posebni bitovi: setuid, setgid i stickySpecial bits: setuid, setgid and stickyProces dobiva efektivni UID vlasnika programa; u /tmp briše samo vlasnikA process gets the program owner’s effective UID; in /tmp only owners deleteKontrola pristupa po oznakamaLabel-based access control 2 simulatora2 simulators
Dozvole kažu da, SELinux kaže neDAC says yes, SELinux says noDruga provjera nakon dozvola, po oznakama: tip, politika, način radaA second, label-based check after permissions: type, policy, modeDozvole kažu da, SELinux kaže neDAC says yes, SELinux says no › setenforce 0: prekidač, a ne popravaksetenforce 0: a switch, not a fixU načinu permissive radnja prolazi, a odbijanje se i dalje bilježiIn permissive mode the action goes through, and the denial is still loggedTokeni i efektivni pristup na WindowsimaTokens and effective access on Windows 3 simulatora3 simulators
Pristupni tokenThe access tokenSID-ovi i grupe utvrđuju se pri prijavi; zato se nakon promjene grupe odjavišSIDs and groups are fixed at logon; why you log off after a group change
UAC i podijeljeni tokenUAC and the split tokenAdministrator radi s filtriranim tokenom dok ne podigne ovlastiAdmins run with a filtered token until elevated
Efektivni pristup: NTFS i dijeljenjeEffective access: NTFS plus shareStrože od dvaju pobjeđuje, zabrana je jača od dozvole, grupe se zbrajajuThe stricter of the two wins; deny beats allow; groups add upVatrozidi i zoneFirewalls and zones 8 simulatora8 simulators
Kako se čitaju pravila vatrozidaHow firewall rules are read 3 simulatora3 simulators
Odlučuje prvi pogodakFirst match winsČita se odozgo, odlučuje prvo pravilo koje odgovara, na kraju skrivena zabranaRead top down, the first matching rule decides, an implicit deny ends the list
Vatrozid bez stanja i sa stanjemStateless and stateful firewallOdgovor treba zasebno pravilo, osim ako vatrozid pamti vezuThe reply needs its own rule, unless the firewall remembers the connectionAsimetričan put kroz NAT i vatrozidAsymmetric path through NAT and firewallOdgovor vraćen drugim putem uređaj sa stanjem ne prepoznajeReplies taking another path break stateful devicesZone i DMZZones and the DMZ 3 simulatora3 simulators
DMZ: matrica pravila vatrozidaDMZ: the firewall's rule matrixKoja zona smije otvoriti što prema kojojWhich zone may open what to whichCrtač mrežne topologijeNetwork topology drafter › Perimetar, DMZ i unutarnji LANPerimeter, DMZ and internal LANPerimetar s dva vatrozida u tri koraka: internet, DMZ, unutarnji LANA two-firewall perimeter in three steps: Internet, DMZ, internal LAN
Zone vatrozidaFirewall zoneszonu paketa određuje njegova izvorišna adresa ili sučeljea packet's zone comes from its source or its interfaceOdbacivanje ili odbijanjeDropping or rejecting 2 simulatora2 simulators
TCP SYN: otvoren, zatvoren, filtriranTCP SYN: open, closed, filtered › Vatrozid: odbaciti ili odbitiFirewall: drop or rejectTišina, ICMP 3/13 ili RST u ime hosta za isti blokirani portSilence, ICMP 3/13 or an RST in the host's name for the same blocked portZone vatrozidaFirewall zones › drop ili block: tišina ili odbijenicadrop or block: silence or a rejectodbačen paket izgleda kao ugašen stroj, odbijen dobiva odgovora dropped packet looks like a host that is down; a rejected one gets a replyKako napadi radeHow attacks work 22 simulatora22 simulators
Unos koji postaje kodInput that becomes code4 simulatora4 simulatorsPreljev međuspremnikaBuffer overflow1 simulatorKrivotvoreni pošiljatelji i puteviForged senders and routes3 simulatora3 simulatorsPreplavljivanje žrtveFlooding a victim1 simulatorKretanje kroz Windows domenuMoving through a Windows domain6 simulatora6 simulatorsNapadi kroz sklopovljeAttacks through hardware2 simulatora2 simulatorsUcjenjivački programi i sigurnosne kopijeRansomware and backups5 simulatora5 simulators
Unos koji postaje kodInput that becomes code 4 simulatora4 simulators
Umetanje SQL-aSQL injectionUnos zalijepljen u upit postaje kod; parametri to sprječavajuConcatenated input becomes code; parameters fix itUmetanje SQL-aSQL injection › ' OR '1'='1: uvijek istinito' OR '1'='1: always trueNavodnik u unosu zatvori nisku i uvjet vrijedi za svaki redakA quote in the input closes the string; the condition holds for every rowUmetanje SQL-aSQL injection › Parametrizirani upitParameterized queryIsti unos je samo vrijednost i nijedan redak se ne poklapaThe same input is just a value, and no row matchesSkriptiranje među stranicama (XSS)Cross-site scripting (XSS)Pohranjeni i reflektirani XSS; kodiranje izlazaStored vs reflected XSS; output encodingPreljev međuspremnikaBuffer overflow 1 simulator
Krivotvoreni pošiljatelji i puteviForged senders and routes 3 simulatora3 simulators
SPF, DKIM i DMARCSPF, DKIM and DMARC › Krivotvoreni From:A spoofed From:SPF i DKIM prolaze za tuđu domenu, DMARC ne prolaziSPF and DKIM pass for another domain; DMARC failsIPv6 NDP umjesto ARP-aIPv6 NDP instead of ARP › NDP i hop limit 255NDP and hop limit 255Oglas susjeda koji je prošao usmjernik odbacuje seA neighbour advertisement that crossed a router is droppedBGP: otmica prefiksa i provjera izvorištaBGP hijack and route origin validationSpecifičniji prefiks pobjeđuje; provjera izvorišta puta (ROA, ROV)A more-specific prefix wins; route origin validation (ROA, ROV)Preplavljivanje žrtveFlooding a victim 1 simulator
Kretanje kroz Windows domenuMoving through a Windows domain 6 simulatora6 simulators
Bočno kretanje i slojevi ovlastiLateral movement and tiering › Skok po skokHop by hopOd radne stanice preko poslužitelja do kontrolera domeneFrom a workstation through a server to the domain controllerBočno kretanje i slojevi ovlastiLateral movement and tieringJedna administratorska prijava na radnoj stanici otvara cijelu domenuOne admin logon on a workstation exposes the whole domainBočno kretanje i slojevi ovlastiLateral movement and tiering › Samo LAPSLAPS onlyLAPS siječe lokalni sažetak, ali ne štiti domenskog administratoraLAPS cuts the local hash but does not protect the Domain AdminBočno kretanje i slojevi ovlastiLateral movement and tiering › SlojeviTieringAdministrator sloja 0 ne prijavljuje se na radne stanice: nema što ukrastiA Tier 0 admin never logs on to a workstation: nothing to stealNTLM i KerberosNTLM vs KerberosIzazov-odgovor ili karta; prelazak na NTLM; zašto pass-the-hash radiChallenge-response vs tickets; NTLM fallback; why pass-the-hash works
Stalna ili privremena prava; račun za hitne slučajeveStanding or just-in-time admin; the break-glass accountStalna prava izložena su cijelu godinu, privremena samo dok trajuStanding admin rights are exposed all year; just in time only while in useNapadi kroz sklopovljeAttacks through hardware 2 simulatora2 simulators
Nuspojave sklopovlja: brzina, prostor, povjerenjeHardware side effects: speed, space and trustIspravni dijelovi ostavljaju tragove u dijeljenom stanju; optimizacija ih množiCorrect parts leave traces in shared state; optimising multiplies themRowhammer: smetnja među DRAM retcimaRowhammer: disturbance between DRAM rowsČeste aktivacije jednog retka prazne ćelije susjednih redaka prije osvježavanjaFrequent activations of one row drain the cells next to it before a refreshUcjenjivački programi i sigurnosne kopijeRansomware and backups 5 simulatora5 simulators
3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomwareKoje kopije prežive šifriranje i brisanjeWhich copies survive encryption and deletion3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomware › 3-2-1 u mreži3-2-1 online3-2-1 na papiru, a jedna vjerodajnica dohvaća sve kopije3-2-1 on paper, yet one credential reaches every copy3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomware › Nepromjenjiva kopijaImmutable copyZaključana kopija u oblaku odbija brisanje i preživiA locked cloud copy refuses the delete and survives3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomware › Vrpca izvan mrežeOffline tapeVrpca izvan mreže preživi, ali je starijaThe offline tape survives, but it is older
Očekivani godišnji gubitak (ALE) i cijena zaštiteExpected annual loss and the price of a controlALE = gubitak × učestalost; zaštita vrijedi kad uklanja više nego što stojiALE = loss × frequency; a control pays when it removes more than it costsGdje žive podaci: diskovi i datotečni sustaviWhere data lives: disks and file systems 53 simulatora53 simulators
Od jednog diska do volumena, snimki i grozdova za pohranu.From a single disk to volumes, snapshots and storage clusters.
Unutar diskaInside a disk9 simulatora9 simulatorsParticije: MBR i GPTPartitions: MBR and GPTKako SSD pišeHow an SSD writesIOPS, propusnost i kašnjenjeIOPS, throughput and latencyPriručna memorija za pisanje i nestanak strujeWrite caches and power lossDatotečni sustaviFile systems10 simulatora10 simulatorsKako su datoteke složene na diskuHow files are laid outImena, inodei i povezniceNames, inodes and linksMontiranjeMountingDisk koji kaže da je punA disk that says it is fullKontrolni zbrojevi i samoizlječenjeChecksums and self-healingVolumeni i bazeniVolumes and pools10 simulatora10 simulatorsLogički volumeniLogical volumesTanko dodjeljivanje prostoraThin provisioningDatotečni sustavi s bazenomPooled file systemsDatotečna i blokovska pohrana na mrežiFile and block storage over the networkRAID5 simulatora5 simulatorsRazine RAID-a i paritetRAID levels and parityObnova nakon kvara diskaRebuilding after a failed diskZrcalo nije sigurnosna kopijaA mirror is not a backupSnimke i kopiranje pri pisanjuSnapshots and copy-on-write9 simulatora9 simulatorsSnimke s kopiranjem pri pisanjuCopy-on-write snapshotsSjenovite kopije u WindowsimaWindows shadow copiesLanci slika diskaDisk image chainsDeduplikacijaDeduplicationGrozdovi za pohranuStorage clusters12 simulatora12 simulatorsRaspoređivanje podataka na mnogo strojevaPlacing data on many machinesReplike i kodiranje s brisanjemReplicas and erasure codingKad zakaže čvor grozdaWhen a cluster node failsIskoristivi kapacitetUsable capacity
Unutar diskaInside a disk 9 simulatora9 simulators
Particije: MBR i GPTPartitions: MBR and GPT 2 simulatora2 simulators
Tablice particija: MBR i GPTPartition tables: MBR vs GPTOgraničenja particija, zaštitni MBR i kopija zaglavlja na kraju diskaPartition limits, the protective MBR and the backup headerTablice particija: MBR i GPTPartition tables: MBR vs GPT › Disk od 4 TB s tablicom MBRA 4 TB disk with an MBR table32 bita dosežu 2 TiB; ostatak diska je nedostupan bez poruke o grešci32 bits reach 2 TiB; the rest of the disk is unreachable, with no errorKako SSD pišeHow an SSD writes 1 simulator
IOPS, propusnost i kašnjenjeIOPS, throughput and latency 4 simulatora4 simulators
IOPS, propusnost i kašnjenjeIOPS, throughput and latencyDubina reda i veličina bloka mijenjaju IOPS, propusnost i kašnjenjeQueue depth and block size trade IOPS, throughput and latency offIOPS, propusnost i kašnjenjeIOPS, throughput and latency › HDD: dublji red samo čekaHDD: a deeper queue only waits4 KiB uz QD 32: i dalje 125 IOPS, ali 257 ms umjesto 8 ms4 KiB at QD 32: still 125 IOPS, but 257 ms instead of 8 msIOPS, propusnost i kašnjenjeIOPS, throughput and latency › NVMe na stropu propusnostiNVMe at its bandwidth ceiling128 KiB uz QD 32: 3000 MB/s, IOPS staje, kašnjenje 1,4 ms128 KiB at QD 32: 3000 MB/s, IOPS stop, latency 1.4 ms
Raspoređivanje diskaDisk schedulingSSTF, SCAN, C-SCAN, FSCANPriručna memorija za pisanje i nestanak strujeWrite caches and power loss 2 simulatora2 simulators
Odgođeno i izravno upisivanjeWrite-back vs write-throughWrite-back je brz dok ne nestane struje; predmemorija s baterijomWrite-back is fast until the power fails; battery-backed cachePredmemorija stranica i prljave stranicePage cache and dirty pages › Gotovo pisanje nije na diskuA finished write is not on the diskPrljave stranice nestaju sa strujom; sync ih spašavaDirty pages go with the power; sync saves themDatotečni sustaviFile systems 10 simulatora10 simulators
Kako su datoteke složene na diskuHow files are laid out1 simulatorImena, inodei i povezniceNames, inodes and links3 simulatora3 simulatorsMontiranjeMounting3 simulatora3 simulatorsDisk koji kaže da je punA disk that says it is full3 simulatora3 simulatorsKontrolni zbrojevi i samoizlječenjeChecksums and self-healing1 simulator
Kako su datoteke složene na diskuHow files are laid out 1 simulator
Imena, inodei i povezniceNames, inodes and links 3 simulatora3 simulators
Imena, inodei i povezniceHard links, symlinks and inodesIme pokazuje na inode; brojač poveznica; viseća simbolička poveznicaNames point to inodes; the link count; dangling symlinksImena, inodei i povezniceHard links, symlinks and inodes › Viseća simbolička poveznicaA dangling symbolic linkPoveznica pamti samo stazu; bez datoteke na njoj cat ne uspijevaThe link stores only a path; with no file there, cat failsImena, inodei i povezniceHard links, symlinks and inodes › rm, a prostor se ne vraćarm, and the space does not come backBrojač je 0, ali proces drži datoteku otvorenomThe count is 0, but a process holds the file openMontiranjeMounting 3 simulatora3 simulators
Od blokovnog uređaja do točke montiranjaBlock device to mount pointDisk → particija → datotečni sustav → montiranje; montiranje zaklanja sadržajDisk → partition → filesystem → mount; a mount hides what was thereOd blokovnog uređaja do točke montiranjaBlock device to mount point › Četiri sloja do stazeFour layers to a pathTablica particija i particija, mkfs, mount: tek tada df ima redakPartition table and partition, mkfs, mount: only then does df have a rowOd blokovnog uređaja do točke montiranjaBlock device to mount point › Dva montiranja na istoj staziTwo mounts on one pathStaza vodi u najnovije; umount skida gornjeThe path leads to the newest; umount removes the top oneDisk koji kaže da je punA disk that says it is full 3 simulatora3 simulators
„Disk je pun”, a mjesta ima"Disk full" with free spacePonestalo inodea; obrisana datoteka koju proces drži otvorenomRunning out of inodes; a deleted file a process holds open„Disk je pun”, a mjesta ima"Disk full" with free space › Pun disk na 28 %Disk full at 28%Datoteke od jednog bajta potroše sve inode prije blokova1-byte files use up every inode before the blocksImena, inodei i povezniceHard links, symlinks and inodes › rm, a prostor se ne vraćarm, and the space does not come backBrojač je 0, ali proces drži datoteku otvorenomThe count is 0, but a process holds the file openKontrolni zbrojevi i samoizlječenjeChecksums and self-healing 1 simulator
Volumeni i bazeniVolumes and pools 10 simulatora10 simulators
Logički volumeniLogical volumes 2 simulatora2 simulators
LVM: topologijaLVM: topologyKako fizički volumeni, grupa volumena i logički volumeni dijele ekstenteHow physical volumes, a volume group and logical volumes share extents
Proširenje logičkog volumena i datotečnog sustavaExtending an LV and its filesystemFizički volumen → grupa → logički volumen → datotečni sustav, tim redomPV → VG → LV → filesystem, in that orderTanko dodjeljivanje prostoraThin provisioning 3 simulatora3 simulators
Tanki bazen i prekomjerno dodjeljivanjeThin provisioning and overcommitObećani i stvarni prostor: tanki bazen se puni pod svimaPromised vs real space: the thin pool fills under everyoneTanki bazen i prekomjerno dodjeljivanjeThin provisioning and overcommit › Jedan volumen puni bazenOne volume fills the poolPisanje pada i volumenu čiji datotečni sustav pokazuje 40 GiB slobodnoWrites fail even for a volume whose filesystem shows 40 GiB freeTanki bazen i prekomjerno dodjeljivanjeThin provisioning and overcommit › Obrisano, a nije vraćeno bazenuDeleted, not returned to the poolBrisanje datoteka ne oslobađa bazen bez odbacivanja blokovaDeleting files frees nothing in the pool without discardDatotečni sustavi s bazenomPooled file systems 2 simulatora2 simulators
ZFS i Btrfs: topologijaZFS and Btrfs: topologyZFS drži zalihost u vdevovima, Btrfs u profilima komada; što preživi otkaz diskaZFS puts redundancy in vdevs, Btrfs in chunk profiles; what survives a failure
Stratis: topologijaStratis: topologyOd lokalnog ili mrežnog blokovnog uređaja do bazena i tankog datotečnog sustavaFrom a local or network block device to a pool and a thin filesystemDatotečna i blokovska pohrana na mrežiFile and block storage over the network 3 simulatora3 simulators
Datotečno i blokovno spremišteFile vs block storageNAS (NFS/SMB) ili SAN (iSCSI/FC): tko vodi datotečni sustavNAS (NFS/SMB) vs SAN (iSCSI/FC): who owns the filesystem
Multipath: preuzimanje kad put padneMultipath I/O: path failoverKad put do LUN-a padne, U/I se ponavlja na drugom putu ili čekaWhen a path to the LUN fails, I/O is resent on another path or waitsNFS i root_squash: tko si, odlučuje poslužiteljNFS and root squash: the server decides who you areZahtjev nosi samo broj; poslužitelj ga preslikava, pa provjerava dozvoleA request carries only a number; the server maps it, then checks permissionsRAID 5 simulatora5 simulators
Razine RAID-a i paritetRAID levels and parity 2 simulatora2 simulators
RAID i priručna memorija diskaRAID and disk cacheRAID 0–6, paritet, disk cacheRAID 0–6, parity, disk cacheZFS i Btrfs: topologijaZFS and Btrfs: topologyZFS drži zalihost u vdevovima, Btrfs u profilima komada; što preživi otkaz diskaZFS puts redundancy in vdevs, Btrfs in chunk profiles; what survives a failureObnova nakon kvara diskaRebuilding after a failed disk 2 simulatora2 simulators
Obnova pod opterećenjem i drugi kvarRebuild under load and the second failureDuga obnova, nečitljiv sektor, izgubljeno poljeA long rebuild, an unreadable sector, a lost array
Kontrolni zbrojevi i samoizlječenjeChecksums and self-healingProvjera integriteta nađe loš blok i popravi ga iz zrcalaA scrub finds a bad block and repairs it from the mirrorZrcalo nije sigurnosna kopijaA mirror is not a backup 1 simulator
Snimke i kopiranje pri pisanjuSnapshots and copy-on-write 9 simulatora9 simulators
Snimke s kopiranjem pri pisanjuCopy-on-write snapshots 4 simulatora4 simulators
Datotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystemsSnimke dijele blokove; pisanje ide u nove blokoveSnapshots share blocks; writes go to new blocks
LVM snimka se puniAn LVM snapshot filling upPodručje kopiranja pri pisanju i nevaljana snimka kad se napuniCopy-on-write snapshot space, and invalidation when fullDatotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystems › Kopiranje ili preusmjeravanje pri pisanjuCopy-on-write vs redirect-on-writeKamo nakon snimke ide stari, a kamo novi blok; kazna pisanjaWhere the old and the new block go after a snapshot; the write penalty
Prirasna i diferencijalna kopijaIncremental vs differential backup › Slanje i primanje snimkiSnapshot send and receiveInkrementalna replikacija iz parova snimkiIncremental replication from snapshot pairsSjenovite kopije u WindowsimaWindows shadow copies 2 simulatora2 simulators
Datotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystems › Sjenovite kopije i prethodne verzijeShadow copies and Previous VersionsPrije prepisivanja stari blok ide u diferencijalno područje; vraćanje iz sjeneBefore an overwrite the old block goes to a diff area; restore from a shadowDatotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystems › Puno diferencijalno područjeA full diff areaKad se područje napuni, briše se najstarija sjena i njezina verzija nestajeWhen the diff area fills up, the oldest shadow is deleted with its versionLanci slika diskaDisk image chains 2 simulatora2 simulators
Lanci slika diskaBacking chainsČitanje pada kroz lanac, spajanje i prekinuta karikaReads fall through the chain, merging, and a broken linkLanci slika diskaBacking chains › Kontrolne točke u Hyper-V-uHyper-V checkpointsBrisanje kontrolne točke spaja njezin AVHDX u roditeljaDeleting a checkpoint merges its AVHDX into the parentDeduplikacijaDeduplication 1 simulator
Grozdovi za pohranuStorage clusters 12 simulatora12 simulators
Raspoređivanje podataka na mnogo strojevaPlacing data on many machines3 simulatora3 simulatorsReplike i kodiranje s brisanjemReplicas and erasure coding3 simulatora3 simulatorsKad zakaže čvor grozdaWhen a cluster node fails3 simulatora3 simulatorsIskoristivi kapacitetUsable capacity3 simulatora3 simulators
Raspoređivanje podataka na mnogo strojevaPlacing data on many machines 3 simulatora3 simulators
Ceph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recoveryKako CRUSH smješta podatke i što grozd preživi kad mu dijelovi otkažuHow CRUSH places data, and what a cluster survives when parts of it failCeph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recovery › Hiperkonvergirana 3 čvora3-node hyperconvergedNajmanji razuman grozd: tri domaćina, tri replike, po jedan MON na svakomThe smallest sensible cluster: three hosts, three replicas, a MON on each
Domena kvara u pravilu smještajaFailure domain in a placement ruleIsti podaci uz type host i uz type rack, pa se izgubi ormarSame data, rule by host vs by rack; then lose a rackReplike i kodiranje s brisanjemReplicas and erasure coding 3 simulatora3 simulators
Kodiranje s brisanjem ili kopijeErasure coding vs replicationProstor, preživljeni kvarovi i cijena obnove: n kopija ili k+m dijelovaOverhead vs failures tolerated vs rebuild cost: n replicas or k+m shards
size i min_size: kada bazen stanesize and min_size: when a pool stopssize 2, min_size 2 staje na jednom kvaru; 3/2 ne stajesize 2, min_size 2 stops on one failure; 3/2 does notsize i min_size: kada bazen stanesize and min_size: when a pool stops › Sjedište: pada osd.15HQ: osd.15 failsvm-rbd, size 2, min_size 2: 30 od 512 PG-ova stajevm-rbd, size 2, min_size 2: 30 of 512 PGs stopKad zakaže čvor grozdaWhen a cluster node fails 3 simulatora3 simulators
down i out: kada Ceph kopiradown vs out: when Ceph copiesdown: degradirano, ništa se ne miče; out nakon intervala: preraspodjeladown: degraded, nothing moves; out after a timer: rebalancingCeph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recovery › Tri replike, jedan ormarThree replicas, one rackDomena kvara host: zdravo dok ne padne ormar, a onda PG-ovi stanuFailure domain host: healthy until a rack fails, then PGs go inactiveKodiranje s brisanjem ili kopijeErasure coding vs replication › EC 4+2: cijelo, a ipak stojiEC 4+2: complete, yet stoppedDva ispala: 4 od 6 dijelova, podaci su cijeli, ali min_size 5 zaustavlja U/ITwo hosts down: 4 of 6 shards, the data is complete, but min_size 5 stops I/OIskoristivi kapacitetUsable capacity 3 simulatora3 simulators
Najmanji disk određuje kapacitetThe smallest disk caps the poolNajpuniji OSD određuje MAX AVAIL; neravnomjerni poslužitelji pune se prviThe fullest OSD sets MAX AVAIL; uneven hosts fill firstNajmanji disk određuje kapacitetThe smallest disk caps the pool › Sjedište: „tek 38 % puno”HQ: "only 38 % full"Sirovo 38 %, a osd.13 na 89 %: vm-rbd prima još samo 3,4 TiB38 % raw, but osd.13 at 89 %: vm-rbd takes only 3.4 TiB moreCeph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recovery › Neuravnoteženi domaćiniUnbalanced hostsJedan velik i dva mala domaćina: mali se pune prvi i ograničavaju grozdOne big host, two small ones: the small ones fill first and cap the clusterKad nešto zakaže: zalihost i oporavakWhen things fail: redundancy and recovery 71 simulator71 simulators
Kopije, kvorumi, sigurnosne kopije i planovi koji čuvaju uslugu i podatke.Copies, quorums, backups and plans that keep a service and its data alive.
Domene kvaraFailure domains8 simulatora8 simulatorsNajmanje što obara usluguThe smallest thing that takes a service downIspadi preko više regijaOutages that cross regionsRaspoređivanje kopija po ormarimaSpreading copies across racksZalihosne komponenteRedundant components15 simulatora15 simulatorsZalihosni diskoviRedundant disksKoliko je kopija dovoljnoHow many copies are enoughZalihosne vezeRedundant linksZalihosni poslužiteljiRedundant serversReplikacijaReplication8 simulatora8 simulatorsZaostatak replikacije i preuzimanjeReplication lag and failoverPisanje na više glavnih poslužiteljaWrites on several mastersRaspoređivanje ključeva po čvorovimaSpreading keys across nodesPonovno kopiranje nakon kvaraRecopying after a failureKvorum i dogovorQuorum and consensus7 simulatora7 simulatorsKvorum i rascjep mozgaQuorum and split-brainOgrađivanje čvoraFencing a nodeIzbor vođeElecting a leaderDosljednost ili dostupnostConsistency or availabilitySigurnosne kopijeBackups15 simulatora15 simulatorsPotpuna, prirasna i diferencijalnaFull, incremental and differentialIzmještanje podatakaCopying the data offŠto nije sigurnosna kopijaWhat is not a backupKopije koje lažuBackups that liePlaniranje za katastrofuPlanning for disaster19 simulatora19 simulatorsKoliko podataka i vremena gubišHow much data and time you losePrelazak na drugu lokacijuSite failoverPreživjeti ucjenjivački programSurviving ransomwareObnova imenika domeneRestoring the domain directoryUvođenje i povlačenje izmjeneRolling out and rolling back a change
Domene kvaraFailure domains 8 simulatora8 simulators
Najmanje što obara usluguThe smallest thing that takes a service down 3 simulatora3 simulators
Domene kvara i minimalni rezni skupoviFault domains and minimal cut setsŠto je najmanje što obara uslugu, i zašto odgovor nikad nije »ništa«The smallest thing that takes a service down, and why it is never nothingDomene kvara i minimalni rezni skupoviFault domains and minimal cut sets › Tri ormara, jedna razdjelnica napajanjaThree racks, one power stripKorelirani kvar: dva ormara na istom napajanju, trostruka zalihost postaje jednaCorrelated failure: two racks on one feed turn 3x redundancy into oneDomene kvara i minimalni rezni skupoviFault domains and minimal cut sets › Tri zone, a opet nije nulaThree zones, and still not zeroKvorum od tri i replike posvuda: nacrtano drži, a onda dođu autoritetiQuorum of three, replicas everywhere: the drawing holds, then authorities landIspadi preko više regijaOutages that cross regions 2 simulatora2 simulators
Domene kvara i minimalni rezni skupoviFault domains and minimal cut sets › Više regija, upravljačka ravnina u jednojMulti-region, single-region control planeIspad od 20. 10. 2025.: zdravo opterećenje u drugoj regiji ipak ne radiThe 20 Oct 2025 outage: a healthy workload in another region still cannot serveDomene kvara i minimalni rezni skupoviFault domains and minimal cut sets › Konfiguracijska izmjena stiže u svaku regijuA config push reaches every regionIspad od 29. 10. 2025.: jedna izmjena globalnog ruba obara sve regije odjednomThe 29 Oct 2025 outage: one change to the global edge takes every region at onceRaspoređivanje kopija po ormarimaSpreading copies across racks 3 simulatora3 simulators
Domena kvara u pravilu smještajaFailure domain in a placement ruleIsti podaci uz type host i uz type rack, pa se izgubi ormarSame data, rule by host vs by rack; then lose a rackCeph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recovery › 9 čvorova u 3 ormara9 nodes across 3 racksReplike po ormarima, EC 4+2 po domaćinima: što preživi gubitak ormara?Replicas across racks, EC 4+2 across hosts: which survives a lost rack?Ceph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recovery › Tri replike, jedan ormarThree replicas, one rackDomena kvara host: zdravo dok ne padne ormar, a onda PG-ovi stanuFailure domain host: healthy until a rack fails, then PGs go inactiveZalihosne komponenteRedundant components 15 simulatora15 simulators
Zalihosni diskoviRedundant disks 4 simulatora4 simulators
RAID i priručna memorija diskaRAID and disk cacheRAID 0–6, paritet, disk cacheRAID 0–6, parity, disk cacheObnova pod opterećenjem i drugi kvarRebuild under load and the second failureDuga obnova, nečitljiv sektor, izgubljeno poljeA long rebuild, an unreadable sector, a lost arrayKontrolni zbrojevi i samoizlječenjeChecksums and self-healingProvjera integriteta nađe loš blok i popravi ga iz zrcalaA scrub finds a bad block and repairs it from the mirrorMultipath: preuzimanje kad put padneMultipath I/O: path failoverKad put do LUN-a padne, U/I se ponavlja na drugom putu ili čekaWhen a path to the LUN fails, I/O is resent on another path or waitsKoliko je kopija dovoljnoHow many copies are enough 4 simulatora4 simulators
Kodiranje s brisanjem ili kopijeErasure coding vs replicationProstor, preživljeni kvarovi i cijena obnove: n kopija ili k+m dijelovaOverhead vs failures tolerated vs rebuild cost: n replicas or k+m shardssize i min_size: kada bazen stanesize and min_size: when a pool stopssize 2, min_size 2 staje na jednom kvaru; 3/2 ne stajesize 2, min_size 2 stops on one failure; 3/2 does notDomene kvara i minimalni rezni skupoviFault domains and minimal cut sets › size=2, min_size=2Kad su potrebne sve kopije, gubitak jednog diska zaustavlja bazenWhen every copy is required, losing one disk stops the poolKodiranje s brisanjem ili kopijeErasure coding vs replication › EC 4+2: cijelo, a ipak stojiEC 4+2: complete, yet stoppedDva ispala: 4 od 6 dijelova, podaci su cijeli, ali min_size 5 zaustavlja U/ITwo hosts down: 4 of 6 shards, the data is complete, but min_size 5 stops I/OZalihosne vezeRedundant links 3 simulatora3 simulators
Udruživanje veza i raspodjela tokovaLink aggregation and flow hashingZašto jedan tok nikad ne premaši brzinu jedne članske vezeWhy one flow never exceeds one member linkNačini rada bondaBonding modesactive-backup, balance ili 802.3ad: što koji način rada žrtvujeactive-backup vs balance vs 802.3ad: what each gives upRazapinjuće stablo (STP)Spanning tree (STP)Izbor korijenskog mosta, uloge priključaka i koji priključak blokira petljuRoot bridge election, port roles, and which port blocks the loopZalihosni poslužiteljiRedundant servers 4 simulatora4 simulators
Obrnuti proxy i raspodjela opterećenjaReverse proxy and load balancing › Provjera ispravnosti i 502Health checks and 502b2 otkaže u 4 s, isključen je tek u 8 s; do tada njegovi zahtjevi dobivaju 502b2 fails at 4 s and is marked down only at 8 s; until then its requests get 502DNS: sekundarni poslužitelj i istek zoneDNS: the secondary and zone expirySekundarni je predmemorija s rokom: mrtvi primarni obori zonu, samo kasnijeA secondary is a cache with a timer: a dead primary takes the zone down later
DHCP failoverRaspodjela ili vruća pričuva, MCLT i partner down; stari podijeljeni opseg 80/20Load balance vs hot standby, MCLT and partner down; the old 80/20 split scope
VRRP: prijelaz na pričuvniVRRP failoverIzbor glavnog, virtualna IP adresa, preuzimanje prednosti, ARP objavaMaster election, virtual IP, preemption and gratuitous ARPReplikacijaReplication 8 simulatora8 simulators
Zaostatak replikacije i preuzimanjeReplication lag and failover2 simulatora2 simulatorsPisanje na više glavnih poslužiteljaWrites on several masters2 simulatora2 simulatorsRaspoređivanje ključeva po čvorovimaSpreading keys across nodes2 simulatora2 simulatorsPonovno kopiranje nakon kvaraRecopying after a failure2 simulatora2 simulators
Zaostatak replikacije i preuzimanjeReplication lag and failover 2 simulatora2 simulators
Zaostatak replikacije i preuzimanjeReplication lag and failoverAsinkrone replike kasne; preuzimanje gubi rep; čitanje vlastitih upisaAsync replicas lag; failover loses the tail; reading your own writesZaostatak replikacije i preuzimanjeReplication lag and failover › Sinkrona i asinkrona replikacijaSynchronous vs asynchronous replicationSinkrono: RPO 0 uz sporije upise; asinkrono: gubitak pri paduSync: RPO 0 but slower commits; async: loss on failoverPisanje na više glavnih poslužiteljaWrites on several masters 2 simulatora2 simulators
Replikacija s više glavnih poslužitelja: sukobMulti-master replication with a conflictIstodobni upisi na dva glavna poslužitelja: zadnji upis, inačice, što se gubiConcurrent writes on two masters: last-writer-wins, versions, what is lost
Replikacija AD-a s više glavnih kopijaAD multi-master replicationUSN-ovi, vektor ažurnosti i pobjeda zadnjeg upisa po atributuUSNs, the up-to-dateness vector, attribute-level last writer winsRaspoređivanje ključeva po čvorovimaSpreading keys across nodes 2 simulatora2 simulators
Dosljedno raspršivanjeConsistent hashingNovi čvor na prstenu premješta 1/n ključeva, a mod n gotovo sveAdding a node moves 1/n of the keys on a ring; mod n moves almost allDosljedno raspršivanjeConsistent hashing › Jedna točka po čvoruOne point per nodeNa prstenu se premjesti malo ključeva, ali opterećenje čvorova je nejednakoFew keys move on the ring, but the nodes' load is unevenPonovno kopiranje nakon kvaraRecopying after a failure 2 simulatora2 simulators
down i out: kada Ceph kopiradown vs out: when Ceph copiesdown: degradirano, ništa se ne miče; out nakon intervala: preraspodjeladown: degraded, nothing moves; out after a timer: rebalancingCeph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recoveryKako CRUSH smješta podatke i što grozd preživi kad mu dijelovi otkažuHow CRUSH places data, and what a cluster survives when parts of it failKvorum i dogovorQuorum and consensus 7 simulatora7 simulators
Kvorum i rascjep mozgaQuorum and split-brain 3 simulatora3 simulators
Kvorum i rascjep mozgaQuorum and split-brainVećina drži jednu stranu živom; paran broj čvorova, svjedok i rascjep mozgaA majority keeps one side alive; even counts, witnesses and split-brainKvorum i rascjep mozgaQuorum and split-brain › Windows grozd sa svjedokomFailover cluster with a witnessDva čvora i svjedok na dijeljenoj mapi: jedan pada, drugi ima 2 od 3 glasaTwo nodes and a file share witness: one fails, the other has 2 of 3 votesKvorum i rascjep mozgaQuorum and split-brain › Dinamički kvorum i svjedokDynamic quorum and witnessPali čvorovi gube glas, svjedok glasa uz paran broj: grozd radi do zadnjeg čvoraFailed nodes lose their votes, the witness votes on even counts: down to 1 nodeOgrađivanje čvoraFencing a node 1 simulator
Izbor vođeElecting a leader 2 simulatora2 simulators
Raft: izbor vođe i replikacija dnevnikaRaft: leader election and log replicationMandati, glasovi i potvrda zapisa na većini poslužiteljaTerms, votes and committing an entry on a majorityRaft: izbor vođe i replikacija dnevnikaRaft: leader election and log replication › Raft: vođa u manjiniRaft: a leader in a minorityOdsječeni vođa ne može potvrditi; njegovi zapisi se zamjenjujuA cut-off leader cannot commit; its entries are replacedDosljednost ili dostupnostConsistency or availability 1 simulator
Sigurnosne kopijeBackups 15 simulatora15 simulators
Potpuna, prirasna i diferencijalnaFull, incremental and differential 3 simulatora3 simulators
Prirasna i diferencijalna kopijaIncremental vs differential backupŠto koja kopija sprema i koje kopije treba oporavakWhat each backup stores, and what a restore needs
Retencija: djed-otac-sinRetention: grandfather-father-sonKoliko kopija raspored čuva i koliko se daleko unatrag može vratitiHow many copies a schedule keeps and how far back you can goRetencija: djed-otac-sinRetention: grandfather-father-son › 7 dnevnih i 4 tjedne: koliko unatrag?7 daily and 4 weekly: how far back?11 točaka, najstarija 32 dana: greška od prije 6 tjedana nema kamo11 points, the oldest 32 days: a fault from 6 weeks ago has nowhere to goIzmještanje podatakaCopying the data off 4 simulatora4 simulators
rsync: kosa crta na kraju i --deletersync: the trailing slash and --deletesrc ili src/, i kako --delete zrcali pogreškusrc vs src/, and how --delete mirrors a mistake
Deduplikacija: odsječci stalne duljine i po sadržajuDeduplication: fixed vs content-defined chunksUmetnut bajt pomiče sve fiksne odsječke; granice po sadržaju vraćaju se sameAn inserted byte shifts every fixed chunk; rolling-hash boundaries resynchronise
Prozor za kopiranje i prva izmještena kopijaBackup window and offsite seedingKoličina, propusnost i prozor: zašto prva kopija ide kamionomSize vs bandwidth vs window: why the first offsite copy goes by truckProzor za kopiranje i prva izmještena kopijaBackup window and offsite seeding › Prva kopija kamionomFirst copy by truck21,4 TB preko 50 Mbit/s: 39,6 dana; diskovima manje od tri dana21.4 TB over 50 Mbit/s: 39.6 days; on disks under three daysŠto nije sigurnosna kopijaWhat is not a backup 3 simulatora3 simulators
Zrcalo nije sigurnosna kopijaA mirror is not a backupRAID štiti od kvara diska, ne od brisanja ni pogrešnog sadržajaRAID protects against disk loss, not deletion or corruption
RPO i RTORPO and RTO › Replika nije kopijaReplica is no backupReplikacija daje RPO 0 za kvar diska, a za brisanje nijednu točku oporavkaReplication gives RPO 0 for a disk failure and no recovery point for a deletionDatotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystems › Sjenovite kopije i prethodne verzijeShadow copies and Previous VersionsPrije prepisivanja stari blok ide u diferencijalno područje; vraćanje iz sjeneBefore an overwrite the old block goes to a diff area; restore from a shadowKopije koje lažuBackups that lie 5 simulatora5 simulators
Kopija koja lažeThe backup that liesKopija javlja uredno; tek proba oporavka pokaže što u njoj nemaBackups report OK; only a test restore shows what is missingKopija koja lažeThe backup that lies › Tjedna kontrolna točka od 1,2 MBA 1.2 MB weekly checkpointDnevnik osam tjedana kaže „nightly OK”; jedan tjedan ima 1,2 MBEight weeks of "nightly OK" in the log; one week is 1.2 MB
Izlazni status: &&, ||, set -e i pipefailExit status: &&, ||, set -e and pipefail › Noćni posao javlja OK, a sigurnosna kopija je krnjaThe nightly job says OK, and the backup is truncatedPad usred cjevovoda bez pipefail: status 0, poruka OK, datoteka od 1,2 MBA failure mid-pipeline without pipefail: status 0, an OK mail, a 1.2 MB fileRetencija: djed-otac-sinRetention: grandfather-father-son › Kad noćni posao padaWhen the nightly job failsNišta se ne orezuje: istih 11 kopija, najnovija stara 49 danaNothing is pruned: the same 11 copies, the newest 49 days old
Testovi obnove kao dokaz: cijelo okruženje u godini danaRestore tests as evidence: covering the estate in a yearKopiju dokazuje test obnove; redoslijed testova odlučuje što ostaje netestiranoA restore test proves a backup; the order of tests decides what is never testedPlaniranje za katastrofuPlanning for disaster 19 simulatora19 simulators
Koliko podataka i vremena gubišHow much data and time you lose6 simulatora6 simulatorsPrelazak na drugu lokacijuSite failover1 simulatorPreživjeti ucjenjivački programSurviving ransomware5 simulatora5 simulatorsObnova imenika domeneRestoring the domain directory3 simulatora3 simulatorsUvođenje i povlačenje izmjeneRolling out and rolling back a change4 simulatora4 simulators
Koliko podataka i vremena gubišHow much data and time you lose 6 simulatora6 simulators
RPO i RTORPO and RTOKoliko podataka i koliko vremena gubite, na jednoj vremenskoj crtiHow much data and how much time you lose, on one timelineRPO i RTORPO and RTO › Noćna kopijaNightly backupKopija u 01:40, incident u 14:05: 12 h 25 min podataka i 6,5 h prekidaA copy at 01:40, an incident at 14:05: 12 h 25 min of data, 6.5 h downRPO i RTORPO and RTO › Tek u ponedjeljakFound on MondaySamo otkrivanje traje 32,5 sata, cilj RTO promašen prije vraćanjaDetection alone takes 32.5 hours; the RTO target is missed before any restoreRPO i RTORPO and RTO › Neuspjele kopijeFailing backupsKopija svake noći, a zadnja koja se vraća stara je 49 danaA copy every night, but the last one that restores is 49 days old
Koliko košta sat zastoja i koliko vrijedi jedna devetkaWhat an hour down costs, and what a nine is worthSat zastoja košta prosjek tjedna; svaka devetka štedi manje, a košta višeAn hour down costs the week's average; each nine saves less and costs more
Analiza utjecaja na poslovanje: što se mora prvo vratitiBusiness impact analysis: what must come back firstSustav nasljeđuje najkraći podnošljivi prekid svih procesa iznad sebeA system inherits the shortest tolerable downtime of every process above itPrelazak na drugu lokacijuSite failover 1 simulator
Preživjeti ucjenjivački programSurviving ransomware 5 simulatora5 simulators
3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomwareKoje kopije prežive šifriranje i brisanjeWhich copies survive encryption and deletion3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomware › 3-2-1 u mreži3-2-1 online3-2-1 na papiru, a jedna vjerodajnica dohvaća sve kopije3-2-1 on paper, yet one credential reaches every copy3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomware › Nepromjenjiva kopijaImmutable copyZaključana kopija u oblaku odbija brisanje i preživiA locked cloud copy refuses the delete and survives3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomware › Vrpca izvan mrežeOffline tapeVrpca izvan mreže preživi, ali je starijaThe offline tape survives, but it is olderRPO i RTORPO and RTO › Ucjenjivački softverRansomwareŠifriranje nose replika i kopije poslije 02:10; vrijedi kopija od prije napadaThe replica and the copies after 02:10 carry the encryption; the 01:40 one worksObnova imenika domeneRestoring the domain directory 3 simulatora3 simulators
Obrisani objekti: tombstone i koš za smeće AD-aDeleted objects: tombstone and Recycle BinŽivotni vijek nadgrobnog zapisa, koš za smeće AD-a i mjerodavna obnovaTombstone lifetime, the Recycle Bin and authoritative restore
Obnova DC-a i USN rollbackRestoring a DC, and USN rollbackNemjerodavna i mjerodavna obnova; vraćanje snimke DC-a tiho kvari replikacijuNon-authoritative vs authoritative restore; snapshot reverts break replication
FSMO uloge: prijenos ili preuzimanjeFSMO roles: transfer or seizePoslovi samo jednog DC-a, što pada bez nositelja; prijenos ili preuzimanjeThe single-master jobs, what breaks without the holder; transfer vs seizeUvođenje i povlačenje izmjeneRolling out and rolling back a change 4 simulatora4 simulators
Plavo-zeleno, kanarinac, postupno uvođenjeBlue-green, canary, rollingKako svaka strategija seli promet na novu inačicu i vraća lošu natragHow each strategy moves traffic to a new version and rolls a bad one back
Grupe računala i odobrenjaComputer groups and approvals › Prstenovi uvođenja ažuriranjaUpdate ringsPrstenovi s odgodom odobrenja; loša zakrpa zaustavljena u prstenu 1Approval rings and deferrals; a bad patch stopped at ring 1Domene kvara i minimalni rezni skupoviFault domains and minimal cut sets › Konfiguracijska izmjena stiže u svaku regijuA config push reaches every regionIspad od 29. 10. 2025.: jedna izmjena globalnog ruba obara sve regije odjednomThe 29 Oct 2025 outage: one change to the global edge takes every region at once
Upravljanje promjenama: razredi rizika ili odbor za sveChange management: risk classes or one board for everythingOdbor za svaku promjenu rađa velike pakete koji češće padaju; razredi rizika neA board for every change breeds big batches that fail more; risk classes don'tPerformanse: zašto sustavi usporavajuPerformance: why systems get slow 57 simulatora57 simulators
Redovi čekanja, predmemorije i granice koje određuju stvarnu brzinu.Queues, caches and limits that decide how fast things really go.
Redovi čekanja i opterećenjeQueues and load15 simulatora15 simulatorsČekanje pri gotovo punoj iskorištenostiWaiting near full utilisationKoliko ih je u sustavu: Littleov zakonHow many are inside: Little's lawVarijabilnost i najsporiji zahtjeviVariability and tail latencyČitanje opterećenja sustavaReading the load averageRaspodjela zahtjeva po poslužiteljimaSpreading requests over serversPreviše zahtjeva: ograničenje i ponovni pokušajiToo many requests: limits and retriesParalelizam i njegove graniceParallelism and its limits4 simulatora4 simulatorsDio koji se ne može ubrzatiThe part that cannot be sped upMnogo jezgri, jedna memorijaMany cores, one memoryMnogo veza, jedan tokMany links, one flowBrzina mrežeNetwork speed12 simulatora12 simulatorsKašnjenje na jednom skokuDelay on one hopVeličina prozora i brzina prijenosaWindow size and throughputPrioritet prometa: QoSTraffic priority: QoSBrže web straniceFaster web pagesBrzina diskaDisk speed8 simulatora8 simulatorsIOPS, dubina reda i veličina blokaIOPS, queue depth and block sizeRedoslijed zahtjeva prema diskuOrdering disk requestsPriručne memorije ispred diskaCaches in front of the diskPojačanje pisanja u SSD-uWrite amplification in an SSDPritisak na memorijuMemory pressure9 simulatora9 simulatorsStraničenje i zamjena stranicaPaging and page replacementOdlagalište i ubojica OOMSwap and the OOM killerOgraničenja za skupinu procesaLimits for a group of processesKad ponestane kapacitetaRunning out of capacity9 simulatora9 simulatorsPohrana koja se prerano puniStorage that fills up earlyRasponi adresa koji se trošeAddress ranges that run outUzbuna prije nego ponestaneAlerting before it runs outKoliko pouzdano je dovoljno: SLOHow reliable is reliable enough: SLOsAutomatsko skaliranjeAutoscaling
Redovi čekanja i opterećenjeQueues and load 15 simulatora15 simulators
Čekanje pri gotovo punoj iskorištenostiWaiting near full utilisation4 simulatora4 simulatorsKoliko ih je u sustavu: Littleov zakonHow many are inside: Little's law1 simulatorVarijabilnost i najsporiji zahtjeviVariability and tail latency3 simulatora3 simulatorsČitanje opterećenja sustavaReading the load average3 simulatora3 simulatorsRaspodjela zahtjeva po poslužiteljimaSpreading requests over servers2 simulatora2 simulatorsPreviše zahtjeva: ograničenje i ponovni pokušajiToo many requests: limits and retries2 simulatora2 simulators
Čekanje pri gotovo punoj iskorištenostiWaiting near full utilisation 4 simulatora4 simulators
Kašnjenje pri gotovo punoj iskorištenostiLatency near full utilisation › Pola opterećenjaHalf loadρ 0,5: srednje vrijeme 0,20 s, dvaput samo posluživanje; p99 0,92 sρ 0.5: mean time 0.20 s, twice the service alone; p99 0.92 sKašnjenje pri gotovo punoj iskorištenostiLatency near full utilisation › KoljenoThe kneeρ 0,9: srednje vrijeme 1 s, deset puta posluživanje; p99 4,6 sρ 0.9: mean time 1 s, ten times the service; p99 4.6 sKašnjenje pri gotovo punoj iskorištenostiLatency near full utilisation › Skoro punoNear fullρ 0,99: srednje vrijeme 10 s, p99 46 s; zadnjih 9 % opterećenja košta 10×ρ 0.99: mean time 10 s, p99 46 s; the last 9 % of load costs 10×Kašnjenje pri gotovo punoj iskorištenostiLatency near full utilisationVrijeme čekanja eksplodira kad iskorištenost ρ ide prema 1Waiting time explodes as utilisation ρ goes to 1Koliko ih je u sustavu: Littleov zakonHow many are inside: Little's law 1 simulator
Varijabilnost i najsporiji zahtjeviVariability and tail latency 3 simulatora3 simulators
Kašnjenje pri gotovo punoj iskorištenostiLatency near full utilisation › VarijabilnostVariabilitycv² od 1 na 9 uz ρ 0,1: srednje vrijeme ×1,4, p99 ×5cv² from 1 to 9 at ρ 0.1: mean time ×1.4, p99 ×5Kašnjenje pri gotovo punoj iskorištenostiLatency near full utilisation › Lanac od tri slojaThree-tier chainp99 se zbraja po pozivima: 0,99 s s kraja na kraj, ispod cilja od 2 sp99 adds up along the calls: 0.99 s end to end, under the 2 s target
Kašnjenje u repu i grananje pozivaTail latency and fan-outp99 se odvaja od prosjeka; grananje poziva rep čini uobičajenimp99 decouples from the mean; fan-out makes the tail commonČitanje opterećenja sustavaReading the load average 3 simulatora3 simulators
Opterećenje sustavaLoad averageOpterećenje broji poslove u stanju R i D, a ne postotak procesoraLoad counts runnable and D-state tasks, not CPU percentOpterećenje sustavaLoad average › Dva posla na jednoj jezgriTwo tasks on one coreIsta brojka na manje jezgri: red dulji od kapacitetaThe same number on fewer cores: a queue longer than capacityOpterećenje sustavaLoad average › Visoko opterećenje uz prazan procesorHigh load with an idle CPUPoslovi koji čekaju disk ulaze u opterećenje, a ne u %CPUTasks waiting for disk count in the load, not in %CPURaspodjela zahtjeva po poslužiteljimaSpreading requests over servers 2 simulatora2 simulators
Obrnuti proxy i raspodjela opterećenjaReverse proxy and load balancingKružno, najmanje veza, hash i kolačić; provjere ispravnostiRound robin vs least connections vs hash vs sticky; health checksObrnuti proxy i raspodjela opterećenjaReverse proxy and load balancing › Najmanje veza i spori poslužiteljLeast connections and a slow backendSpori b2 drži veze otvorene i dobiva 2 od 9 zahtjeva; kružno bi dobio 3The slow b2 keeps connections open and gets 2 of 9 requests; round robin gives 3Previše zahtjeva: ograničenje i ponovni pokušajiToo many requests: limits and retries 2 simulatora2 simulators
Kantica sa žetonima i kantica koja curiToken bucket vs leaky bucketNalet propušten odjednom ili razvučen u čekanjeA burst let through at once, or spread out as delay
Oluja ponovnih pokušaja i metastabilni kvarRetry storms and metastable collapsePonovni pokušaji drže sustav dolje; odgoda, slučajni pomak, kontrola prijemaRetries keep a recovered system down; backoff, jitter, admission controlParalelizam i njegove graniceParallelism and its limits 4 simulatora4 simulators
Dio koji se ne može ubrzatiThe part that cannot be sped up 2 simulatora2 simulators
Amdahlov zakonAmdahl's lawUbrzanje ograničava dio programa koji se ne može ubrzatiSpeedup is limited by the part of a program that cannot be sped upAmdahlov zakon na web poslužiteljuAmdahl's law on a web serverUbrzanje zahtjeva ograničavaju dijelovi koji nisu ubrzaniA request's speedup is limited by the parts that are not sped upMnogo jezgri, jedna memorijaMany cores, one memory 1 simulator
Mnogo veza, jedan tokMany links, one flow 1 simulator
Brzina mrežeNetwork speed 12 simulatora12 simulators
Kašnjenje na jednom skokuDelay on one hop 4 simulatora4 simulators
Četiri vrste kašnjenjaFour kinds of delayKašnjenje prijenosa, širenja, obrade i čekanja u redu na jednom skokuTransmission, propagation, processing and queuing delay over one hopČetiri vrste kašnjenjaFour kinds of delay › Mali paketSmall packet64 B umjesto 1500 B na 10 Mb/s: prijenos s 1,2 na 0,051 ms64 B instead of 1500 B at 10 Mb/s: transmission from 1.2 to 0.051 msČetiri vrste kašnjenjaFour kinds of delay › Zauzet usmjernikBusy routerOpterećenje 90 %: red dodaje 1,08 ms, a veza je ista90 % load: the queue adds 1.08 ms on the same linkČetiri vrste kašnjenjaFour kinds of delay › Preko satelitaVia a satelliteGeostacionarni satelit: oko 239 ms u jednom smjeru samo od širenjaA geostationary satellite: about 239 ms one way from propagation aloneVeličina prozora i brzina prijenosaWindow size and throughput 3 simulatora3 simulators
Klizni prozor: veličina prozora i brzinaSliding window: window size and throughputBrzina je prozor / kružno vrijeme, a nikad više od brzine vezeThroughput is window / round-trip time, never more than the link's rateKontrola toka: prozor primateljaFlow control: the receiver's windowPrimatelj prozorom kaže koliko prima; pošiljatelj ne smije preko desnog rubaThe receiver's window says how much it takes; the sender stops at its right edgeKontrola zagušenja u TCP-uTCP congestion controlSlow start, congestion avoidance i AIMD pila; Reno i CUBIC nakon gubitkaSlow start, congestion avoidance, the AIMD sawtooth; Reno and CUBIC after a lossPrioritet prometa: QoSTraffic priority: QoS 1 simulator
Brže web straniceFaster web pages 4 simulatora4 simulators
HTTP/1.1, HTTP/2 i HTTP/3HTTP/1.1 vs HTTP/2 vs HTTP/3 › Jedna HTTP/1.1 vezaOne HTTP/1.1 connectionZahtjevi zaredom na jednoj vezi: 800 ms; HTTP/2 ih multipleksira: 300 msRequests in a row on one connection: 800 ms; HTTP/2 multiplexes them: 300 msHTTP/1.1, HTTP/2 i HTTP/3HTTP/1.1 vs HTTP/2 vs HTTP/3 › Izgubljen segmentA lost segmentJedan gubitak zaustavi sve HTTP/2 tokove; u HTTP/3 čeka samo njegov tokOne loss stalls every HTTP/2 stream; in HTTP/3 only its own stream waitsHTTP predmemoriranjeHTTP cachingCache-Control, ETag i 304: što drži preglednik, a što rubni poslužitelj CDN-aCache-Control, ETag and 304: what the browser and the CDN edge keepAnycast i rubna mjesta CDN-aAnycast and CDN edgesJedna adresa na više mjesta; BGP bira najbližeOne address, many places; BGP picks the nearestBrzina diskaDisk speed 8 simulatora8 simulators
IOPS, dubina reda i veličina blokaIOPS, queue depth and block size3 simulatora3 simulatorsRedoslijed zahtjeva prema diskuOrdering disk requests1 simulatorPriručne memorije ispred diskaCaches in front of the disk3 simulatora3 simulatorsPojačanje pisanja u SSD-uWrite amplification in an SSD1 simulator
IOPS, dubina reda i veličina blokaIOPS, queue depth and block size 3 simulatora3 simulators
IOPS, propusnost i kašnjenjeIOPS, throughput and latencyDubina reda i veličina bloka mijenjaju IOPS, propusnost i kašnjenjeQueue depth and block size trade IOPS, throughput and latency offIOPS, propusnost i kašnjenjeIOPS, throughput and latency › HDD: dublji red samo čekaHDD: a deeper queue only waits4 KiB uz QD 32: i dalje 125 IOPS, ali 257 ms umjesto 8 ms4 KiB at QD 32: still 125 IOPS, but 257 ms instead of 8 msIOPS, propusnost i kašnjenjeIOPS, throughput and latency › NVMe na stropu propusnostiNVMe at its bandwidth ceiling128 KiB uz QD 32: 3000 MB/s, IOPS staje, kašnjenje 1,4 ms128 KiB at QD 32: 3000 MB/s, IOPS stop, latency 1.4 msRedoslijed zahtjeva prema diskuOrdering disk requests 1 simulator
Priručne memorije ispred diskaCaches in front of the disk 3 simulatora3 simulators
Predmemorija stranica i prljave stranicePage cache and dirty pagesPredmemorija je posuđena, ne izgubljena; zapisano čeka na diskPage cache is lent, not lost; what you write waits for the diskOdgođeno i izravno upisivanjeWrite-back vs write-throughWrite-back je brz dok ne nestane struje; predmemorija s baterijomWrite-back is fast until the power fails; battery-backed cacheRAID i priručna memorija diskaRAID and disk cacheRAID 0–6, paritet, disk cacheRAID 0–6, parity, disk cachePojačanje pisanja u SSD-uWrite amplification in an SSD 1 simulator
Pritisak na memorijuMemory pressure 9 simulatora9 simulators
Straničenje i zamjena stranicaPaging and page replacement 2 simulatora2 simulators
Odlagalište i ubojica OOMSwap and the OOM killer 3 simulatora3 simulators
Memorija, odlagalište i ubojica OOMMemory, swap and the OOM killerPredmemorija se vraća, odlagalište daje mjesta, a OOM ubija najveći zbrojPage cache gives way, swap buys room, the OOM killer takes the top scoreMemorija, odlagalište i ubojica OOMMemory, swap and the OOM killer › Odlagalište spašava bazuSwap saves the databaseStranice baze odlaze u odlagalište i nitko ne umireThe database's pages go to swap and nobody diesMemorija, odlagalište i ubojica OOMMemory, swap and the OOM killer › Ubojica OOM ubija bazuThe OOM killer kills the databaseUmire proces s najvećim zbrojem, ne onaj koji je tražioThe highest score dies, not the process that askedOgraničenja za skupinu procesaLimits for a group of processes 4 simulatora4 simulators
Ograničenja u cgroupscgroup limitsTežine i granica procesora, granice memorije; OOM unutar kontrolne grupeCPU weights and caps, memory limits; OOM inside a cgroupOgraničenja u cgroupscgroup limits › Težina nije granicaA weight is not a limitUdio koji druga grupa ne troši dobiva grupa s manjom težinomA share another group leaves unused goes to the lighter groupOgraničenja u cgroupscgroup limits › memory.high usporava, ne ubijamemory.high slows down, it does not killIznad memory.high grupa se usporava; ubija tek memory.maxAbove memory.high the group is slowed; only memory.max killsOgraničenja u cgroupscgroup limits › OOM unutar grupeOOM inside the groupOOM killer ubija proces grupe iako domaćin ima 15 GB slobodnoThe OOM killer kills a process of the group though the host has 15 GB freeKad ponestane kapacitetaRunning out of capacity 9 simulatora9 simulators
Pohrana koja se prerano puniStorage that fills up early4 simulatora4 simulatorsRasponi adresa koji se trošeAddress ranges that run out1 simulatorUzbuna prije nego ponestaneAlerting before it runs out2 simulatora2 simulatorsKoliko pouzdano je dovoljno: SLOHow reliable is reliable enough: SLOs1 simulatorAutomatsko skaliranjeAutoscaling1 simulator
Pohrana koja se prerano puniStorage that fills up early 4 simulatora4 simulators
Najmanji disk određuje kapacitetThe smallest disk caps the poolNajpuniji OSD određuje MAX AVAIL; neravnomjerni poslužitelji pune se prviThe fullest OSD sets MAX AVAIL; uneven hosts fill firstNajmanji disk određuje kapacitetThe smallest disk caps the pool › Sjedište: „tek 38 % puno”HQ: "only 38 % full"Sirovo 38 %, a osd.13 na 89 %: vm-rbd prima još samo 3,4 TiB38 % raw, but osd.13 at 89 %: vm-rbd takes only 3.4 TiB moreCeph grozd: CRUSH, PG-ovi, replikacija i oporavakCeph cluster: CRUSH, PGs, replication and recovery › Neuravnoteženi domaćiniUnbalanced hostsJedan velik i dva mala domaćina: mali se pune prvi i ograničavaju grozdOne big host, two small ones: the small ones fill first and cap the clusterTanki bazen i prekomjerno dodjeljivanjeThin provisioning and overcommit › Jedan volumen puni bazenOne volume fills the poolPisanje pada i volumenu čiji datotečni sustav pokazuje 40 GiB slobodnoWrites fail even for a volume whose filesystem shows 40 GiB freeRasponi adresa koji se trošeAddress ranges that run out 1 simulator
Uzbuna prije nego ponestaneAlerting before it runs out 2 simulatora2 simulators
Stanja uzbune: na čekanju i aktivnaAlert states: pending and firingPravilo vidi samo uzorke; for traži uvjet bez prekida, pa treperenje ne okidaThe rule sees only scrapes; for wants an unbroken run, so flapping never firesStanja uzbune: na čekanju i aktivnaAlert states: pending and firing › Skok između dva uzorkaA spike between two scrapesPravilo vidi samo prikupljene uzorke: skok koji nitko nije prikupio ne postojiThe rule sees only scraped samples: a spike nobody scraped does not existKoliko pouzdano je dovoljno: SLOHow reliable is reliable enough: SLOs 1 simulator
Automatsko skaliranjeAutoscaling 1 simulator
Novac: koliko IT stvarno koštaMoney: what IT really costs 23 simulatora23 simulators
Proračun, ulaganja i rizik riječima financija: kapitalni izdaci, amortizacija, TCO, NSV.Budgets, investments and risk in the words finance uses: CapEx, depreciation, TCO, NPV.
Kako financije knjiže kupnjuHow finance books a purchase6 simulatora6 simulatorsKapitalni izdaci ili operativni troškoviCapEx or OpExAmortizacija i knjigovodstvena vrijednostDepreciation and book valueTrošak nije isto što i plaćanjeAn expense is not a paymentPlan i ostvarenjeBudget vs actualsIsplati li se?Is it worth it?5 simulatora5 simulatorsVremenska vrijednost novcaThe time value of moneyPovrat, razdoblje povrata i NSVROI, payback and NPVOdlučuje se gledajući naprijedDecide looking forwardKoliko stvarno koštaWhat it really costs4 simulatora4 simulatorsUkupni trošak vlasništvaTotal cost of ownershipTrošak po korisniku i tko ga plaćaCost per user, and who pays itKada zamijeniti opremuWhen to replace equipmentKupiti, unajmiti ili se pretplatitiBuy, lease or subscribe5 simulatora5 simulatorsLeasing ili kupnjaLease or buyTrajna licenca ili pretplataPerpetual licence or subscriptionUgovorena potrošnja u oblakuCloud commitmentsKada i kako platitiWhen and how to payRizik izražen u novcuRisk in money6 simulatora6 simulatorsKoliko košta zastojWhat downtime costsOčekivani gubitak i cijena zaštiteExpected loss and the price of a controlPričuva za nepredviđenoA reserve for the unexpected
Kako financije knjiže kupnjuHow finance books a purchase 6 simulatora6 simulators
Kapitalni izdaci ili operativni troškoviCapEx or OpEx 2 simulatora2 simulators
CapEx ili OpEx: jedna kupnja, tri pogledaCapEx vs OpEx: one purchase, three viewsKupnja se plaća odmah, a u trošak ide amortizacijom; usluga ide mjesečnoBuying pays on day one but spreads the expense; a service is expensed monthly
Leasing ili kupnjaLease vs buyGotovina, kredit ili leasing: novac, trošak i bilanca se razlikuju; usporedi NSVCash, loan or lease: cash, expense and balance sheet differ; compare by NPVAmortizacija i knjigovodstvena vrijednostDepreciation and book value 2 simulatora2 simulators
Amortizacija i knjigovodstvena vrijednostDepreciation and book valueLinearna ili degresivna amortizacija; rana prodaja knjiži gubitak ili dobitakStraight-line or declining balance; selling early books a loss or a gain
Ciklus zamjene opreme i ekonomski vijek trajanjaRefresh cycles and economic lifeTrošak po godini ima minimum, ekonomski vijek; zamjena odjednom je zid isplataYearly cost has a minimum, the economic life; all at once makes a cash wallTrošak nije isto što i plaćanjeAn expense is not a payment 1 simulator
Plan i ostvarenjeBudget vs actuals 2 simulatora2 simulators
Plan i ostvarenje: čitanje odstupanjaBudget vs actuals: reading a varianceOdstupanje čine količina, cijena i vrijeme; račun koji kasni nije uštedaA variance is volume, price and timing; a late invoice is not a saving
Trošak ili plaćanje: vremenska razgraničenja kroz godinuAccruals vs cash: a year of invoicesTrošak pripada mjesecu uporabe, a ne mjesecu u kojem je plaćenAn expense belongs to the month of use, not the month it is paidIsplati li se?Is it worth it? 5 simulatora5 simulators
Vremenska vrijednost novcaThe time value of money 2 simulatora2 simulators
Vremenska vrijednost novca i neto sadašnja vrijednostTime value of money and NPVEuro sljedeće godine vrijedi manje; NSV zbraja diskontirane novčane tokoveA euro next year is worth less; NPV sums the discounted cash flows
Inflacija, indeksacija i tečaj u višegodišnjem ugovoruInflation, indexation and currency in a multi-year contractInflacija jede fiksnu cijenu, indeksacija prenosi inflaciju, tečaj dodaje rizikInflation eats a fixed price, indexation passes it on, a currency adds riskPovrat, razdoblje povrata i NSVROI, payback and NPV 2 simulatora2 simulators
Povrat ulaganja, razdoblje povrata i NSV ne slažu seROI, payback and NPV disagreeTri mjerila različito rangiraju iste projekte; ISP je stopa uz koju je NSV nulaThree yardsticks rank the same projects differently; IRR is where NPV is zero
Trošak kašnjenja: koji projekt prviCost of delay: which project firsttjedan čekanja košta; prvi ide projekt s najvećom vrijednošću tjedno ÷ trajanjeevery week a project waits loses value; order by value per week ÷ durationOdlučuje se gledajući naprijedDecide looking forward 1 simulator
Koliko stvarno koštaWhat it really costs 4 simulatora4 simulators
Ukupni trošak vlasništvaTotal cost of ownership 1 simulator
Trošak po korisniku i tko ga plaćaCost per user, and who pays it 2 simulatora2 simulators
Fiksni, varijabilni i stepenasti troškovi; točka pokrićaFixed, variable and step costs; break-evenFiksni trošak na više korisnika: prosjek pada, a sljedeći korisnik nije prosjekFixed cost over more users lowers the average; the next user is not the average
Raspodjela troškova IT-a: prikaz ili interna naplataShowback and chargebackKljuč odlučuje tko plaća; uz naplatu odlazak jednog odjela diže cijenu ostalimaThe key decides who pays; under chargeback one leaving raises the others' priceKada zamijeniti opremuWhen to replace equipment 1 simulator
Kupiti, unajmiti ili se pretplatitiBuy, lease or subscribe 5 simulatora5 simulators
Leasing ili kupnjaLease or buy 1 simulator
Trajna licenca ili pretplataPerpetual licence or subscription 1 simulator
Ugovorena potrošnja u oblakuCloud commitments 1 simulator
Kada i kako platitiWhen and how to pay 2 simulatora2 simulators
Popust za plaćanje unaprijed i rokovi plaćanjaPay upfront for a discount?Popust za uplatu unaprijed je skrivena kamata; rok pomiče novac, a ne trošakA prepayment discount is hidden interest; payment terms move cash, not costInflacija, indeksacija i tečaj u višegodišnjem ugovoruInflation, indexation and currency in a multi-year contractInflacija jede fiksnu cijenu, indeksacija prenosi inflaciju, tečaj dodaje rizikInflation eats a fixed price, indexation passes it on, a currency adds riskRizik izražen u novcuRisk in money 6 simulatora6 simulators
Koliko košta zastojWhat downtime costs 2 simulatora2 simulators
Koliko košta sat zastoja i koliko vrijedi jedna devetkaWhat an hour down costs, and what a nine is worthSat zastoja košta prosjek tjedna; svaka devetka štedi manje, a košta višeAn hour down costs the week's average; each nine saves less and costs moreRPO i RTORPO and RTOKoliko podataka i koliko vremena gubite, na jednoj vremenskoj crtiHow much data and how much time you lose, on one timelineOčekivani gubitak i cijena zaštiteExpected loss and the price of a control 3 simulatora3 simulators
Očekivani godišnji gubitak (ALE) i cijena zaštiteExpected annual loss and the price of a controlALE = gubitak × učestalost; zaštita vrijedi kad uklanja više nego što stojiALE = loss × frequency; a control pays when it removes more than it costs3-2-1 i nepromjenjive kopije protiv ucjenjivačkog programa3-2-1 and immutable copies vs ransomwareKoje kopije prežive šifriranje i brisanjeWhich copies survive encryption and deletion
Cijena neusklađenosti i cijena kontrolaThe price of non-compliance and the price of controlsNajviša kazna: fiksni iznos ili % prometa, što je veće; prema cijeni mjeraFine ceiling: a fixed sum or % of turnover, whichever is higher, vs the controlsPričuva za nepredviđenoA reserve for the unexpected 1 simulator
Pravila i dokazi: usklađenost i procedureRules and proof: compliance and procedures 29 simulatora29 simulators
Rizik, pristupi, promjene, osobni podaci i incidenti onako kako ih traže GDPR, NIS2 i revizor.Risk, access, changes, personal data and incidents the way GDPR, NIS2 and the auditor ask for them.
Pravila i dokaziRules and evidence4 simulatora4 simulatorsOd politike do zapisaFrom policy to recordRevizorski uzorakThe audit sampleZrelost i iznimkeMaturity and exceptionsUpravljanje rizikomManaging risk6 simulatora6 simulatorsRegistar rizikaThe risk registerDobavljači i oblakSuppliers and the cloudCijena neusklađenostiThe price of non-complianceTko smije štoWho may do what6 simulatora6 simulatorsDolazak, premještaj, odlazakJoiners, movers, leaversRazdvajanje dužnosti i četiri okaSegregation of duties and four eyesAdministratorska pravaPrivileged accessZapisi kao dokazLogs as evidencePromjene i zakrpeChanges and patches3 simulatora3 simulatorsUpravljanje promjenamaChange managementRokovi za zakrpePatch deadlinesOsobni podaciPersonal data4 simulatora4 simulatorsProcjena učinka na zaštitu podatakaData protection impact assessmentRokovi čuvanjaRetentionZahtjevi ispitanikaData subject requestsPovreda osobnih podatakaPersonal data breachKad nešto pođe po zluWhen something goes wrong6 simulatora6 simulatorsKljučni i važni subjektiEssential and important entitiesRokovi za prijavu incidentaIncident reporting deadlinesAnaliza utjecaja na poslovanjeBusiness impact analysisDokaz da se može vratitiProof that restores work
Pravila i dokaziRules and evidence 4 simulatora4 simulators
Od politike do zapisaFrom policy to record 1 simulator
Revizorski uzorakThe audit sample 1 simulator
Zrelost i iznimkeMaturity and exceptions 2 simulatora2 simulators
Razine zrelosti: prosjek skriva najslabije područjeMaturity levels: the average hides the weakest areaNalazi i incidenti dolaze iz najslabijeg područja; svaka iduća razina je skupljaFindings and incidents come from the weakest area; each level up costs more
Iznimke od politike: prihvaćeni rizik s rokom istekaExceptions to policy: an accepted risk with an end dateIznimka treba vlasnika, kontrolu i rok, inače iznimke postanu stvarna politikaAn exception needs an owner, a control and an end date, or it becomes the policyUpravljanje rizikomManaging risk 6 simulatora6 simulators
Registar rizikaThe risk register 3 simulatora3 simulators
Registar rizika: vjerojatnost × učinak i preostali rizikRisk register: likelihood × impact and residual riskPostupanje spušta rizik na preostali; bodovi i novac rangiraju drugačijeTreatment moves a risk to residual; score and money rank it differentlyOčekivani godišnji gubitak (ALE) i cijena zaštiteExpected annual loss and the price of a controlALE = gubitak × učestalost; zaštita vrijedi kad uklanja više nego što stojiALE = loss × frequency; a control pays when it removes more than it costs
Prvo ukloniti opasnost: redoslijed mjera zaštiteRemove the hazard first: the order of controlsRizik je vjerojatnost × posljedica; mjere koje treba pamtiti najčešće zakažuRisk is likelihood × severity; controls someone must remember fail most oftenDobavljači i oblakSuppliers and the cloud 2 simulatora2 simulators
Rizik dobavljača: razine i dubina provjereSupplier risk: tiers and how deep to checkRazina dobavljača određuje dubinu provjere, a ne isti upitnik svimaA supplier's tier sets how deep to check, not one questionnaire for all
Podijeljena odgovornost u oblaku: tko provodi koju kontroluShared responsibility: who runs which control in the cloudPružatelj preuzima sloj po sloj; podaci, pristup i kopije ostaju vamaThe provider takes layer by layer; data, access and backups stay yoursCijena neusklađenostiThe price of non-compliance 1 simulator
Tko smije štoWho may do what 6 simulatora6 simulators
Dolazak, premještaj, odlazakJoiners, movers, leavers 1 simulator
Razdvajanje dužnosti i četiri okaSegregation of duties and four eyes 2 simulatora2 simulators
Razdvajanje dužnosti: nespojive kombinacije ovlastiSegregation of duties: toxic combinationsTko drži oba dijela para može pogriješiti i sakriti; malom timu treba kontrolaWhoever holds both halves can err and hide it; a small team needs a control
Načelo četiri oka: kad drugi potpis postane formalnostFour eyes: when the second approver is a rubber stampDrugi potpis hvata neispravan zahtjev samo ako ga neovisan odobravatelj pogledaA second signature stops a bad request only if an independent approver looksAdministratorska pravaPrivileged access 2 simulatora2 simulators
Stalna ili privremena prava; račun za hitne slučajeveStanding or just-in-time admin; the break-glass accountStalna prava izložena su cijelu godinu, privremena samo dok trajuStanding admin rights are exposed all year; just in time only while in useBočno kretanje i slojevi ovlastiLateral movement and tieringJedna administratorska prijava na radnoj stanici otvara cijelu domenuOne admin logon on a workstation exposes the whole domainZapisi kao dokazLogs as evidence 1 simulator
Promjene i zakrpeChanges and patches 3 simulatora3 simulators
Upravljanje promjenamaChange management 2 simulatora2 simulators
Upravljanje promjenama: razredi rizika ili odbor za sveChange management: risk classes or one board for everythingOdbor za svaku promjenu rađa velike pakete koji češće padaju; razredi rizika neA board for every change breeds big batches that fail more; risk classes don'tPlavo-zeleno, kanarinac, postupno uvođenjeBlue-green, canary, rollingKako svaka strategija seli promet na novu inačicu i vraća lošu natragHow each strategy moves traffic to a new version and rolls a bad one backRokovi za zakrpePatch deadlines 1 simulator
Osobni podaciPersonal data 4 simulatora4 simulators
Procjena učinka na zaštitu podatakaData protection impact assessment 1 simulator
Rokovi čuvanjaRetention 1 simulator
Zahtjevi ispitanikaData subject requests 1 simulator
Povreda osobnih podatakaPersonal data breach 1 simulator
Kad nešto pođe po zluWhen something goes wrong 6 simulatora6 simulators
Ključni i važni subjektiEssential and important entities 1 simulator
Rokovi za prijavu incidentaIncident reporting deadlines 1 simulator
Analiza utjecaja na poslovanjeBusiness impact analysis 2 simulatora2 simulators
Analiza utjecaja na poslovanje: što se mora prvo vratitiBusiness impact analysis: what must come back firstSustav nasljeđuje najkraći podnošljivi prekid svih procesa iznad sebeA system inherits the shortest tolerable downtime of every process above itRPO i RTORPO and RTOKoliko podataka i koliko vremena gubite, na jednoj vremenskoj crtiHow much data and how much time you lose, on one timelineDokaz da se može vratitiProof that restores work 2 simulatora2 simulators
Testovi obnove kao dokaz: cijelo okruženje u godini danaRestore tests as evidence: covering the estate in a yearKopiju dokazuje test obnove; redoslijed testova odlučuje što ostaje netestiranoA restore test proves a backup; the order of tests decides what is never testedKopija koja lažeThe backup that liesKopija javlja uredno; tek proba oporavka pokaže što u njoj nemaBackups report OK; only a test restore shows what is missingUpravljanje Linux sustavimaRunning Linux systems 118 simulatora118 simulators
Ljuska, dozvole, usluge, diskovi, mreža i kontejneri na Linuxu.The shell, permissions, services, disks, networking and containers on Linux.
LjuskaThe shell17 simulatora17 simulatorsTokovi, preusmjeravanje i cjevovodiStreams, redirection and pipesNavodnici i razdvajanje na poljaQuoting and word splittingIzlazni status i neuspjehExit status and failureRegularni izraziRegular expressionsCjevovodi teksta ili objekataPipelines of text or of objectsKorisnici i dozvoleUsers and permissions13 simulatora13 simulatorsBitovi dozvola i umaskPermission bits and umaskVlasnik, grupa, ostali i ACLOwner, group, other and ACLsSELinux oznakeSELinux labelsKako se provjerava prijavaHow a login is checkedPodizanje, usluge i dnevniciBoot, services and logs16 simulatora16 simulatorsStablo direktorijaThe directory treeLanac podizanja sustavaThe boot chainOvisnosti i redoslijed uslugaService dependencies and orderProcesi i signaliProcesses and signalsKamo idu poruke dnevnikaWhere log messages goPaketi i ovisnostiPackages and dependenciesDiskovi i memorijaDisks and memory25 simulatora25 simulatorsOd blokovnog uređaja do stazeFrom a block device to a pathInodei, poveznice i slobodan prostorInodes, links and free spaceLogički volumeniLogical volumesDatotečni sustavi s bazenom i kopiranjem pri pisanjuPooled and copy-on-write file systemsSlobodna, raspoloživa memorija i odlagališteFree, available and swapKopiranje i zrcaljenje podatakaCopying and mirroring dataMreža i vatrozidiNetworking and firewalls14 simulatora14 simulatorsAdresa, ruta i rezolverAddress, route and resolverZone vatrozidaFirewall zonesPaket kroz vatrozid jezgreA packet through the kernel firewallUdaljena prijava i tuneliRemote login and tunnelsKontejneri i virtualni strojeviContainers and virtual machines21 simulator21 simulatorsLinux imenski prostori: kontejner je procesLinux namespaces: a container is a processOgraničenja resursa (cgroups)Resource limits (cgroups)Mreža kontejneraContainer networkingSlojevi slike i podaci kontejneraImage layers and container dataDiskovi i seoba virtualnih strojevaVirtual machine disks and migrationAutomatizacija, uvođenje i nadzorAutomation, deployment and monitoring12 simulatora12 simulatorsDvostruko pokretanje iste izmjeneRunning a change twiceInfrastruktura kao kod i odmakInfrastructure as code and driftUvođenje nove inačiceRolling out a new versionUzbune koje se aktivirajuAlerts that fire
LjuskaThe shell 17 simulatora17 simulators
Tokovi, preusmjeravanje i cjevovodiStreams, redirection and pipes3 simulatora3 simulatorsNavodnici i razdvajanje na poljaQuoting and word splitting3 simulatora3 simulatorsIzlazni status i neuspjehExit status and failure5 simulatora5 simulatorsRegularni izraziRegular expressions3 simulatora3 simulatorsCjevovodi teksta ili objekataPipelines of text or of objects3 simulatora3 simulators
Tokovi, preusmjeravanje i cjevovodiStreams, redirection and pipes 3 simulatora3 simulators
Tri toka, preusmjeravanje i cjevovodThree streams, redirection and pipesstdin, stdout, stderr; poredak > i 2>&1; cijev nosi samo deskriptor 1stdin, stdout, stderr; the order of > and 2>&1; a pipe carries only fd 1Tri toka, preusmjeravanje i cjevovodThree streams, redirection and pipes › 2>&1 prije > : greška ostaje na zaslonu2>&1 before > : the error stays on the screenPreusmjeravanja idu slijeva nadesno: 2 kopira 1 dok 1 još vodi na zaslonRedirections apply left to right: 2 copies 1 while 1 still points to the screenTri toka, preusmjeravanje i cjevovodThree streams, redirection and pipes › Greška kroz cijev: 2>&1 |The error through the pipe: 2>&1 |Cijev se spaja prije preusmjeravanja, pa 2>&1 šalje grešku u cijevThe pipe is connected before redirections, so 2>&1 sends the error into itNavodnici i razdvajanje na poljaQuoting and word splitting 3 simulatora3 simulators
Navodnici i razdvajanje na poljaQuoting and word splittingŠto ljuska učini s retkom prije nego što ga naredba vidiWhat the shell does to a line before the command sees itNavodnici i razdvajanje na poljaQuoting and word splitting › Uzorak u varijabli: rm $xA pattern in a variable: rm $xRazrješavanje staza dolazi poslije razdvajanja, pa ime s razmakom ostaje cijeloPathname expansion comes after splitting, so a name with a space stays wholeNavodnici i razdvajanje na poljaQuoting and word splitting › Zamjena naredbe: for f in $(ls)Command substitution: for f in $(ls)Ispis naredbe ide kroz razdvajanje na polja kao i vrijednost varijableA command's output goes through field splitting like a variable's valueIzlazni status i neuspjehExit status and failure 5 simulatora5 simulators
Izlazni status: &&, ||, set -e i pipefailExit status: &&, ||, set -e and pipefailKako se neuspjeh širi skriptom, i cjevovod koji javlja uspjeh iako je paoHow failure propagates, and a pipeline that reports success while failingIzlazni status: &&, ||, set -e i pipefailExit status: &&, ||, set -e and pipefail › a && b || c nije if-elsea && b || c is not if-else|| se izvršava i nakon uspjeha prve naredbe, kad padne druga|| also runs after the first command succeeds, when the second failsIzlazni status: &&, ||, set -e i pipefailExit status: &&, ||, set -e and pipefail › pipefail: cjevovod vraća 127pipefail: the pipeline returns 127S pipefail cjevovod vraća status člana koji je pao, pa set -e stajeWith pipefail the pipeline returns the failed member's status, so set -e stopsIzlazni status: &&, ||, set -e i pipefailExit status: &&, ||, set -e and pipefail › Noćni posao javlja OK, a sigurnosna kopija je krnjaThe nightly job says OK, and the backup is truncatedPad usred cjevovoda bez pipefail: status 0, poruka OK, datoteka od 1,2 MBA failure mid-pipeline without pipefail: status 0, an OK mail, a 1.2 MB file
Podljuske i hvatanje (trap)Subshells and trapscd u podljusci ne ostaje; čišćenje na izlazu s trap … EXITA cd in a subshell doesn't stick; cleanup on EXITRegularni izraziRegular expressions 3 simulatora3 simulators
Kako regularni izraz pogađaHow a regex matchesMatcher hoda po retku, vraća se unatrag i provjerava sidraThe matcher walks the input, backtracks, anchorsKako regularni izraz pogađaHow a regex matches › a|ab: prvi pogodak ili najduljia|ab: first match or longestVraćanje unatrag javlja prvi pogodak, POSIX najdulji od istog početkaBacktracking reports the first match, POSIX the longest from the same startKako regularni izraz pogađaHow a regex matches › (a+)+b: stotine pokušaja(a+)+b: hundreds of triesUgniježđeni kvantifikatori tjeraju matcher da isproba svaku podjelu retkaNested quantifiers make the matcher try every way to split the lineCjevovodi teksta ili objekataPipelines of text or of objects 3 simulatora3 simulators
PowerShell šalje objekte, bash tekstPowerShell pipes objects, bash pipes textIsti zadatak u dva cjevovoda: retci teksta naspram objekata sa svojstvimaThe same task in two pipelines: lines of text versus objects with propertiesPowerShell šalje objekte, bash tekstPowerShell pipes objects, bash pipes text › Razmak u imenu: awk ispisuje pola imenaA space in a name: awk prints half the nameTekst se dijeli na razmacima, pa se polja pomaknu; svojstvo Name ostaje cijeloText splits at the blanks, so the fields shift; the Name property stays wholePowerShell šalje objekte, bash tekstPowerShell pipes objects, bash pipes text › Format-Table prije Sort-Object: tablica nije poredanaFormat-Table before Sort-Object: the table is not sortedOblikovanje pretvara objekte u zapise za ispis, pa iza njega nema LengthFormatting turns objects into display records; after it there is no LengthKorisnici i dozvoleUsers and permissions 13 simulatora13 simulators
Bitovi dozvola i umaskPermission bits and umask 4 simulatora4 simulators
Devet bitova dozvola, oktalni zapis i umaskNine permission bits, octal notation and umaskDevet bitova u tri zapisa; umask briše bitove: 666 uz 077 daje 600Nine bits written three ways; umask clears bits: 666 with 077 gives 600Devet bitova dozvola, oktalni zapis i umaskNine permission bits, octal notation and umask › umask 077: 600, a ne 567umask 077: 600, not 567Maska briše bitove iz 666, ne oduzima brojThe mask clears bits from 666; it does not subtractDevet bitova dozvola, oktalni zapis i umaskNine permission bits, octal notation and umask › Oktalni chmod briše nespomenuti bitOctal chmod erases a bit nobody namedchmod 640 na rwx------ odnosi izvršni bit vlasnikachmod 640 on rwx------ takes the owner's execute bitPosebni bitovi: setuid, setgid i stickySpecial bits: setuid, setgid and stickyProces dobiva efektivni UID vlasnika programa; u /tmp briše samo vlasnikA process gets the program owner’s effective UID; in /tmp only owners deleteVlasnik, grupa, ostali i ACLOwner, group, other and ACLs 3 simulatora3 simulators
Tko smije: vlasnik, grupa, ostaliWho may: owner, group, otherVlasnik, grupa, ostali: odlučuje prva klasa koja odgovara; maska ACL-aOwner, group, other: the first class that matches decides; the ACL maskTko smije: vlasnik, grupa, ostaliWho may: owner, group, other › Vlasnik bez prava, a svi ostali smijuAn owner with no rights, and everyone else mayPrva klasa koja odgovara je konačna: prava se ne zbrajajuThe first class that matches is final: rights do not add upTko smije: vlasnik, grupa, ostaliWho may: owner, group, other › Unos kaže rwx, maska kaže rw-The entry says rwx, the mask says rw-Između upisanog i onoga što vrijedi stoji maskaThe mask stands between what is written and what appliesSELinux oznakeSELinux labels 3 simulatora3 simulators
Dozvole kažu da, SELinux kaže neDAC says yes, SELinux says noDruga provjera nakon dozvola, po oznakama: tip, politika, način radaA second, label-based check after permissions: type, policy, modeDozvole kažu da, SELinux kaže neDAC says yes, SELinux says no › setenforce 0: prekidač, a ne popravaksetenforce 0: a switch, not a fixU načinu permissive radnja prolazi, a odbijanje se i dalje bilježiIn permissive mode the action goes through, and the denial is still loggedDozvole kažu da, SELinux kaže neDAC says yes, SELinux says no › cp i mv s oznakom postupaju različitocp and mv treat the label differentlyOznaka pripada datoteci: mv je nosi sa sobom, restorecon je vraćaThe label belongs to the file: mv carries it along, restorecon resets itKako se provjerava prijavaHow a login is checked 3 simulatora3 simulators
PAM: kontrolne oznake odlučuju o prijaviPAM: control flags decide a loginrequired, requisite, sufficient i optional zajedno odlučuju o prijavirequired, requisite, sufficient and optional together decide a loginPAM: kontrolne oznake odlučuju o prijaviPAM: control flags decide a login › required pa sufficient: uspjeh se zanemarujerequired, then sufficient: the success is ignoredNakon pada required modula uspjeh sufficient modula se zanemarujeAfter a required module fails, a sufficient success is ignoredPAM: kontrolne oznake odlučuju o prijaviPAM: control flags decide a login › pam_permit na vrhu: svatko ulazipam_permit on top: everyone gets inRedoslijed je važan: sufficient pam_permit prvi pušta bilo koju lozinkuOrder matters: sufficient pam_permit first lets any password inPodizanje, usluge i dnevniciBoot, services and logs 16 simulatora16 simulators
Stablo direktorijaThe directory tree1 simulatorLanac podizanja sustavaThe boot chain3 simulatora3 simulatorsOvisnosti i redoslijed uslugaService dependencies and order4 simulatora4 simulatorsProcesi i signaliProcesses and signals3 simulatora3 simulatorsKamo idu poruke dnevnikaWhere log messages go4 simulatora4 simulatorsPaketi i ovisnostiPackages and dependencies1 simulator
Stablo direktorijaThe directory tree 1 simulator
Lanac podizanja sustavaThe boot chain 3 simulatora3 simulators
Lanac podizanja sustavaThe boot chainFirmware → pokretač sustava → jezgra → initramfs → systemd: lanac predajaFirmware → boot loader → kernel → initramfs → systemd: a chain of hand-oversLanac podizanja sustavaThe boot chain › Cilj nije dosegnutThe target is not reachedPID 1 radi, ali redak u /etc/fstab ne uspije: emergency.targetPID 1 runs, but a line in /etc/fstab fails: emergency.targetLanac podizanja sustavaThe boot chain › Krivi root=UUIDA wrong root=UUIDJezgra radi, pravi korijen se ne pronalazi: hitna ljuska u initramfs-uThe kernel runs, the real root never shows up: emergency shell in the initramfsOvisnosti i redoslijed uslugaService dependencies and order 4 simulatora4 simulators
Ovisnosti i redoslijed jedinicaUnit dependencies and orderingWants/Requires povlače, After/Before određuju redoslijed; neuspjela ovisnostWants/Requires pull units in, After/Before set the order; a failed dependencyOvisnosti i redoslijed jedinicaUnit dependencies and ordering › Requires= bez After=Requires= without After=Obje kreću istodobno, pa app radi iako db nije uspioBoth start at once, so app runs although db failedOvisnosti i redoslijed jedinicaUnit dependencies and ordering › After= ništa ne povlačiAfter= pulls nothing indb nije u transakciji, a app kreće bez njegadb isn't in the transaction, and app starts without it
cron i mjerači vremena: propušteni terminicron vs systemd timers: missed runsPropušteni termini, Persistent= i nasumična odgodaMissed runs, Persistent= and randomized delayProcesi i signaliProcesses and signals 3 simulatora3 simulators
Signali: SIGTERM, SIGKILL, SIGHUP i nohupSignals: SIGTERM, SIGKILL, SIGHUP and nohupPostupanje sa signalom odlučuje: zadana radnja, zanemari ili uhvatiThe disposition decides: default action, ignore, or catch
Upravljanje poslovima: fg, bg, Ctrl-Z i odjavaJob control: fg, bg, Ctrl-Z and logging outPosao je grupa procesa; tipke idu prednjoj grupi, SIGHUP svim poslovimaA job is a process group; keys go to the foreground group, SIGHUP to every job
ProcesiProcessesStanja procesa, PCB, fork/exec/waitProcess states, PCB, fork/exec/waitKamo idu poruke dnevnikaWhere log messages go 4 simulatora4 simulators
Put jedne poruke u dnevnikThe path of a log messageProgram → journald → rsyslog → datoteka ili poslužiteljApp → journald → rsyslog → file or remotePut jedne poruke u dnevnikThe path of a log message › authpriv.none i authpriv.*authpriv.none and authpriv.*Poruka o prijavi ispada iz /var/log/messages i odlazi u /var/log/secureA login message drops out of /var/log/messages and goes to /var/log/securePut jedne poruke u dnevnikThe path of a log message › Poslužitelj ne primaThe log server isn't receivingPrekid se vidi na pošiljatelju; na poslužitelju samo nedostaje redakThe break shows on the sender; the server just lacks a line
Rotacija dnevnika: create i copytruncateLog rotation: create and copytruncateZapisivač piše u i-čvor: create traži reload, a copytruncate može izgubiti retkeThe logger writes to an inode: create needs a reload, copytruncate loses linesPaketi i ovisnostiPackages and dependencies 1 simulator
Diskovi i memorijaDisks and memory 25 simulatora25 simulators
Od blokovnog uređaja do stazeFrom a block device to a path4 simulatora4 simulatorsInodei, poveznice i slobodan prostorInodes, links and free space5 simulatora5 simulatorsLogički volumeniLogical volumes4 simulatora4 simulatorsDatotečni sustavi s bazenom i kopiranjem pri pisanjuPooled and copy-on-write file systems5 simulatora5 simulatorsSlobodna, raspoloživa memorija i odlagališteFree, available and swap4 simulatora4 simulatorsKopiranje i zrcaljenje podatakaCopying and mirroring data3 simulatora3 simulators
Od blokovnog uređaja do stazeFrom a block device to a path 4 simulatora4 simulators
Tablice particija: MBR i GPTPartition tables: MBR vs GPTOgraničenja particija, zaštitni MBR i kopija zaglavlja na kraju diskaPartition limits, the protective MBR and the backup headerOd blokovnog uređaja do točke montiranjaBlock device to mount pointDisk → particija → datotečni sustav → montiranje; montiranje zaklanja sadržajDisk → partition → filesystem → mount; a mount hides what was thereOd blokovnog uređaja do točke montiranjaBlock device to mount point › Četiri sloja do stazeFour layers to a pathTablica particija i particija, mkfs, mount: tek tada df ima redakPartition table and partition, mkfs, mount: only then does df have a rowOd blokovnog uređaja do točke montiranjaBlock device to mount point › Dva montiranja na istoj staziTwo mounts on one pathStaza vodi u najnovije; umount skida gornjeThe path leads to the newest; umount removes the top oneInodei, poveznice i slobodan prostorInodes, links and free space 5 simulatora5 simulators
Imena, inodei i povezniceHard links, symlinks and inodesIme pokazuje na inode; brojač poveznica; viseća simbolička poveznicaNames point to inodes; the link count; dangling symlinks„Disk je pun”, a mjesta ima"Disk full" with free spacePonestalo inodea; obrisana datoteka koju proces drži otvorenomRunning out of inodes; a deleted file a process holds open„Disk je pun”, a mjesta ima"Disk full" with free space › Pun disk na 28 %Disk full at 28%Datoteke od jednog bajta potroše sve inode prije blokova1-byte files use up every inode before the blocksImena, inodei i povezniceHard links, symlinks and inodes › rm, a prostor se ne vraćarm, and the space does not come backBrojač je 0, ali proces drži datoteku otvorenomThe count is 0, but a process holds the file open
Kvote: meko i tvrdo ograničenje, razdoblje odgodeDisk quotas: soft and hard limit, grace periodMeko se smije prijeći dok traje razdoblje odgode; tvrdo zaustavlja pisanjeSoft limit: passable while the grace period runs; the hard limit stops the writeLogički volumeniLogical volumes 4 simulatora4 simulators
LVM: topologijaLVM: topologyKako fizički volumeni, grupa volumena i logički volumeni dijele ekstenteHow physical volumes, a volume group and logical volumes share extentsProširenje logičkog volumena i datotečnog sustavaExtending an LV and its filesystemFizički volumen → grupa → logički volumen → datotečni sustav, tim redomPV → VG → LV → filesystem, in that orderLVM snimka se puniAn LVM snapshot filling upPodručje kopiranja pri pisanju i nevaljana snimka kad se napuniCopy-on-write snapshot space, and invalidation when fullTanki bazen i prekomjerno dodjeljivanjeThin provisioning and overcommitObećani i stvarni prostor: tanki bazen se puni pod svimaPromised vs real space: the thin pool fills under everyoneDatotečni sustavi s bazenom i kopiranjem pri pisanjuPooled and copy-on-write file systems 5 simulatora5 simulators
ZFS i Btrfs: topologijaZFS and Btrfs: topologyZFS drži zalihost u vdevovima, Btrfs u profilima komada; što preživi otkaz diskaZFS puts redundancy in vdevs, Btrfs in chunk profiles; what survives a failureStratis: topologijaStratis: topologyOd lokalnog ili mrežnog blokovnog uređaja do bazena i tankog datotečnog sustavaFrom a local or network block device to a pool and a thin filesystemDatotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystemsSnimke dijele blokove; pisanje ide u nove blokoveSnapshots share blocks; writes go to new blocksKontrolni zbrojevi i samoizlječenjeChecksums and self-healingProvjera integriteta nađe loš blok i popravi ga iz zrcalaA scrub finds a bad block and repairs it from the mirrorPrirasna i diferencijalna kopijaIncremental vs differential backup › Slanje i primanje snimkiSnapshot send and receiveInkrementalna replikacija iz parova snimkiIncremental replication from snapshot pairsSlobodna, raspoloživa memorija i odlagališteFree, available and swap 4 simulatora4 simulators
Memorija, odlagalište i ubojica OOMMemory, swap and the OOM killerPredmemorija se vraća, odlagalište daje mjesta, a OOM ubija najveći zbrojPage cache gives way, swap buys room, the OOM killer takes the top scoreMemorija, odlagalište i ubojica OOMMemory, swap and the OOM killer › Slobodno 0, a stroj nije bez memorijeFree is 0, and the machine is not out of memoryPredmemorija stranica se vraća: gleda se raspoloživo, ne slobodnoPage cache is given back: read available, not freePredmemorija stranica i prljave stranicePage cache and dirty pagesPredmemorija je posuđena, ne izgubljena; zapisano čeka na diskPage cache is lent, not lost; what you write waits for the diskPredmemorija stranica i prljave stranicePage cache and dirty pages › drop_caches: slobodno raste, raspoloživo nedrop_caches: free rises, available does notPredmemorija stranica nije izgubljena memorija, samo posuđenaThe page cache is not lost memory, only lentKopiranje i zrcaljenje podatakaCopying and mirroring data 3 simulatora3 simulators
rsync: kosa crta na kraju i --deletersync: the trailing slash and --deletesrc ili src/, i kako --delete zrcali pogreškusrc vs src/, and how --delete mirrors a mistakeZrcalo nije sigurnosna kopijaA mirror is not a backupRAID štiti od kvara diska, ne od brisanja ni pogrešnog sadržajaRAID protects against disk loss, not deletion or corruptionObnova pod opterećenjem i drugi kvarRebuild under load and the second failureDuga obnova, nečitljiv sektor, izgubljeno poljeA long rebuild, an unreadable sector, a lost arrayMreža i vatrozidiNetworking and firewalls 14 simulatora14 simulators
Adresa, ruta i rezolverAddress, route and resolver 5 simulatora5 simulators
Adresa, ruta i rezolverAddress, route and resolverTri stvari koje stroj treba za mrežu, i traženje ruteThe three things a host needs, and the route lookupAdresa, ruta i rezolverAddress, route and resolver › Ime radi, ruta neThe name works, the route does notBez zadane rute: Network is unreachable, iako je ime razriješenoNo default route: Network is unreachable, though the name resolvedAdresa, ruta i rezolverAddress, route and resolver › Ime vodi na krivu adresuA name leads to the wrong addressStari redak u /etc/hosts odgovara prije DNS-a, i to bez upozorenjaA stale line in /etc/hosts answers before DNS, without a warning
Usmjeravanje po praviluPolicy routingip rule bira tablicu prije traženja ruteip rule picks a table before the route lookupNačini rada bondaBonding modesactive-backup, balance ili 802.3ad: što koji način rada žrtvujeactive-backup vs balance vs 802.3ad: what each gives upZone vatrozidaFirewall zones 3 simulatora3 simulators
Zone vatrozidaFirewall zoneszonu paketa određuje njegova izvorišna adresa ili sučeljea packet's zone comes from its source or its interfaceZone vatrozidaFirewall zones › Izvorišna adresa ispred sučeljaThe source address before the interfacevezivanje izvora odlučuje prije zone sučelja kroz koje je paket ušaoa source binding decides before the zone of the interface the packet came in onZone vatrozidaFirewall zones › drop ili block: tišina ili odbijenicadrop or block: silence or a rejectodbačen paket izgleda kao ugašen stroj, odbijen dobiva odgovora dropped packet looks like a host that is down; a rejected one gets a replyPaket kroz vatrozid jezgreA packet through the kernel firewall 4 simulatora4 simulators
Vatrozid bez stanja i sa stanjemStateless and stateful firewallOdgovor treba zasebno pravilo, osim ako vatrozid pamti vezuThe reply needs its own rule, unless the firewall remembers the connection
Paket kroz netfilterA packet through netfilterprerouting, input, forward, output, postrouting: gdje su NAT i filtriranjeprerouting, input, forward, output, postrouting; where NAT and filter happenPaket kroz netfilterA packet through netfilter › Prosljeđivanje porta ide kroz forwardA port forward goes through forwardDNAT u prerouting mijenja odredište prije odluke o usmjeravanjuDNAT in prerouting changes the destination before the routing decisionPaket kroz netfilterA packet through netfilter › accept nije konačanaccept is not finalaccept završava samo svoj lanac; drugi lanac iste kuke još može odbaciti paketaccept ends only its chain; another chain at the same hook can still dropUdaljena prijava i tuneliRemote login and tunnels 2 simulatora2 simulators
SSH: ključ poslužitelja i ključ korisnikaSSH host and user keysknown_hosts, prijava ključem ili lozinkom, upozorenje pri prvom spajanjuknown_hosts, key auth vs password, the first-connection warningSSH: prosljeđivanje portaSSH port forwardinglokalno, udaljeno i dinamičko prosljeđivanjelocal, remote and dynamic forwardingKontejneri i virtualni strojeviContainers and virtual machines 21 simulator21 simulators
Linux imenski prostori: kontejner je procesLinux namespaces: a container is a process4 simulatora4 simulatorsOgraničenja resursa (cgroups)Resource limits (cgroups)4 simulatora4 simulatorsMreža kontejneraContainer networking5 simulatora5 simulatorsSlojevi slike i podaci kontejneraImage layers and container data3 simulatora3 simulatorsDiskovi i seoba virtualnih strojevaVirtual machine disks and migration5 simulatora5 simulators
Linux imenski prostori: kontejner je procesLinux namespaces: a container is a process 4 simulatora4 simulators
Kontejner je procesA container is a processImenski prostori za PID, mrežu i montiranje izoliraju jedno stablo procesaPID, network and mount namespaces isolate one process treeKontejner je procesA container is a process › ps u kontejneru bez novog /procps in a container without a new /procecho $$ kaže 1, a ps ispisuje procese domaćinaecho $$ says 1, yet ps lists the host's processesKontejner je procesA container is a process › Kad PID 1 kontejnera umreWhen a container's PID 1 diesIznutra ga ni SIGKILL ne ubija; izvana pada cijeli imenski prostorNot even SIGKILL kills it from inside; from outside the whole namespace falls
Kontejner bez root ovlasti: root unutra, običan vaniRootless containers: root inside, an ordinary user outsideRoot u kontejneru preslikava se u neprivilegirani UID na domaćinuRoot inside the container maps to an unprivileged UID on the hostOgraničenja resursa (cgroups)Resource limits (cgroups) 4 simulatora4 simulators
Ograničenja u cgroupscgroup limitsTežine i granica procesora, granice memorije; OOM unutar kontrolne grupeCPU weights and caps, memory limits; OOM inside a cgroupOgraničenja u cgroupscgroup limits › Težina nije granicaA weight is not a limitUdio koji druga grupa ne troši dobiva grupa s manjom težinomA share another group leaves unused goes to the lighter groupOgraničenja u cgroupscgroup limits › memory.high usporava, ne ubijamemory.high slows down, it does not killIznad memory.high grupa se usporava; ubija tek memory.maxAbove memory.high the group is slowed; only memory.max killsOgraničenja u cgroupscgroup limits › OOM unutar grupeOOM inside the groupOOM killer ubija proces grupe iako domaćin ima 15 GB slobodnoThe OOM killer kills a process of the group though the host has 15 GB freeMreža kontejneraContainer networking 5 simulatora5 simulators
Imenski prostori, veth i mostNamespaces, veth and a bridgeKako se mreža kontejnera spaja ručnoHow container networking is wired by handImenski prostori, veth i mostNamespaces, veth and a bridge › Iz imenskog prostora u svijetFrom a namespace out to the worldRuta, prosljeđivanje i prevođenje adresa: tri koraka nakon mostaA route, forwarding and masquerade: three more steps after the bridgeImenski prostori, veth i mostNamespaces, veth and a bridge › Zaboravljen ip_forwardForgot ip_forwardRuta i NAT postoje, a paket stane na mostuRoute and NAT are there, yet the packet stops at the bridgeImenski prostori, veth i mostNamespaces, veth and a bridge › Što sustav za kontejnere složi samWhat a container engine wires for youMost, veth par po kontejneru, privatna /16 i prevođenje adresaA bridge, a veth pair per container, a private /16 and masqueradeProsljeđivanje portovaPort forwarding › Objava porta kontejneraPublishing a container port-p je pravilo DNAT na domaćinu: port domaćina vodi na adresu kontejnera-p is a DNAT rule on the host: the host's port leads to the container's addressSlojevi slike i podaci kontejneraImage layers and container data 3 simulatora3 simulators
Slojevi slike i kopiranje navišeImage layers and copy-upSlojevi samo za čitanje, gornji za pisanje, kopiranje naviše, oznake brisanjaRead-only layers, a writable top, copy-up and whiteoutsSlojevi slike i kopiranje navišeImage layers and copy-up › RUN rm ne smanjuje slikuRUN rm does not shrink the imageBrisanje u kasnijem sloju dodaje samo oznaku brisanjaDeleting in a later layer adds only a whiteout
Gdje se gube podaci kontejneraWhere container data is lostSloj kontejnera, svezak ili vezano montiranje: što rm čuva, a što brišeContainer layer, volume or bind mount: what rm keeps and what it deletesDiskovi i seoba virtualnih strojevaVirtual machine disks and migration 5 simulatora5 simulators
Tip 1 i tip 2, kontejneri i VM-oviType 1 vs type 2, containers vs VMsGdje sjede jezgra i hipervizorWhere the kernel and the hypervisor sitLanci slika diskaBacking chainsČitanje pada kroz lanac, spajanje i prekinuta karikaReads fall through the chain, merging, and a broken link
Seoba uživoLive migrationPretkopiranje konvergira samo ako gost prlja sporije nego što veza kopiraPre-copy rounds converge only if dirtying is slower than copyingSeoba uživoLive migration › Gost prlja brže od vezeThe guest dirties faster than the linkSvaki krug ponovno šalje cijeli radni skup; pretkopiranje ne konvergiraEvery round resends the whole working set; pre-copy does not convergeSeoba uživoLive migration › Prigušivanje gostaThrottling the guestManje procesora gostu, sporije prljanje: seoba konvergira nakon 10 krugovaLess CPU for the guest, slower dirtying: the migration converges after 10 roundsAutomatizacija, uvođenje i nadzorAutomation, deployment and monitoring 12 simulatora12 simulators
Dvostruko pokretanje iste izmjeneRunning a change twice3 simulatora3 simulatorsInfrastruktura kao kod i odmakInfrastructure as code and drift3 simulatora3 simulatorsUvođenje nove inačiceRolling out a new version3 simulatora3 simulatorsUzbune koje se aktivirajuAlerts that fire3 simulatora3 simulators
Dvostruko pokretanje iste izmjeneRunning a change twice 3 simulatora3 simulators
Idempotentnost: skripta i playbookIdempotence: a script and a playbookSkripta pokrenuta dvaput nešto pokvari; deklarativni zadatak neA script run twice breaks things; a declarative task doesn'tIdempotentnost: skripta i playbookIdempotence: a script and a playbook › Tri zadatka, drugo pokretanjeThree tasks, the second runmkdir pada na postojećem direktoriju, set -e zaustavlja skriptumkdir fails on the existing directory and set -e stops the scriptIdempotentnost: skripta i playbookIdempotence: a script and a playbook › Rukovatelj samo nakon promjeneA handler only after a changeSkripta ponovo pokreće poslužitelj svaki put, a rukovatelj samo nakon promjeneThe script restarts the server every run, the handler only after a changeInfrastruktura kao kod i odmakInfrastructure as code and drift 3 simulatora3 simulators
Infrastruktura kao kod: konfiguracija, stanje i odmakInfrastructure as code: configuration, state and driftŽeljeno, zapisano i stvarno: plan pokazuje razlikuDesired, recorded and real: plan shows the differenceInfrastruktura kao kod: konfiguracija, stanje i odmakInfrastructure as code: configuration, state and drift › Izgubljen zapis u stanjuA lost state entryAlat zaboravi objekt: plan predlaže novi, a apply pada na imenuThe tool forgets an object: plan proposes a new one, apply fails on the nameInfrastruktura kao kod: konfiguracija, stanje i odmakInfrastructure as code: configuration, state and drift › Prihvaćanje odmakaAccepting drift-refresh-only upiše ručnu promjenu u stanje, ali plan je i dalje vraća-refresh-only writes the hand change into state, yet plan still reverts itUvođenje nove inačiceRolling out a new version 3 simulatora3 simulators
Plavo-zeleno, kanarinac, postupno uvođenjeBlue-green, canary, rollingKako svaka strategija seli promet na novu inačicu i vraća lošu natragHow each strategy moves traffic to a new version and rolls a bad one backPlavo-zeleno, kanarinac, postupno uvođenjeBlue-green, canary, rolling › Skrivena greška od 3 %A subtle 3 % bugKanarinac je vidi na 10 % prometa, uzbuna za cijelu uslugu tek na 75 %The canary sees it at 10 % of traffic, the service-wide alert only at 75 %Plavo-zeleno, kanarinac, postupno uvođenjeBlue-green, canary, rolling › Greška ispod pragaA bug below the thresholdNijedna strategija ne hvata ono što njezina provjera ne vidiNo strategy catches what its check cannot seeUzbune koje se aktivirajuAlerts that fire 3 simulatora3 simulators
Stanja uzbune: na čekanju i aktivnaAlert states: pending and firingPravilo vidi samo uzorke; for traži uvjet bez prekida, pa treperenje ne okidaThe rule sees only scrapes; for wants an unbroken run, so flapping never firesStanja uzbune: na čekanju i aktivnaAlert states: pending and firing › Treperenje uz for: 0Flapping with for: 0Bez čekanja svaki skok postaje uzbuna: pet uzbuna u petnaest minutaWith no wait every rise becomes an alert: five alerts in fifteen minutesStanja uzbune: na čekanju i aktivnaAlert states: pending and firing › Skok između dva uzorkaA spike between two scrapesPravilo vidi samo prikupljene uzorke: skok koji nitko nije prikupio ne postojiThe rule sees only scraped samples: a spike nobody scraped does not existUpravljanje Windows domenomRunning a Windows domain 58 simulatora58 simulators
Active Directory, grupna pravila, DNS, DHCP i ažuriranja u Windows mreži.Active Directory, Group Policy, DNS, DHCP and updates in a Windows network.
Active Directory14 simulatora14 simulatorsŠume, domene i OUForests, domains and OUsGrupe i njihovi opseziGroups and their scopesKontroleri domene i njihove ulogeDomain controllers and their rolesReplikacija Active DirectoryjaActive Directory replicationUčlanjenje i prijavaJoining and logging on9 simulatora9 simulatorsUčlanjenje računala u domenuJoining a computer to the domainPrijava u domenu i pristupni tokenDomain logon and the access tokenKerberos, NTLM i vrijemeKerberos, NTLM and timeGrupna pravila u WindowsimaWindows Group Policy7 simulatora7 simulatorsKoje pravilo pobjeđujeWhich policy winsKada se pravila primjenjujuWhen policy appliesUklanjanje pravilaRemoving a policyPravila lozinki za dio korisnikaPassword policies for some usersDNS i DHCP u domeniDNS and DHCP in a domain12 simulatora12 simulatorsZone i prosljeđivačiZones and forwardersZapisi koje domena drži u DNS-uRecords the domain keeps in DNSČišćenje zastarjelih zapisaCleaning up stale recordsKako klijent razrješava imeHow a client resolves a nameDHCP opsezi i failoverDHCP scopes and failoverPlaniranje i praćenje adresaPlanning and tracking addressesDozvole nad datotekama i administratorska pravaFile permissions and admin rights8 simulatora8 simulatorsNTFS dozvole i dozvole dijeljenjaNTFS and share permissionsTokeni i podizanje ovlastiTokens and elevationZaštita administratorskih računaProtecting admin accountsDistribucija ažuriranjaDistributing updates5 simulatora5 simulatorsKako zakrpa stiže do klijentaHow an update reaches a clientAžuriranje na strani klijentaThe client side of updatingPrstenovi uvođenja ažuriranjaUpdate ringsOporavak i visoka dostupnostRecovery and high availability10 simulatora10 simulatorsObnova Active DirectoryjaRestoring Active DirectoryGrozdovi s preuzimanjem i kvorumFailover clusters and quorumLanac podizanja WindowsaThe Windows boot chainSjenovite kopije i kontrolne točkeShadow copies and checkpoints
Active Directory 14 simulatora14 simulators
Šume, domene i OUForests, domains and OUs4 simulatora4 simulatorsGrupe i njihovi opseziGroups and their scopes2 simulatora2 simulatorsKontroleri domene i njihove ulogeDomain controllers and their roles6 simulatora6 simulatorsReplikacija Active DirectoryjaActive Directory replication4 simulatora4 simulators
Šume, domene i OUForests, domains and OUs 4 simulatora4 simulators
Šuma, stablo, domena, OUForest, tree, domain, OUGrađa AD-a i čemu služi svaka granica: sigurnost, replikacija, pravilaAD structure and what each boundary is for: security, replication, policy
OU ili grupa?OU or group?OU nosi pravila i delegiranje, grupa dozvole; jedan OU, mnogo grupaOUs carry policy and delegation, groups permissions; one OU, many groups
Delegiranje ovlastiDelegation of controlPravo na OU-u umjesto članstva u Domain AdminsGranting rights on an OU instead of Domain Admins
Odnosi povjerenjaTrusts between domains and forestsSmjer, tranzitivnost, povjerenje između šuma i vanjsko: tko smije kamoDirection, transitivity, forest vs external trusts: who can access whatGrupe i njihovi opseziGroups and their scopes 2 simulatora2 simulators
OU ili grupa?OU or group?OU nosi pravila i delegiranje, grupa dozvole; jedan OU, mnogo grupaOUs carry policy and delegation, groups permissions; one OU, many groups
Opsezi grupa i AGDLPGroup scopes and AGDLPGlobalna, lokalna grupa domene, univerzalna: tko je član, gdje se koristiGlobal, domain local, universal: who can be a member, where it can be usedKontroleri domene i njihove ulogeDomain controllers and their roles 6 simulatora6 simulators
Što radi promocija kontrolera domeneWhat promoting a DC doesAD DS, DNS zona i SRV zapisi, SYSVOL i prva replikacijaAD DS, the DNS zone and SRV records, SYSVOL, the first replicationŠto radi promocija kontrolera domeneWhat promoting a DC does › Prvi kontroler domeneThe first domain controllerNova šuma: baza, DNS zone, SYSVOL, FSMO i SRV zapisiA new forest: database, DNS zones, SYSVOL, FSMO and SRV recordsŠto radi promocija kontrolera domeneWhat promoting a DC does › Drugi kontroler domeneA second domain controllerNalazi domenu u DNS-u, replicira particije i SYSVOLFinds the domain in DNS, replicates the partitions and SYSVOLFSMO uloge: prijenos ili preuzimanjeFSMO roles: transfer or seizePoslovi samo jednog DC-a, što pada bez nositelja; prijenos ili preuzimanjeThe single-master jobs, what breaks without the holder; transfer vs seize
Funkcionalne razineFunctional levelsŠto podizanje razine domene i šume otključava, a što isključujeWhat raising the domain and forest level unlocks, and what it rules out
RODC u podružniciRead-only DC at a branchPravilo replikacije lozinki i što otkriva ukradeni RODCPassword replication policy, and what a stolen RODC exposesReplikacija Active DirectoryjaActive Directory replication 4 simulatora4 simulators
Replikacija AD-a s više glavnih kopijaAD multi-master replicationUSN-ovi, vektor ažurnosti i pobjeda zadnjeg upisa po atributuUSNs, the up-to-dateness vector, attribute-level last writer wins
Lokacije, veze lokacija i KCCSites, site links and the KCCReplikacija unutar i između lokacija, trošak i raspored; izbor DC-a po lokacijiIntra-site vs inter-site replication, cost and schedule; site-aware DC choice
Replikacija SYSVOL-aSYSVOL replicationVerzija GPO-a u AD-u i u SYSVOL-u; GPO koji je u podružnicu stigao napolaGPO version in AD vs in SYSVOL; a GPO that half-arrived at a branchRODC u podružniciRead-only DC at a branchPravilo replikacije lozinki i što otkriva ukradeni RODCPassword replication policy, and what a stolen RODC exposesUčlanjenje i prijavaJoining and logging on 9 simulatora9 simulators
Učlanjenje računala u domenuJoining a computer to the domain 2 simulatora2 simulators
Učlanjenje u domenuJoining a domainSRV zapis, račun računala i sigurni kanal; vraćena snimka prekida kanalSRV lookup, computer account, secure channel; a snapshot revert breaks it
Što AD upisuje u DNSWhat AD puts in DNS_ldap._tcp, _kerberos._tcp, _msdcs; što se pokvari kad ih nema_ldap._tcp, _kerberos._tcp, _msdcs; what breaks when they are missingPrijava u domenu i pristupni tokenDomain logon and the access token 3 simulatora3 simulators
Prijava u domenuDomain logonLociranje DC-a preko DNS SRV, zatim Kerberos; bez DC-a spremljene vjerodajniceDC locator via DNS SRV, then Kerberos; cached credentials when no DC answersPristupni tokenThe access tokenSID-ovi i grupe utvrđuju se pri prijavi; zato se nakon promjene grupe odjavišSIDs and groups are fixed at logon; why you log off after a group changeZaključavanje računaAccount lockoutPrag, brojač na emulatoru PDC-a i zastarjela lozinka koja zaključa računThreshold, bad-password count at the PDC emulator, a stale password locking itKerberos, NTLM i vrijemeKerberos, NTLM and time 4 simulatora4 simulators
Kerberos: karte i satoviKerberos: tickets and clocksAS daje TGT, TGS kartu za uslugu, AP otvara mapu; razlika satova to rušiAS gives a TGT, TGS a service ticket, AP opens the share; clock skew breaks itNTLM i KerberosNTLM vs KerberosIzazov-odgovor ili karta; prelazak na NTLM; zašto pass-the-hash radiChallenge-response vs tickets; NTLM fallback; why pass-the-hash worksVrijeme u domeniTime in a domainEmulator PDC-a je izvor, članovi slijede DC-ove, Kerberos pada nakon 5 minutaPDC emulator is the source, members follow DCs, Kerberos fails past 5 minutesOdnosi povjerenjaTrusts between domains and forestsSmjer, tranzitivnost, povjerenje između šuma i vanjsko: tko smije kamoDirection, transitivity, forest vs external trusts: who can access whatGrupna pravila u WindowsimaWindows Group Policy 7 simulatora7 simulators
Koje pravilo pobjeđujeWhich policy wins 2 simulatora2 simulators
GPO: prednost i pobjednička postavkaGPO precedence: the winning settingLokalno → lokacija → domena → OU, redoslijed veza, prisilno i blokadaLocal → site → domain → OU, link order, Enforced and Block Inheritance
GPO: sigurnosno i WMI filtriranjeGPO security and WMI filteringNa koga se GPO primjenjuje; i račun računala treba čitanjeWho a GPO applies to; the computer account needs Read tooKada se pravila primjenjujuWhen policy applies 2 simulatora2 simulators
Kada se pravila primjenjujuWhen policy appliesPokretanje, prijava, osvježavanje svakih 90 ± 30 min, gpupdate i dvije prijaveStartup, logon, refresh every 90 ± 30 min, gpupdate, and the second logonReplikacija SYSVOL-aSYSVOL replicationVerzija GPO-a u AD-u i u SYSVOL-u; GPO koji je u podružnicu stigao napolaGPO version in AD vs in SYSVOL; a GPO that half-arrived at a branchUklanjanje pravilaRemoving a policy 1 simulator
Pravila lozinki za dio korisnikaPassword policies for some users 2 simulatora2 simulators
Detaljna pravila lozinki: koji PSO pobjeđujeFine-grained password policies: which PSO winsJedno pravilo domene iz GPO-a na korijenu; PSO-ovi ga nadjačavaju po prednostiOne domain policy from the domain root GPO; PSOs override it by precedenceZaključavanje računaAccount lockoutPrag, brojač na emulatoru PDC-a i zastarjela lozinka koja zaključa računThreshold, bad-password count at the PDC emulator, a stale password locking itDNS i DHCP u domeniDNS and DHCP in a domain 12 simulatora12 simulators
Zone i prosljeđivačiZones and forwarders2 simulatora2 simulatorsZapisi koje domena drži u DNS-uRecords the domain keeps in DNS3 simulatora3 simulatorsČišćenje zastarjelih zapisaCleaning up stale records1 simulatorKako klijent razrješava imeHow a client resolves a name1 simulatorDHCP opsezi i failoverDHCP scopes and failover2 simulatora2 simulatorsPlaniranje i praćenje adresaPlanning and tracking addresses3 simulatora3 simulators
Zone i prosljeđivačiZones and forwarders 2 simulatora2 simulators
DNS: vrste zona i opseg replikacijeDNS zone types and replication scopePrimarna, sekundarna, stub i zona u AD-u; opseg šuma, domena ili vlastitiPrimary, secondary, stub, AD-integrated; forest, domain or custom scopeProsljeđivači, uvjetni prosljeđivači i root hintsForwarders, conditional forwarders, root hintsKamo DC šalje imena koja nisu njegovaWhere a DC sends names it doesn't ownZapisi koje domena drži u DNS-uRecords the domain keeps in DNS 3 simulatora3 simulators
Što AD upisuje u DNSWhat AD puts in DNS_ldap._tcp, _kerberos._tcp, _msdcs; što se pokvari kad ih nema_ldap._tcp, _kerberos._tcp, _msdcs; what breaks when they are missing
DNS: sigurno dinamičko ažuriranjeDNS: secure dynamic updateKlijent sam upisuje svoj zapis; vlasnik zapisa je SID, pa novi račun ne smijeClients register their own records; the owner is a SID, so a new account can't
DHCP upisuje klijente u DNSDHCP registering clients in DNSPoslužitelj upisuje zapise za klijente: vlasnik, zaštita imena, DnsUpdateProxyThe server registers records for clients: owner, Name Protection, DnsUpdateProxyČišćenje zastarjelih zapisaCleaning up stale records 1 simulator
Kako klijent razrješava imeHow a client resolves a name 1 simulator
DHCP opsezi i failoverDHCP scopes and failover 2 simulatora2 simulators
DHCP: scope, rezervacije i prednost opcijaDHCP scopes, reservations and option precedenceIsključenja, rezervacije i razine opcija: pobjeđuje najspecifičnijaExclusions, reservations and option levels: the most specific winsDHCP failoverRaspodjela ili vruća pričuva, MCLT i partner down; stari podijeljeni opseg 80/20Load balance vs hot standby, MCLT and partner down; the old 80/20 split scopePlaniranje i praćenje adresaPlanning and tracking addresses 3 simulatora3 simulators
Adresni blok, rasponi i rastAddress block, ranges and growthOd bloka do raspona i adresa za lokacije i VLAN-ove, s prostorom za rastFrom a block to ranges and addresses for sites and VLANs, with room to grow
Iskorištenost i pragoviUtilisation and thresholdsPopunjenost opsega na poslužiteljima; upozorenje prije nego što se raspon napuniScope fill across servers; an alert before a range runs out
Tko je imao ovu adresu u 14:32?Who had this IP at 14:32?Povezivanje dodjela i prijava do uređaja i korisnikaCorrelating leases and logon events to find a machine and a userDozvole nad datotekama i administratorska pravaFile permissions and admin rights 8 simulatora8 simulators
NTFS dozvole i dozvole dijeljenjaNTFS and share permissions 2 simulatora2 simulators
Nasljeđivanje NTFS dozvolaNTFS inheritanceNaslijeđeni i izričiti unosi, isključeno nasljeđivanje, kopija i premještanjeInherited vs explicit entries, disabling inheritance, copy vs moveEfektivni pristup: NTFS i dijeljenjeEffective access: NTFS plus shareStrože od dvaju pobjeđuje, zabrana je jača od dozvole, grupe se zbrajajuThe stricter of the two wins; deny beats allow; groups add upTokeni i podizanje ovlastiTokens and elevation 2 simulatora2 simulators
Pristupni tokenThe access tokenSID-ovi i grupe utvrđuju se pri prijavi; zato se nakon promjene grupe odjavišSIDs and groups are fixed at logon; why you log off after a group changeUAC i podijeljeni tokenUAC and the split tokenAdministrator radi s filtriranim tokenom dok ne podigne ovlastiAdmins run with a filtered token until elevatedZaštita administratorskih računaProtecting admin accounts 4 simulatora4 simulators
Delegiranje ovlastiDelegation of controlPravo na OU-u umjesto članstva u Domain AdminsGranting rights on an OU instead of Domain AdminsBočno kretanje i slojevi ovlastiLateral movement and tieringJedna administratorska prijava na radnoj stanici otvara cijelu domenuOne admin logon on a workstation exposes the whole domainBočno kretanje i slojevi ovlastiLateral movement and tiering › Samo LAPSLAPS onlyLAPS siječe lokalni sažetak, ali ne štiti domenskog administratoraLAPS cuts the local hash but does not protect the Domain AdminBočno kretanje i slojevi ovlastiLateral movement and tiering › SlojeviTieringAdministrator sloja 0 ne prijavljuje se na radne stanice: nema što ukrastiA Tier 0 admin never logs on to a workstation: nothing to stealDistribucija ažuriranjaDistributing updates 5 simulatora5 simulators
Kako zakrpa stiže do klijentaHow an update reaches a client 2 simulatora2 simulators
WSUS: kako zakrpa stiže do klijentaWSUS: how an update reaches a clientSredišnji WSUS → podružnica → klijent: sinkronizacija, odobrenje, preuzimanjeMicrosoft Update → upstream WSUS → downstream → client: sync, approval, downloadGrupe računala i odobrenjaComputer groups and approvalsOdobrenje po grupi, rokovi; dodjela grupe na poslužitelju ili na klijentu (GPO)Approve per group, deadlines; server-side vs client-side targeting by GPOAžuriranje na strani klijentaThe client side of updating 2 simulatora2 simulators
Ciklus ažuriranja na klijentuThe client update cycleNađi, preuzmi, instaliraj, pokreni ponovno; učestalost, rok, aktivni satiDetect, download, install, restart; scan interval, deadlines, active hours
Klonovi koji se ne javljajuClients that never reportKlonovi iste slike dijele jedan client ID, pa ih WSUS vidi kao jedno računaloCloned images share one client ID, so many machines show as onePrstenovi uvođenja ažuriranjaUpdate rings 1 simulator
Oporavak i visoka dostupnostRecovery and high availability 10 simulatora10 simulators
Obnova Active DirectoryjaRestoring Active Directory3 simulatora3 simulatorsGrozdovi s preuzimanjem i kvorumFailover clusters and quorum2 simulatora2 simulatorsLanac podizanja WindowsaThe Windows boot chain2 simulatora2 simulatorsSjenovite kopije i kontrolne točkeShadow copies and checkpoints3 simulatora3 simulators
Obnova Active DirectoryjaRestoring Active Directory 3 simulatora3 simulators
Obrisani objekti: tombstone i koš za smeće AD-aDeleted objects: tombstone and Recycle BinŽivotni vijek nadgrobnog zapisa, koš za smeće AD-a i mjerodavna obnovaTombstone lifetime, the Recycle Bin and authoritative restoreObnova DC-a i USN rollbackRestoring a DC, and USN rollbackNemjerodavna i mjerodavna obnova; vraćanje snimke DC-a tiho kvari replikacijuNon-authoritative vs authoritative restore; snapshot reverts break replicationFSMO uloge: prijenos ili preuzimanjeFSMO roles: transfer or seizePoslovi samo jednog DC-a, što pada bez nositelja; prijenos ili preuzimanjeThe single-master jobs, what breaks without the holder; transfer vs seizeGrozdovi s preuzimanjem i kvorumFailover clusters and quorum 2 simulatora2 simulators
Kvorum i rascjep mozgaQuorum and split-brain › Windows grozd sa svjedokomFailover cluster with a witnessDva čvora i svjedok na dijeljenoj mapi: jedan pada, drugi ima 2 od 3 glasaTwo nodes and a file share witness: one fails, the other has 2 of 3 votesKvorum i rascjep mozgaQuorum and split-brain › Dinamički kvorum i svjedokDynamic quorum and witnessPali čvorovi gube glas, svjedok glasa uz paran broj: grozd radi do zadnjeg čvoraFailed nodes lose their votes, the witness votes on even counts: down to 1 nodeLanac podizanja WindowsaThe Windows boot chain 2 simulatora2 simulators
Lanac podizanja sustavaThe boot chain › Lanac podizanja WindowsaThe Windows boot chainUEFI → Boot Manager → winload → jezgra → smss → winlogonUEFI → Boot Manager → winload → kernel → smss → winlogonLanac podizanja sustavaThe boot chain › Windows bez BCD-aWindows without its BCDBoot Manager ne zna koji winload.efi pokrenuti: zaslon za oporavakBoot Manager does not know which winload.efi to start: the recovery screenSjenovite kopije i kontrolne točkeShadow copies and checkpoints 3 simulatora3 simulators
Datotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystems › Sjenovite kopije i prethodne verzijeShadow copies and Previous VersionsPrije prepisivanja stari blok ide u diferencijalno područje; vraćanje iz sjeneBefore an overwrite the old block goes to a diff area; restore from a shadowDatotečni sustavi s kopiranjem pri pisanjuCopy-on-write filesystems › Puno diferencijalno područjeA full diff areaKad se područje napuni, briše se najstarija sjena i njezina verzija nestajeWhen the diff area fills up, the oldest shadow is deleted with its versionLanci slika diskaBacking chains › Kontrolne točke u Hyper-V-uHyper-V checkpointsBrisanje kontrolne točke spaja njezin AVHDX u roditeljaDeleting a checkpoint merges its AVHDX into the parentRadiovalovi i signaliRadio waves and signals 58 simulatora58 simulators
Signali, sklopovi, modulacija i kako se radiovalovi šire.Signals, circuits, modulation and how radio waves travel.
Valovi i signaliWaves and signals8 simulatora8 simulatorsSinusni titraj, perioda i valna duljinaA sine wave, its period and wavelengthOd signala do spektraFrom a signal to its spectrumUzorkovanje i kvantizacijaSampling and quantisationSklopovi i anteneCircuits and antennas10 simulatora10 simulatorsTitrajni krugoviResonant circuitsAnteneAntennasIspravljači i valovitostRectifiers and rippleSmanjenje snage otpornicimaLowering power with resistorsKvarovi koji se čuju u tonuFaults you can hear in a toneAntene i zračenjeAntennas and radiation13 simulatora13 simulatorsZašto antena zračiWhy an antenna radiatesBlisko i daleko poljeNear field and far fieldPolarizacijaPolarizationDipolThe dipoleDobitak i usmjerenostGain and directivityAntena iznad tlaAntennas over groundProračun vezeThe link budgetModulacijaModulation12 simulatora12 simulatorsAmplitudna i fazna modulacijaAmplitude and phase modulationBalansni modulatori i jedan bočni pojasBalanced modulators and single sidebandI/Q signaliI/Q signalsDigitalna modulacijaDigital modulationKako se radiovalovi šireHow radio waves travel7 simulatora7 simulatorsOdbijanje od ionosfereBouncing off the ionosphereVišestazno širenje i fedingMultipath and fadingAurora i Dopplerovo širenjeAurora and Doppler spreadTko koristi koju frekvencijuWho uses which frequency12 simulatora12 simulatorsNamjena frekvencijaFrequency allocationAmaterski načini radaAmateur radio modesDijeljenje kanalaSharing a channelRadijske mrežeRadio networksVođenje radio mrežeRunning a radio net
Valovi i signaliWaves and signals 8 simulatora8 simulators
Sinusni titraj, perioda i valna duljinaA sine wave, its period and wavelength 2 simulatora2 simulators
Amplituda i perioda sinusnog titrajaAmplitude and period of a sine waveAmplituda je visina titraja, perioda njegovo trajanje, a f = 1/TAmplitude is how far a sine swings, the period how long it lasts; f = 1/T
Valna duljina i frekvencijaWavelength and frequencyŠto je valna duljina kraća, frekvencija je veća: f = c / λThe shorter the wavelength, the higher the frequency: f = c / λOd signala do spektraFrom a signal to its spectrum 4 simulatora4 simulators
Fourierova sintezaFourier synthesisPeriodičan signal: zbroj sinusnih titraja na višekratnicima osnovne frekvencijeA periodic signal is a sum of sine waves at multiples of a base frequency
Spektar pravokutnog signalaThe spectrum of a square wavePravokutni signal: zbroj neparnih harmonika; uz skok ostaje prebačaj od oko 9 %A square wave is a sum of odd harmonics; at each jump a 9 % overshoot stays
Spektar govornog signalaSpectrum of speech signalsZvučni glasovi su crte harmonika pod formantima, bezvučni su šumVoiced sounds are harmonic lines under formants; unvoiced sounds are noise
FFT i vodopadni dijagramThe FFT and the waterfallBrzina uzorkovanja određuje raspon, veličina FFT-a razlučivostThe sample rate sets the span, the FFT size sets the resolutionUzorkovanje i kvantizacijaSampling and quantisation 3 simulatora3 simulators
Teorem uzorkovanja i aliasingThe sampling theorem and aliasingSignal se iz uzoraka može rekonstruirati samo ako je fs > 2fA signal can be rebuilt from its samples only if fs > 2f
Uzorkovanje i kvantizacijaSampling and quantisationA/D pretvarač mjeri signal u razmacima 1/fs i zaokružuje ga na 2ⁿ razinaAn A/D converter measures a signal every 1/fs and rounds it to 2ⁿ levelsFFT i vodopadni dijagramThe FFT and the waterfallBrzina uzorkovanja određuje raspon, veličina FFT-a razlučivostThe sample rate sets the span, the FFT size sets the resolutionSklopovi i anteneCircuits and antennas 10 simulatora10 simulators
Titrajni krugoviResonant circuits2 simulatora2 simulatorsAnteneAntennas3 simulatora3 simulatorsIspravljači i valovitostRectifiers and ripple3 simulatora3 simulatorsSmanjenje snage otpornicimaLowering power with resistors1 simulatorKvarovi koji se čuju u tonuFaults you can hear in a tone3 simulatora3 simulators
Titrajni krugoviResonant circuits 2 simulatora2 simulators
LC titrajni krugLC resonant circuitEnergija titra između električnog polja u kondenzatoru i magnetskog u zavojniciEnergy swings between the capacitor's electric and the coil's magnetic field
Od titrajnog kruga do anteneFrom resonant circuit to antennaOtvoreni titrajni krug pušta polje u prostor: nastaje dipolOpening up a resonant circuit lets its field out into space: a dipoleAnteneAntennas 3 simulatora3 simulators
Od titrajnog kruga do anteneFrom resonant circuit to antennaOtvoreni titrajni krug pušta polje u prostor: nastaje dipolOpening up a resonant circuit lets its field out into space: a dipole
Trap-dipolTrap dipoleTrapovi daju istoj žici različite električne duljine na različitim pojasevimaTraps give one wire different electrical lengths on different bands
SWR i stojni valSWR and standing wavesNeprilagođen teret reflektira snagu, a na vodu nastaje stojni valA mismatched load reflects power and a standing wave forms on the lineIspravljači i valovitostRectifiers and ripple 3 simulatora3 simulators
Punovalni ispravljač sa srednjim odcjepomCentre-tap full-wave rectifierDvije diode provode naizmjence, pa obje poluperiode izlaze pozitivneTwo diodes take turns, so both half-periods come out positive
Mosni ispravljačBridge rectifierParovi dioda provode naizmjence; struja kroz trošilo teče u istom smjeruTwo diode pairs take turns; the current through the load always flows one way
Brujanje i preostala valovitostMains hum and ripplePoluvalno ostaje valovitost 50 Hz, punovalno 100 Hz; zvučnik je čini brujanjemHalf-wave leaves a 50 Hz ripple, full-wave 100 Hz; a speaker makes it a humSmanjenje snage otpornicimaLowering power with resistors 1 simulator
Kvarovi koji se čuju u tonuFaults you can hear in a tone 3 simulatora3 simulators
Chirp u CW odašiljačuChirp in a CW transmitterNapon VFO-a padne pri pritisku tipke, pa točke i crte počnu krivom visinom tonaWhen the VFO's supply dips at key-down, every dit and dah starts off pitch
Chirp u QSO-uChirp in a QSOTon jedne postaje je miran, a svaka crta druge raste od pritiska tipkeOne station's tone is steady; every dah of the other rises from key-downBrujanje i preostala valovitostMains hum and ripplePoluvalno ostaje valovitost 50 Hz, punovalno 100 Hz; zvučnik je čini brujanjemHalf-wave leaves a 50 Hz ripple, full-wave 100 Hz; a speaker makes it a humAntene i zračenjeAntennas and radiation 13 simulatora13 simulators
Zašto antena zračiWhy an antenna radiates3 simulatora3 simulatorsBlisko i daleko poljeNear field and far field2 simulatora2 simulatorsPolarizacijaPolarization2 simulatora2 simulatorsDipolThe dipole2 simulatora2 simulatorsDobitak i usmjerenostGain and directivity3 simulatora3 simulatorsAntena iznad tlaAntennas over ground1 simulatorProračun vezeThe link budget1 simulator
Zašto antena zračiWhy an antenna radiates 3 simulatora3 simulators
Zašto ubrzani naboj zrači: silnice koje se lomeWhy an accelerated charge radiates: field lines that kinkVijest o guranju putuje brzinom c i lomi silnice; lom pada kao 1/r: zračenjeNews of a push travels out at c and kinks the field lines; the kink falls as 1/r
Dipol kroz vrijeme: blisko polje, daleko polje i petljeThe dipole over time: near field, far field and loopsBlizu dipola silnice izlaze i vraćaju se; od oko λ/4 petlje se odvajaju i odlazeNear the dipole lines go out and back; from about λ/4 loops break awayOd titrajnog kruga do anteneFrom resonant circuit to antennaOtvoreni titrajni krug pušta polje u prostor: nastaje dipolOpening up a resonant circuit lets its field out into space: a dipoleBlisko i daleko poljeNear field and far field 2 simulatora2 simulators
Dipol kroz vrijeme: blisko polje, daleko polje i petljeThe dipole over time: near field, far field and loopsBlizu dipola silnice izlaze i vraćaju se; od oko λ/4 petlje se odvajaju i odlazeNear the dipole lines go out and back; from about λ/4 loops break away
Sprega u bliskom polju: indukcija bez zračenjaNear-field coupling: induction without radiationBlizu napon pada kao 1/r³, kao u transformatoru; iza λ/2π preuzima zračenje, 1/rClose in the voltage falls as 1/r³, like a transformer; past λ/2π radiation, 1/rPolarizacijaPolarization 2 simulatora2 simulators
Polarizacija: val nosi smjer antenePolarization: the wave carries the antenna's directionE leži u ravnini žice i spojnice; prijamni dipol uzima cos ψE lies in the plane of the wire and the line of sight; a receiver takes cos ψ
Različite antene na predaji i prijamu: gubitak polarizacijeDifferent antennas at each end: polarization lossPrijamna antena uzima projekciju vala |ê·ê*|²: pravac, elipsa ili krugThe receiving antenna takes the wave's projection |ê·ê*|²: line, ellipse, circleDipolThe dipole 2 simulatora2 simulators
Duljina dipola: struja, dijagram zračenja i otpor zračenjaDipole length: current, pattern and radiation resistanceStruja je stojni val s nulama na krajevima; duljina pomiče napajanje po njemuThe current is a standing wave, zero at the ends; length moves the feed along it
Kratke antene: otpor zračenja, gubici i širina pojasaShort antennas: radiation resistance, losses and bandwidthKratki dipol ugođen zavojnicom: malen, učinkovit, širokopojasan, biraj dvaA short dipole tuned by a coil: small, efficient, broadband, pick twoDobitak i usmjerenostGain and directivity 3 simulatora3 simulators
Dobitak i usmjerenost: dBi, dBd, ERP i EIRPGain and directivity: dBi, dBd, ERP and EIRPAntena ne dodaje snagu, nego je preraspodjeljuje: stisnut dijagram, veći dobitakAn antenna adds no power, it redistributes it: squeeze the pattern, gain rises
Dvije antene zajedno: razmak, faza i zakretanje snopaTwo antennas together: spacing, phase and steering the beamPolja se zbrajaju s razlikom puta i faze: faktor niza oblikuje i zakreće snopFields add by path difference and feed phase: the array factor shapes the beam
Yagi antena: reflektor, direktori i inducirane strujeThe Yagi: a reflector, directors, and parasitic currentsNapaja se samo zračitelj; ostali nose inducirane struje, faze im daje duljinaOnly one element is fed; the others carry induced currents phased by lengthAntena iznad tlaAntennas over ground 1 simulator
Proračun vezeThe link budget 1 simulator
ModulacijaModulation 12 simulatora12 simulators
Amplitudna i fazna modulacijaAmplitude and phase modulation 2 simulatora2 simulators
Amplitudna modulacija (AM)Amplitude modulation (AM)Amplituda nositelja prati NF signal; u spektru nastaju dva bočna pojasaThe carrier's amplitude follows the AF signal; the spectrum gains two sidebands
Fazna modulacija (PM)Phase modulation (PM)Faza nositelja izravno prati vrijednost signala; kod FM to radi frekvencijaThe carrier's phase follows the signal directly; in FM, the frequency doesBalansni modulatori i jedan bočni pojasBalanced modulators and single sideband 3 simulatora3 simulators
Prstenasti modulatorRing modulatorDiodni prsten kao preklopka polariteta: U₃ = ±U₁ prema predznaku U₂A diode ring as a polarity switch: U₃ = ±U₁, following the sign of U₂
Balansni modulator (DSB)Balanced modulator (DSB)Izbalansiran prsten dioda potiskuje nositelj; ostaju samo dva bočna pojasaA balanced diode ring suppresses the carrier and leaves only the two sidebands
Filtarska metoda za SSBSSB filter methodFiksni pojasni filtar propušta jedan bočni pojas; kvarc oscilatora bira kojiA fixed bandpass filter keeps one sideband; the oscillator's crystal picks whichI/Q signaliI/Q signals 2 simulatora2 simulators
I/Q kazaljkaI/Q phasorProjekcije okretne kazaljke: vodoravno I (kosinus), okomito Q (sinus)A turning phasor's projections: I horizontally (a cosine), Q vertically (a sine)
I/Q signaliI/Q signalsI i Q nositelji pomaknuti za 90° zbrajaju se u jedan titraj amplitude A i faze φI and Q carriers 90° apart add up to one wave of amplitude A and phase φDigitalna modulacijaDigital modulation 5 simulatora5 simulators
ASK, FSK i PSKASK, FSK and PSKTri načina da se bitovi utisnu na nositeljThree ways to put bits on a carrier
QPSK u konstelacijskom dijagramuQPSK in the constellation diagramŠum pomiče primljene točke; prijamnik bira simbol po kvadrantuNoise moves the received points; the receiver picks the symbol by quadrantLoRa: cvrkuti i faktor širenjaLoRa: chirps and spreading factorFaktor širenja: vrijeme u eteru prema dometuSpreading factor: time on air against rangeQAM i OFDMQAM and OFDMVeća konstelacija prema šumu; nositelji koji se ne ometajuConstellation size against noise; subcarriers that do not interfereShannon-Hartleyev zakonThe Shannon–Hartley lawKapacitet kanala iz širine pojasa i omjera signal-šumChannel capacity from bandwidth and signal-to-noise ratioKako se radiovalovi šireHow radio waves travel 7 simulatora7 simulators
Odbijanje od ionosfereBouncing off the ionosphere 3 simulatora3 simulators
Skok-udaljenostSkip distanceRavniji kut zračenja i viša lomeća regija daju dulji skok preko ionosfereA flatter radiation angle and a higher region make a longer ionospheric hop
Greyline (siva linija)The grey lineU pojasu sumraka D-regija više ne guta signal, a F-regija ga još lomi dalekoAt twilight the D region is gone but the F region still bends HF signals far
Antena iznad tla: zrcalna slika i kut zračenjaAn antenna above ground: its image and the take-off angleTlo je zrcalo: izravni i odbijeni val zbrajaju se ili poništavaju po visiniThe ground is a mirror: direct and reflected waves add or cancel by heightVišestazno širenje i fedingMultipath and fading 3 simulatora3 simulators
Višestazno širenje i interferencijaMultipath propagation and interferenceSignali s dvaju putova zbrajaju se: fazna razlika ih pojačava ili poništavaSignals from two paths add up; their phase difference makes them grow or cancel
Feding (QSB)Fading (QSB)Prizemni i prostorni val se zbrajaju; dok se faza mijenja, signal jača i slabiGround and sky wave add up; as their phase drifts, the signal swells and fadesOd odašiljača do prijamnika: proračun vezeFrom transmitter to receiver: the link budgetSnaga i dobici, minus gušenje puta i gubici: margina iznad osjetljivosti u dBPower plus gains, minus path loss and losses: the margin above sensitivity in dBAurora i Dopplerovo širenjeAurora and Doppler spread 1 simulator
Tko koristi koju frekvencijuWho uses which frequency 12 simulatora12 simulators
Namjena frekvencijaFrequency allocation 2 simulatora2 simulators
Komunikacijske tehnologije: spektralni pregledCommunication technologies: a spectrum overviewBežične tehnologije prema namjeni, smještene po frekvenciji na logaritamskoj osiWireless technologies by purpose, placed by frequency on a logarithmic axis
Radiofrekvencijski spektar: plan namjene EU/HRRadio spectrum: the EU/HR allocation planTko smije koju frekvenciju: plan namjene i tehnologije od 9 kHz do 300 GHzWho may use which frequency: allocation plan and technologies, 9 kHz to 300 GHzAmaterski načini radaAmateur radio modes 2 simulatora2 simulators
Amaterski načini rada: referentni pregledAmateur radio modes: a referenceAnalogni i digitalni načini rada s klasom emisije ITU-a i širinom pojasaAnalog and digital modes with their ITU emission class and bandwidth
CTCSS: tonska šumna bravaCTCSS tone squelchPodzvučni ton otvara prijamnikA sub-audible tone opens the receiverDijeljenje kanalaSharing a channel 2 simulatora2 simulators
Radijske mrežeRadio networks 3 simulatora3 simulators
Radijske mreže pod opterećenjemRadio networks under loadFiksni kanali, zajednički skup ili put preko releja: tko dođe na redFixed channels, a shared pool or a route through relays: who gets throughKako poruka putuje kroz LoRa i mesh mrežeHow a message travels in LoRa and mesh networksTko prosljeđuje: gateway, svi čvorovi, samo repetitori ili svatko kao routerWho forwards: a gateway, every node, only repeaters, or everyone as a routerLoRa: cvrkuti i faktor širenjaLoRa: chirps and spreading factorFaktor širenja: vrijeme u eteru prema dometuSpreading factor: time on air against rangeVođenje radio mrežeRunning a radio net 3 simulatora3 simulators
Usmjerena mreža ili svi odjednomDirected net vs free-for-allNCS pretvara nadmetanje za kanal u red čekanjaAn NCS turns contention into a queue
Zamjenski NCS preuzima mrežuBackup NCS takeoverMreža preživljava gubitak kontrolne staniceThe net survives losing its control station
Prioritetni promet i potvrda primitkaPriority traffic and ACKHITNO prekida, prioritet određuje red, tek ACK isporučuje porukuHITNO preempts, priority sets the order, only an ACK deliversRad na setu: sigurnost i tko što radiWorking on set: safety and who does what 12 simulatora12 simulators
Sigurnost, odjeli i snimateljski dan: tko što radi, kojim redom i kada se sve zaustavlja.Safety, departments and the shooting day: who does what, in what order, and when everything stops.
Ekipa i odjeliCrew and departments3 simulatora3 simulatorsTko o čemu odlučujeWho decides whatTko zaustavlja radWho stops the workOdjeliDepartmentsSnimateljski danThe shooting day1 simulatorPozivi i radioCalls and radioSigurnostSafety1 simulatorMjere za rizikeRisk controlsStruja, svjetlo i toplinaPower, light and heat2 simulatora2 simulatorsOpterećenje strujnih krugovaLoading the circuitsStativi, tereti i visinaStands, loads and height3 simulatora3 simulatorsStabilnost stativaKeeping stands upRadno opterećenjeWorking loadRad na visiniWorking at heightZdravlje kroz dugi danHealth over a long day2 simulatora2 simulatorsUmor i odmorFatigue and restSluhHearing
Ekipa i odjeliCrew and departments 3 simulatora3 simulators
Tko o čemu odlučujeWho decides what 1 simulator
Tko zaustavlja radWho stops the work 1 simulator
OdjeliDepartments 1 simulator
Snimateljski danThe shooting day 1 simulator
Pozivi i radioCalls and radio 1 simulator
SigurnostSafety 1 simulator
Mjere za rizikeRisk controls 1 simulator
Struja, svjetlo i toplinaPower, light and heat 2 simulatora2 simulators
Opterećenje strujnih krugovaLoading the circuits 2 simulatora2 simulators
Vati, volti, amperi: zašto izbaci osigurač i grije se kabelWatts, volts, amps: why a circuit trips and a cable heatsI = P / U: struje se zbrajaju do osigurača, a namotan kabel se pregrijeI = P / V: currents add up to the breaker; a coiled cable overheats
Tri faze: raspodjela reflektora na agregatuThree phases: spreading the lamps on a generatorSvaka faza ima svoju granicu; ono što se ne poništi vraća se nulvodičemEach phase has its own limit; what does not cancel returns on the neutralStativi, tereti i visinaStands, loads and height 3 simulatora3 simulators
Stabilnost stativaKeeping stands up 1 simulator
Radno opterećenjeWorking load 1 simulator
Rad na visiniWorking at height 1 simulator
Zdravlje kroz dugi danHealth over a long day 2 simulatora2 simulators
Umor i odmorFatigue and rest 1 simulator
SluhHearing 1 simulator
Računanje na papiruArithmetic on paper 6 simulatora6 simulators
Zbrajanje, oduzimanje, množenje i dijeljenje na papiru, u bilo kojoj bazi.Adding, subtracting, multiplying and dividing on paper, in any base.
Brojevi i mjesna vrijednostNumbers and place value1 simulatorKoliko vrijedi znamenkaWhat a digit is worthČetiri računske operacijeThe four operations4 simulatora4 simulatorsPisano zbrajanjeColumn additionPisano oduzimanjeColumn subtractionPisano množenjeColumn multiplicationPisano dijeljenjeLong divisionProvjeraChecking1 simulatorJe li točno?Is it right?
Brojevi i mjesna vrijednostNumbers and place value 1 simulator
Koliko vrijedi znamenkaWhat a digit is worth 1 simulator
Četiri računske operacijeThe four operations 4 simulatora4 simulators
Pisano zbrajanjeColumn addition 1 simulator
Pisano oduzimanjeColumn subtraction 1 simulator
Pisano množenjeColumn multiplication 1 simulator
Pisano dijeljenjeLong division 1 simulator
ProvjeraChecking 1 simulator
Je li točno?Is it right? 1 simulator
Za predavačaFor the lecturer 3 simulatora3 simulators
Alati za vođenje nastave.Tools for running a class.
