Protocol Atlas

Defined once

Glossary

Terms are authored with the protocols that use them. A citation appears when a standard names the thing; vendor slang is labelled as such by living on a proprietary protocol.

Access port
A port belonging to one VLAN. Frames arrive untagged and are classified on ingress; frames leave with no tag.
Active Virtual Forwarder
A GLBP member responsible for one virtual MAC address. Several AVFs may forward simultaneously even though one member alone is the active virtual gateway. Cisco IOS XE 17.x — Configuring GLBP §GLBP Virtual Forwarder Redundancy
Active Virtual Gateway
The elected GLBP member that owns the virtual IP and assigns virtual MAC addresses. It answers ARP requests; the active virtual forwarders carry the resulting traffic. Cisco IOS XE 17.x — Configuring GLBP §GLBP Active Virtual Gateway
Administrative distance
A local, configurable preference between routing protocols offering the same prefix. It never crosses the wire and runs only after longest-prefix match has chosen the prefix.
Allowed IPs
In WireGuard, the prefixes associated with a peer’s public key. They install outbound routes toward that peer and filter which inner source addresses are accepted from it — one setting, two jobs. WireGuard Protocol §2 Cryptokey Routing
Alternate port
A port with a path to the root that is not the best one, held discarding and ready to be promoted. Naming the backup in advance is where most of RSTP’s speed comes from. IEEE 802.1D-2004 §17.10
Anycast RP
Several routers owning one RP address, with the IGP choosing the nearest. It makes the address redundant and nothing else — the RPs still have to share source state themselves. RFC 4610 §2
ARP cache
A host’s table of IPv4-to-MAC bindings, filled from replies and from any request that carries a binding it already holds. Entries age out rather than being revoked, so a wrong entry survives until its timer expires. RFC 826
AS_PATH
The sequence (and optional set) of ASes a path has traversed. Shorter wins after LOCAL_PREF. An AS_SET counts as one, not as its cardinality. RFC 4271 §5.1.2
Authoritative server
A server answering from a zone it holds rather than from a cache. It sets the AA bit — which says where the answer came from, not that the zone is current. RFC 1035 §4.1.1
BFD echo
A mode where a system sends packets the neighbour loops straight back in the forwarding plane, testing the data path rather than the neighbour’s control plane. RFC 5880 §6.4
BPDU
Bridge protocol data unit. The 35-octet message bridges exchange to agree on the active topology, sent to the Bridge Group Address 01:80:C2:00:00:00. IEEE 802.1D-2004 §9.3.1
Bridge identifier
Eight octets identifying a bridge: a settable 16-bit priority followed by the 48-bit bridge address. Compared as a single number, priority first. IEEE 802.1D-2004 §9.2.5
Broadcast domain
The set of ports a broadcast frame reaches. One per VLAN, which is what VLANs are for.
Certificate chain
The leaf plus the intermediates a server sends so a client can build a path to a root it already trusts. The root is omitted; sending only the leaf works in browsers, which fetch what is missing, and nowhere else. RFC 8446 §4.4.2
Channel
The (source, group) pair that identifies a source-specific stream. Two sources on the same group address are two channels and do not interfere. RFC 4607 §2
CIST
Instance 0, and not an ordinary instance: it is the tree a region uses to reach anything outside itself, and the one every unmapped VLAN falls into. At a region boundary every other instance follows it. IEEE 802.1Q-2022
Command authorization
A TACACS+ authorization decision for a requested command and its arguments, separate from the authentication exchange that established the administrator identity. RFC 8907 §6
Configuration datastore
A NETCONF configuration target such as running, candidate, or startup. Editing candidate does not change forwarding until a commit moves that configuration into running. RFC 6241 §5.1
Congestion window
The sender’s private estimate of what the network will carry. It appears nowhere in the header, the receiver never learns it, and it is usually the smaller of the two limits on how much may be in flight. RFC 5681 §3.1
Connection ID
A QUIC identifier for a connection that is independent of the UDP four-tuple. It is what makes connection migration possible when addresses change. RFC 9000 §5.1
Cryptokey routing
WireGuard’s peer table: a public key maps to allowed tunnel IPs and an optional underlay endpoint. There is no separate IPsec-style SPD. WireGuard Protocol §2 Cryptokey Routing
Delegation
The NS records by which a parent zone hands responsibility for a subtree to another set of servers. The parent stores where to ask, not the answers. RFC 1034 §4.2
Designated port
The one port on each segment that forwards toward the root on that segment’s behalf. Every segment has exactly one. IEEE 802.1D-2004 §17.7
Designated Router
On an OSPF multi-access segment, the router that originates the Network-LSA and with which every other router becomes fully adjacent. A higher-priority latecomer does not take over. RFC 2328 §7.3
Detection time
The negotiated BFD interval multiplied by the detect multiplier. The whole tuning surface: it is what should be compared against the failure being protected against. RFC 5880 §6.8.4
DHCP snooping
A switch feature that drops DHCP server messages on untrusted ports and records MAC-to-IP bindings from leases learned via trusted ports. Cisco Catalyst — DHCP Snooping and IP Source Guard §DHCP Snooping
DIS
Designated Intermediate System on an IS-IS LAN. Highest priority then highest SNPA, preempting, with no backup. Originates the pseudonode LSP. RFC 1195 §4.3
DSCP
Differentiated Services Code Point: the six-bit label in the IPv4/IPv6 DS field that selects a per-hop behaviour. It requests treatment; it does not reserve bandwidth. RFC 2474 §3
Edge port
A port declared to face a host, so it forwards immediately and is skipped by the sync procedure. The declaration is revoked silently the moment a BPDU arrives, which is what BPDU guard turns into an alert. IEEE 802.1Q-2022 §13.4
Endpoint-independent mapping
A NAT mapping behaviour where the external address and port for an internal source do not depend on the destination. Required by RFC 4787 so a host can learn one public binding and reuse it with other peers. RFC 4787 §4.1
ESI
Ethernet Segment Identifier. EVPN type 1 and type 4 use it for multihoming, aliasing, mass-withdraw, and DF election. It is not a VNI. RFC 7432 §7.4
Explicit Route Object
The list of hops an RSVP-TE Path message asks for. Strict hops mean exactly that router next; a loose hop delegates the segment to the IGP, which is where LSPs on surprising paths come from. RFC 3209 §4.3
ExStart
The neighbor state in which two routers elect a master and slave by exchanging empty Database Description packets. Interface MTU is checked here, not in Hello. RFC 2328 §10.1
Extended ACL
An IPv4 access list that can match source, destination, protocol, and transport ports. Standard lists match source address only. Cisco IOS XE 17.x — Creating an IP Access List §Information About Creating an IP Access List
Facility backup
One pre-signalled bypass per protected link or node, shared by every LSP crossing it. The state is per element rather than per LSP, which is why it scales where one-to-one detours do not. RFC 4090 §3.2
Feasible successor
An EIGRP neighbor whose reported distance is strictly less than the feasible distance through the successor. That inequality is the loop-free test. RFC 7868 §3.3
Filtering database
A switch’s table of MAC addresses and the ports they were last seen on. Built entirely by reading the source address of arriving frames; nothing registers with it. IEEE 802.1D-2004 §7.9
Floating static
A static route configured with a worse administrative preference than the preferred source for the same prefix length, so it stays unused until that source withdraws. RFC 1812 §5.2.4.4
Flood and prune
The dense-mode model: send the group to every router, and remove the branches that object. Prune state is timed, so the flood repeats until State Refresh keeps it alive. RFC 3973 §3
Flooding
Sending a frame out every port in the VLAN except the one it arrived on. The correct response to a destination the switch has not learned. IEEE 802.1D-2004 §7.7
Forward proxy
An intermediary chosen and configured by the client, which asks it to fetch on its behalf. Same machinery as a reverse proxy, pointed the other way. RFC 9110 §3.7
giaddr
The relay agent address field. The server matches it against its scopes, so this one field decides which subnet a client is allocated from. RFC 2131 §2
Glue record
An address record a parent zone serves for a name server it does not own, so that resolving the delegation does not require following it first. RFC 1034 §4.2.1
Gratuitous ARP
An ARP packet whose sender and target protocol addresses are the same. Nobody asked for it: it announces where an address now lives, which is how failover completes and how spoofing works. RFC 5227 §3
Group-to-RP hash
The deterministic function that picks an RP when several serve one range at equal priority. It spreads groups across the available RPs and guarantees every router picks the same one. RFC 7761 §4.7.2
Hairpinning
When two hosts behind the same NAT communicate using each other’s external mapped addresses, the NAT must translate and send the packet back out the inside interface. RFC 4787 requires it. RFC 4787 §6
HTTP/3
HTTP semantics mapped onto QUIC. QUIC is the transport (RFC 9000); HTTP/3 is the mapping (RFC 9114) — they are not the same specification. RFC 9114 §1
Idempotent method
One whose effect is the same however many times it is applied, so a client or proxy may retry after a failure without knowing whether the first attempt was processed. It is why a lost GET can be repeated and a lost POST cannot. RFC 9110 §9.2.2
IGMPv3 INCLUDE list
The membership report that names which sources a receiver wants. It is what makes SSM expressible; IGMPv2 has no field for a source, so a v2 report in the SSM range does nothing. RFC 3376 §2
IMET route (type 3)
An EVPN advertisement saying this leaf wants broadcast and multicast traffic for a VNI. Collected across the fabric, the type 3 routes are the ingress replication list. RFC 7432 §11.1
Implicit deny
The invisible final deny at the end of an IP ACL. Traffic that matches no explicit entry is dropped — absence of a deny line is not a permit.
Ingress replication
Flooding by sending one unicast copy per remote peer instead of using underlay multicast. The list is either maintained by hand or distributed by EVPN, and a peer missing from it fails only for hosts nobody has learned yet. RFC 8365 §5.1
Instance ID
An octet in the OSPFv3 header that lets several processes share a link. Hellos with a different Instance ID are ignored, not rejected as malformed. RFC 5340 §2.4
IPFIX template
The ordered list of field identifiers and lengths that gives later Data Records their schema. Its identifier is meaningful only in the exporter and observation-domain context. RFC 7011 §10.2
Lease
A binding between a client and an address, valid for a stated time. The client renews at half the lease and again at seven eighths; reaching expiry means every renewal failed. RFC 2131 §1.5
LOCAL_PREF
A well-known discretionary attribute. Higher is better. Compared in Phase 2 before AS_PATH length. Not sent to eBGP peers. RFC 4271 §5.1.5
Locator
The routed half of an SRv6 SID, advertised into the IGP as an ordinary IPv6 prefix. A locator that is not advertised produces a plain routing failure nobody connects to SRv6. RFC 8986 §3.3
Longest prefix match
The forwarding rule: among all routes containing a destination, the one fixing the most bits is used. Metric and administrative distance only compare routes to the same prefix and never override this. RFC 4632 §5.1
LS age
Seconds since the LSA was originated. At 3600 seconds (MaxAge) it is flushed. Flooding prefers the younger of two copies with the same sequence. RFC 2328 §12.1.1
MAC mobility sequence
A counter in an extended community, incremented each time a MAC moves, that orders two advertisements without needing synchronised clocks. Strip the community anywhere in the path and every move looks like a tie. RFC 7432 §15
MAC withdrawal
A message telling other provider edges to flush specific addresses after a topology change, instead of waiting out the ageing timer while traffic goes to the site a host has left. RFC 4762 §6.2
Make-before-break
Signalling a new LSP before tearing the old one down. It needs Shared Explicit style, or the two instances double-book the bandwidth on every link they have in common. RFC 3209 §2.5
mGRE
Multipoint Generic Routing Encapsulation: one tunnel interface that can have many remote endpoints. DMVPN hubs use it so every spoke shares a single hub tunnel. RFC 2784 §2
MSDP mesh group
A set of peers that do not forward SAs to each other and skip the peer-RPF check between themselves. It trades loop protection for a promise of a full mesh, and it is what makes Anycast RP work. RFC 3618 §10.2
MSS clamping
A router rewriting the maximum segment size option in a passing SYN so both ends agree on a size that fits. It is the path-MTU fix that does not depend on ICMP surviving a network you do not control. RFC 9293 §3.7.1
MST digest
A 16-octet HMAC-MD5 of the VID-to-MSTID table. Two bridges share a region only when name, revision, and digest all match. Matching names with different maps do not merge. IEEE 802.1Q-2022 §13.8
MST region
The set of switches that share a spanning tree instance map. Membership is decided by comparing a digest of the region name, the revision and the whole VLAN-to-instance table — not by comparing configuration. IEEE 802.1Q-2022 §13.7
MULTI_EXIT_DISC
An optional non-transitive metric. Lower is better. Compared only among paths from the same neighboring AS unless a local always-compare policy is on. RFC 4271 §5.1.4
NAPT
Network Address Port Translation: many internal addresses share one external address, distinguished by transport port. What most deployments call “NAT” or “PAT”. RFC 3022 §2.2
Native VLAN
The one VLAN a trunk carries untagged. It exists for interoperability with devices that do not understand tags, and it is where most VLAN misconfiguration lives. IEEE 802.1Q-2022 §9.5
NET
Network Entity Title: the NSAP an IS-IS process sources from. Area address, six-octet System ID, n-selector 00. Without it the process cannot send a Hello. RFC 1195 §3.3
NHRP
Next Hop Resolution Protocol: resolves an NBMA underlay address for an overlay next hop. In DMVPN, spokes register with a hub (NHS) and may resolve other spokes for Phase 3 shortcuts. RFC 2332 §2.2
Node SID
A Prefix-SID advertised for a loopback, drawn from the SRGB. TI-LFA may push one to reach a PQ node when no direct LFA exists. RFC 8402 §3.2
NTP stratum
The number of synchronization steps from a reference clock: a primary server is stratum 1 and its client is stratum 2. It describes hierarchy, not guaranteed accuracy. RFC 5905 §3
Object identifier
A hierarchical numeric name for a managed object or instance in an SNMP information model. RFC 3411 §2.7
Option overload
Option 52, which declares that the sname and file header fields carry options instead of their usual contents — 192 extra octets when the 312-octet options area is full. RFC 2132 §9.3
Origin validation
RFC 6811 maps a prefix to Valid, NotFound, or Invalid using RPKI. Applying those states to best-path is local policy, not a rewrite of RFC 4271 §9.1.2.2. RFC 6811 §2
Overload bit
A flag in the LSP header telling the domain not to transit this IS. Prefixes it originates remain reachable; paths through it do not. RFC 1195 §5.3.4
Path cost
The cost of reaching the root, accumulated on receiving ports. Two recommended tables exist: 16-bit values from 802.1D-1998 and 32-bit values from 802.1D-2004. IEEE 802.1D-2004 §17.14
Peer-RPF
MSDP’s only loop protection: an SA is accepted solely from the peer on the unicast path back toward the RP that originated it. A failure is silent — the session stays up and the cache stays empty. RFC 3618 §10.1.3
PHB
Per-hop behaviour: the forwarding treatment a DS-compliant node applies to packets with a given codepoint — queueing, scheduling, and discard — not an end-to-end guarantee. RFC 2474 §5
PIM Assert
The election that picks one forwarder when two routers send the same group onto a shared LAN. Administrative distance, then metric, then highest IP address — not lowest. RFC 3973 §4.6.1
Prefix length
The count of leading bits an address fixes. Everything else about a subnet — its size, its network address, its broadcast — is derived from this one number. RFC 4632 §3.1
Proposal/agreement
RSTP handshake on a point-to-point designated port. A Proposal bit asks the neighbor to agree; Agreement lets the port skip listening/learning timers. IEEE 802.1Q-2022 §13
Proxy ARP
A router answering ARP for addresses it can reach but does not own, so a host with a wrong mask or no gateway still works. It hides the misconfiguration rather than fixing it. RFC 1027
Pseudowire
An emulated point-to-point circuit over an MPLS tunnel. In VPLS the pseudowires between provider edges are the ports of an emulated switch. RFC 4762 §4
PTP grandmaster
The clock selected by the best-master clock algorithm as the time source for a PTP domain. IEEE 1588-2019 §9
QUIC stream
An independent ordered byte sequence within a QUIC connection. Loss stalls only streams that needed the lost frames — not every stream on the connection as with HTTP/2 over TCP. RFC 9000 §2
RA Guard
Access-layer filtering that blocks Router Advertisements on ports that should not send them — the IPv6 counterpart to DHCP snooping for rogue gateway prevention. RFC 6105 §2
RADIUS attribute
A typed value in a RADIUS packet describing identity, service, policy result, or accounting data. Correct authentication does not imply the client understood every returned attribute. RFC 2865 §5
Receive window
How much the receiver can buffer, advertised in every acknowledgement. It sets a ceiling on throughput of window divided by round-trip time, which is why it needs scaling on a long path. RFC 9293 §3.8.6
Recursive resolver
A server that walks the delegation from the root on a client’s behalf and caches every step. The cache is why the root servers are not asked about every lookup. RFC 1034 §4.3.2
Relay agent
A router that forwards DHCP between a client broadcast domain and a server elsewhere, recording the interface it came from in giaddr. RFC 2131 §4.1
Reported distance
A neighbour’s own distance to a destination, before this router adds the link cost. Strictly less than the feasible distance is what proves the neighbour is not routing back through here. RFC 7868 §3.3
Reverse proxy
An intermediary deployed by the operator that answers as the origin server. The client is not told it exists, which is what distinguishes it from a forward proxy. RFC 9110 §3.7
Root bridge
The bridge with the lowest bridge identifier. Every path in the active topology is measured as a cost back to it, and all of its ports are designated. IEEE 802.1D-2004 §17.6
Root port
The single port on a non-root bridge with the lowest-cost path to the root. Every non-root bridge has exactly one. IEEE 802.1D-2004 §17.7
Route Distinguisher
Eight octets prepended to an IPv4 prefix so two VPNs can use the same address. Import and export are Route Targets. The RD does not decide who imports the route. RFC 4364 §4.2
Route leaking
Importing specific routes from one VRF into another without merging the tables. Import and export lists are separate, so the relationship can be one-way — which is how shared services and hub-and-spoke are both built. RFC 4364 §4.3.1
Route reflector
An iBGP speaker allowed to re-advertise iBGP-learned paths to clients. ORIGINATOR_ID and CLUSTER_LIST prevent reflection loops. RFC 4456 §8
Route tag
A value attached to a route and carried across protocols. In a mutual redistribution it restores the origin history that redistribution discarded, which is what prevents the loop.
Route Target
An extended community that decides which VRFs import a VPN route. Export and import lists need not be symmetric — that is how hub-and-spoke L3VPNs are built. It is not the Route Distinguisher. RFC 4364 §4.3.1
Router-LSA
Type 1. Every router originates one per area, listing its links in that area. In OSPFv2 it also carries stub prefixes; in OSPFv3 it does not. RFC 2328 §12.4.1
RP set
The list of candidate rendezvous points a BSR floods to the domain. It is a list, not an assignment — each router applies range, priority and hash rules to it and reaches the same answer alone. RFC 5059 §3.6
RPF check
Forward a multicast datagram only if it arrived on the reverse-path interface toward the source (or the RP for (*,G)). Any other interface is an RPF failure. RFC 7761 §4.2
RRset
All records sharing a name, class and type. It is served, cached, expired and signed as one unit, so every record in it carries the same TTL. RFC 2181 §5.2
Scope
A server-side pool of addresses for one subnet, with the options that go with it. Selected by giaddr, not by anything the client says.
Seed metric
The metric invented at a redistribution boundary, because the original is meaningless in the receiving protocol. Every route gets the same one unless a policy differentiates them.
Segments Left
The counter in the Segment Routing Header naming which entry is active. Only the node whose SID is currently in the destination address decrements it; transit hops never touch the header. RFC 8754 §2
Shared tree
The (*,G) tree rooted at the rendezvous point, which every receiver joins before it knows any source. Traffic uses it until a last-hop router learns a source and builds a direct path instead. RFC 7761 §3.1
SLAAC
Stateless Address Autoconfiguration: a host forms an IPv6 address from a prefix advertised with the autonomous flag. It does not by itself install DNS resolvers. RFC 4862 §5.5
SNI
Server Name Indication: the hostname a client names in the TLS handshake, in the clear, so one address can present the right certificate for many names. RFC 6066 §3
Solicited-node multicast
A link-local multicast address derived from the low 24 bits of an IPv6 address. Neighbor Solicitations for resolution and DAD are sent here instead of to all nodes. RFC 4861 §7.2.2
Source-Active message
The MSDP announcement that a source is active for a group. It names the source, the group and the RP that originated it — the last of those so receiving peers can run the peer-RPF check. RFC 3618 §3
SPI
Security Parameters Index: a 32-bit value in the ESP or AH header that, with the destination address and security protocol, selects which Security Association will process the packet. RFC 4303 §2.1
Split horizon
A distance-vector rule: do not advertise a route out the interface it was learned on. Poison reverse advertises it as unreachable instead. RFC 2453 §3.4.3
SPT threshold
The local policy deciding when a last-hop router leaves the shared tree for the shortest path. Zero means immediately; infinity means never. It is not negotiated, so two routers may legitimately differ. RFC 7761 §4.2.1
SRv6 SID
A 128-bit routable IPv6 address with structure: a locator that gets the packet to a router and a function that tells that router what to do. One field replaces a transport label and a VPN label. RFC 8986 §3.1
State Refresh
A message originated by the first-hop router and forwarded hop by hop, resetting prune timers so a pruned branch never re-floods. Every router on the path has to forward it. RFC 3973 §4.5
Sticky MAC
A dynamically learned port-security address written into the running configuration so it can persist across reload once the config is saved. Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §Sticky Secure MAC Addresses
Stub area
An OSPF area that does not flood AS-external-LSAs. The ABR injects a Type-3 default instead. Type-4 is omitted because it exists only to reach an ASBR. RFC 2328 §3.6
Stuck-in-active
A query unanswered for the whole active duration, which resets the adjacency and loses every prefix behind it. The router that reports it is the one that waited; the cause is further along the chain it queried. RFC 7868 §4.4.1
Summary route
One prefix advertised in place of several. Because a prefix is always a contiguous power-of-two block, a summary absorbs any gap between its components and claims reachability for it. RFC 4632 §5.2
Symmetric IRB
Routing between segments at both ends through a transit L3VNI, so a leaf needs only the VNIs it has hosts in. Asymmetric routes at ingress and bridges at egress, which needs every routed VNI on every leaf. RFC 9135 §4
TLS termination
Decrypting at the proxy rather than the backend. It is what makes routing, caching and header rewriting possible, and it is why the backend has to be told the client used HTTPS.
Traffic selector
The set of addresses, protocols, and ports that a Child SA is allowed to protect. Mismatched selectors are the usual reason an IPsec tunnel is up but carries no traffic. RFC 4301 §4.4.1
Trunk port
A port carrying several VLANs over one link. Each frame is tagged so the far end knows which VLAN it belongs to — except the native VLAN.
Trust boundary
The edge of a DiffServ domain where markings from outside are accepted or rewritten. Interior nodes are expected to act on the codepoints the boundary left them. RFC 2475 §2.1.1
Tunnel mode
IPsec mode that encrypts (and/or authenticates) an entire inner IP packet and adds a new outer IP header — what gateways use to protect traffic for hosts that are not themselves IPsec peers. RFC 4303 §3.1.2
Unknown unicast flooding
Flooding traffic addressed to a specific host because its entry has aged out. Harmless once; a continuous stream when one side of a conversation talks and the other rarely answers.
Up/down bit
In an Extended IP Reachability TLV, set when a prefix is leaked from L2 into L1 (or must not be exported upward). Another L1L2 IS must not advertise that prefix into L2. RFC 5305 §4.1
Violation mode
How port security reacts when a frame’s source MAC exceeds the allowed set: protect and restrict drop (restrict also counts/logs); shutdown err-disables the port. Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §How to Configure Port Security
VLAN
A broadcast domain defined by configuration rather than cabling. A switch keeps a VLAN identifier against each port and scopes flooding and forwarding to it. IEEE 802.1Q-2022 §6.9
VNI
24-bit VXLAN Network Identifier in the eight-octet VXLAN header. It is the overlay segment, not a VLAN until a VTEP maps it to one. RFC 7348 §5
VPLS split horizon
The rule that a frame arriving on one pseudowire is never sent out another. It is the only loop prevention in a VPLS core, and it works only because the mesh is full. RFC 4762 §4.4
VPN label
The inner MPLS label an ingress PE pushes so the egress PE can select the correct VRF. P routers ignore it and switch only on the outer transport label. RFC 4364 §5
VRF
A separate routing and forwarding table on one device. Interfaces are bound to it, and the interface a packet arrives on selects the table — nothing in the packet does. RFC 4364 §4.1
VRF-lite
VRFs without MPLS. The table separation is identical; what differs is that separation is carried between devices by a tagged subinterface or a tunnel rather than by a label.
VRRP priority
Master election value. 255 is reserved for the address owner. Preempt is on by default in RFC 5798; Cisco HSRP preempts only when configured. RFC 5798 §5.1
VTEP
The switch or host that adds and removes the VXLAN wrapper. The tunnel is built between VTEP source addresses, which is why underlay reachability has to be checked between loopbacks rather than between switches. RFC 7348 §4.1
Wide metric
The 24-bit IS-IS metric in TLV 22 (RFC 5305). The original neighbour TLV is 6 bits, maximum 63, which is why two 10 Gb/s links can look equal until wide is enabled. RFC 5305 §3
Wildcard mask
A Cisco ACL match mask where 0 bits must equal the address and 1 bits are don’t-care. It is the inverse of a subnet mask: 0.0.0.255 matches a /24; 0.0.0.0 matches one host.
X-Forwarded-For
A comma-separated list in which each hop appends the address it received the connection from. Never standardised; read it from the right by the hops you operate, because the left end is whatever the client sent. RFC 7239 §8.1