Networking

What we're doing: Validate an IP address and a subnet with the ipaddress module, and show that a service is really identified by an (IP, port) pair, not the IP alone.

import ipaddress

v4 = ipaddress.ip_address('192.168.1.10')
v6 = ipaddress.ip_address('2001:db8::1')
print(type(v4).__name__, v4.is_private)
print(type(v6).__name__, v6.version)

net = ipaddress.ip_network('192.168.1.0/24')
print('network:', net, 'num addresses:', net.num_addresses)

3

ip_address() parses and validates -- it raises ValueError on anything that is not a real IPv4/IPv6 address, rather than silently accepting a bad string.

5

.is_private confirms 192.168.1.10 falls in a reserved private range (RFC 1918) -- not routable on the public internet directly.

8

ip_network parses a whole CIDR block; num_addresses is computed from the prefix length (/24 = 2^(32-24) = 256).

IPv4Address True
IPv6Address 6
network: 192.168.1.0/24 num addresses: 256

Why this works: ip_address() and ip_network() do real structural validation, not just string formatting -- they reject malformed addresses and compute real network math (address count from prefix length), which is what makes them safer than string-splitting an address by hand.

What we're doing: Run a real TCP echo server and client over the loopback interface, and prove the connection actually completed by reading back each side's address.

import socket, threading, time

server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server.bind(('127.0.0.1', 0))
port = server.getsockname()[1]
server.listen(1)

def run_server():
    conn, addr = server.accept()
    data = conn.recv(1024)
    conn.sendall(b'echo:' + data)
    conn.close()

threading.Thread(target=run_server).start()
time.sleep(0.1)

client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client.connect(('127.0.0.1', port))
client.sendall(b'hello')
reply = client.recv(1024)
client.close()
print('bound port:', port)
print('client received:', reply)

5

bind(('127.0.0.1', 0)) with port 0 asks the OS to assign any free port -- getsockname() reads back which one it picked.

9

accept() blocks the server thread until the client actually connects -- it returns a brand-new socket dedicated to this one connection.

18

connect() performs the real TCP three-way handshake against the server's bound port before this line returns.

20

recv(1024) blocks until bytes arrive -- here, the server's echoed reply.

bound port: 57773
client received: b'echo:hello'

Why this works: The client only receives the echoed bytes because a full TCP connection was established (connect() succeeded, accept() returned a live socket) -- recv() would hang or raise if no connection existed, so the printed reply is direct proof the handshake and data transfer both actually happened.

What we're doing: Send a UDP datagram with no prior connection setup, unlike the TCP example elsewhere in this section that requires connect()/accept() first.

import socket

udp_server = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
udp_server.bind(('127.0.0.1', 0))
udp_port = udp_server.getsockname()[1]

udp_client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
udp_client.sendto(b'ping', ('127.0.0.1', udp_port))
data, addr = udp_server.recvfrom(1024)
print('UDP received:', data, 'from port:', addr[1])

7

No .connect() call at all -- sendto() ships the datagram directly to an address with zero handshake.

9

recvfrom() returns both the data and the sender's address, since UDP has no persistent connection object to already know it.

UDP received: b'ping' from port: 55378

Why this works: The datagram arrives despite no connect()/accept() pair ever running -- proof that UDP genuinely skips the setup step TCP requires. Nothing here confirms the OS did not also drop it; UDP simply gives no mechanism to know either way.

What we're doing: Resolve a real hostname to an IP address and confirm the result is a valid dotted-quad IPv4 address.

import socket

ip = socket.gethostbyname('www.python.org')
print('www.python.org resolves to (an IPv4):', ip, '-- valid dotted quad:', len(ip.split('.')) == 4)

3

gethostbyname() sends the actual DNS query through the OS resolver and blocks until it gets an answer or the query times out.

www.python.org resolves to (an IPv4): 167.82.56.223 -- valid dotted quad: True

Why this works: The printed address is a genuine live DNS answer, not a hardcoded value -- it can change over time as python.org repoints its infrastructure, which is exactly the indirection DNS exists to provide: the hostname stays stable while the underlying IP is free to change.

What we're doing: Perform a real TLS handshake directly on top of a raw socket -- confirming TLS is a distinct step wrapping an already-open TCP connection, not something HTTP does itself.

import socket, ssl

ctx = ssl.create_default_context()
with socket.create_connection(('www.python.org', 443), timeout=5) as sock:
    with ctx.wrap_socket(sock, server_hostname='www.python.org') as tls:
        print('TLS version negotiated:', tls.version())
        cert = tls.getpeercert()
        print('cert has subject:', 'subject' in cert)
        print('cipher:', tls.cipher()[0])

4

socket.create_connection() is a plain TCP connect -- no encryption yet, identical to what an http:// request would use.

5

wrap_socket() takes that already-open TCP socket and performs the TLS handshake on top of it -- a genuinely separate step, not part of opening the socket.

TLS version negotiated: TLSv1.3
cert has subject: True
cipher: TLS_AES_128_GCM_SHA256

Why this works: wrap_socket() only returns successfully once a real TLS handshake completed and the certificate passed validation against the trusted CA store -- reaching 'TLS version negotiated' output is proof both the TCP and TLS handshakes finished, in that order, before any HTTP request was ever sent.

What we're doing: Prove a socket timeout actually fires and raises, rather than the code hanging forever, using a blocking recv on a socket nothing will ever send to.

import socket, time

udp_t = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
udp_t.bind(('127.0.0.1', 0))
udp_t.settimeout(0.2)
start = time.time()
try:
    udp_t.recvfrom(1024)
    print('no timeout raised (unexpected)')
except socket.timeout as e:
    elapsed = time.time() - start
    print('socket.timeout raised after ~', round(elapsed, 1), 's:', repr(e))
udp_t.close()

5

settimeout(0.2) applies to every subsequent blocking call on this socket, not just the next one.

8

recvfrom() would block forever without a timeout -- nothing is ever going to send to this socket.

socket.timeout raised after ~ 0.2 s: TimeoutError('timed out')

Why this works: The timeout fires at approximately the configured 0.2s, not immediately and not never -- confirming settimeout() genuinely bounds the wait rather than just being an ignored hint. socket.timeout is a real alias for the built-in TimeoutError in modern Python.

What we're doing: Confirm the SSE wire format is genuinely plain HTTP by writing a real streaming HTTP response by hand over a socket, using this section's own socket/TLS machinery rather than a third-party SSE library.

import socket, threading, time

server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind(('127.0.0.1', 0))
port = server.getsockname()[1]
server.listen(1)

def run_server():
    conn, _ = server.accept()
    conn.recv(1024)   # discard the client's request line
    conn.sendall(
        b'HTTP/1.1 200 OK\r\n'
        b'Content-Type: text/event-stream\r\n\r\n'
        b'data: {"progress": 10}\n\n'
        b'data: {"progress": 42}\n\n'
    )
    conn.close()

threading.Thread(target=run_server).start()
time.sleep(0.1)
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client.connect(('127.0.0.1', port))
client.sendall(b'GET /events HTTP/1.1\r\n\r\n')
print(client.recv(4096).decode())
client.close()

10

Content-Type: text/event-stream is the only thing that marks this as SSE -- otherwise it is an ordinary HTTP response, unlike a WebSocket's protocol-level Upgrade.

12

Each event is plain UTF-8 text ending in a blank line (\n\n) -- no binary framing, no separate protocol.

HTTP/1.1 200 OK
Content-Type: text/event-stream

data: {"progress": 10}

data: {"progress": 42}

Why this works: Nothing here is WebSocket framing or a protocol upgrade -- it is one ordinary HTTP response whose body is simply written incrementally and never explicitly ended, which is the entire SSE mechanism. Any HTTP client can read it; no specialized library is structurally required, unlike a WebSocket connection.