Clients, Servers, Peers & Interfaces
What is it?
In any exchange, the node that starts the conversation is the client and the node that answers is the server. When two nodes talk as equals, each both asking and answering, they are peers. The role is about behaviour in that exchange, not about the size or importance of the device. A device joins the network through a network interface (wired or wireless), which is what actually holds its address.
Why it matters
Knowing who is the client and who is the server tells you who initiated, who is expected to be listening, and which direction a request flows. Almost every design and troubleshooting decision starts by getting that direction right.
Where you see it
A browser (client) requesting a web server; a phone app (client) calling a cloud API (server); two machines syncing files as peers; `ipconfig`/`ip addr` showing a device's own interfaces and addresses.
What normal looks like
Clients open connections toward servers; servers sit listening and answer; each device has an interface with a valid address. A machine acting as a server for the service it is meant to run, and as a client when it reaches out for updates, is entirely normal.
What suspicious looks like
A role that does not fit the device's job: a device that should only ever answer suddenly initiating outbound connections, an interface with no address, or two interfaces claiming the same address. In an operational sense these are the shapes of a misconfiguration (or, occasionally, a compromise).
How analysts investigate
By asking, for any connection, 'who opened it?' — that names the client and the server. Then check each end's interface: does it have a valid address, and is playing this role expected for that device?
Common beginner mistakes
- Assuming 'server' means a big powerful machine and 'client' means a small one. The roles are about who starts and who answers in a given exchange — a tiny sensor can be a server and a supercomputer a client.
- Forgetting that one device can be a client in one exchange and a server in another, at the same time.
When a Meridian employee opens the internal wiki, their laptop asks a question and a wiki server answers it. But that same wiki server, minutes later, reaches out to a software repository to download an update — and in that moment the server is the one asking. Same machine, opposite roles, decided entirely by who started the conversation.
| Role | In an exchange | Everyday example |
|---|---|---|
| Client | Starts the conversation; sends the request | A browser opening a website |
| Server | Waits, listening; sends the answer | The web server that returns the page |
| Peer | Both asks and answers, as an equal | Two laptops sharing a file directly |
A device does not touch the network directly — it connects through a network interface. A laptop typically has two: a wired Ethernet interface and a wireless Wi-Fi one. The interface is what actually holds the device's address on the network, which is why one machine with two interfaces can appear at two addresses at once.
Which end is the server?
A connection log line reads: 10.10.4.20 opened a connection to 10.10.4.9. A colleague says '10.10.4.9 is the server because it has the lower number.' Decide the roles properly.
Ignore the numbers; ask who opened it.
The log says 10.10.4.20 opened the connection. Whoever opens a connection is, by definition, the client for that exchange. The address value is irrelevant — 'lower number = server' is a made-up rule. So 10.10.4.20 is the client.
Name the other end and confirm with behaviour.
10.10.4.9 answered, so it is the server for this exchange. Confirm it fits: a server sits listening on a known port for a service (a wiki, a database, a file share). If 10.10.4.9 runs such a service, the roles are consistent and unremarkable.
Notice when the role would be worth a second look.
The role only becomes interesting if it does not fit the device's job — for example if 10.10.4.9 is a printer (which should answer print jobs, not run a wiki), or if a machine that should only ever answer suddenly starts opening outbound connections. Role + expected job together is what tells you 'normal' from 'worth investigating'.
Quick check
What decides whether a node is the client or the server in a given exchange?
A quick self-check — it doesn't affect your XP or progress.
Quick check
A single server hosts a website AND, every night, downloads its own software updates. How should you describe its roles?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.