Jargon Decoder

The lookup table for the whole book. Skim it once now; return whenever a later chapter drops a term. Grouped by theme; within a group, roughly the order you’ll meet things. “The analogy” column maps each term onto systems you already run.

1. The hardware

Term	Expanded	Plain English	The analogy	Where it matters
NIC	Network Interface Card	The device that turns wire signals into bytes in RAM and back	A sidecar container with its own CPU/memory that owns all network I/O	Everything in Part I; the most-tuned hardware in the rack
PHY	Physical layer transceiver	Analog electronics converting light/voltage into digital bits	TLS-terminating proxy, but it terminates physics	Fixed tens-of-ns cost; exotic links (microwave) compete here
MAC	Media Access Control layer	Digital logic framing bits into Ethernet frames, checking addresses + CRC	Body-parsing + signature-check middleware; drops garbage early	Hardware timestamping hooks here; MAC-dropped frames are invisible to software
PCIe	Peripheral Component Interconnect Express	The packet-switched network inside the box linking CPU/RAM to cards	The app-server↔database network, but in-chassis and ~1000× faster	~500 ns–1 µs per device round trip; the latency floor after kernel bypass
DMA	Direct Memory Access	Devices read/write RAM directly; the CPU copies nothing	Presigned S3 upload — client writes straight to storage, server just gets notified	Why arrival is CPU-free; the enabling trick of kernel bypass
NUMA	Non-Uniform Memory Access	Each CPU socket has its own RAM; the other socket’s RAM is ~2× slower	Read replica in another region — same schema, hidden extra hop	Pin hot threads + memory to the NIC’s socket or eat ~50–100 ns per access
Cache line	—	The 64-byte unit in which memory actually moves	Postgres reads the whole 8 KB page, never one column	Struct layout; two hot variables per line = one fetch; two writers per line = disaster
MTU	Maximum Transmission Unit	Largest payload one Ethernet frame carries (default 1500 bytes)	Max request-body size — bigger payloads get chunked	Frame count per message; fragmentation is a latency tax
Jumbo frames	—	Raising MTU to ~9000 bytes	Batch API endpoint — fewer, bigger requests	Throughput plays (snapshots, recovery); irrelevant to small ticks
FPGA	Field-Programmable Gate Array	A chip whose circuitry you rewire to be your program	Compiling the hot path into custom silicon instead of running on general-purpose	The endgame: parse-and-respond on the NIC itself, sub-µs, skipping PCIe+CPU

2. The kernel packet path

Term	Expanded	Plain English	The analogy	Where it matters
IRQ	Interrupt Request	Hardware forcing a core to stop and run a handler now	Webhook vs polling — the device pushes	~1–2 µs delivery latency; also victimizes whatever thread was running
MSI-X	Message Signaled Interrupts, eXtended	Many independent interrupt vectors per device, each aimed at a chosen core	One webhook endpoint per event type, each with its own consumer	Enables per-queue → per-core steering; keeps IRQs off strategy cores
hardirq	Hard interrupt (top half)	The minimal urgent part: ack device, schedule follow-up, return	Webhook handler that enqueues a job and returns 200 in 2 ms	Runs with interrupts blocked; must be tiny
softirq	Soft interrupt (bottom half)	The deferred bulk work: drain ring, run the network stack	The queue worker draining what the webhook enqueued	Deferrable/migratable → classic source of p99.9 jitter
NAPI	New API (its real name)	Under load, kernel disables the interrupt and polls the ring in batches	Switching from per-message callbacks to batch-draining a queue under load	The kernel’s own admission that polling beats interrupts under load
sk_buff	Socket buffer	Kernel’s per-packet metadata object, allocated/freed per packet	Express `req` — one object per request, annotated by each middleware	Hundreds of ns of overhead per packet; bypass frameworks’ objects are ~a pointer
Descriptor ring	—	Fixed circular array in RAM where driver posts empty buffers and NIC fills them	Bounded SPSC queue: consumer pre-posts empty envelopes, producer fills	Overflow = silent drops (`rx_missed`); the exact interface bypass maps into your process
Page fault	—	CPU trap when code touches an unmapped memory page; kernel intervenes	ORM lazy loading — touching a field fires a query	µs+ landmine inside innocent code; pre-touch + `mlock` everything at boot
TLB	Translation Lookaside Buffer	Tiny cache of virtual→physical address translations	Route cache in front of a slow resolver	Miss = ~100 ns page-table walk before your real access starts
Hugepages	—	2 MB / 1 GB memory pages instead of 4 KB, so the TLB covers far more	Connection pooling for address translation	Free tail insurance for big state; DPDK requires them

3. Steering and offloads

Term	Expanded	Plain English	The analogy	Where it matters
RSS	Receive Side Scaling	NIC hashes each packet’s flow to pick one of several RX queues/cores	Consistent-hash sharding across consumers, in silicon	Per-flow ordering + multi-core spread; first steering knob you’ll touch
RPS / RFS / XPS	Receive/Flow/Transmit Packet Steering	Software versions: kernel bounces packet work to chosen cores (RFS: toward the consuming app; XPS: TX side)	App-layer load balancer when the hardware one (RSS) is missing or wrong	Fallback steering; an extra inter-core hop RSS avoids
Flow steering	—	Explicit NIC rules: “this port/multicast group → this exact queue”	Routing rules pinning one tenant’s traffic to a dedicated worker pool	Dedicate a queue+core to the feed that matters
GRO / LRO	Generic/Large Receive Offload	Kernel/NIC merges consecutive same-flow packets into one big one before processing	Batching webhook deliveries before handling	Throughput win, latency poison — off on hot paths (batching = waiting)
TSO	TCP Segmentation Offload	You hand the NIC one big buffer; it slices into MTU-sized frames	Chunked upload handled by the storage SDK, not your code	TX CPU saver; fine for bulk, irrelevant-to-harmful for small urgent sends
Multicast	—	One packet, delivered by the network to every subscribed host	Redis pub-sub, implemented by the switches themselves	How exchanges publish market data: every subscriber hears simultaneously
Unicast	—	Ordinary one-sender-one-receiver traffic	A normal HTTP call	Your order-entry path; contrast with multicast feeds

4. Protocol and socket knobs

Term	Expanded	Plain English	The analogy	Where it matters
Nagle	Nagle’s algorithm	Kernel delays small TCP writes hoping to coalesce them into fewer packets	Auto-batching outbound webhooks to save requests	Adds up to ~40 ms (!) to small sends; the classic “why is my order slow”
TCP_NODELAY	—	Socket option that turns Nagle off: send every write immediately	`flush: true` — deliver now, efficiency be damned	Line one of every low-latency TCP setup
Delayed ACK	Delayed acknowledgment	Receiver waits (~40 ms max) hoping to piggyback the ACK on data	Batching read-receipts	Interacts pathologically with Nagle: request/response ping-pong stalls
RTO / dup-ACKs	Retransmission TimeOut / duplicate ACKs	How TCP notices loss: a pessimistic timer (~200 ms floor), or the receiver repeating “still waiting for byte N” — three repeats trigger immediate resend (“fast retransmit”)	Webhook retry with exponential backoff, unless the receiver actively reports the gap	Why one lost packet can freeze a TCP feed for 200 ms; fast retransmit needs traffic still flowing to generate the repeats
Receive window	TCP flow control	The receiver advertises how much buffer it has left; at zero the sender must stop sending	Stream backpressure — `pause()` until the consumer drains	How a slow consumer physically slows the sender; the mechanism behind every “slow subscriber” story
epoll	Event poll (Linux)	Register N sockets once; one blocking syscall returns whichever are ready	What libuv and tokio run on — your event loop’s engine	The C10K solution; its wake-up cost is what busy-polling deletes
SO_BUSY_POLL	Socket option: busy poll	Kernel spins on the driver ring for you instead of sleeping and waking	Tight `queue.tryPop()` loop, but the kernel runs it	Halfway house: µs savings without bypass frameworks
io_uring	I/O user ring	Submit and reap I/O via two shared-memory rings; syscalls optional	Job queue between you and the kernel replacing per-job RPC	Modern Linux async I/O; amortizes the syscall wall

5. Kernel bypass

Term	Expanded	Plain English	The analogy	Where it matters
Kernel bypass	—	NIC DMA-writes packets into your process’s memory; kernel never sees them	Clients write directly to S3; your API server is out of the data path	The headline move: ~2–10 µs kernel path → ~1 µs
Zero-copy	—	Consume bytes where they landed; never duplicate them	Streaming a request body instead of buffering; `sendfile`	Deletes the copy in `recv`; pairs with bypass
DPDK	Data Plane Development Kit	Framework: unbind the NIC from the kernel; your app owns it, polling from userspace	Evicting Express and speaking raw TCP because the framework tax was the bottleneck	The industry-standard bypass toolkit; brings its own drivers + hugepage pools
PMD	Poll Mode Driver	DPDK’s userspace driver that spins on the ring; no interrupts, ever	`while(true) tryPop()` as a formal driver model	Why DPDK cores sit at 100% CPU by design
Onload	(Solarflare/AMD product)	Transparent bypass: `LD_PRELOAD` swaps the socket API’s guts for a userspace stack	Swapping the DB driver for a faster wire-compatible one; app code unchanged	Bypass without a rewrite — sockets API in, kernel out
ef_vi	(Solarflare API)	Onload’s raw layer: direct access to the NIC’s virtual interfaces, no sockets, no TCP	Dropping the ORM and the driver — hand-rolled wire protocol	Lowest-latency Solarflare path; you parse raw frames
XDP	eXpress Data Path	Run a small verified program (eBPF) inside the driver, at the earliest hook: drop/redirect/pass per packet	Middleware at the CDN edge instead of in the app	Filter/steer before any sk_buff exists
AF_XDP	Address Family XDP	Socket type where XDP redirects raw frames into your process’s ring	Kernel-sanctioned bypass — the escape hatch that’s still in the building	Bypass-lite: no vendor lock, kernel keeps coexisting
UMEM	User memory (AF_XDP’s buffer region)	The chunk of your process’s memory registered so the NIC can DMA into it	The shared S3 bucket both producer and consumer have keys to	Where AF_XDP packets physically land

6. CPU isolation and tuning

Term	Expanded	Plain English	The analogy	Where it matters
Pinning / affinity	CPU affinity	Lock a thread to one core so its caches stay warm and it never migrates	Sticky sessions — same server every time, cache stays hot	Non-negotiable for every hot thread
isolcpus	Isolated CPUs (boot flag)	Remove cores from the scheduler entirely; only pinned threads run there	Dedicated instances vs shared tenancy	The strategy core shares with nothing
nohz_full	No HZ (tick-less) full	Stop the kernel’s periodic timer tick on chosen cores	Turning off a health-check that interrupts the worker every 4 ms	Deletes the last periodic ~µs of jitter on isolated cores
C-states	CPU idle states	Numbered sleep depths (C0 awake … C6 off); deeper = slower wake	Serverless cold starts, in silicon	Wake from deep sleep = tens of µs on the packet that mattered; HFT caps at C1
Frequency scaling	P-states / governors	CPU clocks down when load looks light	Autoscaling that scales in right before the traffic spike	Pin the governor to `performance`; determinism over watts

7. Time

Term	Expanded	Plain English	The analogy	Where it matters
TSC	Time Stamp Counter	Per-CPU register counting cycles since boot; read in ~10 ns	`process.hrtime()` if it cost nearly nothing	The only clock cheap enough for hot-path timestamps
rdtsc	Read TSC (the instruction)	The single instruction that reads the TSC	Calling `hrtime()` directly	How you instrument ns-scale code without perturbing it
NTP	Network Time Protocol	Classic clock sync over the network; ~ms accuracy	Cron-based reconciliation — fine daily, useless intraday	Too coarse for trading; regulation and measurement demand better
PTP	Precision Time Protocol	Hardware-assisted sync to ~sub-µs across machines	Distributed tracing with clocks good enough to order spans across hosts	Cross-machine latency measurement; regulatory timestamps (MiFID II)
PHC	PTP Hardware Clock	The clock chip on the NIC itself that PTP disciplines	The DB’s own `now()` vs your app server’s clock	Hardware timestamps come from this clock
SO_TIMESTAMPING	Socket option: timestamping	Ask for NIC-hardware timestamps on RX/TX packets	Trusting the load balancer’s access log over your app logger	Measures true wire-to-wire latency, excluding your own software’s lies

8. Memory and CPU micro-architecture

Term	Expanded	Plain English	The analogy	Where it matters
False sharing	—	Two cores write different variables that share one 64-byte cache line; the line ping-pongs	Two services hammering the same DB row for unrelated columns	Silent 10–100× slowdown; fix = pad/align to 64 B
MESI	Modified/Exclusive/Shared/Invalid	The hardware protocol keeping all cores’ caches agreeing on each line	Cache-invalidation events between replicas, in silicon, per 64 bytes	The mechanism behind false sharing and atomic-op costs
CAS	Compare-And-Swap	Atomic instruction: “if it still equals X, set to Y” — the basis of lock-free code	Optimistic concurrency: `UPDATE … WHERE version = 41`	Building block of every lock-free queue; ~20 ns, more under contention
Memory ordering	acquire / release / seq_cst	How much the CPU/compiler may reorder your reads/writes around an atomic	Read-your-writes vs eventual consistency, at nanosecond scale	Choosing correctly is the hard half of lock-free code; seq_cst is the safe-but-slower default
Lock-free vs wait-free	—	Lock-free: someone always progresses. Wait-free: everyone does, bounded steps	At-least-one-consumer-progresses vs per-request SLA	Queues on the hot path; wait-free = no thread can stall another
SPSC / MPSC	Single/Multi Producer, Single Consumer	Queue disciplines; fewer sides = far simpler and faster	One webhook source vs many, one worker draining	SPSC ring buffers are HFT’s workhorse pipe — the ring, again
IPC	Instructions Per Cycle	How many instructions the core actually retires per clock (typ. 0.5–4)	Requests/sec per worker — utilization vs stall	Low IPC = memory-stalled code; the first diagnosis number in `perf`
PMU	Performance Monitoring Unit	On-chip counters: cache misses, branch misses, stalls	Built-in APM (application performance monitoring) agent, in hardware, ~free	Where all real profiling data comes from
perf	(Linux tool)	Samples the PMU + stacks to show where cycles/misses go	The profiler tab, for native code, off the PMU	The daily driver for “why is this loop 400 ns not 80”
Flamegraph	—	Stack-trace samples rendered as stacked flames; width = time share	You know this one — same picture, now over CPU samples	Reading them below the runtime: kernel frames, not just your functions

9. Measurement discipline

Term	Expanded	Plain English	The analogy	Where it matters
p99.9	99.9th percentile	The latency 1-in-1000 events exceed	Your p99 dashboards, one digit stricter	HFT lives in extreme tails: the bad tick is correlated with the valuable tick
Coordinated omission	—	Measuring only when the system deigns to respond, so stalls erase their own evidence	Uptime checker that skips checks while the site is down	The classic way benchmarks lie; send on schedule, count the waiting
HdrHistogram	High Dynamic Range Histogram	Records full latency distributions cheaply from ns to seconds	Prometheus histogram buckets minus the resolution lies at the tail	Standard tool; its docs are the coordinated-omission sermon
Tick-to-trade	—	Market-data packet hits your NIC → your order leaves it; the end-to-end number	Webhook-received → outbound-call-sent, measured at the wire both ends	The single metric the whole book optimizes; wire-timestamped, not app-logged
EWMA	Exponentially Weighted Moving Average	Running average that weights recent samples more; old data fades geometrically — one multiply per update	The rolling latency number on your dashboard, computed incrementally	How routers (and TCP itself) estimate RTT cheaply; the venue-health signal of the broker and mini-market chapters (ch26, ch28)

10. Trading-system architecture

Term	Expanded	Plain English	The analogy	Where it matters
Colo	Colocation	Your servers racked in the exchange’s own data center	Deploying into the same AZ (availability zone) as the dependency — physically	Propagation delay is 5 ns/m; distance is bought, not optimized
Cross-connect	—	The literal dedicated fiber from your cage to the exchange’s, priced per metre	VPC peering, except it is an actual cable and metres are nanoseconds	The shortest permitted path to the matching engine
Feed handler	—	The component that parses the exchange’s raw feed into your book/events	The webhook-ingestion service: decode, validate, order, dedupe, fan out	The receive hot path; where bypass + parsing tricks concentrate
Gap fill	—	Detecting missed sequence numbers in a UDP feed and recovering them	Idempotency keys + replay for missed webhooks	UDP feeds drop; you own reliability now (level 4 of the Express-to-wire chapter)
Snapshot / recovery channel	—	Side channel serving current-state snapshots so late/gapped joiners can catch up	Full resync endpoint alongside the change stream — bootstrap then tail	Cold start and post-gap recovery for every feed handler
Sequencer	—	Single choke point stamping one global order on all events; everyone replays the same stream	Kafka single-partition total order, or your matching engine’s inbound queue	The determinism backbone of exchange-grade architectures
Event sourcing	—	State = fold(events); store the events, derive the state	Double-entry ledger: the journal is truth, balances are a view	Replayable, auditable, deterministic — natural fit downstream of a sequencer
Upcaster	—	Transformer that migrates old stored events to the current schema on read	API-version adapters for old webhook payloads	Evolving event-sourced systems without rewriting history
Kill switch	—	Pre-armed instant flatten-and-halt path, independent of the strategy	Circuit breaker + feature-kill flag, drilled and audited	Regulatory requirement and survival tool; must be faster than the thing it stops

11. Orders and execution (the trader vocabulary)

Part V and the broker chapters speak this dialect constantly. None of it is hard — it’s the web-shop vocabulary of markets.

Term	Expanded	Plain English	The analogy	Where it matters
CLOB	Central Limit Order Book	The venue’s standing list of buy and sell orders, sorted by price, then by arrival time within a price	A sorted job queue per price level, matched first-come-first-served	“The book” — the data structure every venue chapter is about
L1 / L2	Level 1 / Level 2 data	L1 = best bid and best ask only; L2 = the whole depth ladder, level by level	A summary endpoint vs the full table plus its change stream	The feed tiers venues sell; the market-data and mini-market chapters (ch25, ch28) build both
The touch	—	The best bid and best ask — the front of the line, where the next trade happens	The head of the queue	Queue position at the touch decides who fills first
Spread (tight / wide)	—	The gap between best bid and best ask. Tight = small gap (cheap to trade now); wide = big gap	The convenience fee for immediacy	“Deep” = lots of size resting behind the touch; venue quality in the mini-market lab (ch28) is exactly the tight-vs-deep trade-off
Tick size / lot size	—	The smallest price step / smallest quantity step a venue accepts	Prices in integer cents — no $10.001 allowed	Why hot-path prices are integers in ticks; floats never touch a price
Notional	—	Quantity × price — the total money at stake, ignoring direction	The cart total	Risk limits and caps are set in notional, not share counts
bps	Basis points	Hundredths of a percent; 100 bps = 1%	—	The unit fees and execution quality are quoted in (no relation to Gbps)
Parent / child order	—	Parent = the client’s whole order; children = the venue-sized slices a router cuts it into	One API request fanned out into N backend calls, results rolled back up	The SOR chapters; fills report child → parent
TIF (IOC / FOK)	Time In Force (Immediate-Or-Cancel / Fill-Or-Kill)	How long an order may rest. IOC: fill what you can right now, cancel the rest. FOK: fill it all right now or do nothing	Request timeout semantics — partial results accepted vs all-or-nothing	Flags every gateway must honor; venues differ in which they truly support
Post-only	—	An order that may only rest in the book (add liquidity); rejected if it would trade immediately on arrival	Insert-only write — abort on conflict instead of updating	Maker-fee strategies; the “rejects on cross” behavior in the mini-market lab (ch28)
Iceberg	—	A big resting order that shows only a small visible slice at a time; each fill reveals the next slice	Pagination — total count hidden from the client	Venue-side feature; the public feed only ever sees the tip
TWAP / VWAP / POV	Time-/Volume-Weighted Average Price, Percent Of Volume	Execution algos for working a big parent: drip it out evenly over time / proportional to when the market usually trades / never exceed X% of live volume	A rate-limited batch job: fixed rate / traffic-shaped / capped at a % of cluster load	What “algo selection” means in the broker chapters
OMS / SOR	Order Management System / Smart Order Router	OMS: the institution’s system of record for orders. SOR: the component that picks which venue gets each child	The CRUD backend of record + a load balancer with a cost model	The broker-side machine of the SOR and mini-market chapters (ch26, ch28)
Print / the tape	—	A print = one executed trade published on the public feed; the running public record is “the tape”	A row appearing in the public audit log	“Printing volume”, “the worst print of the day”, TCA benchmarks
Slippage / TCA	Transaction Cost Analysis	Score a fill against the mid-price at the moment the order arrived (“arrival mid”); the shortfall is slippage	Price drift between cart and receipt, measured and reported	How execution quality is judged; the payoff metric of the broker chapters (ch26, ch28)
Alpha	—	Information you can profitably trade on before the market prices it in	Knowing tomorrow’s traffic spike today	Why brokers must wall off client intent — seeing a client’s big buy is a signal (“alpha leak”)
Drop copy	—	A real-time duplicate stream of your own orders/fills, sent to risk and compliance systems	Mirroring prod events into the audit pipeline	Independent risk monitoring; regulator feeds (the venue and risk chapters — ch23, ch27)

12. Data layer and deployment (the part you already half-know)

Term	Expanded	Plain English	The analogy	Where it matters
WAL	Write-Ahead Log	Append the intent durably before applying it; replay after a crash	You run Postgres; this is its heart — and Kafka is a WAL with an API	Trading journals/persistence reuse the pattern; append-only is also the fast path
MVCC	Multi-Version Concurrency Control	Writers make new versions; readers see a consistent snapshot; no read locks	Postgres again — why `VACUUM` exists	The same trick reappears in lock-free structures: readers never block
Logical replication	—	Ship decoded row-changes (not disk blocks) to subscribers	Postgres pub/sub of row deltas — CDC (change data capture)	Feeding analytics/risk systems off the trading DB without touching it
Expand-migrate-contract	—	Schema change in 3 deploys: add new alongside, migrate + dual-write, drop old	Your zero-downtime migration playbook	The only way to change a schema under a system that can’t stop
Blue-green	—	Two full environments; flip traffic atomically, flip back to roll back	You’ve done this	Deploying a trading system inside a maintenance window measured in seconds
Canary	—	New version takes a small traffic slice first, watched closely	You’ve done this too	For strategies: small size limits + tight risk rails before full capital
Shadow deploy	—	New version receives real input, its output compared but never acted on	Dark launch / dual-run diffing	The pattern for validating a rewritten hot path against the incumbent

13. Wire formats

Term	Expanded	Plain English	The analogy	Where it matters
FIX	Financial Information eXchange	The venerable text key=value protocol of institutional trading (`35=D\|55=AAPL\|…`)	JSON-over-HTTP of finance: verbose, universal, slow-ish	Order entry at most venues; parse cost is real
SBE	Simple Binary Encoding	Fixed-layout binary messages; fields at known offsets, zero parsing	Protobuf taken further: no varints, no decode step — cast the pointer and read	Modern feeds and gateways; decode in ~ns, and shorter messages serialize faster (level 7 of the Express-to-wire chapter)

What you can now read

Everything. That’s this chapter’s job — it’s the index you return to, not a rung on the ladder. Concretely: Part I (machine + packet path: groups 1–6), the measurement chapters (groups 7 and 9 — read the coordinated-omission row twice), the concurrency chapters (group 8), and the architecture and operations chapters (groups 10–13, where more of your existing experience transfers than any other part of this book — group 11 is the trader dialect Part V speaks). When a later chapter uses a term that isn’t in this table and isn’t defined on the spot, that’s a bug in the book — flag it.

Keyboard shortcuts

The HFT Gap Closer