Models & encapsulation

The OSI model is not a description of how software is actually written. It is a shared vocabulary: a way for two engineers to agree on where a problem lives before arguing about how to fix it. "It's a layer 1 issue" means go and look at the cable. That is the whole value of it.

The seven layers

Click any layer to inspect what happens there, what the unit of data is called, which devices operate at that level, and which protocols you would name in an exam answer.

OSI versus the TCP/IP model

The internet was built on the TCP/IP (DoD) model, which collapses OSI's top three layers into one and its bottom two into one. Both are correct; they are different maps of the same territory. Exams ask you to translate between them.

Encapsulation: headers all the way down

When you send data, each layer prepends its own header (and layer 2 also appends a trailer). The result is a set of nested envelopes. Receiving is the same process in reverse, called de-encapsulation. The name of the bundle changes as it descends — this naming is examined constantly.

Header sizes worth knowing

Topologies and traffic patterns

North-south traffic leaves the data centre toward users; east-west traffic moves between servers inside it. The shift from north-south to east-west is exactly why spine-leaf replaced three-tier designs.

The physical layer

Layer 1 is the only layer that is genuinely physical: voltage on copper, light in glass, radio in air. Its job is to turn ones and zeros into a signal a receiver can recover, and its failures are the most common and most under-diagnosed faults in any network.

Signalling and encoding

A wire cannot send "1". It sends a voltage. Encoding schemes define how a receiver recovers bits — and, critically, how it stays in time with the sender when a long run of identical bits offers no transitions to lock onto.

• NRZ — high voltage is 1, low is 0. Simple, but a long run of zeros gives the receiver no clock reference and it drifts.
• Manchester (10BASE-T) — every bit contains a mid-bit transition, so the clock is embedded in the data. Costs double the bandwidth for the same bit rate.
• 4B/5B, 8B/10B, 64B/66B — map data words to slightly longer symbols chosen to guarantee transitions. 8B/10B carries 25% overhead; 64B/66B carries about 3%, which is why 10G and above use it.
• PAM-4/PAM-5 — multiple voltage levels per symbol so each symbol carries more than one bit. 1000BASE-T uses PAM-5 across all four pairs simultaneously in both directions.

Baud rate is not bit rate. Baud counts symbols per second; bit rate counts bits per second. With PAM-4, one symbol carries two bits, so the bit rate is double the baud rate. Exams like this distinction.

Copper

Twisting is the point. Two conductors carrying equal and opposite signals pick up interference equally; the receiver subtracts one from the other and the noise cancels. Untwist more than 13 mm at a termination and you have built an antenna.

Copper faults and their fingerprints

Pinouts

T568A and T568B differ only in swapping the orange and green pairs. Straight-through cables use the same standard at both ends; a crossover uses A at one end and B at the other. Modern switches negotiate this automatically with Auto-MDIX, but you still need to identify the pinouts on paper.

Fibre

Fibre carries light through a glass core surrounded by cladding of a lower refractive index, so light entering within the acceptance angle is totally internally reflected along the length. It is immune to electromagnetic interference, carries no ground potential between buildings, and is not tappable without detectable loss.

Connectors: LC (small form factor, duplex clip — dominant today), SC (square push-pull), ST (bayonet twist), MPO/MTP (12 or 24 fibres in one ferrule, used for 40/100G breakouts), FC (screw, legacy). Polish types: UPC (blue, ultra physical contact) and APC (green, 8-degree angled, far better return loss for RF-over-glass and long haul). Never mate APC to UPC.

Transceivers: SFP (1G), SFP+ (10G), SFP28 (25G), QSFP+ (40G), QSFP28 (100G), QSFP-DD/OSFP (400G). Media converters bridge copper to fibre when a run exceeds 100 m. For short runs inside a rack, DAC (direct attach copper twinax, a few metres, cheap and low power) and AOC (active optical cable, up to tens of metres, immune to interference) come with the transceivers permanently attached, avoiding the cost of two optics plus a patch lead. BiDi optics send and receive on different wavelengths over a single strand, doubling the capacity of existing fibre where pulling more is impractical — they must be deployed in matched pairs.

Power over Ethernet

Watch the switch's total power budget, not just the per-port figure: thirty 30 W cameras need 900 W of budget. Power sourcing equipment (PSE) detects a powered device (PD) by signature resistance before applying voltage, so plugging in a laptop is safe.

The data link layer

Layer 2 gets a frame from one interface to another on the same network segment. It has no concept of the wider internet — its entire world is the set of devices it can reach without a router. Everything a switch does follows from three rules it applies to every frame it receives.

MAC addresses

A MAC address is 48 bits, written as six hex octets. The first three octets are the OUI (organisationally unique identifier) assigned to the manufacturer; the last three are assigned by that manufacturer. They are meant to be globally unique and burned into the NIC, though every modern OS can override them — and phones randomise them per network to defeat tracking.

Ethernet speeds and standards

The naming is systematic once you see it: speed, then BASE for baseband signalling, then the medium. T is twisted pair, X or R indicates the encoding, and S, L and E on fibre mean short, long and extended reach.

The 2.5G and 5G standards exist specifically to get more than a gigabit out of installed Cat 5e and Cat 6 without rewiring a building — they were driven by wireless access points outgrowing their uplinks.

What a switch actually does

A switch applies exactly three rules, forever:

1. Learn. Record the source MAC of every incoming frame against the port it arrived on.
2. Forward. If the destination MAC is in the table, send the frame out that one port only.
3. Flood. If it is not in the table (unknown unicast), or is broadcast or multicast, send it out every port except the one it came in on.

Entries age out after about five minutes of silence. That is the entire behaviour — step through it below.

Collision and broadcast domains

A hub is a layer 1 repeater: one collision domain, one broadcast domain, everyone shares the bandwidth. A switch gives every port its own collision domain (which is why full duplex and CSMA/CD's retirement are possible) but all ports remain in one broadcast domain unless you add VLANs. A router breaks up broadcast domains — that is its defining layer 2 side-effect.

CSMA/CD (collision detection) governed half-duplex Ethernet: listen, transmit, detect a collision, jam, back off for a random interval. CSMA/CA (collision avoidance) is the wireless equivalent, because a radio cannot listen while transmitting; it uses RTS/CTS and acknowledgements instead.

VLANs

A VLAN splits one physical switch into several logical switches. Ports in VLAN 10 cannot reach ports in VLAN 20 without a router or a layer 3 switch, even though they share the same hardware. This is how you get separate broadcast domains, separate security zones, and separate subnets without buying more switches.

• Access port — belongs to exactly one VLAN, carries untagged frames, faces an end device.
• Trunk port — carries many VLANs between switches, tagging each frame with 802.1Q: a 4-byte tag inserted after the source MAC containing the 12-bit VLAN ID (1–4094) and a 3-bit priority field for QoS.
• Native VLAN — the one VLAN sent untagged on a trunk. It must match on both ends, and leaving it as VLAN 1 is a classic finding in a security audit because of VLAN hopping via double tagging.
• Voice VLAN — a phone with a built-in switch takes tagged voice traffic while the PC behind it stays untagged on the data VLAN.
• Inter-VLAN routing — either a router-on-a-stick (one trunked physical link with subinterfaces) or, far more commonly, SVIs on a layer 3 switch.

Spanning Tree Protocol

Redundant links between switches are essential and also fatal: a layer 2 loop has nothing to stop it, because an Ethernet frame has no TTL. A single broadcast circulates forever, multiplying at every switch, and the network melts within seconds — a broadcast storm. STP (802.1D, and today RSTP 802.1w) prevents this by blocking redundant paths until they are needed.

1. Elect a root bridge — lowest bridge ID wins, where the bridge ID is priority (default 32768, configurable in steps of 4096) followed by the MAC address. Left to itself the oldest switch usually wins, which is rarely what you want; set the priority manually on your core.
2. Each non-root switch picks one root port — the interface with the lowest cumulative path cost back to the root. Cost is inversely related to bandwidth: 10G = 2, 1G = 4, 100M = 19.
3. Each segment picks one designated port — the port on that segment nearest the root forwards; every remaining port is blocked.

Variants worth naming: the original 802.1D STP runs one spanning tree for the whole switch, so every VLAN follows the same blocked links. PVST+ runs a separate tree per VLAN, which lets you balance load by making different switches root for different VLANs — at the cost of one tree per VLAN to compute. MSTP (802.1s) is the compromise: VLANs are mapped into a small number of instances, so you get per-instance load balancing with a fraction of the overhead. RSTP (802.1w) is the fast-converging behaviour that all of them now use.

Classic 802.1D port states are blocking, listening, learning, forwarding and disabled, taking up to 50 seconds to converge. RSTP cuts that to a second or two with discarding/learning/forwarding and proposal-agreement handshakes. PortFast (edge port) skips the delay on access ports; pair it with BPDU Guard, which shuts a port down if a BPDU arrives there — that means someone plugged a switch into a desk port. Two related protections: Root Guard on ports facing downstream switches refuses to accept a superior BPDU, so a new switch cannot take over as root and drag your traffic through a wiring closet; Loop Guard protects against a link that stops receiving BPDUs but stays physically up, which would otherwise let a blocked port wrongly start forwarding and create the loop STP existed to prevent.

Link aggregation

LACP (802.3ad) bundles several physical links into one logical link for both bandwidth and resilience. Frames are distributed by a hash of source and destination addresses, so a single conversation still uses only one member link — four bonded 1G ports do not give one file transfer 4 Gbps. Both ends must agree, and STP treats the bundle as a single interface.

ARP: the joint between layers 2 and 3

A host knows the destination IP but must put a MAC address in the frame. ARP resolves one to the other. The host broadcasts "who has 192.168.1.1, tell 192.168.1.50"; the owner replies with its MAC by unicast; both cache the result for a few minutes. View it with arp -a.

• Gratuitous ARP — an unsolicited announcement, used to detect duplicate addresses and to move a virtual IP during failover.
• Proxy ARP — a router answers on behalf of a host in another subnet. Mostly a legacy nuisance.
• ARP spoofing — since ARP has no authentication, an attacker replies to everything and becomes a man in the middle. Mitigate with Dynamic ARP Inspection plus DHCP snooping.
• IPv6 has no ARP. It uses Neighbor Discovery over ICMPv6 with neighbor solicitation and advertisement messages.

Frame integrity and switching modes

Every Ethernet frame ends with a 4-byte FCS holding a CRC32 of the frame. The receiver recomputes it and silently discards mismatches — layer 2 detects errors but does not correct them; recovery is left to TCP. A store-and-forward switch buffers the whole frame and validates the FCS before forwarding. Cut-through forwards as soon as it has read the destination MAC, cutting latency but propagating corrupt frames. Runts are frames under 64 bytes, giants exceed the MTU, and jumbo frames (typically 9000 bytes) must be enabled consistently on every device in the path or you get silent drops.

IP addressing & subnetting

Subnetting is the single topic that decides most Network+ results, and it is arithmetic, not theory. Once you can convert between decimal and binary confidently, everything else is bookkeeping. Work through the tools here until the answers arrive before the calculator does.

Binary, because everything is binary

An IPv4 address is 32 bits shown as four decimal octets. Each octet is eight bit positions with these values:

To convert 192 to binary, take the largest value that fits (128, remainder 64), then 64 (remainder 0): 11000000. To go back, add the positions holding a 1. Learn the eight valid subnet-mask octets by heart — they are the only ones that exist: 128, 192, 224, 240, 248, 252, 254, 255.

Classes, private ranges and special addresses

Classful addressing is dead in practice — CIDR replaced it — but the class boundaries and private ranges are still examined. Other reserved blocks to recognise on sight:

• 127.0.0.0/8 — loopback. The whole /8 is reserved; 127.0.0.1 is just the customary one.
• 169.254.0.0/16 — APIPA / link-local. If a host has this, it asked for DHCP and got nothing. Diagnose the DHCP path, not the host.
• 100.64.0.0/10 — carrier-grade NAT, used inside ISPs.
• 224.0.0.0/4 — multicast; 255.255.255.255 — limited broadcast.

Masks, CIDR and the two numbers that matter

The mask splits the 32 bits into a network part (1s) and a host part (0s). Two formulas cover almost every question:

The block-size shortcut. Take 256 minus the interesting octet of the mask. A /26 is 255.255.255.192, so 256 − 192 = 64: subnets start at .0, .64, .128, .192. Any address between .64 and .127 belongs to the .64 network with .127 as its broadcast. This works in seconds and needs no binary at all.

Worked example: VLSM

You have 192.168.20.0/24 and need subnets for 100 users, 50 phones, 20 printers, and two point-to-point links. Allocate largest first, always rounding up to the next power of two:

Point-to-point links use /30 (or /31 where supported, which dispenses with network and broadcast addresses entirely). Fixed-length subnetting would have wasted most of this /24.

Summarisation and supernetting

Subnetting divides a block. Summarisation does the reverse: it advertises several contiguous networks as one shorter prefix, so a neighbour holds one route instead of eight. Supernetting is the same arithmetic applied to what were once classful boundaries — the reason CIDR was invented.

The method is to write the candidates in binary and find how many leading bits they all share:

Three rules decide whether a summary is safe. The blocks must be contiguous; the count must be a power of two; and the first block must sit on a boundary that is a multiple of the block count. 10.20.4.0/24 through 10.20.7.0/24 summarise to 10.20.4.0/22, but 10.20.3.0/24 through 10.20.6.0/24 do not summarise at all, however contiguous they look.

IPv6

128 bits, written as eight groups of four hex digits. Compression rules: drop leading zeros in a group, and replace one run of all-zero groups with :: — once only, or the address becomes ambiguous.

A /64 is the standard subnet size for any LAN because SLAAC requires 64 host bits: the router advertises a prefix and the host generates its own address, either from its MAC via EUI-64 (which inserts fffe in the middle and flips the seventh bit) or from a random value for privacy. Transition mechanisms worth naming: dual stack (run both, the preferred approach), tunnelling (6to4, Teredo, GRE), and NAT64/DNS64 for IPv6-only clients reaching IPv4 servers.

Routing & NAT

A router makes one decision, over and over: given this destination IP, which interface do I send it out of, and to which next hop? Everything about routing protocols exists only to populate the table that answers that question.

Where this sits: builds on module 04. The protocols that populate this routing table are module 06; the tools that diagnose it are module 07. QoS is introduced here and covered properly in module 13.

The forwarding decision

A router compares the destination against every route in its table and picks the longest prefix match — the most specific route wins, regardless of protocol or metric. A /32 host route beats a /24, which beats the /0 default route. Only if two routes have identical prefix lengths does the router compare administrative distance, and only then the metric.

Lower AD means more trustworthy. It is a tie-breaker between protocols; metric is a tie-breaker within a protocol.

Static versus dynamic

Static routes are predictable, use no CPU or bandwidth, and do not adapt: if the link fails, traffic keeps being sent into the hole unless you add tracking. They suit stub sites and default routes. A floating static route is the standard trick for backup paths: configure a second static route to the same destination with a deliberately worse administrative distance — say 200 instead of 1 — so it stays out of the table until the preferred route disappears, then installs itself automatically. It is how a 4G backup link sits idle behind a leased line without any routing protocol at all.

Dynamic protocols discover topology, converge around failures, and scale — at the cost of complexity and of trusting your neighbours.

IGP versus EGP: interior gateway protocols (RIP, OSPF, EIGRP, IS-IS) run inside one administrative domain; exterior gateway protocols (BGP) run between them.

First-hop redundancy

Hosts have one default gateway configured. If that router dies, they are stranded. FHRPs let two or more routers share a virtual IP and virtual MAC: VRRP (open standard), HSRP (Cisco), GLBP (Cisco, adds load balancing), and CARP (the free-software equivalent used by pfSense, OPNsense and BSD firewalls). The active router answers ARP for the virtual IP; on failure the standby takes over, usually sending a gratuitous ARP, and hosts never notice.

Network Address Translation

NAT rewrites addresses in the IP header as packets cross a boundary. It exists because IPv4 ran out of addresses, and it has the side effect of hiding internal structure.

• Static NAT — one private address permanently mapped to one public address. Used for servers that must be reachable inbound.
• Dynamic NAT — private addresses drawn from a pool of public ones, first come first served. Runs out when the pool does.
• PAT / NAT overload — many private hosts share one public address, distinguished by source port. This is what your home router does, and what people usually mean by "NAT".
• Port forwarding (destination NAT) — inbound traffic to a public port is redirected to a specific internal host and port.
• Hairpin NAT (NAT loopback) — an internal host reaching its own public address. Without support for it, the request leaves for the router, gets translated, and comes back to an interface that will not accept it, so the site works from outside and fails from inside. The clean fix is split-horizon DNS returning the internal address to internal clients.
• Double NAT — two translating devices in series, typically an ISP router in front of your own. Everything outbound works; inbound port forwarding requires configuring both, and some protocols break. Put the ISP device in bridge or modem mode where possible.
• Carrier-grade NAT — the ISP translates too, so your "public" address is shared with other subscribers from 100.64.0.0/10. You cannot port-forward at all, inbound VPN and gaming break, and the usual answers are a static public address or an outbound tunnel to something you control.

Traffic shaping and QoS — in brief

When a link saturates, something must be prioritised. DSCP markings in the IP header and CoS in the 802.1Q tag classify traffic; queueing then decides who goes first. Policing drops traffic above a rate, shaping buffers and delays it instead. That is enough to read a router configuration — the classification, marking and trust-boundary detail, and the reason voice needs it at all, are covered properly in the multicast and real-time module.

OSPF & BGP in depth

Module 05 covered what routing protocols are for. This one goes inside the two that matter most: the protocol that runs inside almost every enterprise, and the protocol that holds the internet together.

Where this sits: builds on module 05 — assumes you can read a routing table and know what longest prefix match and administrative distance mean. Revisited from the internet side in module 18.

OSPF

Every OSPF router floods descriptions of its own links to every other router in the area. Each then holds an identical link-state database and independently runs Dijkstra's shortest-path-first algorithm over it, placing itself at the root of the tree. Because every router computes from the same map, loops are impossible by construction.

Forming an adjacency

1. Hello packets to 224.0.0.5 every 10 seconds on broadcast links discover neighbours. Both ends must agree on area ID, hello and dead intervals, subnet mask, authentication and stub flags — a mismatch in any one leaves the neighbour stuck and is the usual cause of "OSPF will not come up".
2. States progress Down → Init → 2-Way → ExStart → Exchange → Loading → Full. Getting stuck in ExStart usually means an MTU mismatch; stuck in 2-Way on a broadcast segment is normal for two non-designated routers.
3. On a multi-access segment, routers elect a DR and BDR so that n routers form 2n adjacencies rather than n(n−1)/2. Election is by highest priority, then highest router ID; priority 0 means never eligible. The election is not pre-emptive — a better router arriving later does not take over.

The router ID is a 32-bit value written like an IP: manually set, else the highest loopback address, else the highest active interface address. Set it explicitly, or a rebooted router can adopt a different identity and reshape your database.

Areas and LSA types

Areas limit how far link-state flooding travels: routers inside an area know its full topology, and only summary information crosses the boundary. Every area must touch area 0, the backbone, directly or through a virtual link. An ABR sits between an area and the backbone; an ASBR injects routes from outside OSPF entirely.

Stub areas block type 5 externals and substitute a default route; totally stubby areas block type 3 as well. Both exist to shrink the database on small routers. Summarisation happens only at ABRs and ASBRs — you cannot summarise in the middle of an area, because that would corrupt the shared map.

BGP

BGP does not look for the fastest path. It looks for the path that policy prefers, between organisations that do not trust each other. Each autonomous system has a number (32-bit since 2007; 64512–65534 are private) and advertises which prefixes it can reach, prepending its own AS to the AS_PATH as the advertisement travels. A router that sees its own AS in a received path discards it — that is the entire loop-prevention mechanism.

• eBGP runs between different AS numbers, typically directly connected, TTL 1 by default. iBGP runs inside one AS and requires a full mesh or route reflectors, because iBGP-learned routes are never re-advertised to other iBGP peers.
• Peers connect over TCP 179, exchange OPEN, then UPDATE messages, and hold the session up with KEEPALIVEs. It is incremental: once converged, only changes are sent.
• Transit is paying someone to reach the whole internet. Peering is two networks exchanging their own customers' traffic, usually settlement-free, often at an internet exchange point.

The decision order, simplified but in the right sequence: highest weight (Cisco-local), highest LOCAL_PREF (consistent across your AS — the main lever for outbound traffic), locally originated routes, shortest AS_PATH, lowest origin type, lowest MED (a hint to your neighbour about their inbound preference, only compared between paths from the same AS), eBGP over iBGP, lowest IGP metric to the next hop, then oldest route and lowest router ID as tie-breakers.

Controlling traffic: you influence outbound traffic easily with LOCAL_PREF. Influencing inbound traffic is harder because it depends on other people's policy — the usual tools are AS-path prepending (making your path look longer on the link you would rather not receive on), MED, and BGP communities, which are tags a provider publishes to let you request behaviour such as "do not advertise this to peer X".

ICMP, path tools & MTU

ICMP is not a transport protocol and carries no user data. It is the network's own signalling channel — the way a router tells a sender "that was too big", "nobody is there", or "you ran out of hops". Two of the most-used diagnostic tools in existence are built entirely from it, and blocking it wholesale breaks things that look nothing like a ping.

Where this sits: builds on modules 04 and 05. These tools reappear as part of a method in module 20, and at packet level in module 21.

The messages that matter

ICMPv6 does far more than its v4 counterpart: it carries Neighbor Discovery (replacing ARP), Router Solicitation and Advertisement (which drive SLAAC), and multicast listener discovery. Filtering ICMPv6 the way people filter ICMPv4 breaks IPv6 outright — the address configuration itself depends on it.

Ping, properly

Ping sends an echo request with a sequence number and a payload, and times the reply. What it actually proves: the destination is reachable, the return path exists, and neither direction is dropping at that size. What it does not prove: any application is running, or that TCP will succeed.

Traceroute

Traceroute exploits TTL. It sends a probe with TTL 1; the first router decrements it to zero, discards it and returns ICMP Time Exceeded — revealing itself. Then TTL 2, and so on, until the destination replies (echo reply on Windows, or ICMP port unreachable for the Unix UDP method). Windows tracert uses ICMP echo; classic Unix traceroute uses high-numbered UDP; both support TCP variants that get through firewalls which drop the rest.

Reading a trace honestly. Stars do not mean the path is broken — they mean that hop declined to generate an ICMP reply, which is common on core routers that rate-limit control-plane traffic. Latency that jumps at one hop and stays high is real; latency that spikes at one hop and drops back is that router deprioritising its own ICMP generation, not a fault. And because the return path can differ from the forward path, a trace shows you one direction only. mtr and pathping repeat probes over time and give per-hop loss, which is what you want for intermittent problems.

MTU, fragmentation and MSS

Ethernet's default MTU is 1500 bytes of payload. A packet larger than the next link's MTU must be fragmented by the sender or, in IPv4, by an intermediate router — unless the DF bit is set, in which case the router drops it and returns ICMP type 3 code 4 with the MTU it can accept. That feedback loop is path MTU discovery. IPv6 removes router fragmentation entirely: only the source may fragment, so PMTUD is mandatory rather than optional.

MSS is the TCP-layer equivalent, announced in the SYN: "do not send me segments larger than this." It is normally MTU minus 40 for IPv4 with TCP. MSS clamping on a tunnel interface rewrites that announcement downward as the SYN passes, so both ends negotiate a size that fits — the standard fix for VPN black holes, and far more reliable than depending on ICMP surviving the internet.

The transport layer

Layer 3 gets a packet to the right host. Layer 4 gets it to the right program on that host, and decides whether anyone checks it arrived. Those two jobs — multiplexing by port, and reliability — are the whole layer.

Where this sits: builds on module 04. Every mechanism described here is visible in a capture in module 21.

Ports and sockets

A port is a 16-bit number, so 0–65535. Servers listen on well-known ports; clients pick a random high-numbered ephemeral port (49152–65535 by the IANA definition) for each connection. The pair of IP and port is a socket, and a connection is uniquely identified by four values: source IP, source port, destination IP, destination port.

• 0–1023 — well known, historically requiring administrative privilege to bind.
• 1024–49151 — registered, claimed by specific applications.
• 49152–65535 — dynamic/ephemeral, client side.

TCP: reliability by bookkeeping

TCP is connection-oriented. Before any data moves, the two ends synchronise sequence numbers in a three-way handshake, and every byte thereafter is numbered and acknowledged. Lost data is retransmitted; out-of-order data is reassembled; the sender slows down when the network complains.

The flags

Flow control and congestion control

Two different problems, often confused:

The connection as a state machine

TCP is defined as a set of states and the events that move between them. Every socket on your machine is sitting in one of them right now, and ss -tan or netstat -an shows you which. Reading that output is a diagnostic skill in itself — the state a connection is stuck in tells you which side failed.

Windows, and what actually limits throughput

TCP does not send one segment and wait. It sends as much as the smaller of two windows allows, then waits for acknowledgements to free up space. That amount in flight is bounded by the bandwidth-delay product — the capacity of the pipe itself. A 1 Gbps link with 80 ms of latency holds 10 MB of data in flight at any moment, so a receiver advertising a 64 KB window will use less than 1% of it, no matter how fast the link is.

The 16-bit window field maxes out at 65,535 bytes, which is why the window scaling option exists: a multiplier negotiated in the SYN that raises the ceiling to a gigabyte. If a middlebox strips that option — some old firewalls did — throughput collapses over long paths and nothing looks broken.

Congestion control, in four phases

1. Slow start. The sender begins with a congestion window of a few segments and doubles it every round trip. Despite the name it is exponential and aggressive — it is only slow at the start.
2. Congestion avoidance. Past a threshold, growth becomes linear: roughly one segment per round trip. Careful probing rather than doubling.
3. Fast retransmit. Three duplicate acknowledgements mean a segment went missing but later ones are arriving. The sender resends immediately rather than waiting for a timeout.
4. Fast recovery. The congestion window is halved rather than reset to one, because duplicate ACKs prove the path is still delivering. A full timeout, by contrast, collapses the window completely — which is why a timeout costs far more throughput than a single loss.

Modern stacks mostly run CUBIC, which recovers more aggressively on high-bandwidth long-latency paths, or BBR, which models bandwidth and round-trip time directly instead of treating loss as the only congestion signal — a better fit for wireless links, where loss often means interference rather than a full queue.

Details that produce real faults

UDP: send it and hope

UDP adds ports and an optional checksum to IP, and nothing else. No handshake, no acknowledgements, no ordering, no retransmission, no congestion control. That is a feature: for voice, video, gaming and DNS lookups, a late packet is worse than a lost one, and the application can handle recovery in a way that suits it.

QUIC is the modern twist: it runs over UDP on port 443 but implements reliability, ordering and TLS 1.3 encryption itself in user space, removing a round trip and dodging the middlebox problems TCP suffers. HTTP/3 uses it.

Session, presentation & TLS

Layers 5 and 6 exist to keep a conversation going and to agree what its contents mean — and the protocol that does most of that work today is TLS. It answers two questions at once: is this traffic private, and am I talking to who I think I am. Encryption without identity is worthless — an attacker in the middle can encrypt too. The certificate is the identity half, and almost every "TLS problem" in practice is a certificate problem.

Where this sits: builds on module 08 — TLS runs inside a TCP connection. Applied to real traffic in modules 10 and 11.

Layers 5 and 6, and what they actually do

These are the two layers people skip, partly because no single protocol maps neatly onto them — in the TCP/IP model they are folded into the application layer entirely. They are still worth understanding, because the functions exist regardless of which box you draw them in.

Why it matters in practice. A fault at these layers looks nothing like a network fault: the connection establishes and stays up, packets flow, but the data is wrong or the session dies on a fixed schedule. Mojibake in a web form is a layer 6 encoding mismatch. A user logged out every thirty minutes regardless of activity is a layer 5 session lifetime. A certificate error is layer 6 refusing to proceed. In all three cases pinging harder will not help — and recognising that is the value of keeping the layers separate in your head.

Symmetric and asymmetric, and why both

Symmetric encryption (AES) uses one shared key, is fast, and can move gigabits. Its problem is distribution: how do two strangers agree on a key over a network anyone can read? Asymmetric encryption (RSA, elliptic curve) uses a mathematically linked key pair — anything encrypted with the public key can only be decrypted with the private one, and a signature made with the private key can be verified by anyone holding the public one. It is slow, so TLS uses it only to authenticate the server and agree a symmetric session key, then switches to symmetric for the actual data.

Modern TLS agrees that session key with an ephemeral Diffie-Hellman exchange, which gives perfect forward secrecy: the key is never transmitted and is discarded afterwards, so an attacker who records today's traffic and steals the server's private key next year still cannot decrypt it.

SNI (Server Name Indication) is the extension that lets one IP address host many TLS sites: the client states the hostname it wants in the Client Hello, so the server knows which certificate to present. It is sent in clear text in TLS 1.2 and 1.3, which is how filtering appliances still identify HTTPS destinations without decrypting anything. Encrypted Client Hello is the emerging fix.

What a certificate actually is

A signed statement binding a public key to an identity. The important fields:

• Subject and Subject Alternative Names — the names the certificate is valid for. Browsers ignore the old common name field entirely; if the name you typed is not in the SAN list, it fails.
• Issuer — who signed it, pointing at the next certificate up the chain.
• Validity period — not-before and not-after dates. This is why a wrong clock produces certificate errors, which ties directly back to module 12.
• Public key, signature algorithm, and the CA's signature over everything above.
• Key usage / extended key usage — whether it may be used for server authentication, client authentication, code signing and so on.

Validation walks the chain: the server certificate is signed by an intermediate, the intermediate by a root, and the root is already in the client's trust store because the operating system or browser vendor put it there. A server must send its intermediates — forgetting them is the single most common certificate misconfiguration, and it fails on some clients and not others depending on what they have cached.

PKI

The machinery around certificates. A Certificate Authority issues and signs them; a Registration Authority verifies who is asking. You generate a key pair, keep the private key, and send a Certificate Signing Request containing the public key and the names you want. The CA validates ownership — by DNS record, an HTTP file, or company documents for higher assurance — and returns a signed certificate.

Application protocols & services

Two services do more invisible work than everything else combined: DNS turns names into addresses, and DHCP hands out the addresses in the first place. When users say "the internet is down", one of these two is the cause more often than any cable.

Where this sits: builds on modules 08 and 09. HTTP is large enough to get its own module and is covered in 11; NTP in 12.

DNS

DNS is a distributed, hierarchical database read from right to left. In www.example.co.uk. the trailing dot is the root, then uk, then co, then example, and finally the host. No single server knows everything; each level knows only who to ask next.

A recursive resolver (your ISP's, or 8.8.8.8 / 1.1.1.1) does the legwork and returns one final answer. Iterative queries are what the resolver sends to each authoritative server: "I do not have it, ask this one instead." Caching happens at every level, governed by each record's TTL — which is why you lower the TTL a day before a planned migration.

Record types

Zones and transfers: a primary (master) server holds the writable zone; secondaries pull copies by zone transfer (AXFR full, IXFR incremental) and answer authoritatively. Split-horizon DNS returns different answers to internal and external clients for the same name. DNSSEC signs records so a resolver can verify they were not tampered with — it provides authenticity, not confidentiality. DoH and DoT encrypt the query itself over 443 and 853.

DHCP

Four messages, in order: Discover, Offer, Request, Acknowledge. Remember DORA. The client starts with no address at all, so Discover is a broadcast from 0.0.0.0 to 255.255.255.255 on UDP port 68, and the server replies from port 67.

Scope — the range of addresses a server can hand out. Reservation — a specific address always given to a specific MAC. Exclusion — addresses inside the scope the server must not use, typically for static infrastructure. Lease — the time an address is valid; the client tries to renew at 50% (T1) directly with the server, and at 87.5% (T2) it broadcasts to any server. Options — extra settings delivered with the address: option 3 default gateway, option 6 DNS servers, option 15 domain name, option 42 NTP servers, option 66/67 boot server for PXE.

Other services you must be able to name

HTTP, proxies & load balancing

HTTP is a request-response protocol made of plain text lines, which is why it is so easy to debug and so easy to proxy. Everything sitting between a browser and an application server — reverse proxies, load balancers, CDNs, WAFs — is manipulating those lines.

Where this sits: builds on modules 09 and 10. The Kubernetes and cloud equivalents of these load balancers are in module 17.

Anatomy of a request

The method, the path, the version, then headers, a blank line, and an optional body. The Host header is what makes virtual hosting possible: one IP and one port can serve hundreds of sites because the server reads the name from the request. Lose that header and a reverse proxy has no idea which backend you wanted.

Versions

• HTTP/1.1 — one request at a time per connection, with keep-alive to avoid reopening TCP. Head-of-line blocking is solved by browsers opening six connections per host.
• HTTP/2 — binary framing, many multiplexed streams over one TCP connection, header compression, server push. Still suffers TCP-level head-of-line blocking: one lost packet stalls every stream.
• HTTP/3 — the same model over QUIC on UDP 443, where each stream is independent, so loss on one does not stall the others. Also merges the transport and TLS handshakes into a single round trip.

Proxies

Because a reverse proxy terminates the client connection, the backend sees the proxy's address as the source. X-Forwarded-For preserves the original client address, X-Forwarded-Proto records whether the client used HTTPS, and X-Forwarded-Host the original hostname. Applications that generate absolute URLs will emit http://internal-name/ links unless these are set and trusted correctly — and they must be stripped from inbound requests, or a client can forge its own source address in your logs and access rules.

TLS termination ends encryption at the proxy, giving it visibility for routing and caching; TLS passthrough forwards the encrypted stream untouched; re-encryption terminates and opens a fresh TLS session to the backend, which is what you want when the internal network is not trusted.

Proxy variants worth naming

• Explicit proxy — the client is configured with the proxy address, usually by policy or a PAC file. Honest, visible, and it breaks if the setting is wrong.
• Transparent proxy — the network redirects port 80 and 443 without the client knowing. Nothing to configure, but TLS interception requires deploying a trusted root to every device, and some applications with certificate pinning will simply refuse to work.
• SOCKS proxy — operates at layer 5 rather than 7, so it relays any TCP stream and, in SOCKS5, UDP too. It does not read or modify the protocol inside, which makes it useful for arbitrary applications. ssh -D 1080 creates one on the fly, which is the simplest way to route a browser through a remote network.
• Secure web gateway — a proxy with the full policy stack bolted on: category filtering, malware scanning, data loss prevention and TLS inspection.

Load balancing

Time synchronisation

Time is the one shared assumption every distributed system makes and almost nobody verifies. Kerberos refuses tickets more than five minutes out. TLS certificates become "not yet valid". Log correlation across two hosts becomes fiction. Multi-factor codes fail. NTP is the protocol that keeps all of that from happening, and it does something genuinely clever: it measures the delay of the network in order to cancel it out.

Where this sits: depends on modules 08 and 10. Its consequences show up again in module 16 (Kerberos) and module 19 (log correlation).

What "correct time" means

• UTC — Coordinated Universal Time, the civil standard. Derived from atomic time but kept within 0.9 s of the Earth's rotation by inserting leap seconds.
• TAI — International Atomic Time, a pure count of atomic seconds with no leap seconds. Currently 37 seconds ahead of UTC.
• GPS time — atomic, no leap seconds since 1980, so it runs 18 s ahead of UTC. GNSS receivers apply the offset from the navigation message before presenting UTC.
• Unix epoch — seconds since 00:00:00 UTC on 1 January 1970. A signed 32-bit counter overflows on 19 January 2038; NTP's own 32-bit era counter rolls over on 7 February 2036, which NTPv4 handles with era numbering.
• Leap seconds — announced six months ahead, applied as 23:59:60 UTC. NTP signals one with the two leap indicator bits; systems either step, or "smear" the second across a day so nothing sees a discontinuity. Smearing and stepping servers must never be mixed in one pool.

Local time zones and daylight saving are an operating-system presentation concern. Infrastructure runs on UTC internally, always: it removes an entire class of ambiguity from logs, and it means nothing happens twice at 01:30 in October.

Stratum: distance from truth

Stratum is not a quality rating and not a hop count in the routing sense. It counts how many NTP servers you are from a reference clock. Each layer adds its own error, so the number is a rough proxy for accumulated uncertainty. Click a level to inspect it.

How NTP actually measures time

The naive approach — "the server says it is 12:00:00, so set the clock to 12:00:00" — is wrong by however long the reply took to arrive. NTP solves this with four timestamps captured across one exchange:

From those four values:

The delay is the total time on the wire with the server's own processing removed. The offset is the average of how wrong the clock looked on the way out and on the way back — averaging cancels the transit time provided the path is symmetric. That assumption is the protocol's one real weakness: on an asymmetric path (say 5 ms out, 25 ms back), NTP will confidently place the clock 10 ms off and report a healthy delay. It is also why running NTP through a congested or heavily queued link degrades accuracy even though nothing is broken.

Disciplining the clock

Knowing the offset is not the same as fixing it. A computer's oscillator is a cheap crystal that runs fast or slow by a fairly constant amount, measured in parts per million. At 50 ppm — entirely normal — a clock gains or loses 50 microseconds per second, which is 4.3 seconds per day. NTP does not just correct the error; it learns the drift rate, writes it to a drift file, and applies continuous compensation so that even if the network disappears, the clock stays close.

• Slew — speed the clock up or down slightly until it converges. Time never jumps and never goes backwards. Used for offsets under 128 ms. Correcting a large error by slewing alone takes a long time, because the maximum slew rate is about 500 ppm.
• Step — jump the clock straight to the right value. Used above 128 ms. Applications that assume monotonic time can behave badly, which is why databases and clusters prefer slewing and why -x / makestep settings exist.
• Panic threshold — by default, an offset over 1000 seconds makes the daemon exit rather than apply a change that large. Something is badly wrong; a dead CMOS battery, usually.

Choosing who to believe

Configure one server and you have no way to know if it is lying. Configure two and you cannot tell which one is wrong. NTP's selection algorithm therefore wants at least four sources, and it works in stages:

1. Sanity checks — reject anything with stratum 16, a bad leap indicator, a failed authentication, or a root distance beyond the limit.
2. Intersection algorithm — each source gives a confidence interval rather than a point. Sources whose intervals do not overlap the majority are falsetickers and are discarded; the survivors are truechimers. This is what makes four sources meaningfully better than two.
3. Clustering — among the survivors, sources with the highest jitter are progressively discarded until the remaining set is tightly grouped.
4. Combining — the surviving offsets are weighted, usually by root distance, and one is chosen as the system peer to drive the loop filter.

Key metrics you will see reported: jitter (short-term variation in measured offset — a network quality signal), dispersion (accumulated maximum error, which grows between polls), root delay and root dispersion (the totals all the way back to the reference clock). Root distance, roughly root dispersion plus half the root delay, is the honest statement of worst-case error.

Poll intervals and burst options

NTP polls between every 64 seconds (2⁶) and every 1024 seconds (2¹⁰) by default, widening the interval automatically as the clock proves stable. That is deliberately gentle: NTP is designed so that a hundred thousand clients can share a public server. iburst sends a short burst of eight packets at startup so a machine synchronises in seconds rather than minutes — you almost always want it. burst does the same on every poll and is considered abusive against servers you do not own. prefer marks a source as the one to favour when the algorithms are otherwise undecided.

Modes and topology

A sane enterprise design: two or three internal servers, each taking time from several external sources or a local GNSS receiver, peering with one another, with every other device on the network pointing only at those internal servers. Firewall outbound UDP 123 so nothing bypasses them. In a Windows domain, the PDC emulator holds the authoritative role and every member syncs down the domain hierarchy automatically — pointing individual member servers at external NTP is a classic cause of drift.

Security

• Amplification attacks — the old monlist command returned a large response to a tiny spoofed request, giving an amplification factor in the hundreds. Disable monlist, restrict queries, and keep daemons current.
• Spoofing and delay attacks — plain NTP is unauthenticated. An attacker who can move a client's clock can expire or un-expire certificates, replay Kerberos tickets, or defeat time-based tokens.
• Symmetric keys — shared secrets configured on both ends. Workable internally, painful to distribute.
• NTS (Network Time Security, RFC 8915) — the modern answer: TLS key establishment on TCP 4460, then authenticated NTP packets on 123. Use it where supported.
• Restrict who may query and who may modify; never leave a server open to the internet by accident.

When milliseconds are not enough: PTP

NTP on a normal LAN gets you within a few milliseconds; on a quiet local link, tens of microseconds. Finance, broadcast, power distribution and mobile networks need better, and that means PTP (IEEE 1588).

A boundary clock terminates PTP and regenerates it, isolating each segment. A transparent clock measures how long a packet spent inside the switch and writes that into a correction field, so downstream devices can subtract it — this is the trick that defeats queueing jitter, and it is why ordinary switches ruin PTP accuracy.

Holdover and hardware

When a GNSS antenna fails or the signal is jammed, the server enters holdover: it keeps time using its own oscillator and the drift figure it has learned. How long that lasts depends entirely on the oscillator — a plain crystal drifts milliseconds within hours, a TCXO does better, an OCXO holds microseconds for a day, and a rubidium standard holds for weeks. This is what you are buying when a time appliance costs thousands rather than tens.

Multicast, VoIP & real-time traffic

Most traffic tolerates delay. Voice and video do not — a packet that arrives late is a packet that was lost, because the audio moment it belonged to has already passed. This module covers one-to-many delivery, and how to protect traffic that cannot wait.

Where this sits: takes the QoS introduction from module 05 and finishes it, and applies the addressing rules from module 04 to multicast.

Multicast

Unicast sends one copy per recipient; broadcast sends to everyone whether they want it or not; multicast sends one copy that the network duplicates only where paths diverge, and only toward receivers who asked. For a 4 Mbps video stream and 200 viewers, that is the difference between 800 Mbps and 4 Mbps leaving the server.

Anycast is the fourth mode and works differently: the same address is advertised from many locations, and normal routing delivers each client to the topologically nearest instance. Root DNS servers and CDN edges use it, which is why 8.8.8.8 answers quickly everywhere.

Getting it right on a LAN

A switch treats an unknown multicast frame like a broadcast and floods it — which turns a 4 Mbps stream into 4 Mbps on every port, including the ones with nothing but a printer on them. IGMP snooping is the fix: the switch listens to the IGMP membership reports passing through it and builds a map of which ports actually have receivers, forwarding the stream only there. On a VLAN with no multicast router, configure an IGMP querier on the switch, or the memberships expire and flooding resumes.

• IGMPv2 — join, leave-group, and queries. IGMPv3 adds source filtering, which is what source-specific multicast needs. IPv6 uses MLD, carried inside ICMPv6.
• PIM routes multicast between subnets. Sparse mode builds a shared tree rooted at a rendezvous point and only where receivers exist — the sane default. Dense mode floods everywhere then prunes, and is a bad idea on anything but a lab.
• The reverse-path-forwarding check discards any multicast packet that did not arrive on the interface the router would use to reach the source. That is how multicast avoids loops.

VoIP

Two separate protocols do two separate jobs, and confusing them makes VoIP faults very hard to diagnose. SIP (TCP/UDP 5060, TLS 5061) is signalling only: register, invite, ring, answer, hang up. The audio never touches it. The audio is RTP over UDP on a dynamically negotiated high port pair, with RTCP alongside carrying statistics on jitter and loss. So a call that connects but has no audio is a media-path problem — one-way audio almost always means NAT or a firewall blocked the RTP stream in one direction, while the SIP signalling flowed fine.

Codecs trade bandwidth for quality: G.711 uses 64 kbps of payload and sounds like a landline; G.729 uses 8 kbps and sounds compressed; Opus adapts between roughly 6 and 128 kbps. Add IP, UDP and RTP headers — 40 bytes on every 20 ms packet — and real-world G.711 needs closer to 87 kbps per direction on Ethernet.

QoS in practice

QoS does nothing until a link is congested; then it decides who suffers. The process is always the same three steps: classify (identify the traffic), mark (write that decision into the packet so everything downstream can act on it without re-inspecting), and queue (act on the marking when there is contention).

Trust boundaries matter: mark as close to the source as possible, but never trust markings from user devices, or a games console will helpfully mark itself EF. Re-mark at the access port. Policing drops or re-marks traffic exceeding a rate immediately; shaping buffers it and releases it smoothly, which suits TCP far better but adds delay. Strict priority queuing must be bounded — an unbounded voice queue can starve everything else.

Wireless

Wi-Fi is Ethernet's rules applied to a medium nobody owns, where every station shares one channel, collisions cannot be detected, and the walls are part of the design. Most wireless faults are radio-planning faults, not configuration faults.

Standards

Higher frequency means more bandwidth and less range: 2.4 GHz penetrates walls but offers only three non-overlapping 20 MHz channels (1, 6, 11) and shares space with Bluetooth, microwaves and cordless phones. 5 GHz offers around 24 channels, some requiring DFS — the AP must vacate within seconds if it detects radar, which shows up as an unexplained brief outage.

Signal, in decibels

RF power is measured in dBm, decibels relative to one milliwatt — a logarithmic scale, so −30 dBm is a thousand times stronger than −60 dBm. Two rules make the arithmetic trivial: +3 dB doubles power, +10 dB multiplies it by ten (and the negatives halve and divide). SNR is the gap between signal and noise floor, and it matters more than raw signal.

Antennas and coverage

Omnidirectional antennas radiate in a doughnut around the mast — the default for indoor APs. Directional types (Yagi, panel, parabolic) concentrate energy into a beam for point-to-point links or covering a long corridor. Antenna gain in dBi does not create power; it reshapes it, trading coverage in one direction for another. Regulators limit EIRP, the combination of transmitter power and antenna gain.

Design for 15–20% cell overlap so clients can roam without dropping. Too much transmit power is a common mistake: it makes clients hear the AP from far away but the AP cannot hear their weaker replies, producing the classic "full bars, no data".

Security

802.1X uses three roles: the supplicant (client), the authenticator (switch or AP, which passes traffic through but nothing else until authentication succeeds), and the authentication server (RADIUS). EAP variants worth naming: EAP-TLS (certificates both ends, strongest), PEAP and EAP-TTLS (server certificate plus inner password auth), EAP-FAST.

Attacks: an evil twin or rogue AP broadcasts your SSID to harvest credentials; deauthentication frames kick clients off so they reconnect to the attacker (protected management frames stop this); war driving maps networks from a vehicle. Hiding an SSID and filtering MAC addresses are not security measures — both are trivially defeated by watching the air.

WAN & remote access

Beyond the building, someone else owns the cable. This module covers what you are actually buying from a provider, how you reach across it securely, and how much downtime the design can absorb.

Where this sits: builds on modules 05 and 09. What lives on the far side of a cloud link is module 17.

WAN links

SD-WAN puts a controller in front of several cheap links — broadband, cellular, MPLS — and steers each application over whichever path currently meets its policy, measuring loss, latency and jitter continuously. It is the reason MPLS budgets have shrunk.

Demarcation point — where the provider's responsibility ends and yours begins. The CSU/DSU or NTU sits at that boundary. Knowing exactly where the demarc is saves hours during an outage, because it decides who you are allowed to blame.

Tunnels and remote access

• Site-to-site VPN — two firewalls build a permanent encrypted tunnel; users are unaware it exists.
• Client-to-site (remote access) VPN — a laptop dials in. With full tunnel, all traffic goes via the office and is inspected; with split tunnel, only corporate subnets do, which saves bandwidth and loses visibility.
• IPsec — the standard suite. IKE negotiates keys in two phases; AH authenticates but does not encrypt, ESP encrypts and authenticates. Tunnel mode wraps the whole original packet; transport mode keeps the original IP header.
• GRE — encapsulation with no encryption; often wrapped inside IPsec because it can carry multicast and routing protocols, which plain IPsec cannot.
• SSL/TLS VPN — runs over 443, so it traverses hotel and airport firewalls that block IPsec.
• Zero trust network access — replaces the flat "you are inside, so you are trusted" model with per-application authorisation on every request.
• Out-of-band management — a console server or dedicated management interface reachable when the production network is down. If your only route to the router is through the router, one bad configuration line costs you a site visit.

Where cloud fits

A cloud region is reached over exactly the technologies above — an IPsec or TLS tunnel across the internet for convenience, or a direct connect circuit into the provider for predictable latency, higher throughput and lower egress cost. Everything on the far side of that link is covered properly in the virtualisation and containers module: service models, VPC design, security groups and network ACLs.

Availability and continuity

RTO is how long you may take to restore service; RPO is how much data you may lose. Those two numbers drive every design decision below. A hot site is running and current; a warm site has hardware and stale data; a cold site is space and power. Aim availability at the "nines": 99.9% allows about 8.8 hours of downtime a year, 99.999% allows just over five minutes. MTBF measures how long a component lasts; MTTR measures how quickly you fix it — and MTTR is usually the one you can actually improve.

Host networking

The network does not stop at the switch port. Every server is a small router with its own interfaces, routing table, ARP cache and firewall, and a large share of "network problems" are actually host configuration. This module covers the two operating systems you will meet, plus the storage protocols that run between them.

Linux networking

The ip command replaced the old ifconfig, route and arp tools; they are the same concepts with better syntax and full support for modern features.

Configuration is persisted by NetworkManager (desktops and RHEL, driven by nmcli), systemd-networkd (servers and containers), or distribution files such as netplan. Name resolution comes from /etc/nsswitch.conf deciding the order, /etc/hosts first, then /etc/resolv.conf — which on most systems now points at a local stub resolver rather than the real DNS servers.

Netfilter: how a packet crosses a Linux box

iptables and its successor nftables are front-ends to the same kernel framework. Understanding the order of the hooks explains why a rule in the wrong chain does nothing.

Connection tracking is what makes a Linux firewall stateful: ct state established,related accepts return traffic for connections you already permitted, so you only write rules for the initiating direction. MASQUERADE is source NAT that picks up the outgoing interface's address automatically — right for dynamic WAN addresses, marginally more expensive than a fixed SNAT.

Network namespaces give a process its own complete network stack — interfaces, routes, firewall rules, sockets. Two namespaces are joined by a veth pair, a virtual cable with an end in each, usually with one end plugged into a Linux bridge that behaves exactly like a switch. Every container network you will ever meet is built from those three pieces.

Windows networking

PowerShell has replaced most of the old commands, and returns objects rather than text: Get-NetIPAddress, Get-NetRoute, Get-NetAdapter, Resolve-DnsName, and Test-NetConnection host -Port 443, which is the modern substitute for telnet-as-a-port-tester. Windows Firewall applies a different rule set per network profile — domain, private, or public — so a service that works in the office and fails on a home network is usually a profile classification issue, not a firewall rule issue.

SMB on TCP 445 carries Windows file and printer sharing. SMB 1 is obsolete and should be disabled outright; SMB 3 adds encryption, multichannel and better performance over WAN links.

Active Directory depends on the network more than people realise

AD is three things stacked: LDAP for directory queries (389, or 636 for LDAPS), Kerberos for authentication (88), and DNS for locating everything. Clients find domain controllers not by address but by SRV records such as _ldap._tcp.dc._msdcs.example.local — which is why pointing a domain-joined machine at a public DNS server breaks logon completely, even though the internet still works.

Sites and subnets tell AD which physical location a client is in, so it uses a local domain controller rather than one across a WAN link. An unregistered subnet produces slow logons and odd replication choices, and shows up in the domain controller's event log as clients from an unknown subnet.

Network storage

File versus block is the distinction to hold onto: NAS serves files and manages the filesystem itself, so many clients can share it safely. SAN serves raw blocks, and the client formats it — which means two clients writing to the same block device without a clustered filesystem will destroy it. Storage traffic is also unusually sensitive to loss and jitter, because a delayed block read stalls an application thread in a way a delayed web request does not.

Virtual, container & cloud networking

None of this is new networking. A virtual switch is a switch, a container is a host with its own namespace, and a Kubernetes Service is a load balancer. What changes is that the wiring is now created and destroyed by software in seconds, and you cannot see it by looking at a rack.

Where this sits: builds on module 15. A virtual switch is module 03 inside a host, and a container namespace is module 16 inside a process.

Hypervisor networking

A virtual switch inside the host forwards frames between VMs and out through one or more physical uplinks. It does VLAN tagging, port groups with policies, and traffic shaping — but by default it does no MAC learning from the outside world, and it is not a managed switch: no STP participation, no CLI, and it forwards VM-to-VM traffic entirely inside the host, where your physical monitoring cannot see it.

Docker

By default Docker creates a Linux bridge (docker0), gives each container a veth pair into it, allocates addresses from a private range, and adds a masquerade rule so containers can reach the outside world. Containers on the same user-defined network reach each other by container name, resolved by Docker's built-in DNS at 127.0.0.11.

Network modes: bridge (isolated, published ports only), host (the container shares the host's stack entirely — no isolation, no port mapping, and a port conflict if two containers want the same one), none (loopback only), and overlay for multi-host clusters, which encapsulates container traffic in VXLAN so containers on different physical hosts appear to share a layer 2 segment.

Kubernetes networking

Kubernetes imposes a deliberately simple model, which the CNI plugin (Calico, Cilium, Flannel) must implement: every pod gets its own IP, every pod can reach every other pod without NAT, and nodes can reach all pods. Pod addresses are ephemeral — a pod that restarts gets a new one — which is why nothing should ever be configured with a pod IP.

Service discovery is DNS: service.namespace.svc.cluster.local, with the short form working inside the same namespace. Network policies are the firewall — and the default is wide open, so until you apply one, every pod can talk to every other pod in the cluster. A policy selecting a pod switches it to default-deny for that direction, which is the usual source of surprise.

Cloud service models

Who runs what, and therefore who is responsible when it breaks.

Deployment models are public, private, hybrid and community. The shared responsibility model is the line that matters: the provider secures the cloud, you secure what you put in it. Almost every headline cloud breach has been a customer misconfiguration — an open storage bucket or an over-permissive security group — rather than a provider failure.

Cloud networking, translated

SDN

Traditional devices make forwarding decisions individually: each has its own control plane deciding routes, and its own data plane moving packets. SDN centralises the control plane in a controller that programs every device's data plane, so policy is expressed once and pushed everywhere. The management plane — how you configure and monitor the devices — is the third, distinct piece. Intent-based networking goes further, taking a statement of desired outcome and continuously verifying reality against it.

Data centre & internet architecture

Two ends of the same story: how a modern data centre fabric is built, and how those fabrics connect to each other to form the internet. Both are worth understanding conceptually well before you would ever configure them.

Inside the data centre

Top-of-rack switches sit in each cabinet with short copper or DAC runs to the servers, and fibre uplinks out. In spine-leaf terms those are the leaves; every leaf connects to every spine, and spines connect only to leaves. Any server is therefore exactly two hops from any other, latency is uniform and predictable, and adding capacity means adding a spine rather than redesigning.

Classic three-tier designs blocked half their links with spanning tree. Spine-leaf refuses to waste them: the fabric runs layer 3 between leaves and spines with ECMP spreading flows across every available path, so all links carry traffic all the time.

MLAG

Servers still want a single logical uplink across two switches for redundancy. MLAG (also MC-LAG, vPC, stacking) lets two switches present themselves as one LACP partner, so the server bonds two links to what it believes is one device — no STP blocking, full bandwidth, and survival of a switch failure. The trade-off is a peer link and shared state between the two switches, which is another split-brain risk to design around.

VXLAN and EVPN

The fabric is routed, but applications still want layer 2 adjacency and VM mobility. VXLAN solves this by encapsulating an entire Ethernet frame inside UDP (port 4789) and carrying it across the routed underlay. The tunnel endpoints are VTEPs, usually the leaf switches. Two extra benefits: the segment identifier is 24 bits, giving about 16 million segments instead of the 4094 VLANs allow, and the outer header is normal IP, so the underlay needs to know nothing about tenants.

EVPN is the control plane that makes VXLAN sane. Without it, VTEPs learn remote MAC addresses by flooding. EVPN uses BGP to advertise MAC and IP reachability between VTEPs, so the fabric knows where every endpoint is without flooding, supports anycast gateways on every leaf, and handles ARP suppression.

How the internet actually fits together

The internet is roughly 75,000 autonomous systems agreeing to carry each other's traffic. Three commercial relationships explain almost all routing behaviour:

• Transit — you pay a provider to reach everywhere. They advertise the full table to you and your prefixes to everyone.
• Peering — two networks exchange traffic destined for each other's customers only, usually without payment, usually at an internet exchange point where hundreds of networks meet on a shared fabric. Cheaper and lower-latency than sending the same traffic via transit.
• Customer — the inverse of transit; you sell it to someone smaller.

A packet's journey is therefore: your router, your ISP's access network, their backbone, an exchange point or transit provider, the destination's ISP, the destination network. Nobody plans that path end to end. Each AS independently picks the next hop it prefers, and the path emerges.

CDNs and anycast

A content delivery network keeps copies of content at edge sites close to users. The request never crosses an ocean because it never leaves the region. Two mechanisms steer users to the right edge: DNS-based routing, where the authoritative server answers differently depending on where the query came from, and anycast, where every edge advertises the same IP prefix by BGP and normal routing delivers each client to the nearest instance.

Anycast has a second use: it absorbs volumetric DDoS by spreading the attack across every site that advertises the prefix, instead of concentrating it on one. It works well for short, stateless exchanges like DNS; for long TCP sessions, a routing change mid-connection can move you to a different server, which is why anycast TCP needs care.

Network security

Security is not a device you add at the edge. It is a set of assumptions you stop making — that the LAN is trustworthy, that a MAC address identifies a device, that a packet's source address is real.

Where this sits: draws on modules 03, 05, 09, 10 and 14. Every attack here is an abuse of a mechanism you have already met.

The starting principles

The CIA triad: confidentiality (only the intended parties can read it), integrity (nobody altered it undetected), availability (it is there when needed). Almost every control maps to one of these, and they pull against each other — encrypting everything harms availability when a key is lost.

AAA: authentication (who are you), authorisation (what may you do), accounting (what did you do). RADIUS and TACACS+ implement it for network devices. Least privilege and defence in depth are the two habits that matter most in practice.

Filtering traffic

Rules are evaluated top to bottom, first match wins, and the list ends with an implicit deny. Order matters more than content: a permissive rule above a restrictive one makes the restrictive one dead code.

Attacks and their countermeasures

Hardening the network itself

• Change default credentials, disable unused ports and services, remove Telnet and HTTP management in favour of SSH and HTTPS.
• Port security — limit MAC addresses per port and define the violation action (protect, restrict, shutdown).
• 802.1X everywhere it is practical, with a guest or quarantine VLAN for devices that fail.
• Network segmentation — separate VLANs for users, servers, voice, management, guest and IoT, with rules between them. A flat network turns one compromised laptop into a full breach.
• Microsegmentation — the same idea taken to individual workloads rather than subnets, enforced by host firewalls, hypervisor policy or a service mesh. Two servers in the same VLAN can be prevented from talking to each other at all, which removes the lateral movement that segmentation alone still permits.
• Zero trust — stop treating network location as evidence of trust. Every request is authenticated and authorised on its own merits, based on identity and device posture, whether it came from a desk in the office or a cafe.
• Private VLANs and client isolation stop devices in the same segment from reaching each other.
• Screened subnet (DMZ) — public-facing servers sit between two rule sets, so a compromise there gains no path inward.
• NAC — posture-check devices before admitting them: patch level, antivirus, certificate.
• Keep firmware current, back up configurations off-box, and keep a change log. Most "sudden" outages follow a change nobody wrote down.

Physical security counts. Locked comms rooms, badge readers, cameras, and cable locks. An attacker with physical access to a switch does not need any of the attacks above.

Tools & troubleshooting

The difference between an engineer and someone who restarts things is method. The method below is the one CompTIA examines, and it is genuinely how good troubleshooting works: narrow the problem before you touch anything.

Where this sits: uses the tools introduced in module 07 and applies them as a method. Goes one level deeper in module 21.

The seven steps

1. Identify the problem. Gather information, question users, identify symptoms, determine what changed, and duplicate the fault if you can. "What changed?" resolves more incidents than any tool.
2. Establish a theory of probable cause. Question the obvious first. Work the OSI model — top down, bottom up, or divide and conquer, but pick one deliberately.
3. Test the theory. If it is confirmed, move on. If not, form a new theory or escalate.
4. Establish a plan of action and identify potential effects. Who will this interrupt, and when is the window?
5. Implement the solution or escalate.
6. Verify full system functionality and, where possible, put preventive measures in place.
7. Document findings, actions and outcomes. Undocumented fixes get made again next year, from scratch.

Command line tools

Hardware tools

Monitoring and documentation

You cannot troubleshoot what you never measured. Establish a baseline of normal utilisation, latency and error counts so "slow" becomes a number rather than an opinion. Collect device metrics with SNMP, logs with syslog, flow records with NetFlow/sFlow/IPFIX (who talked to whom, how much), and packets with SPAN ports or taps when you need the detail. Feed logs into a SIEM for correlation — and note that correlation is only as good as the clock synchronisation behind it, which brings you back to module 12.

Documentation worth keeping current: physical and logical topology diagrams, an IP address management record, rack and floor plans, cable and port maps, a configuration baseline per device, and a change log. A network diagram that is a year out of date is worse than none, because people trust it.

Packet capture & analysis

Every other tool reports what a device believes. A capture shows what actually crossed the wire. When two teams disagree about whose fault something is, this is the evidence that ends the argument — which makes it the highest-value skill on the whole list.

Where this sits: builds on module 20. This is where modules 08 to 11 stop being theory — every handshake and retransmission described there is visible here.

Getting the traffic

Switches forward frames only to the port that needs them, so a capture on your laptop sees your own traffic, broadcasts, and nothing else. Options, in ascending order of fidelity:

• Capture on an endpoint — tcpdump on the server itself. Easiest and usually sufficient. Shows what the host received, which may differ from what was sent.
• SPAN / port mirror — the switch copies traffic from one port or VLAN to your capture port. Convenient, but mirrored traffic is deprioritised, so a busy switch drops copies and you get phantom "missing" packets. It also usually strips VLAN tags and errored frames.
• Network TAP — a passive device in the physical path that copies every bit, including errors and tags, without the switch's involvement. What you use when the answer must be trustworthy.

Capture filters (BPF syntax, applied before the packet is stored) reduce the file size and the load: tcpdump -i eth0 -nn 'host 10.1.1.5 and port 443'. Display filters (Wireshark syntax, applied afterwards) narrow what you look at without losing the rest. They are different languages, and mixing them up is the first hurdle everyone hits. Useful tcpdump flags: -nn no name resolution, -s0 full packet, -w file.pcap to write, -c 100 to stop after 100.

Reading a trace

Below is a short capture of a client fetching a page. Click any row to see what it tells you and what to check next.

Signals worth recognising instantly

Techniques

• Follow TCP stream reassembles a conversation into readable form — invaluable for HTTP, SMTP and anything plain text.
• Statistics → Conversations ranks talkers by bytes, which finds the source of unexpected traffic in seconds.
• Statistics → I/O graph plots throughput over time so you can line a complaint up with a spike.
• Expert Information collects Wireshark's own warnings about retransmissions, resets and malformed packets.
• Capture at both ends of a problem path simultaneously. Comparing what left with what arrived localises loss precisely, and is the only way to prove where a packet died.

Network design & address planning

Everything so far has been components. Design is choosing which ones, arranged how, with which addresses — and doing it so that the person who inherits it in five years can extend it without starting again.

Where this sits: pulls together modules 03, 04, 05, 14 and 19 into decisions rather than components.

Principles

• Hierarchy. Access layer connects endpoints, distribution aggregates and applies policy, core moves traffic fast and does little else. Small sites collapse core and distribution into one pair; the roles still exist conceptually.
• Segment by function and trust, not by floor. Users, servers, voice, wireless, guest, IoT, management and cameras each get their own VLAN and subnet, because each needs different rules.
• Summarise. If every subnet at a site falls inside one contiguous block, that site is one route to everyone else. Allocate with room to grow rather than tightly.
• No single point of failure on anything shared. Dual uplinks, dual power, two gateways with VRRP, two DNS and DHCP servers.
• Manage out of band. A separate management VLAN, and console access that does not depend on the network being healthy.
• Document as you build. A diagram, an address plan, a VLAN table and a change log. Retrofitted documentation is always wrong.

Addressing that scales

Give each octet a job. A common scheme inside 10.0.0.0/8 is 10.[site].[vlan].0/24, so 10.20.30.0/24 is site 20, VLAN 30 — and the whole of site 20 summarises as 10.20.0.0/16. Keep VLAN IDs and third-octet values aligned, so VLAN 30 is always x.x.30.0 wherever you are. It costs nothing and makes reading a firewall log trivial.

A worked design

The brief: 100 employees, 10 servers, 20 VoIP phones, 10 cameras, 5 access points, guest Wi-Fi, one internet connection, remote-access VPN.

Build it in a lab

Reading is not enough — the concepts stick when you break them yourself. Cisco Packet Tracer is free and ideal for switching, VLANs, STP and routing exercises. GNS3 and EVE-NG run real network operating system images for realistic behaviour. Proxmox, Hyper-V or VirtualBox on a spare machine lets you run pfSense, OPNsense or VyOS as a router and firewall, with Linux VMs as clients.

A lab worth building, in order: two VLANs on a switch and prove they cannot talk; add a router or SVI and prove they can; add DHCP with a relay; add a firewall rule that blocks one direction and confirm it from both ends; break the subnet mask deliberately and watch what fails; add a second uplink and watch STP block it; then capture the whole boot sequence of a client — DHCP, ARP, DNS, TCP, TLS, HTTP — in Wireshark and identify every packet. That last exercise is worth more than a week of reading.

Automation, APIs & configuration management

Configuring one switch by hand is fine. Configuring forty consistently, proving they are still configured that way next month, and rolling back safely when they are not — that needs a different approach. This is where networking meets software practice.

Managing devices at all

Running versus startup configuration. The running config is live in memory and takes effect instantly; the startup config is what loads at boot. Forgetting to save means a reboot silently reverts your work — and remembering to save too early means a mistake survives the reboot that would have rescued you. Many platforms offer a confirmed commit that rolls back automatically unless you confirm within a few minutes; use it for anything that could sever your own connection.

Configuration management

• Back up every device automatically, nightly, to a repository. A config file is small; there is no excuse for not having last week's.
• Diff the backups. Yesterday's config against today's answers "what changed?" — the single most useful question in troubleshooting — in seconds rather than hours.
• Version control the whole lot in git. You get history, blame, review before merge, and rollback for free.
• Change control is not bureaucracy for its own sake: a window, a documented plan, a tested rollback, and someone else who read it. Most major outages are self-inflicted during a change nobody reviewed.
• Standardise firmware across a platform. Mixed versions produce bugs that only appear between two specific devices, which are miserable to diagnose.

Programmatic interfaces

Screen-scraping a CLI over SSH works and is still widely done — Netmiko and NAPALM exist to make it bearable — but it is brittle, because a firmware upgrade that reformats one output column breaks your script. Structured interfaces are the alternative:

Read status codes the same way as in module 11: 401 means your token is wrong, 403 means the token is fine but lacks permission, 404 means the path or object name is wrong, and 429 means you are polling too fast.

Infrastructure as code

Two ideas do most of the work. Declarative configuration describes the desired end state and lets the tool work out the steps, rather than scripting the steps yourself. Idempotency means running it twice changes nothing the second time — so you can run it routinely to correct drift, not just at build time.

Worth learning alongside: enough Python to parse and request things, YAML and JSON to read data files and API responses, and git to work with others without overwriting them. None needs to be deep to be useful.

Follow a packet

The real test of networking knowledge is whether you can explain, in order and without hand-waving, everything that happens between typing a URL and seeing a page. Every module in this lab appears somewhere in the sequence below. Step through it, then break something and watch where it fails.

Where this sits: every module in the lab appears somewhere in this sequence. If a stage does not make sense, the trail line at the top of the relevant module says where to go back to.

The short version

If you can expand each of these into a paragraph, and name the command or filter that proves it happened, you have the mid-level understanding this lab set out to build.

Exam room

Two ways to test yourself: flashcards for recall, and a randomised exam drawn from every module. Neither is stored anywhere — refresh and you start clean.

Final reminders