I85PREP
⌘ K
CUNP study materials
CUNP study resources

CUNP: Network Architecture, Protocols, and the TCP/IP Stack

CUNP · Work through your exam, one topic at a time.

All guide sections

Network Architecture, Protocols, and the TCP/IP Stack

This domain tests how data is encapsulated and delivered across the TCP/IP stack. CUNP questions typically require you to identify the layer responsible for a symptom, interpret a capture, or explain TCP versus UDP behavior without relying on memorized OSI slogans.

Core rules and concepts

  • The TCP/IP model is practical: link, internet, transport, and application. Ethernet frames carry ARP, IPv4 or IPv6, and then TCP, UDP, ICMP, or other payloads.
  • ARP resolves IPv4 addresses to MAC addresses on a local segment; IPv6 uses Neighbor Discovery. ARP is link-local and does not cross routers.
  • IP is connectionless and best-effort. MTU limits frame payload; TCP advertises MSS, commonly MTU minus 40 bytes for IPv4 and TCP headers, so 1500-byte Ethernet gives 1460-byte MSS.
  • TCP provides ordered, reliable byte streams using sequence numbers, acknowledgments, retransmission, flow control, and congestion control. The three-way handshake is SYN, SYN-ACK, ACK.
  • UDP preserves message boundaries but provides no delivery guarantee, ordering, or congestion control; applications add those when needed.
  • ICMP reports errors and diagnostics. Blocking all ICMP can break path-MTU discovery and troubleshooting.
  • Ports identify application endpoints; a connection is identified by the four-tuple of source address, source port, destination address, and destination port.

Worked example

A client can resolve a name and starts a connection, but curl hangs before any HTTP request. A capture shows repeated SYN packets and no SYN-ACK. That points below HTTP: check routing, firewall policy, and whether the server is listening. If SYN-ACK returns and the client sends ACK but no HTTP request, investigate TLS, proxy settings, or application delay. If the handshake completes and data flows, the transport is working and the fault is higher in the stack.

Traps that cost marks

Do not say ARP is routed, that TCP preserves message boundaries, or that a successful ping proves an application is healthy. Distinguish MTU from MSS, and remember that TCP reliability does not guarantee application-level correctness. Read captures in both directions before blaming a protocol.

Exam focus

Map symptom to layer, then confirm with ss, tcpdump, dig, or curl. State the evidence, not just the layer name.