CCST Networking cheat sheet

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP model collapses to 4: Network Access, Internet, Transport, Application.

PDU names per layer: bits (L1), frame (L2), packet (L3), segment (L4 TCP) or datagram (L4 UDP), data (L5-L7).

Encapsulation order at send: data, segment, packet, frame, bits; de-encapsulation reverses at receive.

TCP is connection-oriented with a 3-way handshake (SYN, SYN-ACK, ACK), sequencing, and retransmission; UDP is connectionless with no delivery guarantee.

Well-known ports: FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53 (UDP and TCP), DHCP 67/68, HTTP 80, HTTPS 443, SNMP 161/162.

MAC address is 48 bits written as 12 hex digits; the first 3 bytes are the OUI identifying the vendor.

Ethernet II frame fields in order: preamble/SFD, destination MAC, source MAC, EtherType, payload, FCS.

IPv4 header key fields: version, IHL, TTL, protocol (6=TCP, 17=UDP, 1=ICMP), source and destination address.

Private IPv4 ranges per RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; 169.254.0.0/16 is link-local (APIPA).

IPv4 address is 32 bits in four octets; subnet mask bits set to 1 are network bits, 0 are host bits.

Hosts per subnet = 2^h - 2, where h is the number of host bits; subtract 2 for network and broadcast addresses.

Common masks: /24 = 255.255.255.0, /25 = 255.255.255.128, /26 = 255.255.255.192, /27 = 255.255.255.224, /28 = 255.255.255.240, /30 = 255.255.255.252.

Block size in the interesting octet = 256 - mask value; subnets increment by that block size.

Subnet address = address AND mask; broadcast = subnet address with all host bits set to 1.

IPv6 is 128 bits in eight groups of four hex digits; :: may appear only once to compress zeros.

IPv6 prefixes: /64 is the standard subnet size; global unicast starts 2000::/3, link-local is fe80::/10, multicast is ff00::/8.

Loopback is 127.0.0.0/8 (127.0.0.1) for IPv4 and ::1/128 for IPv6; 0.0.0.0/0 is the default route.

MAC address formats: unicast has a 0 in the least significant bit of the first octet; broadcast is FF:FF:FF:FF:FF:FF.

Twisted-pair categories: Cat5e 1 Gbps to 100 m, Cat6 1 Gbps to 100 m (10 Gbps to 55 m), Cat6a 10 Gbps to 100 m.

UTP cable has four twisted pairs on pins 1,2,3,6 (transmit/receive) and 4,5,7,8; T568A and T568B differ in pair 2 and 3 pin positions.

Straight-through cable connects unlike devices (PC to switch); crossover connects like devices (switch to switch) and is obsolete with Auto-MDIX.

Fiber: single-mode has a small core and long reach (kilometers); multimode has a larger core and short reach; connectors include LC, SC, and ST.

Coaxial cable uses F-type or BNC connectors and is common for cable broadband and older Ethernet (10BASE2/5).

Wireless standards: 802.11n (Wi-Fi 4) 2.4/5 GHz, 802.11ac (Wi-Fi 5) 5 GHz, 802.11ax (Wi-Fi 6) 2.4/5/6 GHz.

PoE standards: 802.3af provides up to 15.4 W at the PSE, 802.3at (PoE+) up to 30 W, 802.3bt up to 60 W or 90 W.

Endpoint roles: a switch forwards by MAC within a broadcast domain; a router forwards by IP between subnets; a hub repeats to all ports.

Collision domain ends at a switch port; broadcast domain ends at a router interface or VLAN boundary.

VLANs segment a switch logically; an access port carries one VLAN, a trunk port carries multiple VLANs using 802.1Q tags.

Spanning Tree Protocol (802.1D) prevents Layer 2 loops; port states are blocking, listening, learning, forwarding, disabled.

Routing: static routes are manual; dynamic protocols include RIP (distance vector, hop count), OSPF (link state), and BGP (path vector between autonomous systems).

DHCP DORA sequence: Discover, Offer, Request, Acknowledge; the server leases an IP, mask, gateway, and DNS.

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), PTR (reverse), NS (name server).

NAT translates private addresses to a public address; PAT uses port numbers to multiplex many inside hosts on one public IP.

Firewalls filter by stateful session or ACL rules; ACLs are evaluated top-down with an implicit deny at the end.

Cloud and virtualization terms: hypervisor runs VMs, a virtual switch connects VMs, and SD-WAN centralizes WAN policy.

Troubleshooting order: identify the problem, establish a theory, test the theory, plan action, implement, verify, document.

ping tests ICMP reachability; a successful ping to a gateway but failure to a remote host points to routing or upstream issues.

ipconfig /all shows IP, mask, gateway, DNS, and MAC; ipconfig /release and /renew re-run DHCP; /flushdns clears the resolver cache.

tracert (Windows) or traceroute (Unix) shows each hop and reveals where latency or loss begins.

nslookup or dig tests DNS resolution; a working IP but failing name means DNS is the fault domain.

netstat -an lists listening ports and active connections; arp -a shows the IP-to-MAC cache.

Cable testers verify pinout and continuity; a TDR locates a break in a copper run; an OTDR does the same for fiber.

Duplex mismatch symptoms: late collisions, CRC errors, and slow throughput on a link that negotiates half duplex on one side.

Wi-Fi issues: low RSSI or high channel utilization causes retries; overlapping channels on 2.4 GHz should be limited to 1, 6, and 11.