100-490 RSTECH cheat sheet

MAC address = 48 bits written as 12 hex digits; first 3 bytes (OUI) identify the vendor, last 3 bytes are interface-specific.

Ethernet II frame fields in order: preamble/SFD, destination MAC, source MAC, EtherType, payload (46-1500 bytes), FCS.

VLAN ID field is 12 bits: usable IDs 1-4094; 0 and 4095 reserved. 802.1Q tag adds 4 bytes to the frame.

Access port carries one VLAN untagged; trunk port carries multiple VLANs tagged, with one native VLAN untagged.

STP election: lowest bridge ID wins root (priority then MAC); priority default 32768 in steps of 4096; then lowest path cost to root, then lowest sender bridge ID, then lowest port ID.

Port states 802.1D: blocking, listening, learning, forwarding, disabled. RSTP collapses to discarding, learning, forwarding.

IPv4 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; APIPA 169.254.0.0/16 indicates failed DHCP.

Subnet host count = 2^h - 2, where h = bits remaining in host portion; /24 leaves 8 bits = 254 usable hosts.

Administrative distance: connected 0, static 1, EIGRP 90, OSPF 110, RIP 120. Lowest AD is installed in the routing table.

CLI modes: user EXEC (>) -> privileged EXEC (#) via enable -> global config via configure terminal -> interface/submodes.

Configuration register 0x2102 = boot from flash, load startup-config; 0x2142 = ignore startup-config (password recovery).

copy running-config startup-config (or write memory) saves the active config; show running-config displays it.

show ip interface brief gives interface, IP, status ( Layer 1) and protocol (Layer 2) columns; show interfaces gives counters and errors.

show version reports IOS image, uptime, configuration register value, and memory; show flash: lists image files.

show cdp neighbors detail reveals directly connected Cisco device platform, IP, and local/remote interfaces.

Interface speed/duplex: speed auto and duplex auto are defaults; hard-set both ends or leave both auto to avoid mismatch.

show mac address-table maps MAC to port and VLAN; show vlan brief lists VLANs and assigned ports.

NTP uses UDP 123; ntp server <ip> and show ntp status verify synchronization; syslog uses UDP 514.

Troubleshoot bottom-up: physical (cabling, link light), data link (duplex, VLAN, STP), network (IP/route), transport (port), application.

ping uses ICMP echo; traceroute uses UDP with incrementing TTL (Windows tracert uses ICMP) to map hops.

show interfaces error counters: CRC/input errors point to cabling or duplex; late collisions indicate duplex mismatch or excessive cable length.

Duplex mismatch symptoms: FCS errors, collisions, and poor throughput at higher load while basic ping succeeds.

show ip route codes: C connected, S static, O OSPF, D EIGRP, R RIP, * candidate default; a missing route = no reachability.

show arp / arp -a maps IP to MAC; an incomplete ARP entry means the destination is on-subnet but not answering.

show processes cpu and show memory statistics identify control-plane overload; show logging shows recent syslog events.

Spanning-tree loop signs: high CPU, MAC table flapping (same MAC on multiple ports), broadcast storms; show spanning-tree confirms root.

debug commands are CPU-intensive; always limit with ACLs or use show commands first, and disable debug with undebug all.

Standard ACLs (1-99) filter on source IP only and should be placed near the destination; extended ACLs (100-199) filter source, destination, protocol, and port and are placed near the source.

ACL processing is top-down, first match wins; there is an implicit deny any at the end of every ACL.

ip access-group <n> in|out applies an ACL to an interface; direction is relative to the router interface.

Port security on a switch port limits learned MACs; violation modes: protect (drop, no log), restrict (drop, log, count), shutdown (err-disable).

DHCP DORA: Discover (broadcast), Offer, Request, Acknowledge. Relay uses ip helper-address <server> to forward broadcasts.

NAT terms: inside local (private host), inside global (public representation), outside local, outside global. ip nat inside source plus inside/outside interface labels are required.

AAA components: authentication (who), authorization (what allowed), accounting (what was done); RADIUS uses UDP 1812/1813, TACACS+ uses TCP 49.

SSH requires a hostname, domain name, RSA key pair (crypto key generate rsa), and transport input ssh; Telnet sends credentials in cleartext.

Common ports: FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, HTTP 80, HTTPS 443.