Ruankao Network Engineer (Intermediate) cheat sheet

OSI has 7 layers: physical, data link, network, transport, session, presentation, application; TCP/IP has 4: network access, internet, transport, application.

PDU names: bit (physical), frame (data link), packet (network), segment (TCP transport), datagram (UDP transport), message/data (application).

Encapsulation adds headers top-down; decapsulation strips headers bottom-up; each layer communicates logically with its peer layer.

Topologies: bus (shared medium, collision-prone), star (central switch/hub), ring (token passing), mesh (n(n-1)/2 links, highest redundancy), tree/hierarchical.

Bandwidth-delay product = link rate x RTT, giving the number of bits in flight; it bounds achievable throughput for windowed protocols.

Nyquist (noiseless): max rate = 2W log2(V) bps; Shannon (noisy): C = W log2(1 + S/N); SNR(dB) = 10 log10(S/N).

Circuit switching reserves an end-to-end path; packet switching uses store-and-forward with statistical multiplexing; datagram vs virtual circuit differ in per-packet path commitment.

Standard bodies: ISO (OSI), IEEE 802 (LAN), IETF (RFCs, TCP/IP), ITU-T (telecom), TIA/EIA (cabling); RFC 791 IPv4, RFC 793 TCP, RFC 768 UDP.

Twisted pair categories: Cat5e 100 MHz/1 Gbps, Cat6 250 MHz/1 Gbps (10G to 55 m), Cat6a 500 MHz/10G to 100 m; max segment 100 m (90 m horizontal + 10 m patch cords).

Fiber: single-mode (small core, laser, long haul, km-scale) vs multimode (50/62.5 um, LED/VCSEL, hundreds of meters); connectors LC, SC, ST; single-mode has lower attenuation and no modal dispersion.

Encoding: NRZ, Manchester (self-clocking, used in 10BASE-T), 4B/5B, 8B/10B, 64B/66B; modulation: ASK, FSK, PSK, QAM (QAM-16 = 4 bits/symbol, QAM-64 = 6 bits/symbol).

Multiplexing: FDM (frequency), TDM (time slots, synchronous vs statistical), WDM/DWDM (fiber wavelengths), CDMA (codes).

Error detection: parity (single-bit), checksum (IP/TCP/UDP, weak), CRC (polynomial division, strong, used in Ethernet FCS); Hamming distance d detects d-1 errors and corrects floor((d-1)/2).

Physical equipment: hub (multiport repeater, one collision domain), repeater (regenerates signal), media converter, modem; all operate at layer 1.

Ethernet physical variants: 10BASE-T, 100BASE-TX, 1000BASE-T (4 pairs), 1000BASE-SX/LX (fiber), 10GBASE-SR/LR/ER; baseband transmission uses the whole cable bandwidth.

Attenuation, crosstalk (NEXT/FEXT), and EMI limit copper distance; UTP is susceptible to EMI, STP/FTP adds shielding; fiber is immune to EMI.

Ethernet frame (DIX/802.3): preamble, SFD, destination MAC, source MAC, type/length, payload 46-1500 bytes, FCS; minimum frame 64 bytes, maximum 1518 bytes (1522 with VLAN tag).

MAC address is 48 bits: 24-bit OUI + 24-bit NIC; broadcast FF-FF-FF-FF-FF-FF; locally administered bit and I/G bit are the two low bits of the first octet.

Switching: learning (source MAC to port), flooding (unknown unicast/broadcast), filtering, aging; store-and-forward vs cut-through; each switch port is its own collision domain.

VLAN: 802.1Q tag adds 4 bytes (12-bit VLAN ID, 4094 usable); access port carries one VLAN untagged, trunk port carries multiple tagged; inter-VLAN routing needs a router or L3 switch (SVI).

STP (802.1D): root bridge = lowest bridge ID (priority + MAC), root port = lowest cost path to root, designated port per segment; states blocking, listening, learning, forwarding; convergence 30-50 s.

RSTP (802.1w) has 3 states and faster convergence via proposal/agreement; MSTP (802.1s) maps multiple VLANs to instances; port roles root, designated, alternate, backup.

WLAN (802.11): CSMA/CA with ACK; 802.11b 2.4 GHz 11 Mbps, g 54 Mbps, a 5 GHz 54 Mbps, n (MIMO, 2.4/5 GHz), ac (5 GHz), ax (Wi-Fi 6); BSS/ESS/SSID, WPA2/WPA3 security.

PPP: LCP for link setup, NCP for network protocols, authentication PAP/CHAP; HDLC is Cisco default on serial links (no authentication, no multi-protocol field in standard form).

IPv4 header is 20 bytes minimum (IHL x 4), TTL, protocol field (1 ICMP, 6 TCP, 17 UDP, 89 OSPF), header checksum, fragmentation via ID/flags/fragment offset (offset in 8-byte units).

Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback 127.0.0.0/8; link-local 169.254.0.0/16; multicast 224.0.0.0/4; subnet mask /n leaves 2^(32-n) addresses, usable hosts 2^(32-n) - 2.

Subnetting: block size = 256 - mask octet; borrow bits b give 2^b subnets; VLSM allocates largest requirement first; summarize by common prefix bits.

ARP resolves IPv4 to MAC within a broadcast domain (request broadcast, reply unicast, cached with timeout); gratuitous ARP detects duplicate addresses; IPv6 uses NDP (NS/NA) instead of ARP.

ICMP types: 0 echo reply, 3 unreachable, 5 redirect, 8 echo request, 11 time exceeded (traceroute relies on TTL expiry); ping and traceroute are ICMP-based.

RIP: distance vector, hop count max 15, updates every 30 s, split horizon/poison reverse prevent loops; OSPF: link state, cost = reference bandwidth/interface bandwidth, areas with Area 0 backbone, DR/BDR election by priority then router ID.

BGP is a path-vector EGP between autonomous systems using TCP port 179; attributes include AS_PATH, NEXT_HOP, LOCAL_PREF, MED; iBGP vs eBGP differ in AS loop rules and next-hop handling.

NAT translates private to public addresses (SNAT/PAT overload by port); static NAT one-to-one; IPv6 is 128 bits, 8 groups of 4 hex digits, :: compression once, no broadcast, SLAAC via RA.

TCP header 20 bytes minimum; flags SYN, ACK, FIN, RST, PSH, URG; three-way handshake SYN, SYN-ACK, ACK; teardown uses FIN/ACK pairs; sequence numbers count bytes.

TCP flow control uses a receive window; congestion control: slow start (exponential), congestion avoidance (additive), fast retransmit on 3 duplicate ACKs, fast recovery; MSS = MTU - IP header - TCP header.

UDP header is 8 bytes (source port, destination port, length, checksum), connectionless, no retransmission; used by DNS, DHCP, TFTP, SNMP, RTP, VoIP.

Well-known ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 69 TFTP, 80 HTTP, 110 POP3, 123 NTP, 143 IMAP, 161/162 SNMP, 443 HTTPS, 179 BGP, 3389 RDP.

DNS record types: A, AAAA, CNAME, MX, NS, PTR, SOA, TXT; recursive vs iterative queries; root, TLD, authoritative servers; caching honors TTL; DNS uses UDP 53, TCP 53 for large responses/zone transfer.

DHCP DORA: Discover, Offer, Request, Ack; leases, renewal at 50% (T1) and rebinding at 87.5% (T2); relay agent (option 82) forwards across subnets; ports 67 server, 68 client.

HTTP is stateless; methods GET/POST/PUT/DELETE/HEAD; status codes 1xx info, 2xx success, 3xx redirect, 4xx client error, 5xx server error; HTTPS = HTTP over TLS, default 443.

Mail: SMTP (25/587) sends, POP3 (110) downloads and typically deletes, IMAP (143) keeps mail server-side and syncs; SNMP manager polls agent on 161, traps to 162; MIB and OID structure data.

Router forwards between subnets using a routing table (longest-prefix match); switch forwards within a VLAN by MAC; firewall filters by 5-tuple and state; all three may be combined in an L3 switch or UTM.

Cisco-style CLI: user EXEC (>), privileged (#), global config (config)#, interface config (config-if)#; enable, configure terminal, interface gi0/1, ip address, no shutdown, exit, write memory/copy run start.

VLAN config: vlan 10, name; interface range; switchport mode access; switchport access vlan 10; trunk: switchport mode trunk, switchport trunk allowed vlan list; verify with show vlan brief, show interfaces trunk.

Static route: ip route <next-hop|exit-interface> [distance]; default route 0.0.0.0/0; floating static uses a higher administrative distance than the dynamic protocol.

Verification commands: show ip interface brief, show ip route, show running-config, show mac address-table, show spanning-tree, show arp, ping, traceroute; debug used sparingly due to CPU load.

Wireless controller/AP: CAPWAP tunnels (data 5246, control 5247), SSID-to-WLAN mapping, PoE power budget per AP class, channel planning on 1/6/11 (2.4 GHz) and DFS channels (5 GHz).

Troubleshooting order: physical (link lights, cable, PoE) -> layer 2 (VLAN, MAC, STP) -> layer 3 (IP, mask, gateway, route) -> layer 4+ (port, ACL, DNS); compare with a known-good path.

Firewall/NAT config: security zones (inside/outside/DMZ), ACL order matters (first match wins, implicit deny), PAT with overload on the outside interface, static NAT for published servers.

Requirement analysis captures users, applications, traffic volume, growth forecast, availability target, security and budget; output is a requirement specification with measurable criteria.

Logical design: topology, addressing plan (VLSM, summarization, room for growth), routing protocol choice, VLAN plan, QoS classes, naming convention; physical design: devices, media, racks, power, cabling paths.

Three-tier design: core (high-speed forwarding), distribution (policy, routing, aggregation), access (user ports, PoE, VLAN edge); collapsed core for small sites.

Structured cabling (ISO/IEC 11801, TIA/EIA-568): work area, horizontal cabling (max 90 m permanent + 10 m cords), telecommunications room, backbone/riser, equipment room, entrance facility.

Availability: redundancy at device (VRRP/HSRP), link (EtherChannel/LACP, STP), path (dual-homed), and power (UPS, dual PSU); uptime % maps to allowed downtime (99.9% = ~8.8 h/yr).

EtherChannel/LACP aggregates up to 8 active links; all member ports need the same speed, duplex, and VLAN configuration; provides bandwidth and link redundancy.

QoS: classify and mark (DSCP/CoS), queue and schedule (PQ, WFQ, LLQ), police/shape; voice needs <150 ms one-way delay, <30 ms jitter, <1% loss.

Project documentation: design drawings, IP/VLAN tables, rack layouts, cable schedules, test reports (link certification), as-built documentation, change log, acceptance and handover records.

Security goals CIA: confidentiality (encryption), integrity (hash/MAC), availability (redundancy, anti-DDoS); AAA = authentication, authorization, accounting (RADIUS, TACACS+).

Symmetric ciphers: DES (56-bit, obsolete), 3DES, AES (128/192/256); asymmetric: RSA, ECC, Diffie-Hellman for key exchange; hash: MD5 (broken), SHA-1 (deprecated), SHA-256.

Digital signature = hash encrypted with sender private key; verifies integrity, authenticity, non-repudiation; PKI uses CA-issued X.509 certificates; TLS handshake negotiates cipher suite and session keys.

VPN: IPsec (AH for integrity, ESP for encryption; transport vs tunnel mode; IKE phase 1/2), SSL/TLS VPN (clientless or client), L2TP, GRE; site-to-site vs remote access.

Access control: ACL standard (source only) vs extended (source, destination, protocol, port); 802.1X port authentication with supplicant/authenticator/auth server; NAC; least privilege.

Firewall types: packet filter, stateful inspection, application-layer proxy, NGFW (IPS, app-ID); DMZ hosts public services; IDS detects, IPS blocks inline.

Network management: FCAPS model (fault, configuration, accounting, performance, security); SNMP v1/v2c community strings in clear, v3 adds authentication and encryption; NetFlow/sFlow for traffic analysis.

Backup: full, incremental, differential; 3-2-1 rule (3 copies, 2 media, 1 offsite); RTO = allowed downtime, RPO = allowed data loss; test restores regularly.

Windows Server roles: AD DS (domain controller, LDAP 389, Kerberos 88, DNS 53), DNS, DHCP, file/print, IIS web, Hyper-V; Group Policy applies settings to OUs.

Linux services: Apache/Nginx (80/443), BIND (named, 53), dhcpd (67), Postfix (25), Samba (SMB 445), NFS (2049), SSH (22); configure via /etc files and systemctl.

File sharing: SMB/CIFS on Windows (ports 137-139, 445), NFS on Unix (2049); permissions model differs (ACL vs mode bits rwx for owner/group/other).

DNS server config: forward and reverse zones, SOA, NS, A/AAAA, CNAME, MX; forwarders vs root hints; zone transfer AXFR/IXFR; DNSSEC signs records.

Virtualization: hypervisor type 1 (bare metal: ESXi, Hyper-V) vs type 2 (hosted: VirtualBox); VM gets virtual NIC, vSwitch connects to physical uplink; snapshots are not backups.

Server hardening: patch management, disable unused services, least-privilege accounts, host firewall, logging to central syslog, time sync via NTP (123).

High availability: clustering, load balancing (L4 vs L7), VRRP/keepalived virtual IP; storage: DAS, NAS (file-level), SAN (block-level, FC/iSCSI).

Troubleshooting services: check listening ports (netstat/ss), service status, logs (Event Viewer, /var/log), DNS resolution, firewall rules, and certificate validity.

Key RFCs: 791 IPv4, 793 TCP, 768 UDP, 826 ARP, 959 FTP, 1034/1035 DNS, 2131 DHCP, 2616/7230 HTTP, 1157 SNMPv2, 2328 OSPFv2, 4271 BGP-4, 2460/8200 IPv6.

IEEE 802 families: 802.1 bridging/VLAN/STP, 802.3 Ethernet, 802.11 WLAN, 802.15 WPAN, 802.16 WiMAX; 802.1Q VLAN tagging, 802.1X port authentication, 802.3af/at/bt PoE.

ISO/IEC 11801 and TIA/EIA-568 define cabling categories and limits; T568A vs T568B pinouts; straight-through vs crossover cable usage.

ITU-T recommendations cover telecom (G.652 single-mode fiber, G.992 xDSL); ISO/IEC 27001 specifies an ISMS; ISO/IEC 27002 gives security controls guidance.

Chinese regulations: Cybersecurity Law (2017), Data Security Law (2021), Personal Information Protection Law (2021); MLPS (multi-level protection scheme, grades 1-5) classifies information systems.

Standardization terms: de jure (formal body), de facto (market-adopted); interoperability testing; conformance and certification; IETF drafts become RFCs via rough consensus.

Technical English: 'throughput' vs 'bandwidth', 'latency' vs 'jitter', 'redundancy' vs 'reliability', 'encapsulation', 'forwarding', 'convergence'; passive voice common in specifications.

Units and prefixes: bps vs Bps (1 B = 8 b), k/M/G decimal (10^3) for rates vs binary (2^10) for storage; dB is a ratio, dBm is an absolute power reference.