Ruankao Network Engineer (Intermediate) key terms

A seven-layer framework describing how network functions are divided, from physical transmission up to application services, used as a common vocabulary for comparing protocols and equipment across vendors.

The process in which each protocol layer adds its own header (and sometimes trailer) to data received from the layer above, so that peer layers on the receiving host can interpret and strip that information.

Protocol Data Unit: the named chunk of data at a given layer, such as frame at the data link layer, packet at the network layer, and segment at the transport layer. Naming makes troubleshooting discussions precise.

Maximum Transmission Unit: the largest payload a link can carry in one frame, typically 1500 bytes on Ethernet. Exceeding it forces IP fragmentation or path MTU discovery, and misconfiguration breaks tunnels and VPNs.

Circuit switching reserves a dedicated path for the whole session, while packet switching forwards independently addressed packets over shared links. The contrast explains latency, efficiency, and why data networks use statistical multiplexing.

A forwarding behaviour in which a device receives an entire frame or packet, checks it (for example via FCS or header validation), and only then transmits it onward, trading a little latency for error filtering.

Copper cabling graded by bandwidth performance, such as Cat5e, Cat6, and Cat6A, with different supported frequencies and distances. Category choice determines whether gigabit or 10-gigabit Ethernet can run over the installed link.

A transmission medium carrying data as light pulses through glass or plastic core, immune to electromagnetic interference and supporting long distances. Single-mode suits campus and carrier links; multimode suits building backbones and data centres.

The weakening of a signal as it travels along a medium, measured in decibels. It sets the maximum usable distance for copper and fiber links and drives the need for repeaters or optical amplifiers.

Rules for representing binary data as signal changes: line coding shapes voltage or light levels on a link, while modulation varies a carrier's amplitude, frequency, or phase to carry bits over analogue or wireless channels.

Combining multiple independent signals onto one medium, for example by dividing time (TDM), frequency (FDM), wavelength (WDM), or code space. It underpins carrier trunks and optical backbone capacity planning.

Cyclic redundancy check is an error-detecting code computed over frame bits; the resulting frame check sequence is appended by the sender and recomputed by the receiver, which discards frames that fail the check.

The standard link-layer structure containing destination and source MAC addresses, a type or length field, payload, and a frame check sequence, with preamble and inter-frame gap handling at the physical boundary.

A 48-bit identifier burned into a network interface, usually written as six hexadecimal octets. Switches learn source addresses to build forwarding tables, and the broadcast address ff:ff:ff:ff:ff:ff floods to all ports.

A logical Layer 2 partition of a switch into separate broadcast domains, identified by a tag such as 802.1Q. VLANs isolate traffic and simplify moves, but require routing or a Layer 3 switch to communicate between them.

A link carrying traffic for several VLANs at once, normally by inserting an 802.1Q tag into each frame. Both ends must agree on tagging and allowed VLAN lists or traffic silently disappears.

Spanning Tree Protocol prevents Layer 2 loops by electing a root bridge and blocking redundant ports, leaving a loop-free tree. Rapid variants converge faster; without it, broadcast storms can saturate a campus network.

The set of devices that receive a frame sent to the broadcast address. Routers and VLAN boundaries delimit broadcast domains, which matters because excessive broadcast traffic degrades every host in the domain.

Wireless LAN standards define radio access in the 2.4, 5, and 6 GHz bands; because stations cannot reliably detect collisions, they use carrier sense multiple access with collision avoidance, including acknowledgements and backoff.

An SSID names a wireless network; clients associate with an access point broadcasting it. Roaming hands a client between access points, ideally with fast key exchange so the session survives without re-authentication delay.

Dotted-decimal 32-bit addresses split into network and host parts by a prefix length or mask. Subnetting borrows host bits to create smaller networks, and correct mask and gateway planning is fundamental to routing design.

Classless Inter-Domain Routing expresses prefixes as address plus length, such as 192.168.10.0/24, and allows route aggregation. It replaced fixed address classes and is the notation used throughout routing configuration.

The router address a host uses when the destination is outside its own subnet. A wrong or missing gateway, or one on a different subnet, is a common cause of partial connectivity.

Address Resolution Protocol maps a known IPv4 address to a link-layer MAC address by broadcasting a request and caching the reply. Stale or spoofed ARP entries cause intermittent loss or man-in-the-middle attacks.

Internet Control Message Protocol carries error and diagnostic messages between IP nodes, powering ping and traceroute. Many networks filter selected ICMP types, so blocked replies do not always mean a host is down.

A diagnostic technique that sends packets with increasing time-to-live values and collects ICMP time-exceeded replies, revealing each router hop. It helps locate where paths diverge or where filtering begins.

Time To Live is an IPv4 header counter decremented at every router; reaching zero discards the packet and triggers an ICMP message. It limits looping packets and is exploited by traceroute.

The rule that a router chooses the most specific matching route when several entries fit a destination. It explains why a host route overrides a summary and why default routes are used only as a last resort.

A manually configured path to a destination network, with a next hop or outgoing interface. Simple and predictable in small networks, but it does not adapt to failures unless paired with tracking or dynamic routing.

A link-state interior gateway protocol that floods link information, builds a common topology database, and computes shortest paths with Dijkstra's algorithm. Areas limit flooding, and neighbour adjacency requires matching parameters.

A distance-vector interior protocol using hop count as its metric and periodic updates, with a maximum usable count of 15. Simple to configure but slow to converge, which limits it to small or lab environments.

The path-vector protocol that exchanges routes between autonomous systems on the Internet, selecting paths using attributes such as AS path and local preference. It scales by policy control rather than link-state flooding.

A group of networks under one administrative authority and routing policy, identified by an AS number. Interior protocols run inside it; exterior protocols such as BGP connect it to other autonomous systems.

Network Address Translation rewrites addresses and often ports as packets cross between private and public addressing realms. It conserves public IPv4 space but complicates inbound access and protocols carrying addresses in payloads.

The 128-bit successor to IPv4 with a vastly larger address space, built-in neighbour discovery, and no broadcast. Transition techniques include dual stack and tunnelling, and prefix delegation is common on access links.

Connection setup using synchronise, synchronise-acknowledge, and acknowledge segments, which agrees initial sequence numbers and confirms reachability in both directions before data flows.

The receiver advertises how much data it can accept, and the sender limits outstanding unacknowledged bytes; lost segments are resent after a timeout or duplicate acknowledgements. This provides reliable, ordered delivery.

A connectionless transport protocol with a minimal header offering no delivery guarantee, ordering, or congestion control. It suits DNS queries, streaming, and voice, where low overhead matters more than reliability.

The distributed naming system resolving domain names to addresses through recursive resolvers and authoritative servers, using record types such as A, AAAA, MX, and CNAME. Caching and TTL values govern propagation behaviour.

A protocol that automatically supplies hosts with an address, mask, gateway, and DNS servers through a four-message exchange. Relay agents forward requests across subnets, and lease and scope design prevent address conflicts.

HTTP is the request-response protocol for web content; HTTPS carries it inside TLS, giving confidentiality and server authentication. Status codes, headers, and certificate validity are frequent troubleshooting targets.

Transport Layer Security negotiates keys and encrypts sessions; X.509 certificates bind a public key to an identity and are validated against a trusted chain, expiry dates, and the requested hostname.

A management protocol in which an agent exposes structured variables and a manager polls or receives traps. Community strings or user-based security control access, and MIB definitions describe the available objects.

Syslog forwards event messages to a central collector by severity; monitoring adds polling, thresholds, and alerting on metrics such as interface errors and latency, turning raw device data into operational awareness.

An ordered set of permit or deny rules applied to interfaces or services, matched top-down with an implicit final deny. Placement and specificity decide whether traffic is filtered effectively without blocking legitimate use.

Logical groupings of interfaces with a trust level, such as inside, outside, and demilitarised zone. Policy between zones enforces which traffic may cross, and stateful inspection permits return traffic automatically.

A virtual private network builds an encrypted tunnel over a shared network, using protocols such as IPsec or TLS-based remote access. It protects confidentiality in transit and extends private addressing to remote users or sites.

Planned copying of configuration and data with defined retention, plus tested restoration procedures. Recovery point and recovery time objectives set the schedule, and untested backups are a common audit finding.

Discrete functions installed on a server operating system, such as web, mail, file, or directory services. Separating roles limits attack surface, and each role needs its own ports, storage, and update plan.

Running multiple isolated guest systems on shared physical hardware through a hypervisor, improving utilisation and enabling snapshots and live migration. It also changes network design, adding virtual switches and overlays.

A standards-based hierarchy of cabling subsystems, from work area and horizontal runs to the equipment room and campus backbone, designed to support many services over a long lifespan independent of vendor equipment.

Wireless security certifications using strong encryption and authentication. WPA2 relies on AES-based encryption; WPA3 strengthens handshakes and open-network protection, and both require compatible clients and access points.

Splitting an IP packet into smaller pieces so it fits a link's MTU, with reassembly at the destination. It adds overhead and risk of loss; IPv6 moves the decision to the source instead of routers.