CNPA cheat sheet

OSI layers bottom-up: Physical, Data Link, Network, Transport, Session, Presentation, Application; layer number equals the count of layers below plus itself.

TCP/IP model maps to four layers: Network Access (OSI 1-2), Internet (OSI 3), Transport (OSI 4), Application (OSI 5-7).

PDU names: data (Application), segment (Transport/TCP), packet (Network), frame (Data Link), bit (Physical).

Encapsulation adds a header at each layer downward; de-encapsulation strips headers upward at the receiving host.

Connection-oriented vs connectionless: TCP uses a three-way handshake (SYN, SYN-ACK, ACK); UDP sends datagrams with no handshake or delivery guarantee.

TCP header flags include SYN, ACK, FIN, RST, PSH, URG; a RST closes a connection abruptly.

Well-known ports 0-1023, registered 1024-49151, dynamic/ephemeral 49152-65535.

Common ports: FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, HTTP 80, HTTPS 443, SNMP 161/162.

Bandwidth is capacity in bits per second; throughput is actual delivered rate; latency is delay measured in milliseconds.

Ethernet frame fields in order: preamble/SFD, destination MAC, source MAC, EtherType/length, payload (46-1500 bytes), FCS.

Minimum Ethernet frame is 64 bytes including FCS; frames shorter than 64 bytes are runts; maximum payload is 1500 bytes (MTU).

MAC address is 48 bits written as 12 hex digits; the first 24 bits are the OUI identifying the vendor.

Switch learns source MAC on ingress into the MAC address table and forwards unknown unicast, broadcast, and multicast out all ports except ingress.

Collision domains end at a switch port; broadcast domains end at a router or VLAN boundary.

802.1Q tag adds 4 bytes and carries a 12-bit VLAN ID (usable range 1-4094); native VLAN frames are untagged on a trunk.

STP (802.1D) prevents Layer 2 loops by electing one root bridge (lowest bridge ID) and blocking redundant ports; RSTP (802.1w) converges faster.

Port states in classic STP: blocking, listening, learning, forwarding, disabled.

EtherChannel/LACP (802.3ad) bundles links; member ports must match speed, duplex, and VLAN configuration.

IPv4 is 32 bits in four octets; private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; 169.254.0.0/16 is link-local (APIPA).

Usable hosts per subnet = 2^h - 2, where h is the number of host bits; subtract 2 for network and broadcast addresses.

Prefix to mask: /24 = 255.255.255.0, /25 = .128, /26 = .192, /27 = .224, /28 = .240, /29 = .248, /30 = .252.

Block size = 256 minus the interesting octet value; subnets increment by that block size in the octet where the mask ends.

Broadcast address = network address plus (block size - 1) in the last affected octet.

/30 yields 2 usable hosts and is typical for point-to-point links; /31 is used for point-to-point per RFC 3021.

IPv6 is 128 bits in eight hex groups; :: compresses one run of zero groups; a /64 is the standard LAN prefix.

IPv6 address types: global unicast (2000::/3), link-local (fe80::/10), unique local (fc00::/7), multicast (ff00::/8).

CIDR summarization combines contiguous prefixes; the summary prefix length equals the number of common leading bits.

A router forwards by longest-prefix match: the most specific matching route wins regardless of administrative distance.

Administrative distance ranks sources: connected 0, static 1, EIGRP 90, OSPF 110, RIP 120, external EIGRP 170.

Static route syntax: ip route ; a default route is 0.0.0.0/0.

Distance-vector protocols (RIP, EIGRP) share routes with neighbors; link-state protocols (OSPF, IS-IS) flood link information and run SPF.

RIP uses hop count with a maximum of 15 (16 = unreachable) and updates every 30 seconds.

OSPF uses cost (reference bandwidth / interface bandwidth) as its metric and forms adjacencies via hello packets.

Floating static routes set a higher administrative distance than the primary route so they activate only on failure.

Routing table entries include destination prefix, next hop, outgoing interface, metric, and administrative distance.

Routed (IP) protocols carry user traffic; routing protocols (OSPF, BGP) exchange reachability information between routers.

DNS resolves names to addresses; record types include A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), PTR (reverse), and NS (name server).

DNS uses UDP 53 for standard queries and TCP 53 for zone transfers and large responses.

DHCP DORA: Discover, Offer, Request, Acknowledge; the client leases an address for a defined lease time.

DHCP relay (ip helper-address) forwards broadcasts to a server on another subnet.

HTTP is stateless on TCP 80; HTTPS wraps HTTP in TLS on TCP 443.

SMTP (25) sends mail, POP3 (110) downloads and typically deletes from server, IMAP (143) synchronizes and retains on server.

SNMP manager polls agents on UDP 161; traps are sent to the manager on UDP 162.

NTP synchronizes clocks over UDP 123 and uses stratum levels where stratum 0 is the reference clock.

FTP uses TCP 21 for control and TCP 20 (active) or a negotiated port (passive) for data.

802.11 standards by band: 802.11b/g 2.4 GHz, 802.11a 5 GHz, 802.11n dual-band, 802.11ac 5 GHz, 802.11ax dual-band.

2.4 GHz has 11 channels in North America with only 1, 6, and 11 non-overlapping; 5 GHz offers many more non-overlapping channels.

CSMA/CA avoids collisions by sensing the medium and using acknowledgments; RTS/CTS addresses the hidden node problem.

SSID is the network name; BSSID is the access point radio MAC address.

WPA2 uses AES-CCMP; WPA3 uses SAE for stronger passphrase-based authentication.

802.1X/EAP provides enterprise authentication via a RADIUS server rather than a shared key.

Open authentication plus WEP provides no meaningful confidentiality because WEP encryption is broken.

Antenna gain is measured in dBi; higher gain focuses energy and extends range in a direction rather than adding total power.

A wireless client associates with an AP, then authenticates; roaming hands the client to another AP with the same SSID.

CIA triad: confidentiality (encryption, access control), integrity (hashing, checksums), availability (redundancy, DDoS protection).

Symmetric encryption (AES) uses one shared key and is fast; asymmetric encryption (RSA) uses a public/private key pair and is slower.

Hashing (SHA-256) is one-way and verifies integrity; it is not encryption and cannot be reversed.

TLS combines asymmetric key exchange with symmetric bulk encryption and provides server authentication via certificates.

Stateful firewalls track connection state; stateless ACLs filter each packet independently by addresses, ports, and protocol.

ACL rule order matters: the first matching entry is applied and an implicit deny follows at the end.

AAA stands for Authentication, Authorization, and Accounting, commonly implemented with RADIUS or TACACS+.

A VPN protects traffic in transit by tunneling and encrypting it (IPsec or TLS-based).

Phishing, malware, and social engineering target users; patching and least privilege reduce exposure.

Troubleshooting flow: identify the problem, establish a theory, test the theory, plan and implement a fix, verify, then document.

ping tests ICMP reachability; traceroute/tracert reveals the path and where hops stop responding.

ipconfig (Windows) or ip addr (Linux) shows local addressing; ipconfig /all or ip route shows gateway and DNS settings.

nslookup or dig tests DNS resolution independently of other connectivity.

show interface displays errors, drops, duplex, and speed; late collisions often indicate a duplex mismatch.

show mac address-table maps learned MACs to switch ports; show arp maps IP addresses to MAC addresses.

Cable categories: Cat5e supports 1 Gbps to 100 m, Cat6 supports 10 Gbps to 55 m, and fiber extends distance.

T568A and T568B wiring differ in pin pairs; a straight-through cable uses the same standard on both ends and a crossover uses different ones.

Baseline documentation of normal performance makes anomalies detectable; syslog and SNMP provide ongoing monitoring data.