CPDN cheat sheet

OSI layers bottom-up: Physical, Data Link, Network, Transport, Session, Presentation, Application; the TCP/IP model collapses these into Link, Internet, Transport, and Application.

Encapsulation order on transmit: data -> TCP segment -> IP packet -> Ethernet frame -> bits; each layer adds its own header and the receiver strips them in reverse.

IPv4 addresses are 32 bits with a 20-byte minimum header; IPv6 addresses are 128 bits with a fixed 40-byte header and no broadcast address type.

Private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; 169.254.0.0/16 (APIPA/link-local) is self-assigned when DHCP fails.

CIDR /n yields 2^(32-n) total IPv4 addresses; for traditional subnets usable hosts = 2^(32-n) - 2 (network and broadcast addresses are reserved).

TCP is connection-oriented with a SYN / SYN-ACK / ACK handshake and a 20-byte minimum header; UDP is connectionless with a fixed 8-byte header.

Port ranges: well-known 0-1023, registered 1024-49151, dynamic/ephemeral 49152-65535.

Standard Ethernet MTU is 1500 bytes; for IPv4 TCP, MSS = MTU - 40 (20-byte IP header + 20-byte TCP header).

Throughput ceiling is bounded by the bandwidth-delay product (link rate x round-trip time); latency, not raw bandwidth, dominates many application flows.

Hierarchical three-tier model: core (high-speed transport), distribution (policy, routing boundaries, aggregation), access (endpoint attachment); each layer should have a single clear role.

Availability = MTBF / (MTBF + MTTR); reducing MTTR improves availability as much as increasing MTBF.

Downtime budgets: 99.9% = ~8.77 h/year, 99.99% = ~52.6 min/year, 99.999% = ~5.26 min/year.

Point-to-point links: /30 gives 2 usable addresses; /31 is valid for point-to-point per RFC 3021 and wastes nothing.

VLSM rule: allocate the largest required subnet first and work downward, keeping every block on a bit boundary to avoid overlap.

PoE budgets at the source: 802.3af ~15.4 W per port, 802.3at ~30 W, 802.3bt up to ~90 W (Type 4); check the switch's total power budget, not just per-port.

Copper limits: Cat5e 1 Gb/s to 100 m, Cat6 10 Gb/s to 55 m, Cat6a 10 Gb/s to 100 m; fiber or media converters are required beyond those distances.

2.4 GHz WLAN uses 20 MHz channels; the non-overlapping set in North America is 1, 6, and 11, while 5 GHz offers many more non-overlapping channels.

Layer-2 redundancy should pair an active loop-prevention protocol with link aggregation (LACP) so topology changes converge without broadcast storms.

802.1Q trunking inserts a 4-byte tag carrying a 12-bit VLAN ID and priority bits; the native VLAN is sent untagged, so both ends must agree on it.

DHCP uses the DORA exchange (Discover, Offer, Request, Acknowledge) over UDP 67 (server) and 68 (client); relay agents forward requests across subnets.

Administrative distance ranks route sources: lower wins - connected (0) beats static (1), which beats most dynamic protocols; a floating static uses a raised AD as backup.

NAT overload (PAT) multiplexes many private hosts behind one public address by tracking source port numbers in a translation table.

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), PTR (reverse), TXT (policy/verification), SRV (service location); TTL controls cache lifetime.

NTP runs on UDP 123; stratum 1 syncs to a reference clock, each hop adds one stratum level, and stratum 16 means unsynchronized.

802.1X has three roles: supplicant (endpoint), authenticator (switch/AP), and authentication server (typically RADIUS on UDP 1812/1813).

Static default routes are configured as 0.0.0.0/0 (IPv4) and ::/0 (IPv6); verify next-hop reachability before relying on them.

Save the running configuration to startup after verified changes, and keep an out-of-band path for recovery if in-band management is misconfigured.

FCAPS defines the management functional areas: Fault, Configuration, Accounting, Performance, and Security.

Incident management restores service quickly; problem management finds and removes the root cause. Changes should pass a change advisory review with a rollback plan.

SNMP polls use UDP 161 and traps use UDP 162; SNMPv3 adds authentication and privacy, while v1/v2c send community strings in clear text.

Syslog severities run 0 (emergency) to 7 (debug); lower numbers are more severe, and syslog transport is typically UDP 514.

Flow telemetry (NetFlow/IPFIX) records per-conversation metadata for capacity and security analysis; sFlow uses packet sampling instead of full flow state.

Backup rule 3-2-1: three copies, two media types, one off site. RPO bounds acceptable data loss; RTO bounds acceptable outage duration.

Baselines define normal utilization, latency, and error rates; alerting on deviation from baseline is more reliable than fixed thresholds alone.

Capacity planning extrapolates interface utilization and growth trends so upgrades land before the link saturates.

Configuration drift is controlled by version-controlled templates and periodic compliance scans against the intended state.

CIA triad: confidentiality, integrity, availability - each control should be justified against one or more of these objectives.

Risk = likelihood x impact; treatment options are mitigate, transfer, avoid, or accept, chosen by comparing control cost with expected loss.

Symmetric algorithms (AES) use one shared key and are fast; asymmetric algorithms (RSA, ECDSA) use a key pair and are slower, so TLS uses asymmetric exchange to establish a symmetric session key.

Service ports to know: SSH 22, DNS 53, HTTPS 443, LDAP 389 (636 over TLS), RADIUS 1812/1813, RDP 3389, SNMP 161/162.

Stateful firewalls permit return traffic for established sessions automatically; stateless ACLs must allow both directions explicitly and end with an implicit deny.

PKI trust chains run root CA -> intermediate CA -> leaf certificate; revocation is published via CRL or checked in real time with OCSP.

Least privilege, defense in depth, and network segmentation limit blast radius; zero trust removes implicit trust based on network location.

CVSS scores severity 0.0-10.0: 9.0+ critical, 7.0-8.9 high, 4.0-6.9 medium; prioritization should also weigh exploitability and asset criticality.

Common frameworks: ISO 27001 (ISMS), SOC 2 (trust services), PCI DSS (cardholder data), HIPAA (health data), GDPR (EU personal data).

Choose a structured path: bottom-up from physical, top-down from the application, or divide-and-conquer by testing the middle layer first.

Diagnostic tools: ping (ICMP echo), traceroute (TTL expiry), arp -a (L2 to L3 mapping), dig/nslookup (DNS), ipconfig/ifconfig (local IP config), netstat (sockets).

CRC, FCS, and input errors indicate physical-layer faults (cable, connector, transceiver, interference); they are not routing problems.

Duplex mismatch (one side full, one half) produces late collisions, runts, and FCS errors with link up but poor throughput; fix by matching settings or using autonegotiation on both ends.

An MTU black hole occurs when ICMP 'fragmentation needed' is blocked; test with a don't-fragment ping of decreasing size to find the working MTU.

A Windows host showing 169.254.x.x self-assigned an APIPA address because DHCP did not answer - check VLAN, cabling, and DHCP scope/relay.

Name resolution order on most hosts: local cache -> hosts file -> configured DNS servers; a failure isolated to names but not IP addresses points at DNS.

Intermittent wireless issues are commonly caused by channel overlap, low SNR, or roaming between APs with mismatched security settings.

Escalate with evidence: capture the symptom, scope, timeline, and changes made, and roll back the most recent change before deeper investigation.