CPDN key terms

A seven-layer framework describing how data moves between networked applications, from physical signaling up to user-facing services. It gives technicians a shared vocabulary for locating where a function or fault belongs.

The process of wrapping data with a header at each layer as it travels down the stack, then stripping those headers on receipt. Each header carries the addressing and control information that layer needs.

A way of writing an IP network by the number of leading bits that identify it, such as /24 or /27. It replaced fixed address classes and allows subnets to be sized to real host requirements.

A logical slice of a larger IP network, separated from other slices by routers. Subnets contain broadcast traffic and give administrators a clean unit for applying addressing and security policy.

A Layer 2 broadcast domain defined in switch configuration rather than by cabling. Devices placed in different VLANs cannot communicate without a router or Layer 3 switch forwarding between them.

The group of devices that receive a single Layer 2 broadcast frame. Switches forward broadcasts within it, while routers and VLAN boundaries stop them from spreading further.

The router address a host forwards to when the destination is outside its own subnet. A missing or incorrect gateway produces the classic symptom of local traffic working while remote traffic fails.

An architecture that splits the network into access, distribution, and core layers, each with a focused role. It keeps growth predictable, simplifies policy placement, and shrinks the scope of failures.

A design where the distribution and core layers are merged into a single pair of switches, typically for smaller sites. It saves cost and hops but offers less scalability and less separation between functions.

Duplicating components, paths, or services so that one failure does not stop operation. Redundancy only delivers value when the failover behaviour is designed deliberately and periodically tested.

The automatic transfer of service to a standby device, link, or site when the primary one fails. Designers size failover time against the recovery targets the business has agreed to.

Forecasting future demand for bandwidth, ports, addresses, and power so growth can be accommodated before users notice problems. Sound planning leans on measured baselines and trend data, not intuition.

A standard method for delivering DC power over the same copper cable that carries data to phones, cameras, and access points. Per-switch power budgets must be calculated during design.

A standardized building wiring system with defined subsystems, media, and termination points that supports many services over a long lifespan. It separates permanent building infrastructure from easily changed patch cords.

A protocol such as OSPF that lets routers exchange reachability information and recalculate paths when links change. It costs configuration effort but adapts to failures without administrator intervention.

The point at which every router in a network agrees on the current topology and traffic follows stable paths again. Slow convergence leaves temporary loops, black holes, or out-of-order delivery after a change.

A link that carries traffic for several VLANs, with a tag in each frame identifying which VLAN it belongs to. Mismatched native VLAN or allowed-VLAN settings cause silent, hard-to-see connectivity failures.

Bundling multiple physical links into one logical link to add bandwidth and survive a single cable or port failure. Both ends must agree on the bundling parameters or the bundle will not form.

A Layer 2 protocol that blocks redundant paths so frames cannot circulate endlessly around a switched network. It must be tuned so the intended link forwards and recovery from a break stays fast.

A service that automatically supplies hosts with IP addresses, subnet masks, gateways, and other options. Exhausted scopes or unauthorized servers show up as address conflicts and users with no connectivity.

Rewriting addresses as traffic crosses a boundary, most commonly letting many private hosts share one public address. It conserves addresses but complicates inbound connections and log correlation.

An ordered collection of permit and deny rules applied to traffic on an interface or between zones. Order matters because the first matching rule determines the outcome for that packet.

Mechanisms that classify and prioritize traffic so delay-sensitive flows such as voice survive congestion. Best practice is to mark traffic at the edge and distrust markings arriving from untrusted sources.

A recorded snapshot of normal utilization, performance, and configuration used later as the reference for spotting anomalies. Without a baseline, claims that something is slow cannot be proven or measured.

A management protocol for polling device statistics and receiving unsolicited traps about events. Older versions transmit credentials in clear text, so community strings need protecting or replacing.

A standard for forwarding log messages from network devices to a central collector. Centralized logging enables correlation across devices, long retention, and evidence for audits.

A controlled process for requesting, reviewing, approving, scheduling, and recording modifications to production systems. It reduces outages by requiring rollback plans and impact analysis before work begins.

A contract stating measurable service targets such as availability, latency, and response time, along with consequences for missing them. It converts vague user expectations into testable commitments.

Granting each user, device, or process only the access its job requires and nothing beyond that. Limiting rights shrinks the damage a compromised account or an operator mistake can cause.

The combined processes of authentication, authorization, and accounting that decide who may connect, what they may do, and record what they did. Centralizing these with a service such as RADIUS improves consistency.

Layering independent controls so that defeating one does not expose the whole environment. Typical layers include segmentation, device hardening, monitoring, backups, and user awareness training.

A screened subnet that hosts internet-facing services and is separated from the internal network by firewalls. If a public server is compromised, the DMZ limits how far the attacker can reach.

The combination of how likely a threat is to exploit a weakness and how much harm that exploitation would cause. Comparing risks is how organizations decide which controls are worth their cost.

A weakness in software, configuration, or process that an attacker or event could exploit. It is distinct from a threat, which is the actor or event that might do the exploiting.

The disciplined cycle of identifying, testing, deploying, and verifying software updates across the estate. Unpatched systems remain one of the most common ways attackers gain an initial foothold.

A structured sequence of defining the problem, gathering data, forming and testing hypotheses, then verifying the fix and documenting the outcome. Structure prevents random changes that create fresh faults.

An ICMP echo test that confirms basic reachability and reports round-trip time to a target. A reply proves a path exists, but silence may come from filtering rather than an outage.

A tool that maps the hop-by-hop path to a destination and shows where replies stop. It helps separate a local problem from a transit or far-end problem.

Recording actual frames or packets on an interface for protocol-level inspection. It settles disputes that device counters and log entries cannot resolve on their own.

The structured effort to find why an incident happened rather than merely restoring service. Its findings should feed back into design changes, monitoring, or procedures to prevent recurrence.