Network Fundamentals
Layers, addressing, and ports
You need the OSI and TCP/IP models cold. OSI: physical, data link, network, transport, session, presentation, application. Encapsulation wraps data down the stack; switches work at Layer 2 (MAC), routers at Layer 3 (IP). ARP resolves an IP address to a MAC on the local segment; broadcast domains are split by VLANs, and 802.1Q tags extend VLANs across trunks. Spanning Tree prevents Layer 2 loops.
IPv4 is 32-bit dotted decimal; private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is link-local (APIPA, seen when DHCP fails). CIDR math: a /24 has 256 addresses and 254 usable; each borrowed bit halves the host space and doubles the subnet count. IPv6 is 128-bit hexadecimal with no broadcast - it uses multicast, neighbor discovery, and SLAAC.
TCP is connection-oriented: three-way handshake (SYN, SYN-ACK, ACK), sequencing, acknowledgments, retransmission, and windowing. UDP is connectionless with no delivery guarantee - good for DNS, DHCP, voice, and streaming. Ports to memorize: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 80 HTTP, 123 NTP, 161/162 SNMP, 443 HTTPS, 514 syslog, 830 NETCONF, 3306 MySQL. Standard Ethernet MTU is 1500 bytes.
Routing: static routes are manual; OSPF is link-state interior; BGP is the path-vector exterior protocol of the internet. NAT/PAT rewrites addresses so many hosts share one public IP. ACLs filter on addresses and ports.
Trap: assuming DNS uses TCP (it uses UDP for normal queries), or miscounting usable hosts in a /25 or /26. Rule of thumb: usable hosts = 2^(32−prefix) − 2.