Networking Fundamentals
Networking Fundamentals tests how data moves between hosts and how attackers and defenders use that path. CJCA questions focus on the OSI/TCP-IP models, core protocols, port numbers, and basic troubleshooting logic.
Core rules
- Encapsulation: application data → TCP/UDP segment → IP packet → Ethernet frame. Layers 2, 3, and 4 failures look different.
- TCP is connection-oriented (three-way handshake: SYN, SYN-ACK, ACK) and reliable. UDP is connectionless and used by DNS queries, DHCP, and many real-time services.
- Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 389 LDAP, 443 HTTPS, 445 SMB, 3389 RDP.
- DNS resolves names to IPs; DHCP assigns addresses, gateways, and DNS servers; ARP resolves IPv4 addresses to MAC addresses on the local subnet only.
- Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. NAT translates private addresses to public ones.
Worked example
A user cannot open https://intranet.example.com. The browser resolves the name to 10.10.5.20, but a TCP connection to port 443 times out; ping to the same host succeeds. Because ICMP succeeds, Layer 3 reachability exists. The failure is likely a host firewall blocking 443 or no service listening. On the server, check ss -lntp for a listener and review firewall rules. Do not start by replacing the cable or resetting DNS; the evidence already narrows the fault.
Traps
DNS uses UDP 53 for most queries but TCP 53 for large responses and zone transfers. ARP does not cross routers. A successful ping does not prove a TCP service is reachable. Port 443 is HTTPS, not HTTP. Do not confuse Layer 2 MAC addresses with Layer 3 IP addresses.