Junior Network Administrator cheat sheet
Junior Network Administrator · Keep the key ideas within reach.
Network Fundamentals and Models
OSI layers (1–7): Physical, Data Link, Network, Transport, Session, Presentation, Application; each layer serves the layer above and communicates logically with its peer layer on the remote host.
TCP/IP model layers: Network Access (Link), Internet, Transport, Application; maps to OSI as Link=1–2, Internet=3, Transport=4, Application=5–7.
Encapsulation order: data → segment (TCP) or datagram (UDP) → packet (IP) → frame (Ethernet) → bits; de-encapsulation reverses this at the receiver.
PDU names: Transport = segment (TCP) / datagram (UDP); Network = packet; Data Link = frame; Physical = bit.
Connection-oriented vs connectionless: TCP provides sequencing, acknowledgments, and retransmission; UDP provides no delivery guarantee and lower overhead.
Well-known ports: FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53 (TCP/UDP), DHCP 67/68, HTTP 80, HTTPS 443, SNMP 161/162.
IPv4 header key fields: TTL (decremented per router hop; dropped at 0), protocol (6=TCP, 17=UDP, 1=ICMP), source/destination address, header checksum.
Three-way handshake: SYN → SYN-ACK → ACK; connection teardown uses FIN/ACK exchange or RST to abort.
Private IPv4 ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback 127.0.0.0/8; link-local 169.254.0.0/16 (APIPA).
IP Addressing, Subnetting, and Routing Basics
IPv4 address = 32 bits in four octets; subnet mask bits set to 1 define the network portion, 0 bits define the host portion.
Usable hosts per subnet = 2^h − 2, where h = number of host bits; subtract 2 for network and broadcast addresses.
Subnet count from borrowed bits b = 2^b (with subnet-zero allowed on modern equipment).
Block size (magic number) = 256 − mask octet value; subnets increment by this value in the octet where the mask is neither 0 nor 255.
CIDR notation: /24 = 255.255.255.0, /25 = 255.255.255.128, /26 = .192, /27 = .224, /28 = .240, /29 = .248, /30 = .252 (2 usable hosts, point-to-point links).
Private-to-public translation uses NAT/PAT; PAT multiplexes many inside addresses over one public IP using source port numbers.
Routing decision: longest prefix match wins; if no match, use default route 0.0.0.0/0; administrative distance breaks ties among protocols (connected=0, static=1, RIP=120, OSPF=110, EIGRP=90).
IPv6 address = 128 bits, written as eight 16-bit hex groups; :: compresses consecutive zero groups once; /64 is the standard LAN prefix.
Static route syntax concept: destination network + mask + next-hop or exit interface; floating static routes use a higher administrative distance as backup.
Network Devices, Cabling, and Topologies
Hub = Layer 1 repeater, one collision domain; switch = Layer 2, one collision domain per port, one broadcast domain per VLAN; router = Layer 3, separates broadcast domains.
UTP categories: Cat5e 1 Gbps to 100 m; Cat6 1 Gbps to 100 m (10 Gbps to 55 m); Cat6a 10 Gbps to 100 m; maximum segment length 100 m for copper Ethernet.
Fiber: multimode (OM3/OM4) for short distances and LED/VCSEL sources; single-mode (OS1/OS2) for long-haul; connectors LC, SC, ST.
Straight-through cable connects unlike devices (PC–switch); crossover connects like devices (switch–switch, PC–PC); modern auto-MDIX ports negotiate automatically.
Topologies: star (central switch, single point of failure at center), mesh (redundant paths, highest cost), bus (shared backbone, collisions), ring (token or RPR).
Ethernet standards: 100BASE-TX = 100 Mbps over Cat5; 1000BASE-T = 1 Gbps over Cat5e; 10GBASE-T over Cat6a; 1000BASE-SX over multimode fiber.
Collision domain boundaries are Layer 2 devices; broadcast domain boundaries are routers or VLANs.
PoE standards: 802.3af up to 15.4 W per port, 802.3at (PoE+) up to 30 W, 802.3bt up to 60/100 W; check device power budget before deployment.
Ethernet Switching and VLANs
Switch forwarding: learn source MAC into MAC address table, flood unknown unicast and broadcast, filter known unicast, age entries (default 300 s on many platforms).
VLANs segment broadcast domains; access port carries one VLAN untagged; trunk port carries multiple VLANs tagged with 802.1Q (4-byte tag, 12-bit VLAN ID, native VLAN untagged).
802.1Q trunk native VLAN must match on both ends; mismatched native VLANs can cause VLAN hopping or connectivity loss.
Spanning Tree Protocol prevents Layer 2 loops: elect one root bridge (lowest bridge ID), then root ports and designated ports; blocked ports go to blocking state.
RSTP (802.1w) converges faster with port roles root/designated/alternate/backup; edge (PortFast) ports skip listening/learning for access devices.
Inter-VLAN routing options: router-on-a-stick (subinterfaces), Layer 3 switch SVIs, or one physical interface per VLAN.
MAC address format: 48 bits, first 24 bits OUI (vendor), last 24 bits device-specific; unicast has LSB of first octet = 0, multicast = 1.
VLAN trunking protocols: 802.1Q (industry standard) vs ISL (Cisco proprietary, 30-byte encapsulation); 802.1Q is the default choice.
Wireless Networking Basics
802.11 standards: 802.11b 2.4 GHz 11 Mbps; 802.11g 2.4 GHz 54 Mbps; 802.11a 5 GHz 54 Mbps; 802.11n (Wi-Fi 4) 2.4/5 GHz MIMO; 802.11ac (Wi-Fi 5) 5 GHz; 802.11ax (Wi-Fi 6) 2.4/5/6 GHz.
2.4 GHz non-overlapping channels: 1, 6, 11 (in North America); 5 GHz offers many non-overlapping channels (e.g., UNII bands).
SSID identifies a wireless network; BSSID is the AP radio MAC; ESSID is a logical network spanning multiple APs.
Security progression: WEP (broken) → WPA (TKIP) → WPA2 (AES-CCMP) → WPA3 (SAE); WPA2-Personal uses PSK, WPA2-Enterprise uses 802.1X/RADIUS.
Association process: probe → authentication → association → 4-way handshake (WPA2) → data; roaming between APs uses 802.11r/k/v features.
CSMA/CA avoids collisions by listening and random backoff; RTS/CTS mitigates hidden-node problems.
Channel width: 20 MHz is most reliable; 40/80/160 MHz increase throughput but reduce available channels and increase interference.
Wireless survey tools (e.g., Wi-Fi analyzers) measure RSSI, SNR, and channel utilization; SNR below ~20 dB typically degrades throughput.
Network Services (DHCP, DNS, NAT, NTP)
DHCP DORA: Discover (client broadcast) → Offer (server) → Request (client) → Acknowledgment (server); lease includes IP, mask, gateway, DNS, lease time.
DHCP relay/helper forwards broadcasts to a server on another subnet; without it, clients on remote subnets cannot obtain leases.
DHCP reservations bind a MAC address to a fixed IP; exclusions prevent the server from assigning addresses in a static range.
DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (name server), PTR (reverse), TXT (verification/SPF), SOA (zone authority).
DNS resolution: recursive resolver queries root → TLD → authoritative server; caching honors TTL; forward vs reverse lookup zones.
NAT types: static NAT (1:1), dynamic NAT (pool), PAT/overload (many-to-one using ports); NAT breaks end-to-end IPsec unless NAT-Traversal is used.
NTP uses UDP port 123; stratum 0 is reference clock, stratum 1 directly attached, each level increments stratum; NTP sync is critical for logs, certificates, and Kerberos.
Syslog uses UDP 514 (or TCP/TLS); severity levels 0 (emergency) to 7 (debug); messages include facility, severity, timestamp, hostname, and message text.
SNMP uses UDP 161 for polling and 162 for traps; SNMPv3 adds authentication and encryption (authPriv), replacing plaintext community strings of v1/v2c.
Network Security Fundamentals
CIA triad: Confidentiality (encryption/access control), Integrity (hashing/digital signatures), Availability (redundancy/DDoS protection).
Symmetric encryption (AES) uses one shared key and is fast; asymmetric (RSA/ECC) uses public/private key pairs for key exchange and signatures; TLS combines both.
Hashing (SHA-256) provides integrity, not confidentiality; HMAC adds a secret key for authentication.
Firewall types: stateless packet filter (per-packet rules), stateful (tracks sessions), next-generation (application awareness, IPS, TLS inspection).
AAA: Authentication (who), Authorization (what), Accounting (what was done); RADIUS (UDP 1812/1813) and TACACS+ (TCP 49) are common protocols.
Common attacks: phishing, ARP spoofing, VLAN hopping, DHCP starvation, DNS poisoning, DDoS, on-path (MITM), and password brute force.
Port security on switches limits MAC addresses per port (sticky, maximum, violation actions: protect, restrict, shutdown).
802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS); EAP variants include EAP-TLS and PEAP.
VPN: IPsec (AH/ESP, IKE) for site-to-site; TLS VPN for remote access; always verify certificate validity and use strong ciphers.
Monitoring, Troubleshooting, and Documentation
Troubleshooting methodology: identify problem → establish theory of probable cause → test theory → establish plan of action → implement and verify → document.
Ping (ICMP echo) tests reachability; traceroute/tracert shows path and latency per hop; both rely on ICMP or UDP/TCP probes.
ipconfig/ifconfig/ip shows local addressing; ipconfig /all reveals DHCP lease, DNS servers, and MAC; arp -a shows IP-to-MAC mappings.
netstat/ss shows active connections and listening ports; nslookup/dig test DNS resolution; telnet or nc can test TCP port reachability.
Cable testers verify pinout and continuity; TDR locates breaks; OTDR tests fiber; certifiers measure crosstalk and attenuation.
Interface counters: CRC errors and runts indicate cabling/duplex issues; late collisions suggest duplex mismatch or excessive segment length.
SNMP polling and syslog collection feed monitoring systems; baseline normal traffic to detect anomalies; alert on thresholds (CPU, bandwidth, errors).
Documentation: network diagrams (physical and logical), IP address management (IPAM) spreadsheet, cable labeling, change logs, and device configuration backups.
Change management: request, review, approve, schedule, implement, verify, and roll back plan; document before and after states.