Network Fundamentals and Models
This domain tests whether you can trace a single request from an application on one host to an application on another, naming the layer and protocol responsible at every step. Expect questions that map devices, protocols, and protocol data units (PDUs) to the OSI and TCP/IP models.
The two reference models
OSI has seven layers: Physical, Data Link, Network, Transport, Session, Presentation, Application. The TCP/IP model collapses them into four: Network Access (Link), Internet, Transport, Application. Exam questions use both, so know the mapping: OSI Application, Presentation, and Session all map to TCP/IP Application.
Encapsulation and PDUs
Data moves down the stack and each layer prepends a header: application data becomes a TCP segment or UDP datagram, then an IP packet, then an Ethernet frame, then bits on the wire. A typical Ethernet MTU is 1500 bytes; larger packets are fragmented by IPv4 routers or rejected with an ICMP error under IPv6.
What lives where
- Layer 1: cables, hubs, repeaters, signalling, connectors.
- Layer 2: switches, bridges, MAC addresses, Ethernet, STP, ARP messages.
- Layer 3: routers, IPv4/IPv6, ICMP, OSPF, static routes.
- Layer 4: TCP and UDP, port numbers, the three-way handshake.
- Layer 5 to 7: HTTP, DNS, SMTP, SSH, TLS.
Worked example
A browser opens https://example.com. The host sends a DNS query over UDP port 53 and receives an A record. It then performs a TCP three-way handshake (SYN, SYN-ACK, ACK) to port 443, negotiates TLS, and sends an HTTP GET. Each byte goes down the stack: TCP adds source and destination ports, IP adds addresses and a TTL, Ethernet adds MAC addresses learned via ARP. If the server is off-subnet, the destination MAC is the default gateway's, not the server's.
Traps
Switches are Layer 2 and routers are Layer 3; do not swap them. ARP is a Layer 2 frame carrying a Layer 3 address. Ports are Layer 4, never Layer 7. UDP is not a broken TCP: it simply has no delivery guarantee, which suits DNS, DHCP, TFTP, and voice.