Network Services (DHCP, DNS, NAT, NTP)
This domain covers the services every network depends on: addressing, name resolution, address translation, and time. Questions tend to be protocol-and-port specific, so learn the port numbers alongside the behaviour.
DHCP
DORA: Discover (broadcast), Offer, Request, Acknowledge. Server UDP 67, client UDP 68. A lease has a duration; clients renew at 50% (T1) and rebind at 87.5% (T2). Reservations bind an IP to a MAC. A relay agent forwards requests across routers, because broadcasts do not cross Layer 3 boundaries.
DNS
The namespace is a tree: root, top-level domains, authoritative servers. A resolver queries recursively; servers iterate among themselves. Records: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), PTR (reverse lookup), TXT (SPF, DKIM, domain verification), NS, SOA, SRV. TTL controls caching: a low TTL means faster changes but more queries.
NAT and NTP
NAT translates private addresses to public ones. Static NAT is one-to-one, dynamic NAT uses a pool, and PAT (overload) multiplexes many inside hosts onto one public IP using source ports. Port forwarding publishes an internal service. NTP runs on UDP 123 in a hierarchy of strata: stratum 0 is the reference clock, stratum 1 a server directly attached to it, and stratum 16 means unsynchronised. Accurate time matters for log correlation, Kerberos, and certificate validation.
Worked example
A PC receives 192.168.1.50/24, gateway 192.168.1.1, and DNS 8.8.8.8 via DHCP. It resolves www.example.com to 93.184.216.34 using an A record, then sends the packet to the gateway, which performs PAT: the source becomes the public IP with a unique source port, and the translation table maps the reply back to the PC.
Traps
Mixing up DHCP and DNS ports. Thinking NAT is a security control - it is not. Using a CNAME at the zone apex where an A record is required. Assuming NTP uses TCP.