Network Fundamentals and Protocols
Encapsulation and layer mapping
The exam treats the layered model as a diagnostic index, not a memory drill. Map the PDUs in order: data → segment (TCP/UDP) → packet (IP) → frame (Ethernet) → bits. Each layer prepends a header, and the IP MTU (1500 bytes on standard Ethernet) caps the payload. TCP MSS is MTU minus 40 bytes for IPv4, so a 1500-byte MTU yields MSS 1460. Fragmentation is a symptom, not a fix: Path MTU Discovery depends on ICMP Type 3 Code 4, and filtering that message creates a black hole where small pings succeed and large transfers stall.
Transport behaviour
TCP gives a three-way handshake, sequence numbers, acknowledgements, windowing and retransmission. UDP gives none of that and leaves reliability to the application. Ports identify the service; when reading a capture, separate the ephemeral client port from the well-known destination port.
Addressing and subnetting
IPv4 is 32 bits, and usable host counts are 2^h − 2 for prefixes /1 through /30. IPv6 is 128 bits, has no broadcast, and uses NDP (neighbour solicitation/advertisement) instead of ARP, with SLAAC for stateless addressing. Private space is 10/8, 172.16/12 and 192.168/16; 100.64/10 is shared carrier space, not private.
Worked example
Is 192.168.10.100/26 on the same subnet as 192.168.10.130/26? A /26 gives mask 255.255.255.192 and a block size of 64, so subnets start at .0, .64, .128 and .192. Address .100 sits in .64–.127 (broadcast .127); .130 sits in .128–.191 (broadcast .191). They are separate subnets, so traffic needs a router or L3 switch, and the sender will ARP only inside its own range.
Traps that cost marks
Treating /31 as unusable (it is valid for point-to-point links), assuming ARP crosses a broadcast domain, quoting 2^h instead of 2^h − 2 for host capacity, and confusing a successful ICMP echo with proof that MTU, DNS or application layers are healthy.