CNEn cheat sheet

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP model collapses to Network Access, Internet, Transport, Application.

PDU names per layer: bits (L1), frame (L2), packet (L3), segment/datagram (L4), data (L5-L7).

Encapsulation adds headers top-down: Ethernet header (14 bytes) + IP header (20 bytes minimum) + TCP header (20 bytes minimum) = 54 bytes overhead before payload.

TCP three-way handshake: SYN, SYN-ACK, ACK; teardown uses FIN/ACK pairs or RST to abort.

TCP is connection-oriented and reliable via sequence numbers, ACKs, and windowing; UDP is connectionless with an 8-byte header and no retransmission.

Well-known ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 80 HTTP, 110 POP3, 143 IMAP, 161/162 SNMP, 389 LDAP, 443 HTTPS.

Private IPv4 ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; APIPA 169.254.0.0/16 indicates failed DHCP.

Ethernet frame minimum payload is 46 bytes so the frame reaches 64 bytes total; maximum standard payload is 1500 bytes (MTU).

Subnet host count = 2^h - 2 where h is host bits; usable hosts for /24 is 254, /25 is 126, /26 is 62, /27 is 30, /28 is 14, /30 is 2.

VLSM allocates the largest required subnet first; route summarization requires contiguous blocks whose size is a power of two aligned on its boundary.

VLANs segment broadcast domains at Layer 2; inter-VLAN routing requires a router interface per VLAN or a Layer 3 switch SVI, or router-on-a-stick subinterfaces.

802.1Q inserts a 4-byte tag; native VLAN traffic is untagged on a trunk, and native VLAN mismatch causes CDP errors and VLAN hopping risk.

STP (802.1D) elects one root bridge by lowest bridge ID (priority then MAC); port states are blocking, listening, learning, forwarding, disabled; RSTP (802.1w) converges in seconds.

OSPF uses link-state LSAs, cost = reference bandwidth / interface bandwidth, and forms adjacency only when area ID, hello/dead timers, subnet, and authentication match.

EIGRP is a Cisco advanced distance-vector protocol using composite metric (bandwidth, delay by default) with DUAL for loop-free backup routes.

Administrative distance: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, iBGP 200; lower AD wins when prefix length ties.

CIA triad: confidentiality (encryption, access control), integrity (hashing, digital signatures), availability (redundancy, DDoS mitigation).

Symmetric ciphers (AES, 3DES) are fast and use one shared key; asymmetric (RSA, ECDSA) solves key exchange but is slower; TLS combines both via a handshake.

IPsec: AH provides integrity/authentication only (protocol 51); ESP provides confidentiality plus integrity (protocol 50); IKE negotiates SAs on UDP 500.

AAA components: authentication verifies identity, authorization grants permissions, accounting logs activity; RADIUS uses UDP 1812/1813, TACACS+ uses TCP 49 and encrypts the full payload.

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS) with EAP methods.

Firewall types: stateless packet filter, stateful inspection (tracks connection table), proxy/application-layer, and NGFW with IPS and app awareness.

Common attacks: ARP spoofing (mitigate with DAI), VLAN hopping (disable unused ports, set native VLAN), DHCP starvation (DHCP snooping), DNS poisoning (DNSSEC).

Zero trust model assumes no implicit trust by network location; enforce least privilege, micro-segmentation, and continuous verification.

DHCP DORA: Discover, Offer, Request, Acknowledge; relay agents (option 82) forward requests across subnets to a central server.

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (delegation), PTR (reverse), TXT (SPF/DKIM), SRV (service location).

DNS resolution walks root, TLD, then authoritative servers; recursive resolvers cache results per TTL.

HTTP status classes: 2xx success, 3xx redirect, 4xx client error, 5xx server error; HTTPS wraps HTTP in TLS on port 443.

NTP synchronizes clocks over UDP 123 using stratum levels; stratum 0 is reference clock, stratum 1 servers sync directly to it.

QoS tools: classification/marking (DSCP 6-bit field), queuing (LLQ, CBWFQ), policing (drop excess), shaping (buffer excess), and congestion avoidance (WRED).

VoIP requires low latency (<150 ms one-way), jitter under 30 ms, and packet loss under 1%; RTP carries media, SIP (5060/5061) sets up sessions.

Load balancers distribute traffic via round robin, least connections, or source IP hash; health checks remove failed backends from rotation.

Troubleshooting methodology: identify the problem, establish a theory, test the theory, establish a plan of action, implement, verify full functionality, document.

Bottom-up troubleshooting starts at Layer 1 (cabling, link lights), top-down starts at Layer 7 (application), divide-and-conquer starts at a middle layer.

Command reference: ping (ICMP reachability), traceroute (path hops), ipconfig/ifconfig (local config), nslookup/dig (DNS), netstat (connections), arp -a (L2 mapping).

Interface errors: CRC errors indicate cabling/duplex issues; late collisions indicate duplex mismatch or excessive cable length; runts are frames under 64 bytes.

Syslog severity 0-7: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; lower number is more severe.

SNMP manager polls agents on UDP 161; traps arrive on UDP 162; MIB defines the object tree and OIDs.

Configuration management: backup configs, use version control, document changes, and follow change-control windows to reduce outages.

Baseline metrics (bandwidth, latency, utilization, error rate) let you detect anomalies; NetFlow/sFlow provide traffic flow visibility.

SDN separates control plane (centralized controller) from data plane (forwarding devices); southbound APIs (OpenFlow) program devices, northbound APIs feed applications.

SD-WAN centralizes policy, uses overlay tunnels over any transport, and applies application-aware routing with centralized management.

NFV virtualizes network functions (firewall, load balancer) as software on commodity hardware, distinct from SDN's control/data separation.

Cloud service models: IaaS (infrastructure), PaaS (platform), SaaS (application); shared responsibility splits provider and customer duties.

IPv6 uses 128-bit addresses written as eight hex groups; :: compresses consecutive zero groups once; no broadcast, uses multicast and anycast.

IPv6 address types: global unicast (2000::/3), link-local (fe80::/10), unique local (fc00::/7), loopback (::1); SLAAC builds addresses from router advertisements.

Wi-Fi 6 (802.11ax) adds OFDMA and MU-MIMO for dense environments; WPA3 replaces PSK with SAE to resist offline dictionary attacks.

Zero-touch provisioning and network automation use APIs, templates, and IaC tools (Ansible, Terraform) to configure devices declaratively.