CNEn flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSI Layer 3

The network layer handles logical addressing and routing, moving packets between networks. IP operates here, along with ICMP. Devices include routers and Layer 3 switches.

TCP three-way handshake

Connection setup sequence: client sends SYN, server replies SYN-ACK, client sends ACK. After this exchange both sides have synchronized sequence numbers and the session is established.

Private IPv4 ranges

RFC 1918 addresses are non-routable on the internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. They require NAT for internet access.

APIPA address

A 169.254.x.x self-assigned address appears when a host cannot reach a DHCP server. It allows local link communication only and signals a DHCP failure.

Ethernet MTU

The standard maximum transmission unit is 1500 bytes of payload per frame. Frames larger than that are jumbo frames and require consistent configuration end to end.

Subnet host formula

Usable hosts equal 2 to the power of host bits, minus two. A /26 leaves 6 host bits, giving 62 usable addresses after removing network and broadcast.

VLAN trunking 802.1Q

802.1Q inserts a 4-byte tag identifying the VLAN on trunk links. The native VLAN is sent untagged, so both ends must agree on it to avoid mismatch errors.

STP root bridge election

Switches elect the root bridge with the lowest bridge ID, which combines priority and MAC address. All other switches select a root port toward that bridge.

OSPF cost metric

OSPF cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so fast links may tie unless the reference is raised.

Administrative distance

A trust ranking for route sources. Lower values win: connected 0, static 1, EIGRP 90, OSPF 110, RIP 120. AD only breaks ties between identical prefix lengths.

Router-on-a-stick

A single router interface carries multiple VLANs using subinterfaces, each with an 802.1Q tag matching a VLAN. The switch port is configured as a trunk.

IPsec ESP vs AH

ESP provides confidentiality through encryption plus integrity. AH provides integrity and authentication only, with no encryption. ESP is used in most VPN deployments.

RADIUS vs TACACS+

RADIUS uses UDP ports 1812 and 1813 and encrypts only the password. TACACS+ uses TCP port 49, encrypts the full payload, and separates authentication from authorization.

802.1X components

Port-based access control has three roles: the supplicant (client), the authenticator (switch or access point), and the authentication server (typically RADIUS).

ARP spoofing mitigation

Dynamic ARP Inspection validates ARP packets against a trusted DHCP snooping binding table, dropping forged replies that would redirect traffic through an attacker.

Zero trust security model

No user or device is trusted based on network location. Every request is verified, least privilege is enforced, and segmentation limits lateral movement after a breach.

DHCP DORA process

Four messages: Discover (client broadcast), Offer (server proposal), Request (client acceptance), Acknowledge (server confirmation). The client then configures its address and options.

DNS record types

A maps names to IPv4, AAAA to IPv6, CNAME creates an alias, MX routes mail, NS delegates zones, PTR enables reverse lookup, and TXT carries policy data.

HTTP status classes

2xx means success, 3xx a redirect, 4xx a client error such as 404 not found, and 5xx a server error. The class identifies who must act.

QoS DSCP field

The 6-bit Differentiated Services Code Point in the IP header marks traffic class. Devices use it to apply queuing and drop policy per hop.

VoIP quality thresholds

Acceptable voice needs one-way latency under 150 ms, jitter under 30 ms, and packet loss under 1 percent. RTP carries media while SIP sets up calls.

Load balancer algorithms

Round robin rotates requests, least connections sends to the least busy backend, and source IP hash keeps a client on the same server for session persistence.

Troubleshooting methodology

Identify the problem, form a theory, test it, plan action, implement the fix, verify full functionality, and document. Skipping verification often lets the fault recur.

Bottom-up troubleshooting

Start at the physical layer and work upward: cabling, link lights, interface status, then addressing and applications. Effective when many users lose connectivity at once.

CRC and late collision errors

CRC errors point to cabling or duplex faults. Late collisions indicate a duplex mismatch or a cable run exceeding the allowed length.

Syslog severity levels

Levels run 0 to 7: emergency, alert, critical, error, warning, notice, informational, debug. Lower numbers indicate greater severity and should page an operator.

SNMP ports and roles

A manager polls agents on UDP 161 and receives unsolicited traps on UDP 162. The MIB defines the object tree addressed by OIDs.

SDN control plane separation

Software-defined networking centralizes the control plane in a controller while data-plane devices forward traffic. Southbound APIs such as OpenFlow program the devices.

SD-WAN characteristics

SD-WAN builds overlay tunnels over multiple transports, applies centralized policy, and routes applications by performance rather than by static path preference.

IPv6 address compression

Eight hex groups may be shortened by dropping leading zeros. A double colon replaces one run of consecutive zero groups and may appear only once.

IPv6 link-local address

Link-local addresses come from fe80::/10 and are automatically configured on every interface. They are used for neighbor discovery and are never routed beyond the link.

WPA3 SAE

Simultaneous Authentication of Equals replaces the pre-shared key handshake with a password-authenticated exchange, resisting offline dictionary attacks on captured traffic.