CNEn key terms

A seven-layer reference framework describing how data moves from an application on one host to an application on another, covering physical transmission, addressing, routing, reliability, and application services.

A four-layer practical architecture (link, internet, transport, application) that describes how real networks operate and maps loosely onto the seven-layer OSI reference framework.

The process of wrapping data with protocol headers at each layer as it descends the stack, so each layer adds the information its peer layer needs to deliver and interpret the payload.

A 48-bit hardware identifier burned into a network interface, written as six hexadecimal octets; used for delivery on a local segment and for switch forwarding decisions.

The set of devices that receive a frame sent to the all-ones MAC address; routers and VLAN boundaries stop broadcasts, while switches and hubs propagate them.

A logical division of an IP network created by borrowing host bits for the prefix, grouping addresses that share a common network portion and can communicate directly without a router.

A compact way to express an IP network and its prefix length, such as 192.168.10.0/24, where the number after the slash counts the leading network bits.

Variable Length Subnet Masking: dividing an address block into subnets of different sizes so each segment gets only the addresses it needs, conserving address space.

The router address a host sends traffic to when the destination is outside its own subnet; without a correct gateway, off-subnet communication fails.

Address Resolution Protocol: a host broadcasts a request asking which MAC address owns a given IPv4 address, then caches the reply for later use.

Maximum Transmission Unit: the largest payload a link can carry in one frame, typically 1500 bytes on Ethernet; mismatches cause fragmentation or dropped packets.

Splitting a packet into smaller pieces so it fits a link with a smaller MTU than the original packet size; reassembly happens at the destination, adding overhead.

A virtual LAN: a switch configuration that groups ports into separate logical broadcast domains, isolating traffic without requiring separate physical hardware.

A standard that inserts a four-byte tag into Ethernet frames so a single link can carry traffic for multiple VLANs between switches or to a router.

The VLAN whose frames travel untagged on an 802.1Q trunk; both ends of the link must agree on it, or traffic is misclassified and leaks between VLANs.

Spanning Tree Protocol: switches elect a root bridge and block redundant paths so a Layer 2 loop cannot form, while keeping a backup link ready to activate.

Bonding multiple physical links into one logical channel to increase bandwidth and provide redundancy; the member links must be configured identically on both ends.

A router's list of known destinations with next hops, outgoing interfaces, and metrics; the longest matching prefix wins when forwarding a packet.

A manually configured path to a destination network; simple and predictable, but it does not adapt automatically when the topology changes.

Open Shortest Path First: a link-state interior gateway protocol where routers flood topology information, build a shared map, and compute shortest paths by cost.

Border Gateway Protocol: the path-vector protocol that exchanges routes between autonomous systems on the internet, choosing paths by policy attributes rather than pure speed.

A trust ranking a router assigns to route sources, such as connected, static, or OSPF; when prefixes tie, the lower value is installed in the routing table.

Network Address Translation: rewriting IP addresses (and often ports) as traffic crosses a boundary, letting many private hosts share one public address.

Port Address Translation: a NAT variant that maps many internal sessions to one public IP by assigning each a unique source port, tracked in a translation table.

A device or software that permits or denies traffic based on rules such as addresses, ports, and connection state, placed at boundaries between trust zones.

Access Control List: an ordered set of permit and deny statements applied to interfaces or services; the first match decides, and an implicit deny often ends the list.

A demilitarized zone: a segmented network holding internet-facing servers, separated from the internal LAN so a compromised public service cannot reach internal hosts directly.

A port-based access control standard where a supplicant authenticates through a switch or access point to an authentication server before network access is granted.

Remote Authentication Dial-In User Service: a protocol that centralizes authentication, authorization, and accounting for users connecting to network devices and services.

A suite of protocols that encrypts and authenticates IP packets, commonly used for site-to-site VPNs; it negotiates security associations and can run in tunnel or transport mode.

Virtual Private Network: an encrypted tunnel that carries traffic securely across an untrusted network, connecting remote users or linking sites as if on one private network.

The principle of granting users and devices only the access needed for their tasks, limiting the damage any single compromised account or host can cause.

Dynamic Host Configuration Protocol: automatically supplies hosts with an IP address, mask, gateway, and DNS servers through a discover-offer-request-acknowledge exchange.

Domain Name System: a hierarchical, distributed database that resolves human-readable names into IP addresses and other records such as mail exchangers.

Hypertext Transfer Protocol: the request-response application protocol browsers use to fetch web resources; HTTPS adds TLS encryption and server authentication.

Transport Layer Security: a protocol that encrypts application traffic and authenticates the server with certificates, forming the secure layer under HTTPS and many other services.

Quality of Service: classifying and prioritizing traffic so latency-sensitive flows such as voice and video get bandwidth and delay treatment ahead of bulk data.

Simple Network Management Protocol: a standard for polling device statistics and receiving traps, widely used by monitoring systems to track interface and device health.

A standard for sending event messages from network devices to a central collector, using severity levels so operators can filter and alert on important events.

A tool that sends ICMP echo requests to test reachability and round-trip time to a target host, helping isolate connectivity and latency problems.

A diagnostic tool that reveals the hop-by-hop path to a destination by sending probes with increasing time-to-live values and collecting the returned errors.

Software-defined WAN: centrally managed overlay that steers traffic across multiple WAN links by application policy, improving resilience and cost over fixed circuits.

Software-Defined Networking: separating the control plane that decides forwarding from the data plane that moves packets, enabling centralized programmable network policy.

Using scripts, templates, and APIs to configure and verify network devices consistently, reducing manual error and speeding repetitive changes across many devices.

Infrastructure as Code: defining network and system configuration in version-controlled files so changes are repeatable, reviewable, and testable like software.