CNEpv cheat sheet

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP model collapses to Link, Internet, Transport, Application.

Encapsulation order: data → segment (TCP) or datagram (UDP) → packet (IP) → frame (Ethernet) → bits; each layer adds its own header and the PDU name changes.

Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; APIPA 169.254.0.0/16 indicates DHCP failure; loopback 127.0.0.0/8.

Subnet math: usable hosts = 2^h − 2, where h = 32 − prefix length; /24 = 254 hosts, /30 = 2 hosts, /31 = 2 hosts on point-to-point links (RFC 3021).

Topology decision rule: star scales and isolates faults but has a single point of failure at the switch; full mesh gives N(N−1)/2 links and maximum redundancy at maximum cost.

Ethernet frame fields: preamble, destination MAC, source MAC, EtherType, payload (46-1500 bytes), FCS; MTU 1500 bytes, jumbo frames up to 9000.

TCP three-way handshake SYN → SYN-ACK → ACK; UDP is connectionless with no retransmission, used for DNS, DHCP, VoIP, and streaming.

IPv6 address types: global unicast 2000::/3, link-local fe80::/10, unique local fc00::/7, multicast ff00::/8; no broadcast in IPv6.

Administrative distance defaults: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, IS-IS 115, RIP 120, iBGP 200; lowest AD wins before metric comparison.

OSPF uses cost = reference bandwidth / interface bandwidth (default reference 100 Mbps); neighbors must match area ID, hello/dead timers, authentication, and MTU.

OSPF LSA types: Type 1 router, Type 2 network, Type 3 summary, Type 4 ASBR summary, Type 5 external, Type 7 NSSA external.

EIGRP uses composite metric from bandwidth and delay by default (K1=K3=1); feasible successor requires reported distance < feasible distance of the successor.

BGP path selection order: highest weight, highest local preference, locally originated, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, lowest router ID.

STP: root bridge = lowest bridge ID (priority then MAC); port states blocking, listening, learning, forwarding, disabled; RSTP converges in seconds and adds alternate/discard roles.

VLAN trunking 802.1Q inserts a 4-byte tag with 12-bit VLAN ID (1-4094); native VLAN is untagged; VTP modes server, client, transparent.

First-hop redundancy: HSRP (Cisco, active/standby, virtual MAC 0000.0c07.acXX), VRRP (open standard, master/backup), GLBP (load balancing).

CIA triad: confidentiality (encryption), integrity (hashing, HMAC), availability (redundancy, DDoS mitigation); non-repudiation comes from digital signatures.

Symmetric ciphers AES and 3DES are fast for bulk data; asymmetric RSA and ECDSA handle key exchange and signatures; TLS combines both via ephemeral Diffie-Hellman.

IPsec: AH provides integrity and authentication only (protocol 51); ESP provides confidentiality plus integrity (protocol 50); IKE uses UDP 500 and 4500 for NAT-T.

AAA components: authentication verifies identity, authorization grants permissions, accounting logs activity; RADIUS uses UDP 1812/1813, TACACS+ uses TCP 49 and encrypts the full payload.

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS); EAPoL runs between supplicant and authenticator.

Common attacks: ARP spoofing (mitigate with Dynamic ARP Inspection), MAC flooding (port security), VLAN hopping (disable unused ports, set native VLAN, prune), DHCP starvation (DHCP snooping).

Firewall placement: stateless ACLs filter on 5-tuple; stateful firewalls track sessions; next-gen firewalls add application inspection and IPS; DMZ hosts public-facing services.

Zero trust principle: never trust implicitly, verify explicitly; micro-segmentation and least privilege replace perimeter-only defense.

Troubleshooting methodology: define the problem, gather information, analyze, eliminate causes, propose and test a hypothesis, solve, verify, document.

Command reference: ping (ICMP reachability), traceroute (path and per-hop latency), show interfaces (errors, duplex, speed), show ip route, show arp, nslookup/dig for DNS.

Interface counters that signal trouble: CRC errors and runts (cabling/duplex), late collisions (duplex mismatch), input queue drops (oversubscription), giants (MTU).

Syslog severity 0-7: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; lower number is more severe.

SNMP: manager polls agent on UDP 161; traps and informs sent to manager on UDP 162; MIB is the object database; SNMPv3 adds authentication and encryption.

NetFlow and IPFIX export flow records (source/dest IP, ports, bytes, timestamps) for traffic analysis; sFlow samples packets statistically.

Backup and change management: configuration backups before changes, out-of-band management access, rollback plan, and documented baseline for comparison.

MTU and fragmentation: PMTUD relies on ICMP Type 3 Code 4 (fragmentation needed); black-holed traffic often means ICMP is blocked in the path.

Data formats: JSON (key-value, braces/brackets, native to JavaScript), XML (tags, schema-validated), YAML (indentation-based, human-readable, used by Ansible).

REST constraints: stateless, client-server, cacheable, uniform interface; methods GET (read), POST (create), PUT/PATCH (update), DELETE (remove); status 2xx success, 4xx client error, 5xx server error.

NETCONF runs over SSH port 830 using XML-encoded RPCs; RESTCONF maps YANG models to HTTP methods; both replace CLI screen-scraping with structured data.

YANG is the data modeling language for NETCONF/RESTCONF; models are organized in modules and trees with config and state data.

Configuration management tools: Ansible (agentless, SSH, YAML playbooks), Puppet (agent, manifest), Chef (agent, recipe), SaltStack (agent or agentless).

Idempotency means applying the same automation repeatedly yields the same end state without additional change; declarative tools enforce desired state.

Python for network automation: Netmiko and Paramiko for SSH, NAPALM for multivendor abstraction, requests for REST APIs, Jinja2 for configuration templating.

CI/CD for networks: version control configurations in Git, validate in a lab, deploy via pipeline, and use intent-based networking to translate business policy into device config.

Cloud service models: IaaS provides compute/storage/network, PaaS provides runtime and middleware, SaaS provides the application; responsibility for the network shifts toward the provider as you move up.

Cloud deployment models: public, private, hybrid, community; shared responsibility model divides security duties between provider and customer.

Virtualization: a hypervisor (Type 1 bare-metal like ESXi, Type 2 hosted like VirtualBox) runs VMs; virtual switches provide Layer 2 connectivity between VMs and uplinks.

Overlay networking: VXLAN encapsulates Layer 2 frames in UDP (port 4789) with a 24-bit VNI supporting ~16 million segments; VTEPs are the tunnel endpoints.

SDN architecture separates control plane (controller) from data plane (forwarding); southbound APIs include OpenFlow and NETCONF, northbound APIs are REST-based.

SD-WAN centralizes policy and uses application-aware routing over multiple WAN links (MPLS, broadband, LTE) with IPsec overlays and zero-touch provisioning.

Containers share the host kernel and are lighter than VMs; Kubernetes networking uses pods, services, and CNI plugins for pod-to-pod connectivity.

SASE and SSE converge SD-WAN with cloud-delivered security (SWG, CASB, ZTNA, FWaaS) to enforce policy at the edge rather than the data center.