CNEpv key terms

A seven-layer reference framework describing how network communication is divided into physical, data-link, network, transport, session, presentation, and application responsibilities. Vendors use it to explain how protocols and devices interoperate at each stage of delivery.

A four-layer practical framework (network access, internet, transport, application) that maps to the protocols actually used on the internet. It is the model most configuration and troubleshooting work implicitly follows.

The process of wrapping data with protocol headers as it moves down the stack, so each layer adds the information its peer needs. Decapsulation reverses this at the receiving host.

The largest payload, in bytes, that a single frame can carry on a link. When packets exceed it, fragmentation or path MTU discovery becomes necessary, and mismatches cause silent drops.

A 32-bit value that marks which bits of an IPv4 address identify the network and which identify the host. Combined with the address, it determines local versus remote destinations.

A shorthand that writes an IP prefix as an address followed by a slash and the number of network bits, such as /24. It replaced classful addressing and drives modern route summarization.

The router address a host sends traffic to when the destination is not on its local subnet. A wrong or missing gateway breaks all off-subnet communication while local traffic still works.

Address Resolution Protocol maps a known IPv4 address to a MAC address on the local segment. Its replies are unauthenticated, which enables spoofing and poisoning attacks.

Neighbor Discovery Protocol performs address resolution, router discovery, and duplicate address detection for IPv6 using ICMPv6 messages. It replaces ARP and adds stateless autoconfiguration support.

Stateless Address Autoconfiguration lets an IPv6 host build its own address from a router-advertised prefix plus an interface identifier, without a DHCP server. Router advertisements also supply the default route.

A design separating core, distribution, and access layers so that high-speed transit, policy enforcement, and end-device attachment each have a defined role. It improves scalability and simplifies fault isolation.

A data-center topology where every leaf switch connects to every spine switch, giving consistent hop counts and predictable latency. Traffic between leaves crosses one spine, which supports equal-cost multipathing.

Equal-Cost Multipath lets a router install several next hops for the same prefix and spread traffic across them. Hashing of flow headers keeps a single conversation on one path.

A design where the core and distribution layers are merged into one pair of switches, often used in smaller campuses. It reduces cost and hops but limits policy separation.

The interconnected LAN infrastructure serving a building or group of buildings, typically built from access, distribution, and core blocks with redundant links between them.

A logical Layer 2 broadcast domain created by configuration rather than physical cabling. Devices in different VLANs need a router or Layer 3 switch to communicate.

A switch interface that carries traffic for multiple VLANs by tagging frames, usually with 802.1Q headers. Access ports instead carry a single untagged VLAN.

The standard defining VLAN tags inserted into Ethernet frames so a shared link can carry multiple broadcast domains. The tag adds four bytes and includes a priority field.

Spanning Tree Protocol blocks redundant Layer 2 paths so frames cannot loop forever. It elects a root bridge and assigns port roles based on path cost.

Rapid Spanning Tree Protocol converges far faster than classic STP by using explicit port roles and proposal-agreement handshakes. It is the baseline on modern switches.

Link Aggregation Control Protocol negotiates bundling several physical links into one logical channel. It detects misconfigured or failed members and keeps forwarding consistent.

A link-state interior gateway protocol that floods link information within an area and runs shortest-path calculations. Areas and costs let large networks scale and steer traffic.

The path-vector protocol that exchanges routes between autonomous systems and carries most internet reachability. Policy attributes such as AS path and local preference drive selection.

A vendor-assigned ranking that decides which routing source's route to the same prefix is preferred when several protocols offer one. Lower values are trusted more.

Advertising one aggregate prefix in place of many more specific ones, which shrinks routing tables and limits the blast radius of flapping links. It requires contiguous addressing.

The forwarding database a router consults to choose an egress interface and next hop for each destination prefix. It holds the best routes after policy and preference are applied.

A switch's mapping of learned source MAC addresses to the ports they arrived on. Unknown destinations are flooded until a reply teaches the switch the location.

Authentication, authorization, and accounting is the framework for verifying identity, granting permissions, and logging activity for network access. It is usually centralized on a RADIUS or TACACS+ server.

A port-based access control standard where a supplicant authenticates through an authenticator switch to a backend server before the port forwards normal traffic. It enforces identity at the edge.

A widely used protocol for centralized authentication, authorization, and accounting of dial-in and network access. It encrypts only the password field, so it is often paired with TLS tunnels.

An ordered list of permit and deny rules applied to interfaces or lines to filter traffic by address, port, or protocol. The first matching entry decides the outcome.

A firewall that tracks connection state and automatically permits return traffic for sessions it has already allowed. This is stricter and more efficient than static filtering alone.

A security model that treats no network location as inherently trusted and verifies every request using identity, device posture, and least privilege. It replaces the perimeter-only assumption.

A standard protocol and message format for shipping event logs from network devices to a central collector. Severity levels and timestamps allow filtering and correlation.

A protocol for polling and receiving traps from managed devices about health and configuration. Versions differ mainly in security, with v3 adding authentication and encryption.

A flow-export technology that summarizes traffic metadata such as source, destination, ports, and byte counts. Analysts use it for capacity planning and anomaly detection without full packet capture.

A diagnostic tool that reveals the router-by-router path to a destination by sending packets with increasing time-to-live values. It exposes where latency or loss begins.

An ICMP echo test that confirms basic reachability and round-trip time to a host. Success proves the path works for that protocol, not that an application is healthy.

Managing network and compute configuration through versioned, machine-readable files applied by tooling rather than manual commands. It makes changes reviewable, repeatable, and reversible.

A data modeling language that defines the structure and constraints of device configuration and state for programmatic interfaces. It underpins NETCONF and RESTCONF.

A protocol that uses SSH transport and XML-encoded YANG data to read and change device configuration in a structured, transactional way. It supports candidate configs and rollback.

A lightweight HTTP-based protocol exposing YANG-modeled data through REST-style resources. It is easier to consume from scripts and web tooling than NETCONF.

An agentless automation tool that pushes configuration tasks to devices over SSH or API calls using playbooks. Its idempotent modules describe desired state.

A logical network built on tunnels across an underlying physical fabric, decoupling addressing and policy from cabling. Encapsulation headers carry the virtual topology.

A tunneling standard that encapsulates Layer 2 frames in UDP to stretch segments across a routed underlay. A 24-bit identifier gives far more segments than VLAN tagging.

A software-defined approach that centrally steers WAN traffic across mixed links such as broadband, MPLS, and LTE based on application policy. It reduces reliance on costly circuits.

Software that runs virtual machines and allocates their CPU, memory, and network resources. Type 1 runs on bare metal; Type 2 runs on a host operating system.

A logically isolated virtual network in a public cloud where you define subnets, route tables, and gateways. Security groups and network ACLs control traffic inside it.