00 · Start Here

This is a self-contained course, not a reference manual. It is written for someone who wants to become a network engineer and has no idea where to start.

What this book is

• A curriculum, ordered so that nothing depends on a concept you have not seen yet.
• A field guide. Every chapter ends with "what breaks" and "how to prove it".
• Vendor-neutral first. Cisco syntax appears as an example, but the ideas are the same on Juniper, Arista, FRR, or a Linux box.

What this book is not

• Not a certification dump. Certifications come after understanding, not instead of it.
• Not a list of commands. Commands change; the model in your head does not.

How to read it

Use three passes per chapter. Do not skip the third one — it is where learning happens.

If step 3 is hard, you did not understand it yet. Re-read only the part that failed.

The five questions to ask about any technology

1. What problem does it solve? (If you cannot answer, it is trivia.)
2. What does it look like on the wire? (Bytes, headers, ports.)
3. What does it look like in the config? (Where do I turn it on?)
4. What does it look like when it breaks? (Symptom -> cause.)
5. How do I prove it works? (Which command, which capture.)

Every chapter in this book answers all five.

What you need

• A computer with a browser and a terminal.
• Network Lab, the browser-based simulator linked in the page toolbar, for guided switching and routing practice.
• WSL2 + containerlab + netlab for real routing labs with FRR.
• Wireshark, free.
• A notebook. Physical is better. Draw topologies by hand.

The honest timeline

Anyone who promises two weeks is selling something.

The rule that matters most

A network engineer is not someone who memorised commands. It is someone who can predict what the packets will do, and prove it.

That is the whole job. Everything in this book serves that sentence.

01 · What Networking Really Is

Strip away the marketing and a network is three things: hosts, links, and rules.

The smallest possible network

Two computers and one cable.

[ PC-A ]====================[ PC-B ]
  192.168.1.10              192.168.1.20

For A to send a file to B, four things must be true:

1. A must know B's address (IP address).
2. A must know how to reach it (same subnet -> send directly; different -> send to a router).
3. A must know B's hardware address (MAC address, found with ARP).
4. Both must agree on the rules (Ethernet framing, IP, TCP or UDP, ports).

Everything else in networking is a variation of these four problems at a larger scale.

Why layers exist

Imagine writing one program that handles: the electrical signal, the cable type, the addressing scheme, retransmission, encryption, and the file format. Now imagine changing Wi-Fi and having to rewrite the file format code.

Layers let each part change independently. Wi-Fi replaces Ethernet without changing TCP. IPv6 replaces IPv4 without changing HTTP. This is the single most important idea in networking.

The cast of characters

LAN, WAN, and the Internet

• LAN (Local Area Network) — one administrative domain, usually one building or floor. High speed, low latency, you control it.
• WAN (Wide Area Network) — connects sites over a provider's infrastructure. Lower speed relative to cost, higher latency, you do not control the middle.
• The Internet — the WAN of WANs. A network of networks that agree to exchange routes using BGP.

A network engineer usually owns the LAN edge, the WAN edge, and the policy between them.

Circuit switching vs packet switching

Old telephone networks reserved a path for the whole call. If you were not talking, the capacity was still reserved and wasted.

The Internet does not reserve anything. It chops data into packets and lets each packet find its own way. This is why:

• links can be shared by thousands of users
• a failed link can be routed around
• but quality is not guaranteed — hence QoS, buffers, and congestion

Bandwidth, latency, throughput, jitter

These four get confused constantly. Learn the difference now.

A 1 Gbps link with 200 ms latency still feels slow for interactive work. A 100 Mbps link with 2 ms latency feels instant. Latency is usually the real problem.

The bandwidth-delay product

The amount of data "in flight" on a path:

BDP = bandwidth × round-trip time

On a 1 Gbps link with 100 ms RTT, 100 million bits (about 12.5 MB) can be in flight. If the TCP window is smaller than that, you will never fill the link. This is why long, fast paths need window scaling — and why "the link is 1 Gbps but the file transfer is slow" is a real and common problem.

What a network engineer actually does

Troubleshooting is the biggest slice. That is why this book keeps returning to "what does it look like when it breaks".

Chapter check

1. Why can Wi-Fi replace Ethernet without changing your browser?
2. A user says "the internet is slow". Which of the four metrics do you measure first?
3. You have a 10 Gbps link and a 20 ms RTT. What is the BDP in megabytes?
4. What are the four things two hosts must agree on to communicate?

02 · The Models: OSI and TCP/IP

The OSI model is not a protocol. It is a mental checklist that lets you say "this is a Layer 2 problem" and stop guessing.

The two models side by side

   OSI (7 layers)                 TCP/IP (4 layers)
   ------------------             ---------------------
 7 Application  ┐
 6 Presentation ├──────────────►  Application  (HTTP, DNS, SSH, TLS)
 5 Session      ┘
 4 Transport    ──────────────►  Transport    (TCP, UDP, QUIC)
 3 Network      ──────────────►  Internet     (IP, ICMP, OSPF, BGP)
 2 Data Link    ┐
 1 Physical     ┴─────────────►  Link         (Ethernet, Wi-Fi, ARP)

The industry still speaks OSI ("Layer 2 switch", "Layer 3 problem", "Layer 7 firewall"). TCP/IP is what actually runs. Learn OSI to communicate, TCP/IP to build.

What each layer does, and what breaks there

Rule of thumb: 80% of "network problems" are Layer 1, 2, or a DNS mistake.

Encapsulation

Data moves down the stack on the sender, and up on the receiver.

Sender                              Receiver
HTTP request                        "GET /index.html"
  │                                 ▲
  ▼                                 │
TCP header + data    [TCP|DATA]     │
  │                                 │
  ▼                                 │
IP header            [IP|TCP|DATA]  │
  │                                 │
  ▼                                 │
Ethernet header      [ETH|IP|TCP|DATA|FCS]
  │                                 │
  └──────── wire ───────────────────┘

Each layer adds its own header. At the receiving side, each layer strips its header and hands the payload up. This is why you can capture a single frame and read the entire stack inside it.

MTU and fragmentation

• MTU (Maximum Transmission Unit) — the largest payload a link can carry. Ethernet default: 1500 bytes.
• If an IP packet is bigger than the MTU and DF (don't fragment) is set, the router sends back ICMP "fragmentation needed".
• If DF is not set, the packet is fragmented. Fragmentation is expensive and often breaks firewalls.

Common MTU problems:

MTU by technology: Ethernet 1500, VLAN tag −4, GRE −24, IPsec −50 to −73, VXLAN −50.

Ports: how one IP carries many conversations

A connection is identified by the 5-tuple:

source IP, source port, destination IP, destination port, protocol

That is how your laptop holds 200 connections to the same server on port 443 and keeps them all separate.

See Appendix A for the full port table you actually need.

The troubleshooting ladder

When something is broken, walk the stack. Do not skip.

1. L1: Is the link up? ip link, ethtool eth0, LED, show interface
2. L2: Is the MAC reachable? ip neigh, show mac address-table, VLAN correct?
3. L3: Is there a route? ip route, show ip route, ping, traceroute
4. L4: Is the port open? ss -tulpn, nc -vz host port, firewall rules
5. L7: Does the app answer? curl -v, dig, logs

Each step answers a yes/no question. Once a step fails, stop and fix that — do not "try random things" at Layer 7 when the cable is unplugged.

Chapter check

1. A web request fails with a certificate error. Which layer?
2. Ping works to an IP but not to a hostname. Which layer, and what do you check first?
3. Why is the 5-tuple important for NAT and firewalls?
4. You enable a GRE tunnel and large transfers start hanging. What changed?

03 · Ethernet, MAC Addresses, and Switching

Ethernet is Layer 2. It moves frames between devices on the same local network. It does not know about IP, and it does not route.

The Ethernet frame

+---------+---------+---------+----------+-------------+-----+
| Dst MAC | Src MAC |  Type   | Payload  |     FCS     | IFG |
| 6 bytes | 6 bytes | 2 bytes | 46-1500  |   4 bytes   |     |
+---------+---------+---------+----------+-------------+-----+

Minimum frame: 64 bytes. Maximum: 1518 bytes (1522 with a VLAN tag). Frames outside that range are usually dropped as "runts" or "giants".

MAC addresses

A 48-bit address, written as six hex pairs: 00:1A:2B:3C:4D:5E.

• First 3 bytes = OUI (manufacturer).
• Last 3 bytes = assigned by the manufacturer.
• Unicast — destined for one NIC.
• Broadcast — FF:FF:FF:FF:FF:FF, every device in the broadcast domain.
• Multicast — starts with 01:00:5E (IPv4) or 33:33 (IPv6) at the Ethernet level.

MAC addresses are local to the link. They are not routed. When a router forwards a packet to a new network, it writes new source and destination MACs for the next hop.

How a switch works

A switch is a Layer-2 device that learns which MAC lives on which port.

1. Frame arrives on port 3 from AA:AA:...
2. Switch records AA:AA -> port 3 in its MAC address table (CAM table).
3. It looks up the destination MAC:
   • known -> forward out that port only (unicast)
   • unknown -> flood out all ports except the source (unknown unicast flood)
   • broadcast/multicast -> flood
4. Frames age out of the table after ~300 seconds by default.

Cisco:  show mac address-table
Linux:  bridge fdb show

Collision domains and broadcast domains

• A collision domain is a set of devices that can collide. Each switch port is its own collision domain. A hub is one big collision domain (avoid hubs).
• A broadcast domain is a set of devices that receive each other's broadcasts. A switch (without VLANs) is one broadcast domain. A VLAN is a broadcast domain.

This distinction is the reason VLANs exist.

Duplex and speed

Autonegotiation usually works. When it does not — often with old gear, or a hard-coded side — you get a duplex mismatch. Symptom: link is up, ping works, throughput is terrible, FCS/CRC and late-collision counters climb.

Cisco:  show interfaces | include duplex|collision|CRC
Linux:  ethtool eth0

ARP: finding a MAC from an IP

Before A can send a frame to B on the same subnet, it needs B's MAC.

A: "Who has 192.168.1.20? Tell 192.168.1.10"   -> broadcast FF:FF:FF:FF:FF:FF
B: "192.168.1.20 is at BB:BB:BB:BB:BB:BB"      -> unicast back to A

Then A caches the mapping. If the destination is on another subnet, A ARPs for the default gateway, not for the remote host — a detail that trips up a lot of beginners.

Cisco:  show arp
Linux:  ip neigh

Gratuitous ARP — an unsolicited ARP announcement, used when an interface comes up or an IP moves (failover). It is also the basis of ARP spoofing attacks.

Common Layer-2 attacks (and why they matter to you)

You do not need to be a security engineer, but you must know these exist because they are configured on switches you will touch.

Media types you will meet

Rule: copper inside the rack and to the desk, fiber between buildings and to the core.

Chapter check

1. A switch receives a frame for a MAC not in its table. What does it do?
2. Why does a host ARP for the gateway instead of the destination when the destination is remote?
3. Link is up, ping works, but file transfer is 2 Mbps on a 1 Gbps link. What do you check?
4. How many broadcast domains in a switch with 24 ports and 3 VLANs?

04 · IP Addressing and Subnetting

This is the chapter people fear. It is just binary arithmetic with a shortcut.

The IPv4 address

32 bits, written as four decimal numbers: 192.168.10.25.

192      .168      .10       .25
11000000 .10101000 .00001010 .00011001

An address is split into a network part and a host part by the subnet mask.

IP:    192.168.10.25
Mask:  255.255.255.0    -> /24
       11111111.11111111.11111111.00000000
       |------ network ------|  hosts  |

The first N bits identify the network. The remaining bits identify the host.

CIDR and the block-size trick

Stop converting to binary for every subnet. Use this instead:

Block size = 256 − (mask octet)

Usable hosts = 2^(host bits) − 2 (network and broadcast are reserved).

Worked example: subnet 192.168.10.0/26

• Block size: 256 − 192 = 64
• Networks: .0, .64, .128, .192
• For .64: network .64, broadcast .127, usable .65–.126
• Hosts: 2^6 − 2 = 62

So 192.168.10.90 is in the .64 network. One step, no binary.

Second example: 10.1.1.200/27

• Block size 32, networks: .0 .32 .64 .96 .128 .160 .192 .224
• .200 falls in .192 → network 10.1.1.192, broadcast 10.1.1.223, usable .193–.222

VLSM: different sizes per subnet

Variable Length Subnet Masking = allocate from largest to smallest need.

Requirement: 100 hosts, 50 hosts, 25 hosts, and two point-to-point links, from 172.16.0.0/24.

Always allocate largest first. If you start with the /30s you will fragment the space.

Route summarization

A summary is the smallest prefix covering several networks. Convert to binary and take the common leading bits.

172.16.0.0/24   = 10101100.00010000.00000000
172.16.1.0/24   = 10101100.00010000.00000001
172.16.2.0/24   = 10101100.00010000.00000010
172.16.3.0/24   = 10101100.00010000.00000011
                  common: 22 bits      -> 172.16.0.0/22

Summaries reduce routing table size and make the network stable — if a /24 flaps, the summary does not.

Public, private, and special addresses

169.254.x.x is a diagnostic gift: if a host has it, DHCP did not answer. Say that out loud in an interview and people notice.

Common traps

How to practise

Do 10 problems a day for two weeks. Write the network, broadcast, and usable range for random addresses. Use ipcalc to check yourself:

ipcalc 192.168.10.90/26

Speed comes from repetition, not from reading.

Chapter check

1. Network, broadcast, usable range of 10.20.30.0/27?
2. Is 192.168.5.130/25 in the same subnet as 192.168.5.200/25?
3. Summarize 10.0.0.0/24 through 10.0.7.0/24.
4. How many /30s fit in a /24?
5. A host shows 169.254.10.5/16. What happened?

Next: chapter 04B has the live IPv4/IPv6 calculator — type any address and see the binary, mask, network, broadcast, usable range, and IPv6 compression computed for you. Use it to check your hand calculations.

04B · IPv4 & IPv6 Calculator

Everything in this chapter runs in your browser. Type an address, change the prefix, and every field updates. There are six tabs: IPv4, IPv6, VLSM, IPv6 Split, Practice, and Reference.

The point is not to skip the arithmetic. The point is to see it happen: every result comes with the bits that produced it, so a wrong hand calculation is easy to trace back to the exact bit you got wrong.

What the calculator gives you

Beyond the two columns above, the calculator also has a VLSM planner, an IPv6 splitter, a MAC → EUI-64 helper, and a prefix overlap checker.

Worked example: 15.168.1.1/17

Follow the five steps.

Step 1 — mask. /17 means 17 network bits.

11111111.11111111.10000000.00000000
   255  .   255  .   128  .    0

Step 2 — block size. The interesting octet is the third one (192 → 128 → block 256 − 128 = 128).

Step 3 — network. The third octet is 1. The multiples of 128 are 0 and 128. The highest one at or below 1 is 0.

15.168.1.1  AND  255.255.128.0  =  15.168.0.0

Step 4 — broadcast. Next block starts at 15.168.128.0, so broadcast is 15.168.127.255.

Step 5 — usable range and hosts.

first host  15.168.0.1
last host   15.168.127.254
hosts       2^(32−17) − 2 = 32768 − 2 = 32766

Check those numbers against the calculator below. They should match exactly.

Worked example: an IPv6 address at /48

Take 2001:0db8:85a3:0000:0000:8a2e:0370:7334/48.

Step 1 — split into 8 hextets.

2001 : 0db8 : 85a3 : 0000 : 0000 : 8a2e : 0370 : 7334

Step 2 — /48 keeps the first three hextets. Everything after is the interface ID.

network = 2001:0db8:85a3:0000:0000:0000:0000:0000

Step 3 — last address in the prefix is the network with all host bits set to 1.

2001:0db8:85a3:ffff:ffff:ffff:ffff:ffff

Step 4 — compress. Drop leading zeros, then replace the longest run of zero groups with :: once.

2001:0db8:85a3:0000:0000:8a2e:0370:7334   ->   2001:db8:85a3::8a2e:370:7334

Step 5 — count. 128 − 48 = 80 host bits, so 2^80 addresses — about 1.2 × 10^24.

VLSM in five steps

VLSM means variable length subnet mask: inside the same address block, different subnets can have different sizes. A /24 for four departments does not have to be four /26s.

Example: 10.0.0.0/24, with Sales 50 hosts, IT 20, Voice 10, and one point-to-point link.

Step 1 — sort the requirements biggest first. 50, 20, 10, 2.

Step 2 — size each subnet. Find the smallest host bits n where 2^n − 2 ≥ hosts.

Step 3 — place each block at the next aligned address.

Sales   10.0.0.0/26     .0    - .63
IT      10.0.0.64/27    .64   - .95
Voice   10.0.0.96/28    .96   - .111
P2P     10.0.0.112/30   .112  - .115

Step 4 — see what is left. .116 to .255 = 140 addresses still free.

Step 5 — check alignment. Every block starts on a multiple of its own size. /26 starts at 0, /27 at 64, /28 at 96, /30 at 112. If a block does not start on a multiple of its size, the plan is wrong.

That is exactly what the VLSM tab does — put the base and the host counts in, and it returns the table above. If the requirements do not fit, it tells you which one failed.

Splitting a /48 into /64s

A /48 has 16 subnet bits left before the interface ID, so it contains 2^16 = 65,536 /64s.

2001:db8:1234:0000::/64
2001:db8:1234:0001::/64
2001:db8:1234:0002::/64
...
2001:db8:1234:ffff::/64

Only the fourth hextet changes. The first three hextets are the site prefix, and the last four are the interface ID.

Do not subnet a /64 further. SLAAC needs the host part to stay 64 bits, and every device on the LAN expects the same prefix length.

The other two tools

MAC → EUI-64. Flip the universal/local bit of the first octet (XOR the second-least significant bit of the first byte), then insert ff:fe in the middle.

00:1a:2b:3c:4d:5e
 ^^ flip bit 1 of 0x00 -> 0x02
02:1a:2b  ff:fe  3c:4d:5e      interface ID
fe80::21a:2bff:fe3c:4d5e/64    link-local address

Overlap checker. Two prefixes either share no address at all, are identical, or one is inside the other. If two prefixes share addresses but neither contains the other, one of them is misaligned — that is a configuration error.

The calculator

Accuracy notes

• Binary is shown per bit, with the network portion and the host portion in different colours.
• The network address is a real 32-bit AND, and the table shows every step.
• IPv6 compression follows RFC 5952: longest zero run, first one on a tie, used only once.
• Address type comes from the real prefix, not from the first octet.
• Any valid address works — the results are never limited to a fixed sample.

How to use it while studying

1. Before you calculate by hand, predict the network and broadcast.
2. Type the address into the calculator.
3. Compare. If you were wrong, look at the AND table and find the bit you got wrong.
4. Do five problems in the Practice tab. Aim for five correct in a row.
5. Move the prefix by one (/24 → /25 → /26) and watch which field halves.
6. Design a VLSM plan for 10.0.0.0/24 by hand, then check it in the VLSM tab.
7. Take a /48 and split it into /64s on paper, then confirm the first ten in the IPv6 Split tab.

The goal is not to use the calculator forever. The goal is that after 50 problems you no longer need it — and you can explain every field on the screen.

05 · IPv6 Essentials

You cannot avoid IPv6 anymore. Cloud providers hand it out by default, mobile carriers run it, and every certification expects it. Good news: the concepts are the same. Only the notation and a few mechanisms change.

Why IPv6 exists

IPv4 has about 4.3 billion addresses. That ran out. NAT stretched it for decades, but NAT breaks end-to-end connectivity, complicates VoIP and peer-to-peer, and does not scale to billions of devices.

IPv6 has 340 undecillion addresses (2^128). Enough to give every grain of sand an address.

The address format

Eight groups of four hex digits, separated by colons.

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Two compression rules

1. Drop leading zeros in each group: 0db8 → db8, 0000 → 0.
2. Replace one run of all-zero groups with :: — only once per address.

2001:0db8:0000:0000:0000:0000:0000:0001
-> 2001:db8::1

The /64 rule

A standard LAN is a /64. That leaves 64 bits for hosts — more than enough for SLAAC. Do not use longer prefixes for LANs; SLAAC requires /64.

Address types

There is no broadcast in IPv6. Multicast (and anycast) replace it.

Common multicast addresses:

How a host gets an address

Two mechanisms, often both:

1. SLAAC (Stateless Address Autoconfiguration)

• Host sends a Router Solicitation to ff02::2
• Router replies with a Router Advertisement containing the /64 prefix
• Host builds its own address (EUI-64 or privacy extension) and does Duplicate Address Detection

2. DHCPv6

• Stateful: server assigns addresses (like DHCPv4)
• Stateless: server only gives DNS and other options; address comes from SLAAC

Most enterprise networks use SLAAC + stateless DHCPv6 or DHCPv6 stateful, depending on the vendor and policy.

NDP replaces ARP

Neighbor Discovery Protocol does what ARP, ICMP redirect, and router discovery did in IPv4.

NDP runs over ICMPv6. If you block ICMPv6, you break IPv6. This is the number one IPv6 firewall mistake.

What changed from IPv4

Dual stack and transition

The practical migration is dual stack: run IPv4 and IPv6 on the same interface.

Cisco:  ipv6 unicast-routing
        interface Gi0/1
         ipv6 address 2001:db8:1::1/64
         ipv6 address fe80::1 link-local

Other transition tools you will hear about:

• NAT64/DNS64 — IPv6-only clients reach IPv4 servers
• 6to4 / Teredo — legacy tunnels, mostly dead
• DS-Lite / MAP-T — carrier-grade IPv4-over-IPv6

Common pitfalls

Chapter check

1. Compress 2001:0db8:0000:0000:0001:0000:0000:0001.
2. Why must a LAN be /64 for SLAAC?
3. What replaces ARP?
4. Which ICMPv6 messages must never be blocked?
5. Is fe80::1 routable across the Internet?

06 · Switching in Depth: VLANs, Trunks, STP

Everything here happens at Layer 2, inside one broadcast domain — or between several of them if you configure it right.

VLANs

A VLAN is a logical switch inside the physical switch. Each VLAN is its own broadcast domain, its own MAC table view, and its own subnet (by convention).

Why they exist:

• Segmentation — voice, data, guest, IoT, management, each isolated
• Security — a compromised printer cannot sniff HR traffic
• Flexibility — move a port to another VLAN with one command
• Scale — 48 ports split into 6 VLANs without 6 switches

Cisco:  vlan 10
        name USERS
        interface Gi0/5
         switchport mode access
         switchport access vlan 10

Access ports and trunk ports

Trunking uses 802.1Q: a 4-byte tag inserted after the source MAC.

+------+------+--------+------+---------+-----+
| Dst  | Src  | 0x8100 | VLAN | Type    | ... |
|      |      |  (TPID)| (12b)|         |     |
+------+------+--------+------+---------+-----+

• TPID 0x8100 marks the frame as tagged.
• VLAN ID 12 bits → 1–4094 usable.
• Frames on the native VLAN are sent untagged on the trunk.

Native VLAN

By default, untagged frames on a trunk belong to VLAN 1. Best practice:

• Set native VLAN to an unused VLAN on both ends (must match).
• Never use VLAN 1 for user traffic.
• Mismatched native VLANs cause silent cross-VLAN leakage — a real security issue.

Cisco:  interface Gi0/1
         switchport mode trunk
         switchport trunk allowed vlan 10,20,30
         switchport trunk native vlan 999

Always set allowed vlan explicitly. Default is all VLANs, which is how a guest VLAN ends up trunked to a place it should not be.

Inter-VLAN routing

Two ways to route between VLANs:

ROAS on the router:
interface Gi0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

SVI on a L3 switch:
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
ip routing

ROAS has a single trunk as a bottleneck. SVI scales in hardware. Learn ROAS to understand the concept, use SVI in real designs.

Spanning Tree Protocol (STP)

Redundant Layer-2 links create loops. Broadcast frames would circulate forever, MAC tables would thrash, and the network would die in seconds. STP prevents this by blocking redundant ports.

How it works

1. Elect one root bridge — lowest bridge ID (priority + MAC).
2. Every other switch picks one root port — the lowest-cost path to the root.
3. Each segment picks one designated port per segment.
4. All other ports go to blocking (or discarding in RSTP).

        [Root]
        /    \
      [SW2]--[SW3]      one link is blocked

Port states

Classic STP takes 30–50 seconds to converge. RSTP takes under a second. Modern networks run RSTP (802.1w) or MSTP (802.1s). Never design with classic STP.

Cost

Timers and tuning

• Hello 2 s, forward delay 15 s, max age 20 s (classic).
• Set priority 4096 or 0 on the switch you want as root, and never leave it random.
• PortFast on access ports to skip listening/learning for end devices.
• BPDU Guard on access ports to shut them down if a switch is plugged in.
• Root Guard on ports facing other networks to stop a rogue root.
• Loop Guard on fiber/trunk links to prevent loops from unidirectional failures.

Common STP problems

Cisco:  show spanning-tree
        show spanning-tree root
        show spanning-tree interface Gi0/1 detail

EtherChannel / LAG

Bundle several links into one logical link for bandwidth and redundancy.

Requirements: same speed, same duplex, same VLAN config, same trunk settings on all members.

interface range Gi0/1-2
 channel-group 1 mode active
!
interface Port-channel1
 switchport mode trunk

Hashing is per-flow, not per-packet. One TCP connection will not exceed one member link's speed. Do not promise "2 Gbps" to a single server.

Port security

Limit which MACs can use a port.

interface Gi0/5
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky

Violation modes: protect (drop silently), restrict (drop + log + counter), shutdown (err-disable). Know all three — it is a classic exam and interview question.

Chapter check

1. Two switches, trunk between them, native VLAN mismatched. What happens?
2. Why does a Layer-2 loop kill a network so fast?
3. Which switch becomes root if all priorities are default?
4. You need 4 Gbps between two switches. Is a 4-link EtherChannel enough for one backup job?
5. Difference between an access port and a trunk port in one sentence?

07 · Routing Fundamentals

Routing is the act of choosing a path for a packet between networks. Everything else — OSPF, BGP, MPLS — is just a way to fill the routing table.

The routing table

Every router keeps a table of destinations and next hops.

Destination        Mask            Next hop        Interface   Metric
0.0.0.0            0.0.0.0         203.0.113.1     Gi0/0       1
10.0.0.0           255.0.0.0       10.1.1.2        Gi0/1       20
192.168.10.0       255.255.255.0   directly connected Gi0/2    0

When a packet arrives, the router:

1. Looks up the destination in the table.
2. Picks the most specific match (longest prefix).
3. If several routes match equally, picks the lowest administrative distance.
4. Among routes from the same protocol, picks the lowest metric.
5. Rewrites the Layer-2 header and forwards.

Longest prefix match

Routes:  10.0.0.0/8  -> via A
         10.1.0.0/16 -> via B
Packet to 10.1.2.3  -> matches both -> /16 wins -> via B

Specificity always beats distance. This is why a host route (/32) can override everything.

Administrative distance

Trust ranking between sources of the same route.

Lower is more trusted. A static route beats OSPF by default — occasionally useful, often a trap when a "temporary" static route is forgotten for two years.

Static routes

ip route 192.168.20.0 255.255.255.0 10.1.1.2      # next hop
ip route 192.168.20.0 255.255.255.0 Gi0/1         # exit interface
ip route 0.0.0.0 0.0.0.0 203.0.113.1              # default route
ip route 10.9.0.0 255.255.0.0 10.1.1.9 200        # floating static, AD 200

Floating static — a backup route with a higher AD. It sits unused until the primary disappears. Classic WAN design trick.

When to use static routes: stub networks, default routes to an ISP, very small sites, backup paths. Not for anything that changes often.

Default route

0.0.0.0/0 matches everything. It is the "rest of the world" entry.

A router with only directly connected routes and a default route is called a stub router. Most branch sites are stubs.

First-hop redundancy (FHRP)

If the default gateway dies, hosts lose connectivity. FHRP gives them a virtual gateway.

interface Vlan10
 ip address 192.168.10.2 255.255.255.0
 standby 10 ip 192.168.10.1
 standby 10 priority 120
 standby 10 preempt

Hosts point at 192.168.10.1 — the virtual address. If the active router fails, the standby takes over. Preempt is what lets the original router take back over when it returns.

Control plane vs data plane

A router can have a correct control plane and a broken data plane (a bug, an ACL, a hardware fault). This is why "the route is there but traffic does not pass" is a real scenario.

Policy-based routing (brief)

Sometimes you must forward based on source, port, or protocol, not destination.

route-map PBR permit 10
 match ip address 101
 set ip next-hop 10.1.1.5
!
interface Gi0/1
 ip policy route-map PBR

Useful for forced inspection or dual-ISP tricks. Use sparingly — it breaks the "routing is destination-based" mental model and confuses everyone later.

Troubleshooting routing

Asymmetric routing is a favourite interview topic: the reply takes a different path than the request. Usually fine for routing, fatal for stateful firewalls (they see only half the flow and drop it).

Chapter check

1. Routes 10.0.0.0/8 via A and 10.1.0.0/16 via B. Packet to 10.1.5.5 goes where?
2. Static route AD 1 vs OSPF AD 110. Which wins?
3. What does a floating static route do?
4. Why can a stateful firewall break asymmetric routing?
5. What does 0.0.0.0/0 mean?

08 · OSPF

OSPF is the most common interior routing protocol in enterprise networks. It is a link-state protocol: every router builds a complete map of the area and computes shortest paths with Dijkstra.

The idea in one paragraph

Each router describes its own links (who I am, who I am connected to, what it costs). Those descriptions are flooded to every router in the area. Every router ends up with the same map (the link-state database). Each router then runs the same algorithm on the same map, so everyone agrees on the best path. No rumours, no counting to infinity.

Neighbors first

Before any routing happens, two routers must become neighbors.

Hello timers must match:

If hello/dead, area ID, authentication, or subnet do not match, the adjacency stays down.

Neighbor states

Down -> Init -> 2-Way -> ExStart -> Exchange -> Loading -> Full

• 2-Way is normal between two non-DR routers on a broadcast segment.
• Full means databases are synchronized.
• Stuck in ExStart usually means an MTU mismatch.

DR and BDR

On a broadcast segment with many routers, everyone would form a full adjacency with everyone else (n² adjacencies). Instead, they elect a Designated Router and a Backup DR, and everyone syncs with those two.

• Election: highest priority wins, then highest router ID.
• Priority 0 means "never become DR".
• Non-preemptive: a new router with higher priority does not take over until the DR fails.

Cisco:  show ip ospf neighbor
        show ip ospf interface Gi0/1

Areas

Large flat networks are hard to compute and unstable. OSPF splits them into areas.

• Area 0 (backbone) — all other areas must connect to it.
• Normal area — full LSDB for its own area, summaries for the rest.
• Stub / totally stubby — no external routes (or no summaries either). Smaller tables.
• NSSA — stub but can import external routes as type 7.

        Area 1 --- Area 0 --- Area 2
                     |
                   ABR

ABR (Area Border Router) connects areas. ASBR injects external routes.

Every area must touch Area 0, directly or through a virtual link (avoid virtual links; they are a design smell).

LSAs you must know

Types 1 and 2 build the map. Types 3–5 tell you what is outside.

Cost

cost = reference bandwidth / interface bandwidth

Default reference is 100 Mbps, so a 1 Gbps link costs 1 and a 10 Gbps link also costs 1. That is why modern networks change the reference:

router ospf 1
 auto-cost reference-bandwidth 10000

Or set it manually:

interface Gi0/1
 ip ospf cost 10

Lower cost wins. Cost is cumulative along the path.

Configuration, minimal

router ospf 1
 router-id 1.1.1.1
 network 10.0.0.0 0.0.0.255 area 0
 network 10.1.0.0 0.0.0.255 area 0
 passive-interface Gi0/2
!
interface Gi0/1
 ip ospf 1 area 0

Always set an explicit router ID. Passive interfaces on links with no neighbors (users, loopbacks) — a classic hardening step.

Same lab in FRR:

router ospf
 ospf router-id 1.1.1.1
 network 10.0.0.0/24 area 0

Convergence

When a link fails:

1. Dead timer expires (40 s by default) or the interface goes down immediately.
2. The router floods a new LSA.
3. Every router recomputes SPF.
4. New routes install.

Tuning for faster convergence: BFD (sub-second failure detection), fast hellos, event-driven SPF. Do not tune timers before you understand them — flapping adjacencies are worse than slow convergence.

Troubleshooting table

show ip ospf neighbor
show ip ospf database
show ip ospf interface brief
show ip route ospf
debug ip ospf adj        # use carefully, it is verbose

Design rules that save you later

1. One area 0, keep it small and stable.
2. Summarize at ABRs (area 1 range 10.10.0.0 255.255.0.0).
3. Never run OSPF on user-facing ports (passive-interface default).
4. Set router IDs manually and document them.
5. Keep the topology shallow; OSPF is not a WAN design tool for 500 sites.

Chapter check

1. Why does OSPF use a DR on Ethernet but not on point-to-point?
2. Two routers have hello 10 and hello 30. What happens?
3. What LSA type tells you about a prefix in another area?
4. Why does a 10 Gbps link cost the same as a 1 Gbps link by default?
5. Adjacency stuck in EXSTART — what is the most likely cause?

09 · BGP

BGP is the routing protocol of the Internet and of every large enterprise. It does not find the shortest path. It implements policy: who is allowed to reach what, through whom.

If OSPF asks "what is the fastest road?", BGP asks "which road am I contractually and politically allowed to use?"

Autonomous Systems

An AS is a network under one administrative control, identified by a number.

• Public ASN: assigned by a registry (e.g. 13335 Cloudflare)
• Private ASN: 64512–65534 (and 4200000000–4294967294 for 32-bit)

AS 65001 ---- AS 65002 ---- AS 65003
   eBGP          eBGP

• eBGP — between different ASes. Default TTL 1, next hop changes.
• iBGP — inside one AS. Full mesh required, next hop does not change by default.

Why iBGP needs full mesh or route reflectors

BGP does not re-advertise a route learned from one iBGP peer to another (loop prevention). So with n routers you need n(n−1)/2 sessions. At 20 routers that is 190 sessions.

Solutions:

• Route reflector (RR) — one router reflects routes to clients.
• Confederation — split the AS into sub-ASes.

In practice: route reflectors, always.

The BGP session

BGP runs over TCP port 179. It does not discover neighbors — you configure them.

Neighbor states:
Idle -> Connect -> Active -> OpenSent -> OpenConfirm -> Established

• Active means "trying to connect" (counter-intuitive but correct).
• Established means the session is up and routes are exchanging.

Cisco:  show bgp summary
        show bgp ipv4 unicast summary
        show bgp neighbors 10.1.1.2
FRR:    show bgp summary

Path attributes

A BGP route is a prefix plus a set of attributes.

Best path selection

Cisco's order, simplified. Stop at the first difference.

1. Highest weight (local only)
2. Highest local preference
3. Locally originated (network command, redistribute)
4. Shortest AS_PATH
5. Lowest origin (IGP < EGP < incomplete)
6. Lowest MED
7. eBGP over iBGP
8. Lowest IGP metric to the next hop
9. Oldest route (eBGP only)
10. Lowest router ID
11. Lowest neighbor address

Memorise the first six. That covers 95% of real questions.

The most important insight: BGP prefers the path with the fewest AS hops only at step 4. Local preference beats everything except weight — which is why enterprises control outbound traffic with local preference and inbound traffic with AS_PATH prepending or communities.

Basic configuration

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65002
 network 192.168.10.0 mask 255.255.255.0
 !
 address-family ipv4 unicast
  neighbor 10.1.1.2 activate
  neighbor 10.1.1.2 route-map FROM-ISP in
  neighbor 10.1.1.2 route-map TO-ISP out

FRR equivalent:

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65002
 address-family ipv4 unicast
  network 192.168.10.0/24
  neighbor 10.1.1.2 activate

Filtering: the part that actually matters

You never trust a BGP peer. You filter both directions.

ip prefix-list PL-OUT seq 10 permit 192.168.10.0/24
!
route-map TO-ISP permit 10
 match ip address prefix-list PL-OUT
!
neighbor 10.1.1.2 maximum-prefix 1000 80 warning-only

Route leaks happen when you advertise prefixes you do not own. The 2008 Pakistan Telecom YouTube outage and the 2021 Facebook outage both came from BGP mistakes. Always filter outbound, always set maximum-prefix.

Useful knobs

Common failures

show bgp summary
show bgp ipv4 unicast
show bgp ipv4 unicast 10.0.0.0/8
show bgp neighbors 10.1.1.2 advertised-routes
show bgp neighbors 10.1.1.2 received-routes

Chapter check

1. Why does BGP use TCP and not a raw IP protocol?
2. Session is stuck in Active. Is it connected?
3. Two paths: one with local pref 200 and 5 AS hops, one with local pref 100 and 1 AS hop. Which wins?
4. Why is full-mesh iBGP a problem at scale?
5. What is AS_PATH prepending used for?

10 · Network Services

Routing gets packets there. Services make the network usable. Most real tickets live here.

DHCP — giving out addresses

DORA:

Client -> DHCP DISCOVER (broadcast)
Server -> DHCP OFFER
Client -> DHCP REQUEST (broadcast, "I accept this one")
Server -> DHCP ACK

Ports: server 67, client 68.

What DHCP can hand out: IP, mask, gateway, DNS servers, NTP, TFTP, domain name, lease time.

DHCP relay

Broadcasts do not cross routers. If the server is on another subnet, the router acts as a relay agent (ip helper-address 10.1.1.10 on Cisco). It rewrites the request with the giaddr field so the server knows which pool to use.

Cisco:  show ip dhcp binding
        show ip dhcp pool
        show ip dhcp conflict

DHCP snooping — a switch feature that only trusts DHCP offers from uplink ports. Without it, anyone can run a rogue DHCP server and become the gateway. Tie it to IP Source Guard and Dynamic ARP Inspection for a real defence.

DNS — names to addresses

Resolution flow for www.example.com:

1. Host checks its cache, then /etc/hosts
2. Asks its configured resolver (recursive query)
3. Resolver checks cache; if miss, walks the tree:
   root -> .com -> example.com -> www.example.com   (iterative)
4. Returns the A/AAAA record, cached for the TTL

TTL is the cache lifetime. Lowering TTL before a migration is standard practice; forgetting it is why "the change did not take effect" for hours.

Common tools:

dig example.com
dig +short example.com
dig @8.8.8.8 example.com
dig +trace example.com        # follow the delegation chain
nslookup example.com          # Windows

Why DNS breaks networks: if DNS fails, users say "the internet is down" even though routing is perfect. Always test by IP before blaming the network.

NAT — translating addresses

ip nat inside source list 10 interface Gi0/0 overload
interface Gi0/1
 ip nat inside
interface Gi0/0
 ip nat outside

NAT breaks things that embed IP addresses in payloads: SIP, FTP active mode, some VPNs, IPsec without NAT-T. If a protocol "works internally but not externally", suspect NAT.

NAT also destroys end-to-end addressability, which is why IPv6 exists.

NTP — time

Time is not cosmetic. Certificates, logs, Kerberos, and correlation all depend on it.

• Port 123/UDP
• Stratum 0 = atomic clock, 1 = directly attached, 2+ = synced downstream
• A server at stratum 16 is unsynchronized

Cisco:  ntp server 10.1.1.10 prefer
        show ntp status
Linux:  chronyc tracking
        timedatectl

A wrong clock causes TLS failures and login failures. It is one of the most common "impossible" bugs.

Syslog — logs

Port 514/UDP (or 6514/TLS).

logging host 10.1.1.20
logging trap informational
logging buffered 16384

Send logs to a central server. Logs on the device disappear when the device dies — which is exactly when you need them.

SNMP — monitoring

Ports 161/UDP (poll) and 162/UDP (trap). Use v3 and read-only in production. Poll with a monitoring system (LibreNMS, Zabbix, Prometheus snmp_exporter) and alert on interface errors, CPU, uptime, and BGP state.

QoS — when bandwidth is not enough

Four steps, in order:

1. Classify — identify traffic (ACL, NBAR, DSCP)
2. Mark — set DSCP/CoS at the edge, trust it in the core
3. Queue — priority queue for voice, weighted queues for the rest
4. Shape/police — smooth or drop excess

Police drops or marks above a rate. Shape buffers above a rate. Voice needs low jitter and low loss; bulk data tolerates delay but needs bandwidth.

Rule: QoS cannot create bandwidth. It only decides who suffers first.

Chapter check

1. Host gets 169.254.x.x. What are the first three things you check?
2. Why does DHCP need a relay?
3. What does a low DNS TTL let you do safely?
4. Which NAT type lets 500 users share one public IP?
5. Why does a wrong clock break HTTPS?

11 · Network Security

You are not expected to be a penetration tester. You are expected to build a network that does not fall over when someone plugs in a laptop.

The threat model, briefly

The biggest real-world risk is a flat network: everything in one VLAN, one subnet, no policy. One compromised printer means everything is reachable.

ACLs

An access list is an ordered list of permit/deny rules. First match wins. There is an implicit deny at the end.

Standard vs extended

access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 443
access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 80
access-list 100 deny ip any any log

Apply it:

interface Gi0/0
 ip access-group 100 in

Direction matters. in filters traffic entering the interface from the attached network. out filters traffic leaving toward it. Getting the direction backwards is the single most common ACL mistake.

Wildcard masks

An ACL mask is the inverse of a subnet mask.

permit 10.1.1.0 0.0.0.255   # whole /24
permit 10.1.1.5 0.0.0.0     # one host
permit any                  # everything

Where to place ACLs

• Extended ACLs close to the source — stop traffic early, save bandwidth.
• Standard ACLs close to the destination — they only match source, so placing them early blocks the wrong things.

Stateful vs stateless

A firewall builds a session table from the 5-tuple. That is why it can allow replies without an inbound rule — and why it drops traffic when the reply takes a different path.

Zones and DMZ

Internet --- [ outside ] --- FIREWALL --- [ inside ] --- Users
                                  |
                              [ dmz ] --- Public servers

Rules of thumb:

• Inside → outside: allow, with web filtering
• Outside → DMZ: only the published ports
• DMZ → inside: deny (this is the one people forget)
• Management: separate VLAN, not reachable from users

VPN

IPsec (site-to-site)

Two phases:

Components to match on both sides:

• Encryption (AES-256)
• Integrity (SHA-256)
• DH group
• Authentication (PSK or certificates)
• Interesting traffic (the subnets in the crypto ACL)
• Lifetime

A single mismatch means the tunnel never comes up. When troubleshooting, compare the full proposal on both sides, line by line.

Cisco:  show crypto isakmp sa
        show crypto ipsec sa
        show crypto session

SSL/TLS VPN (remote access)

Client connects to a portal over 443, authenticates, and gets a tunnel or per-app proxy. Works through almost any firewall because it looks like HTTPS.

WireGuard

Modern, simple, fast. UDP only, no built-in user authentication — pair it with a proper identity system. Great for site-to-site and admin access.

802.1X — port-based authentication

Before a device gets network access, it must authenticate.

Supplicant (PC) <--EAPOL--> Authenticator (switch) <--RADIUS--> Authentication server

• Port starts in an unauthorized state.
• EAP exchange happens.
• RADIUS returns Accept/Reject and often a dynamic VLAN.
• MAB (MAC Authentication Bypass) for devices that cannot do 802.1X (printers, cameras).

RADIUS ports: 1812 (auth), 1813 (accounting).

This is how you stop someone plugging an unknown laptop into a wall port.

Layer-2 hardening checklist

• Disable unused ports and put them in a dead VLAN
• Port security with a MAC limit on access ports
• DHCP snooping on access VLANs, trust only uplinks
• Dynamic ARP Inspection on user VLANs
• BPDU Guard + Root Guard
• Disable DTP (switchport nonegotiate) and set access ports explicitly
• Native VLAN changed from 1, unused
• No VLAN 1 for user traffic
• SSH only, Telnet disabled, AAA with TACACS+/RADIUS
• Enable exec-timeout, logging synchronous, banners
• Control plane policing (CoPP) on routers
• uRPF where symmetric routing is guaranteed

Management plane hygiene

Chapter check

1. ACL has permit 10.1.1.0 0.0.0.255 then deny ip any any. A packet from 10.1.1.5 to 8.8.8.8 — allowed or denied?
2. Why must you place an extended ACL near the source?
3. Why does asymmetric routing break a stateful firewall?
4. Which IKE phase builds the data tunnel?
5. What does 802.1X actually authenticate — the user, the device, or the port?

12 · WAN, SD-WAN, and Cloud

The WAN is the part you do not own. That changes everything: cost, latency, and who you call when it breaks.

The old WAN

MPLS in one page

The provider builds a private network. Your sites connect to PE routers. The provider adds a label to each packet so core routers forward by label, not by IP lookup.

• CE = customer edge, PE = provider edge, P = provider core
• Labels stack; the outer label is the transport, the inner identifies the VPN
• Traffic engineering and QoS come for free from the provider's SLAs
• Expensive, slow to change (weeks to add a site)

You configure a plain IP link to the provider and run BGP or static routes with them. The MPLS magic is invisible to you.

The modern WAN: SD-WAN

Instead of one expensive private circuit, use several cheap ones (broadband, LTE, fiber) and let software choose the best path per application.

SASE extends this to security: cloud-delivered firewall, CASB, ZTNA, and SWG at the edge instead of a box in a data center.

Trade-off: SD-WAN is only as good as the underlay. If the broadband is congested, no policy can fix it.

DIA vs backhaul

Backhaul:  Branch -> HQ (inspect) -> Internet      slow, expensive, but centralized policy
DIA:       Branch -> Internet (local breakout)     fast, cheap, distributed policy

Most organisations now use hybrid: DIA for SaaS, backhaul/private for sensitive apps.

Cloud networking

Every cloud has the same basic primitives with different names.

The mental model that transfers

1. A VPC/VNet is a routing domain. Subnets are just address ranges inside it.
2. Security groups are stateful and attached to resources. NACLs are stateless and attached to subnets.
3. Cloud networks are default-deny for inbound, default-allow for outbound in most providers. That is the opposite of a naive on-prem firewall.
4. Everything is software-defined. There is no spanning tree, no VLANs, no ARP storms.
5. Routing is explicit. If a route table does not know a destination, the packet is dropped.

Hybrid connectivity

On-prem ---- (Direct Connect / ExpressRoute) ---- Cloud VPC
On-prem ---- (IPsec VPN over Internet) ---------- Cloud VPC

Design rules:

• Use BGP for dynamic routing between on-prem and cloud.
• Never overlap address space. Cloud VPCs make overlap painful and expensive to fix.
• Two paths minimum, different providers if possible.
• Put a firewall or inspection VPC between the edge and workloads.

Latency reality check

Speed of light in fiber is about 200 km/ms, and real paths are not straight lines. If someone promises 5 ms from Manila to Virginia, they are wrong.

Chapter check

1. What does the provider actually do in an MPLS L3VPN?
2. Why does SD-WAN use multiple underlays?
3. What is the difference between a security group and a NACL?
4. Why is overlapping address space a disaster in hybrid cloud?
5. What is local internet breakout?

13 · Troubleshooting Like an Engineer

This is the chapter that gets you hired. Anyone can configure a lab. Not everyone can find a problem at 2 a.m. without breaking it further.

The method

Never troubleshoot by trying random things. Use a loop.

1. Define the problem precisely
2. Gather facts
3. Form a hypothesis
4. Test the hypothesis
5. Fix, verify, document
   (if wrong, go back to 3 with new facts)

1. Define the problem

"The network is down" is not a problem statement. Ask:

• Who is affected? One user, one floor, one site, everyone?
• What exactly fails? DNS, a specific app, all traffic?
• When did it start? What changed recently?
• Is it constant or intermittent?

"What changed?" solves more tickets than any command.

2. Gather facts

3. Form a hypothesis

A hypothesis is testable: "The DHCP relay is missing on VLAN 30, so hosts on VLAN 30 get link-local addresses."

Not testable: "It's probably the firewall."

4. Test it

One change at a time. If you change two things, you learn nothing.

5. Fix, verify, document

Verification means the user confirms it works, not "it pings now". Documentation means the next person (probably you at 3 a.m.) can find it.

The tools you actually use

Reading show interface output

GigabitEthernet0/1 is up, line protocol is up
  Hardware is ..., address is 0011.2233.4455
  MTU 1500 bytes, BW 1000000 Kbit/sec
  5 minute input rate 12000 bits/sec, 3 packets/sec
  0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
  0 output errors, 0 collisions, 0 interface resets

up/up means Layer 1 and Layer 2 are fine. It does not mean routing or firewalls are fine.

Capture workflow

1. Decide the capture point. The right question: "where can I see both directions?"
2. Use a filter, not a 2 GB file. host 10.1.1.5 and port 443
3. Reproduce the problem once.
4. Stop and check counts: SYN sent? SYN-ACK returned? Retransmissions?
5. Open in Wireshark, apply a display filter.

Useful Wireshark filters:

tcp.flags.syn == 1 && tcp.flags.ack == 0     # connection attempts
tcp.analysis.retransmission                  # retransmits
icmp.type == 3                               # unreachable
dns.flags.response == 0                      # DNS queries
tls.handshake.type == 1                      # client hello
arp                                          # ARP

Expert Information (Analyze → Expert Information) surfaces retransmissions, resets, and malformed packets without reading every packet.

Ten classic tickets

Escalation etiquette

When you hand off, give:

• The exact symptom and impact
• What you checked and what you ruled out
• Timestamps (with time zone)
• Captures and command output
• What you changed, if anything

"The network is broken, please check" wastes everyone's time.

Chapter check

1. What is the first question you ask about any outage?
2. up/up on an interface — does that prove routing works?
3. Why is ping alone a weak test?
4. What does a capture showing SYN with no SYN-ACK mean?
5. Where should you capture to prove a firewall is dropping traffic?

14 · Automation and Programmability

Every network engineer hired after 2020 is expected to automate. Not because it is trendy, but because a 500-device network cannot be configured by hand without errors.

Why automate

The goal is not "replace engineers". It is to stop wasting engineers on copy-paste.

Data formats

YAML

switches:
  - name: sw1
    mgmt: 10.0.0.11
    vlans: [10, 20, 30]
  - name: sw2
    mgmt: 10.0.0.12
    vlans: [10, 20]

JSON

{"switches": [{"name": "sw1", "mgmt": "10.0.0.11", "vlans": [10, 20, 30]}]}

YAML is for humans, JSON for machines. Both map to the same structures: dicts, lists, strings, numbers, booleans.

APIs

REST

GET    /api/devices
POST   /api/devices
PUT    /api/devices/1
DELETE /api/devices/1

Stateless. Authenticate with a token or basic auth. Returns JSON. Learn curl first, then a library.

curl -s -H "Authorization: Token $TOKEN" https://netbox/api/dcim/devices/ | jq '.results[].name'

NETCONF / RESTCONF / gNMI

YANG is the data model — a schema describing what a device can be configured with. This is the "structured data" alternative to screen-scraping CLI output.

Python for network engineers

You need very little Python. This is the whole starting set:

# variables and strings
host = "10.0.0.1"
port = 22
print(f"connecting to {host}:{port}")

# lists and dicts
vlans = [10, 20, 30]
device = {"name": "sw1", "mgmt": "10.0.0.11"}

# loops
for vlan in vlans:
    print(f"vlan {vlan}")

# conditionals
if "mgmt" in device:
    print(device["mgmt"])

# files
with open("inventory.txt") as f:
    for line in f:
        print(line.strip())

# functions
def backup(host):
    return f"backup-{host}.cfg"

# error handling
try:
    do_something()
except Exception as exc:
    print(f"failed: {exc}")

That is enough to write 80% of useful network scripts.

Libraries, in order of learning

The pattern that matters: source of truth → template → deploy → verify

NetBox (intent)
      |
      v
Jinja2 template  ->  rendered config
      |
      v
Nornir / Ansible  ->  push to devices
      |
      v
Verify + report

Never edit devices by hand after this exists. Change NetBox, run the pipeline, verify.

Example: Jinja2 template

{% for vlan in vlans %}
vlan {{ vlan.id }}
 name {{ vlan.name }}
{% endfor %}

Example: idempotent backup

import subprocess, datetime, pathlib

stamp = datetime.datetime.now().strftime("%Y%m%d-%H%M%S")
out = pathlib.Path("backups") / stamp
out.mkdir(parents=True, exist_ok=True)

for host in ["10.0.0.11", "10.0.0.12"]:
    cfg = subprocess.run(
        ["ssh", host, "show running-config"],
        capture_output=True, text=True, check=True,
    ).stdout
    (out / f"{host}.cfg").write_text(cfg)

Idempotent means: running it twice does not break anything.

Git

Non-negotiable. Your configs and scripts go in Git.

git init
git add .
git commit -m "add ospf lab"
git log --oneline
git diff

Why it matters: every change is attributable, reversible, and reviewable. A network engineer without Git is a network engineer who cannot answer "what changed?".

Safe automation rules

1. Dry run first. Print what would change before changing it.
2. One device at a time until the script is proven.
3. Back up before deploy. Always.
4. Verify after deploy. Compare the intended state to the actual state.
5. Blast radius. Never run a loop over all devices on the first attempt.
6. Rate limit. SSH sessions are cheap; device CPUs are not.
7. Log everything. Who ran what, on which device, at what time.

What to learn next

• Terraform for cloud/network infrastructure
• Streaming telemetry (gNMI) instead of polling
• CI/CD for network changes (GitHub Actions + tests)
• Batfish to verify configs before deployment
• Containerlab to test changes before touching production

Chapter check

1. Why is YAML preferred for human-written config data?
2. What is the difference between NETCONF and RESTCONF?
3. What does "idempotent" mean?
4. Why is Git essential for network automation?
5. What is the first thing a deploy script should do?

15 · Labs

Fifteen labs, in order. Each one has a goal, a tool, and a proof — the thing you show someone to prove you did it.

Do not skip the proof. A lab you cannot demonstrate is a lab you did not learn.

Lab 01 — Two hosts, one switch

• Goal: ping between two PCs on the same VLAN; read the MAC table.
• Tool: Packet Tracer
• Proof: show mac address-table output + explanation of why each MAC is on that port.

Lab 02 — ARP and the gateway

• Goal: see ARP for the gateway when pinging a remote host.
• Tool: Packet Tracer simulation mode + Wireshark
• Proof: capture showing ARP request for the gateway, not for the destination.

Lab 03 — Subnetting drill

• Goal: 50 random addresses, 100% correct.
• Tool: pen and paper, then ipcalc
• Proof: a sheet of worked answers with zero corrections.

Lab 04 — VLANs and trunks

• Goal: two VLANs, one trunk, inter-VLAN routing with router-on-a-stick.
• Tool: Packet Tracer
• Proof: topology + show vlan brief + show interfaces trunk + successful cross-VLAN ping.

Lab 05 — Break the trunk

• Goal: remove a VLAN from the allowed list and document the symptom.
• Tool: Packet Tracer
• Proof: a short table: what you broke, what you saw, how you fixed it.

Lab 06 — STP

• Goal: three switches in a triangle; find the root, the root ports, the blocked port.
• Tool: Packet Tracer
• Proof: show spanning-tree from all three + a diagram of port roles.

Lab 07 — OSPF with three routers

• Goal: full adjacency, loopbacks reachable, convergence under 10 s.
• Tool: containerlab + netlab + FRR
• Proof: show ip ospf neighbor, show ip route ospf, convergence timing.

Lab 08 — Break OSPF

• Goal: cause and diagnose three failures: area mismatch, MTU mismatch, passive interface.
• Tool: FRR
• Proof: for each: the symptom, the state you saw, the fix.

Lab 09 — BGP between two ASes

• Goal: eBGP session up, loopback advertised, AS_PATH visible.
• Tool: FRR
• Proof: show bgp summary + show bgp ipv4 unicast showing the path.

Lab 10 — BGP policy

• Goal: change outbound preference with local preference, inbound with prepending.
• Tool: FRR
• Proof: before/after show bgp output with an explanation of which attribute decided it.

Lab 11 — ACLs and NAT

• Goal: permit only HTTP/HTTPS out, block the rest, PAT the inside network.
• Tool: Packet Tracer or FRR + iptables
• Proof: policy working from two different source hosts + show ip nat translations.

Lab 12 — DHCP and DNS

• Goal: a DHCP pool with relay, a local DNS record, a client that resolves it.
• Tool: Linux containers or Packet Tracer server
• Proof: dig output + DHCP lease table.

Lab 13 — Wireshark deep dive

• Goal: explain six captures: ARP, ICMP TTL, OSPF hello, BGP open, DNS query, TCP retransmission.
• Tool: Wireshark
• Proof: notes/observations.md with "expected / saw / because" for each.

Lab 14 — Automation: config backup

• Goal: back up every running lab device to timestamped files.
• Tool: Python
• Proof: script in Git + a backup directory + one paragraph on error handling.

Lab 15 — Automation: intent to config

• Goal: YAML inventory → Jinja2 template → rendered config → deployed → verified.
• Tool: Python + Jinja2 (+ Nornir if you want)
• Proof: a commit showing the template, the rendered output, and the verification report.

How to record a lab

Every lab folder should contain:

lab-name/
├── README.md        # goal, topology, what I did, what broke, what I learned
├── topology.yml     # if applicable
├── configs/         # final configs
├── captures/        # pcap files
└── notes.md         # raw observations

The README is what you show in an interview. Write it for a stranger.

Suggested order and timing

16 · Career: Getting the Job

Skills get you interviews. Evidence gets you offers.

Certifications vs skills

The practical answer: get one certificate early to pass filters, then build evidence.

Do not collect certificates instead of building. Three certs and no lab is a red flag.

What employers actually screen for

1. Can you subnet without a calculator?
2. Can you explain what happens when you type a URL?
3. Can you read a packet capture?
4. Have you broken something and fixed it?
5. Can you describe a network you built or operated?
6. Do you document?

The URL question

Practice this until it is fluent:

Browser checks cache → DNS resolution (recursive → root → TLD → authoritative) → TCP handshake to the server IP:443 → TLS handshake (certificate, key exchange) → HTTP GET → server responds → browser renders. Along the way: ARP for the gateway, routing through the default route, NAT at the edge, stateful firewall tracking the session.

Every word in that answer is a chapter in this book.

Portfolio

Three things, in one public repo:

1. A lab you built — topology diagram, configs, and what you learned.
2. A capture you explained — the pcap plus your analysis.
3. A script you wrote — backup, audit, or report. Small is fine.

Add a README.md that says, in plain language, what each one demonstrates.

Interview questions with short answers

Resume bullets that work

Bad: "Responsible for network operations."

Good:

• "Migrated 42 access switches from static VLAN config to a templated Ansible pipeline, cutting change time from 3 hours to 15 minutes."
• "Reduced recurring broadcast storms by implementing BPDU Guard and RSTP across 12 buildings."
• "Built a containerlab lab replicating the production OSPF/BGP design to test changes before deployment."
• "Documented and automated configuration backups for 120 devices, eliminating manual nightly work."

Formula: action + scale + measurable result.

30-60-90 for a new role

Where the jobs are

Start in operations if you can. You will see more failures in one year than a design role sees in five, and failures teach faster than diagrams.

The unfashionable advice that works

1. Document everything. The engineer who writes the runbook becomes the lead.
2. Learn one thing deeply. OSPF or BGP or Linux networking — depth transfers.
3. Read packet captures for fun. It compounds.
4. Automate the boring part first. Nobody is impressed by a framework; they are impressed by the 15 minutes you gave back.
5. Be the person who says "let me verify". That is the whole job.

Final check

• I can subnet any IPv4 address in under 30 seconds
• I can explain the full URL-to-page path
• I have built and broken a VLAN/STP topology
• I have run OSPF and BGP in a real lab
• I have explained six packet captures
• I have a script that backs up configs
• I have a repo that shows all of the above
• I can describe a failure I caused and how I fixed it

If all eight are true, you are ready to apply — with or without a certificate.

A · Ports and Protocols Reference

The ports you will actually see

IP protocol numbers

Multicast addresses

EtherTypes

Well-known MAC addresses

Notable standards

B · Command Cheat Sheet

Three worlds: Cisco IOS, FRR (vtysh), and Linux. Learn one, map the others.

Device status and interfaces

Switching

Routing

OSPF

BGP

NAT (Cisco)

show ip nat translations
show ip nat statistics
clear ip nat translation *
debug ip nat

DHCP (Cisco)

show ip dhcp binding
show ip dhcp pool
show ip dhcp conflict
show ip dhcp server statistics

VPN (Cisco)

show crypto isakmp sa
show crypto ipsec sa
show crypto session
show crypto map

Linux networking essentials

ip addr                       # addresses
ip -br link                   # interfaces, brief
ip route                      # routes
ip route get 8.8.8.8          # which route would be used
ip neigh                      # ARP/NDP cache
ss -tulpn                     # listening sockets
ss -tnp                       # established TCP
tcpdump -i eth0 -nn port 443  # capture
dig +short example.com        # DNS
traceroute 8.8.8.8            # path
mtr 8.8.8.8                   # path + loss
curl -v https://example.com   # full HTTP/TLS
ethtool eth0                  # link speed, duplex
ethtool -S eth0               # driver counters
bridge fdb show               # MAC table
bridge vlan show              # VLANs

Wireshark display filters

ip.addr == 10.1.1.5
tcp.port == 443
tcp.flags.syn == 1 && tcp.flags.ack == 0
tcp.analysis.retransmission
tcp.analysis.zero_window
icmp.type == 3
dns.flags.response == 0
arp
tls.handshake.type == 1
http.request
!arp && !icmp

tcpdump capture filters

tcpdump -i eth0 -nn 'host 10.1.1.5 and port 443'
tcpdump -i eth0 -nn 'icmp or arp'
tcpdump -i eth0 -nn -w cap.pcap 'not port 22'
tcpdump -r cap.pcap -nn

Useful one-liners

# top talkers on an interface (requires ntopng/iftop)
iftop -i eth0

# who is on this subnet
nmap -sn 192.168.1.0/24

# test a TCP port
nc -vz 10.1.1.10 22

# trace the DNS delegation
dig +trace example.com

# check MTU along a path (Linux)
ping -M do -s 1472 8.8.8.8

# generate traffic
iperf3 -s            # server
iperf3 -c 10.1.1.10  # client

C · Reference Tables

IPv4 subnet reference

Quick lookup by mask octet

Private address space

Administrative distance

Routing protocol comparison

STP port states

STP costs

BGP best-path order

1. Highest weight
2. Highest local preference
3. Locally originated
4. Shortest AS_PATH
5. Lowest origin
6. Lowest MED
7. eBGP over iBGP
8. Lowest IGP metric to next hop
9. Oldest route (eBGP)
10. Lowest router ID
11. Lowest neighbor address

DSCP values

Cable and optics

Ethernet frame sizes

Time and logging

Latency references

D · Glossary

Every entry answers three questions: what it is, what it does, and why you should care. If a term has a chapter, the chapter explains it in context.

ACL rules, for example, are not just "permit/deny lists" — they are read top to bottom and stop at the first match, which is why a broad rule near the top makes every rule below it dead.

A

AAA — Authentication, Authorization, Accounting. The three questions asked of anyone who touches the network: who are you, what are you allowed to do, and what did you actually do. RADIUS and TACACS+ are the protocols that carry those answers.

ABR (Area Border Router) — An OSPF router with interfaces in two or more areas. It keeps a separate topology database for each area and advertises summaries between them, so routers inside one area never need to know another area's internals.

ACL (Access Control List) — An ordered list of permit and deny rules attached to an interface or a firewall. The device reads the rules from the top and stops at the first match, so the order is the policy: a broad permit placed too early makes every rule below it useless, and a missing final deny silently allows everything.

Administrative distance — The number a router uses to choose between routes to the same destination learned from different sources. Lower wins: connected 0, static 1, eBGP 20, OSPF 110, IS-IS 115, RIP 120, iBGP 200. It is the tiebreaker applied before metrics are compared.

Anycast — One address assigned to several servers in different locations. Routing delivers each client to the nearest one, which is how 8.8.8.8 and most CDNs work. If one node fails, traffic simply shifts to the others.

ARP (Address Resolution Protocol) — The protocol that finds the MAC address that owns an IPv4 address on the local link. A host broadcasts "who has 10.0.0.1?" and the owner replies with its MAC, which is then cached for a few minutes. Without ARP, a host knows where it wants to go but not which hardware to hand the frame to.

AS (Autonomous System) — A network under one administrative control, identified by an AS number. Routing between ASes is BGP's job; routing inside one AS is an IGP's job.

AS path — The BGP attribute listing every AS a route has passed through. It is both a loop check (seeing your own AS number means reject) and the usual tiebreaker: the shortest path wins unless policy says otherwise.

ASBR (AS Boundary Router) — An OSPF router that connects the OSPF domain to another routing domain and injects external routes into it. A router can be an ASBR and an ABR at the same time; the roles answer different questions.

Automation — Doing configuration and verification with code instead of typing into devices. The value is repeatability: the same input produces the same result, and one mistake is fixed once instead of on two hundred devices.

B

Bandwidth — The maximum rate a link can carry, measured in bits per second. It is a capacity, not a promise: what you actually get is throughput, which is always lower.

BFD (Bidirectional Forwarding Detection) — A lightweight protocol that sends tiny probes every few hundred milliseconds to detect a dead neighbour. Routing protocols use it so they can fail over in under a second instead of waiting for their own slow timers.

BGP (Border Gateway Protocol) — The routing protocol of the Internet. It exchanges reachability between autonomous systems and chooses paths by policy (which path you prefer) rather than by pure shortest path.

BPDU (Bridge Protocol Data Unit) — The message switches exchange to run Spanning Tree. It carries the bridge ID, root path cost, and port information that decide which ports stay forwarding and which get blocked.

BPDU guard — A switch feature that shuts a port down if it receives a BPDU. Applied to access ports, it stops a user from plugging in their own switch and quietly changing the topology.

Broadcast — A frame or packet addressed to every device on the local segment (MAC ff:ff:ff:ff:ff:ff, IPv4 255.255.255.255). Routers do not forward broadcasts, which is exactly what makes a broadcast domain end at the router.

Broadcast domain — Every device that receives a broadcast sent by any one of them. A whole switch is one broadcast domain unless VLANs split it.

C

CAM table (Content Addressable Memory) — A switch's map of MAC address to port. The switch learns an entry from every frame's source address and uses the table to send frames out only the correct port instead of flooding.

CIDR (Classless Inter-Domain Routing) — Writing a network as an address plus a prefix length, like 10.0.0.0/8. It replaced address classes, so the prefix defines the size — not the first octet.

Collision domain — The set of devices sharing one physical medium where frames can collide. A hub creates one large collision domain; a switch gives every port its own.

Community (BGP) — A tag attached to a BGP route, such as 65000:100. It has no built-in meaning — you define what it means and match it in route maps to apply policy at scale.

Control plane — The part of a device that decides where traffic should go: routing protocols, ARP, STP, and the tables they build. It is the "thinking" half of the router.

Convergence — How long the network takes to agree on a new topology after a change and stop sending traffic into a dead path. Fast convergence is a design goal, not a single feature.

CoS (Class of Service) — The 3-bit priority field inside an 802.1Q tag, used for QoS at Layer 2. It travels with the frame across trunks, so switches can honour priority without reading the IP header.

CPE (Customer Premises Equipment) — The device on the customer's side of a provider link, usually the router the ISP installs or hands over. It is where the provider's responsibility ends.

D

DAI (Dynamic ARP Inspection) — A switch feature that checks ARP packets against the DHCP snooping table and drops forged replies. It blocks ARP spoofing without installing anything on the hosts.

Data plane — The part of a device that actually moves packets: ASICs, the FIB, and the interfaces. Perfect routes in the control plane mean nothing if the data plane drops the traffic.

Default gateway — The router a host sends traffic to when the destination is not on its own subnet. If it is wrong or missing, local traffic still works and everything else fails — the classic "the network is down but only for me" symptom.

Default route — The route 0.0.0.0/0 (or ::/0), meaning "everything not matched more specifically goes here". It is the last resort in the routing table.

DHCP (Dynamic Host Configuration Protocol) — The protocol that gives hosts an address, mask, gateway, and DNS server automatically. It uses four messages: discover, offer, request, acknowledge.

DHCP snooping — A switch feature that marks ports trusted or untrusted and accepts DHCP offers only from trusted ports. It stops a rogue server from handing out a fake gateway.

DIA (Direct Internet Access) — Sending a branch's internet traffic straight out a local link instead of back through the data centre. It cuts latency and WAN cost, but moves the security controls to the branch.

DMZ (Demilitarized Zone) — A segment for services that must be reachable from the internet, kept separate from the internal network. If the web server is compromised, the attacker is still outside the inside.

DNS (Domain Name System) — The system that turns names into addresses. Almost every "the internet is down" ticket is really DNS, because everything else depends on it.

DR/BDR (Designated Router / Backup DR) — The two routers elected on an OSPF broadcast segment to be the only ones forming full adjacencies and generating LSAs for that segment. It keeps the number of adjacencies from growing quadratically as routers are added.

DSCP (Differentiated Services Code Point) — The 6-bit field in the IP header that marks a packet's QoS class. Edge devices set it, interior devices trust or rewrite it, and every hop uses it to choose a queue.

Dual stack — Running IPv4 and IPv6 on the same interface at the same time. It is the normal migration method because there is no flag day when the Internet switches over.

Duplex — Whether a link can send and receive at the same time (full) or only one direction at a time (half). A duplex mismatch causes collisions, retransmissions, and terrible throughput on a link that otherwise looks healthy.

E

eBGP — BGP running between routers in different autonomous systems. It is how networks exchange routes with each other, and it is the protocol that builds the Internet's routing table.

EIGRP (Enhanced Interior Gateway Routing Protocol) — Cisco's advanced distance-vector IGP. It converges quickly and summarizes easily, but it is effectively Cisco-only, which limits mixed-vendor designs.

Encapsulation — Wrapping data in the header of the layer below: a segment gets an IP header, the packet gets a frame header, and the frame becomes bits on the wire. Decapsulation is the reverse process on receipt.

EUI-64 — The 64-bit interface ID built from a 48-bit MAC by flipping the universal/local bit and inserting ff:fe in the middle. SLAAC uses it to build an address with no DHCP server.

EVPN (Ethernet VPN) — A BGP-based control plane for Layer-2 and Layer-3 overlays, usually paired with VXLAN. It replaces flood-and-learn with a real routing protocol, which is why large data centres use it.

F

FHRP (First Hop Redundancy Protocol) — A family (HSRP, VRRP, GLBP) that gives hosts one virtual gateway address served by two or more routers. If the active router dies, the standby takes over the address and the hosts never notice.

FIB (Forwarding Information Base) — The data-plane copy of the routing table, optimized for fast lookups. The control plane computes it; the ASIC reads it for every packet.

Floating static route — A static route configured with a worse administrative distance than the primary route, so it stays hidden until the primary disappears. It is a cheap backup path with no protocol overhead.

FRR (FRRouting) — An open-source routing suite that runs OSPF, BGP, IS-IS, and more on Linux. It is what the free labs in this book use instead of vendor images.

G

gNMI — A gRPC-based protocol for reading and changing device state, including streaming telemetry. It is the modern alternative to polling devices with SNMP or scraping the CLI.

GRE (Generic Routing Encapsulation) — A simple tunnelling protocol that wraps one protocol inside another. It can carry multicast and routing protocols, which IPsec alone cannot, but it adds no encryption by itself.

H

HSRP (Hot Standby Router Protocol) — Cisco's first-hop redundancy protocol. Routers share a virtual IP and MAC address; one is active, the other stands by and takes over if the active one stops answering.

I

iBGP — BGP running between routers in the same autonomous system. It carries external routes inside the AS and needs either a full mesh of sessions or route reflectors.

ICMP (Internet Control Message Protocol) — IP's signalling protocol. It carries errors such as "destination unreachable" and "time exceeded", plus the echo request/reply that ping uses. It carries no user data.

IGP (Interior Gateway Protocol) — Any routing protocol that works inside one autonomous system: OSPF, IS-IS, EIGRP, RIP. It finds the best path within your network, which is the opposite job to BGP.

IPAM (IP Address Management) — Keeping track of which addresses and prefixes exist and who owns them. Without it, duplicate addresses and exhausted pools are discovered by outage instead of by a report.

IPsec — A suite that encrypts and authenticates IP traffic. It has two parts: IKE negotiates keys and parameters, while ESP (or AH) protects the actual packets.

IS-IS (Intermediate System to Intermediate System) — A link-state IGP that runs directly on Layer 2 rather than inside IP. It scales very well and is common in ISP and provider cores.

ISP (Internet Service Provider) — The company that sells connectivity to the rest of the Internet.

J

Jitter — Variation in delay between packets. Voice and video care about jitter more than raw latency: a steady 150 ms sounds fine, but 20 ms ± 80 ms does not.

L

LACP (Link Aggregation Control Protocol) — The IEEE standard (802.3ad) for bundling several links into one logical link. It negotiates with the far end, so a half-configured bundle cannot silently create a loop.

Latency — The time a packet takes to travel from source to destination, measured in milliseconds. Distance, queueing, and serialization all add to it.

Link-state — A class of routing protocol where every router builds a complete map of the topology and runs shortest path over it. OSPF and IS-IS are link-state; they converge quickly and scale well.

Local preference — A BGP attribute used inside an AS to choose the outbound path. Highest wins, and it is exchanged only between iBGP peers — it never crosses an AS boundary.

Longest prefix match — The rule that a router forwards by the most specific route, not the first one configured. A /24 always beats a /16 for the same destination.

LSA (Link State Advertisement) — OSPF's unit of topology information. Routers flood LSAs until every router in the area holds the same database, and then each runs shortest path on it.

M

MAC address — The 48-bit hardware address of an interface, used only within one link. It is not routable, and it changes at every hop as frames are rebuilt.

MED (Multi-Exit Discriminator) — A BGP attribute that hints which entry point into an AS is preferred. Lower is better, and it is normally compared only between the same two neighbours.

Metric — The number a routing protocol assigns to a path to rank it. Lower is better, but the meaning differs by protocol: OSPF cost, RIP hop count, EIGRP composite.

MPLS (Multiprotocol Label Switching) — Provider forwarding that attaches a short label to each packet and switches on the label instead of doing an IP lookup at every hop. It is the basis of many carrier VPNs and traffic-engineering designs.

MSS (Maximum Segment Size) — The largest TCP payload a host will accept, usually MTU minus 40 bytes of IP and TCP headers. If a tunnel lowers the MTU, MSS clamping keeps TCP from overrunning it.

MTU (Maximum Transmission Unit) — The largest payload an interface will send; 1500 bytes on standard Ethernet. A path with a smaller MTU silently drops large packets unless PMTUD or MSS clamping deals with it.

Multicast — One sender, many receivers, using a group address. Hosts join a group and the network delivers only to links that have members. IPv4 uses 224.0.0.0/4; IPv6 uses ff00::/8.

N

NAT (Network Address Translation) — Rewriting addresses at a boundary, usually private to public. PAT, also called NAT overload, rewrites the source port too so many hosts can share one public address.

NDP (Neighbor Discovery Protocol) — IPv6's combined replacement for ARP, router discovery, and redirects. It runs over ICMPv6 and also performs duplicate address detection.

NETCONF — A protocol for configuring devices with structured data over SSH. It is transactional: you send a change, the device validates and applies it — or rejects the whole thing.

Next hop — The next device a packet is handed to on the way to its destination. The destination may be far away; the next hop is always exactly one hop away.

NOC (Network Operations Center) — The team and the room where monitoring, alerting, and incident response happen. Their runbooks matter as much as their dashboards.

NTP (Network Time Protocol) — The protocol that keeps clocks synchronized. Log correlation, certificates, and any real troubleshooting all depend on correct time.

O

OSPF (Open Shortest Path First) — A link-state IGP that floods LSAs, builds a topology map per area, and runs Dijkstra to find shortest paths. It is the most common interior protocol in enterprise networks.

Overlay — A virtual network built on top of a physical underlay, usually with tunnels. VXLAN, IPsec, and SD-WAN are overlays: they hide the underlay's details from the tenants.

P

Packet — The Layer-3 unit of data: an IP header plus payload. Frame is Layer 2, segment is Layer 4, packet is Layer 3.

PAT (Port Address Translation) — NAT that also rewrites the port, letting many internal hosts share one public address. It is what a home router does.

PBR (Policy-Based Routing) — Forwarding decisions based on something other than the destination, such as source address, protocol, or DSCP marking.

PDU (Protocol Data Unit) — The data unit at a given layer: frame at Layer 2, packet at Layer 3, segment at Layer 4.

Peering — Two networks exchanging traffic directly, usually without payment. It is a business relationship expressed as BGP configuration.

Ping — The tool that sends ICMP echo requests and measures the replies. Success proves the path and the return path work; failure does not tell you where it broke.

PoE (Power over Ethernet) — Sending power over the LAN cable with the data, so access points and cameras need no separate supply. Standards run from 802.3af (15.4 W) to 802.3bt (90 W).

Prefix — The network portion of an address, written with its length: 10.1.0.0/16. The prefix length is the number of leading bits that identify the network.

Prefix list — A filter that matches routes by prefix and length. For that specific job it is faster and harder to misconfigure than an access list inside a route map.

Q

QoS (Quality of Service) — Classifying, marking, and scheduling traffic so important packets are served first when a link is congested. It cannot create bandwidth; it decides who suffers when there is not enough.

Queue — A buffer where packets wait for an interface. Queueing is the mechanism behind QoS: which queue is served next is what "priority" actually means.

R

RADIUS — The protocol that centralizes authentication for 802.1X, VPN, and admin logins. The switch or router asks the RADIUS server whether the credentials are good.

Redistribution — Taking routes learned by one routing protocol and injecting them into another. It is where most routing loops and suboptimal paths are born, so it needs filtering and careful metrics.

Route map — A named list of match/set clauses applied to routes or packets. match selects which items are affected; set changes them.

Route reflector — An iBGP router that relays routes to its clients, replacing the full mesh that iBGP otherwise requires. It is the standard way to scale BGP inside an AS.

Route table — The list of destinations a device knows and where it will send traffic for each one.

Router — A device that forwards packets between networks using Layer-3 addresses. It breaks up broadcast domains and marks where one subnet ends and the next begins.

Routing policy — The rules that decide which routes are accepted, preferred, and advertised. In BGP, policy usually matters more than the protocol's own path calculation.

RPKI (Resource Public Key Infrastructure) — A system that cryptographically certifies which AS is allowed to originate which prefixes. It prevents a whole class of BGP hijacks.

RSTP (Rapid Spanning Tree Protocol) — The 802.1w version of STP, converging in under a second instead of tens of seconds. It is the default on modern switches.

S

SD-WAN (Software-Defined WAN) — A policy-driven overlay that spreads traffic across several WAN links according to application needs. It replaces static routing over expensive circuits with measured, per-application path selection.

Segment — The Layer-4 unit: a TCP or UDP header plus payload. The word is also used loosely to mean a piece of a network, so context matters.

Shaping — Delaying packets to keep the rate at or below a limit. Unlike policing, it does not drop traffic; it smooths bursts by buffering them.

SLAAC (Stateless Address Autoconfiguration) — IPv6 hosts build their own address from the prefix a router advertises plus an interface ID. No DHCP server is involved.

SNMP (Simple Network Management Protocol) — The classic protocol for polling counters and receiving traps from devices. Streaming telemetry is replacing it, but it is still everywhere.

Spanning tree — The protocol that keeps a switched network loop-free by electing a root bridge and blocking redundant ports. Without it, one loop saturates a network in seconds.

Static route — A route configured by hand. It does not adapt to failures unless it is paired with something like BFD or a floating backup.

STP (Spanning Tree Protocol) — The IEEE 802.1D protocol that prevents Layer-2 loops. It blocks ports so that exactly one active path exists between any two points.

Subnet — A slice of a larger network, defined by a prefix. Subnetting is the act of choosing where to split the host bits.

Subnet mask — The 32-bit value with 1s in the network bits and 0s in the host bits. The device ANDs it with an address to find the network.

Summarization — Advertising one short prefix instead of many longer ones. It shrinks routing tables, but it hides detail, so a flapping component can still affect the whole summary.

SVI (Switch Virtual Interface) — A Layer-3 interface that represents a VLAN on a switch, used for management or for routing between VLANs.

Switch — A device that forwards frames within a network using MAC addresses. It learns which MAC is on which port and floods only what it has to.

Syslog — The standard for shipping log messages to a central server. It is the first place to look when something changed at 2 a.m.

T

TACACS+ — A Cisco-originated AAA protocol that separates authentication, authorization, and accounting and encrypts the whole payload. It is common for device administration rather than user access.

TCP (Transmission Control Protocol) — A connection-oriented transport that guarantees ordered delivery, retransmits lost data, and adjusts its rate to the network. Web, SSH, and most control traffic use it.

Throughput — The rate actually achieved, as opposed to the link's capacity. Overhead, loss, and latency keep it below the advertised bandwidth.

TLS (Transport Layer Security) — The protocol that encrypts and authenticates application traffic; HTTPS is HTTP inside TLS. It replaced SSL.

Traceroute — A tool that reveals the path by sending packets with increasing TTL values and collecting the "time exceeded" replies. Missing hops usually mean filtering, not a broken path.

Transit — Carrying traffic between two other networks for a fee. It is the opposite of peering.

Trunk — A link that carries several VLANs at once, tagging each frame with its VLAN ID (802.1Q). Access ports carry one untagged VLAN; a trunk is what connects two switches, or a switch to a router that needs to route between VLANs.

TTL (Time to Live) — A counter in the IP header that decreases at every router. At zero the packet is dropped — which stops loops and is what makes traceroute possible.

Tunnel — An encapsulation that makes a packet look like it belongs to another network. VPNs and overlays are built from tunnels.

U

UDP (User Datagram Protocol) — A connectionless transport with no retransmission and no ordering. DNS, DHCP, and voice use it because a late packet is worse than a lost one.

ULA (Unique Local Address) — IPv6 private space, fc00::/7. It is not routable on the internet and plays the role RFC 1918 plays for IPv4.

Unicast — One sender, one receiver, addressed to a single host. It is the normal case for almost all traffic, and it is what a switch forwards using its CAM table instead of flooding.

Underlay — The physical network that carries an overlay's tunnels. If the underlay is unstable, the overlay inherits every problem.

uRPF (Unicast Reverse Path Forwarding) — An anti-spoofing check: accept a packet only if the source address is reachable through the interface it arrived on.

V

VLAN (Virtual LAN) — A logical broadcast domain inside a switch. Ports in different VLANs cannot talk at Layer 2 even when they are on the same physical switch.

VLSM (Variable Length Subnet Mask) — Using different prefix lengths inside one address block so every subnet is sized to its actual need instead of all being equal.

VRF (Virtual Routing and Forwarding) — Several independent routing tables on one device. It lets overlapping addresses coexist, which is the basis of MPLS VPNs and multi-tenant designs.

VRRP (Virtual Router Redundancy Protocol) — The open-standard first-hop redundancy protocol. It does the job of HSRP without being vendor-specific.

VXLAN (Virtual Extensible LAN) — A tunnel that carries Layer-2 frames over a Layer-3 network, identified by a 24-bit VNI. It allows far more segments than 802.1Q's 4094 VLANs.

W

WAN (Wide Area Network) — The links that connect sites across a provider's infrastructure, as opposed to the LAN inside one site.

Wildcard mask — The inverse of a subnet mask, used in ACLs and OSPF network statements. A 0 bit means "must match"; a 1 bit means "don't care".

Wireshark — The packet analyzer. It is the only tool that shows what actually crossed the wire, which is why it settles most arguments.

Y

YANG — The data modelling language that describes a device's configuration and state as a structured tree. NETCONF and gNMI both carry YANG-modelled data.

Z

Zero trust — A security model that authenticates and authorizes every request instead of trusting anything because it is "inside". The network becomes transport, not a trust boundary.