Complete Networking Study Guide

COMPUTER NETWORKING
Complete Study Guide with Explanations

From Beginner to Advanced

Page 1 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 1: Introduction to Computer Networks

1.1 What Is a Computer Network?

A computer network is a collection of two or more computing devices connected together so they can
communicate, share data, and use shared resources. Think of it like a system of roads connecting cities —
the cities are computers and the roads are the connections between them. Just as roads let people and
goods travel between cities, a network lets data travel between computers.

Before networks existed, every computer was isolated. If you wanted to share a document between two
computers, you had to physically copy it to a floppy disk and carry it to the other machine — nicknamed the
"sneakernet." Networks eliminated this inconvenience and enabled the modern digital world.

💡 Real-World Analogy
Think of a computer network like the postal system. Your computer is your home. Data packets are
letters. The internet is the global postal network. Routers are sorting centres that read the
destination address and forward the letter to the next step. Protocols are the rules about how letters
must be addressed and formatted so any post office in the world can handle them.

1.2 Why Do We Need Networks?

Networks exist to solve practical problems. Here is what they enable:
• Resource sharing: Multiple computers share one printer, one internet connection, one file server
• Communication: Email, instant messaging, video calls, social media
• Data sharing: Access the same files from any device, anywhere
• Centralized management: IT teams manage security, updates, and backups from one place
• Cost saving: Share expensive hardware like printers and servers instead of buying one for each
computer
• Reliability: Backup paths mean if one link fails, data finds another route

1.3 Types of Networks by Size

Networks are categorized primarily by their geographic scope:

Page 2 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Type Full Name Range Speed Example

PAN Personal Area Network < 10 meters Up to 3 Mbps Phone + laptop

via Bluetooth

LAN Local Area Network Room to campus 10 Mbps – 10 Home WiFi, office
Gbps network

MAN Metropolitan Area City-wide 10 Mbps – 1 City cable TV, ISP

Network Gbps network

WAN Wide Area Network Countries/global Varies widely The Internet,

corporate VPN

CAN Campus Area Network University/corp 1–10 Gbps University

campus network

SAN Storage Area Network Data center 1–32 Gbps Enterprise disk
storage

WLAN Wireless LAN Building 11 Mbps – 9.6 Wi-Fi in your

Gbps home

1.4 Network Topologies — How Devices Are Connected

Topology refers to the physical or logical layout of how devices are connected. The arrangement affects
performance, cost, and fault tolerance.

Bus Topology
All devices are connected to a single central cable called the bus or backbone. Data sent by any device
travels along the entire cable and every device "sees" it — but only the device with the matching address
actually processes it.
• Advantage: Simple and cheap to set up. Requires little cabling.
• Disadvantage: If the main cable fails, the entire network goes down. Performance degrades as
more devices are added. Only one device can transmit at a time.
• Used in: Early Ethernet (10BASE-2 coaxial cable), legacy systems

Star Topology
All devices connect to a central device — either a hub or (more commonly today) a switch. Communication
between any two devices goes through the central device.
• Advantage: If one connection fails, only that device is affected. Easy to add or remove devices. Easy
to troubleshoot.
• Disadvantage: If the central switch/hub fails, the entire network fails. Requires more cable than
bus.

Page 3 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• Used in: Modern office and home networks (Ethernet with switches, Wi-Fi with access points)

Ring Topology
Devices are connected in a circular chain. Data travels in one direction around the ring. Each device acts as
a repeater, boosting the signal before passing it on.
• Advantage: Equal access for all devices, no collisions, predictable performance.
• Disadvantage: If any device or cable fails, the entire ring breaks (unless a dual ring is used).
Adding/removing devices disrupts the network.
• Used in: Token Ring networks (largely obsolete), SONET/SDH optical networks in telecoms

Mesh Topology
Every device has a direct connection to every other device. If there are N devices, each needs N-1
connections.
• Advantage: Extremely reliable — if any link fails, data takes another path. No single point of failure.
• Disadvantage: Very expensive. The number of connections grows as N(N-1)/2. Complex to manage.
• Used in: Internet backbone, military networks, critical infrastructure

Tree (Hierarchical) Topology

A hierarchy of star networks connected together — like a family tree. A root switch connects to distribution
switches, which connect to access switches, which connect to end devices.
• Advantage: Highly scalable. Mirrors how most enterprise networks are actually built.
• Disadvantage: If the root node fails, whole sections go down. More complex to configure.
• Used in: Large enterprise networks, ISPs, campus networks

🔑 Key Insight: Hybrid Topology

Modern real-world networks almost never use a single topology. Most large networks are hybrids —
for example, a star topology at the building level, connected in a mesh between buildings, all
connected via a tree hierarchy for the overall campus. Understanding the pros and cons of each
topology helps you understand WHY large networks are designed the way they are.

1.5 Network Devices — The Hardware That Makes It Work

Each device in a network has a specific job. Understanding these devices is fundamental to understanding
how networks function.

Page 4 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Hub
A hub is the simplest network device — a "dumb" box with multiple ports. When a hub receives data on
one port, it blindly broadcasts (repeats) that data out of ALL other ports. Every device on the hub receives
every packet, even if the packet is not meant for them.
• Problem: This creates lots of unnecessary traffic and collisions. If two devices transmit
simultaneously, the signals collide and corrupt each other.
• Works at: Layer 1 (Physical) of the OSI model
• Status: Obsolete. Replaced by switches in all modern networks.

Switch
A switch is an intelligent hub. It learns the MAC address of every device connected to each of its ports by
examining incoming frames. It builds a MAC address table (also called a CAM table). When a frame arrives,
the switch looks up the destination MAC address in its table and forwards the frame ONLY to the correct
port.
• Benefit: Eliminates unnecessary traffic. Creates a private "virtual circuit" between sender and
receiver. No collisions.
• Works at: Layer 2 (Data Link) of the OSI model
• Advanced versions (Layer 3 switches) can also do routing
• Used in: Every modern LAN

Router
A router connects different networks together. While a switch connects devices on the same network, a
router connects your home network to the internet, or connects the New York office network to the
London office network. Routers make decisions based on IP addresses, finding the best path for data to
reach its destination across many networks.
• Routers maintain routing tables — databases of known network routes and their costs
• Works at: Layer 3 (Network) of the OSI model
• Routers separate broadcast domains — broadcast traffic doesn't cross routers

Access Point (AP)

An access point is the device that creates a Wi-Fi network. It connects wirelessly to devices (laptops,
phones) and connects them to the wired network via an Ethernet cable.
• In homes, the router and access point are usually combined in one device (your "router" is actually
a router + switch + access point + modem)
• Works at: Layer 2 (Data Link)

Page 5 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Modem
A modem converts (modulates and demodulates) signals between your home network's digital signals and
the type of signal your ISP uses on their lines (which might be cable, fiber, or telephone lines). "Modem" =
Modulator-Demodulator.

Firewall
A firewall monitors and controls all network traffic entering and leaving a network based on security rules.
It's like a security guard checking everyone who enters a building. Firewalls can block suspicious traffic,
prevent unauthorized access, and log network activity.

Device OSI Layer Addresses Used Key Function

Repeater Layer 1 – Physical None Boost and regenerate

signals

Hub Layer 1 – Physical None Broadcast to all ports

Bridge Layer 2 – Data Link MAC address Connect two LAN

segments

Switch Layer 2 – Data Link MAC address Forward frames to

correct port only

Router Layer 3 – Network IP address Route packets between

networks

Firewall Layers 3–7 IP, Port, Content Filter traffic based on

rules

Gateway All Layers Multiple Connect different

protocol networks

Page 6 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 2: The OSI Model — How Networks Communicate

The OSI (Open Systems Interconnection) model is the most important conceptual framework in networking.
Created by the International Organization for Standardization (ISO) in 1984, it divides network
communication into 7 distinct layers. Each layer has a specific job, and each layer communicates with the
layers directly above and below it.

ℹ️ Why the OSI Model Matters

The OSI model is like a blueprint for communication. It allows equipment from different
manufacturers to work together, because they all follow the same layered rules. When a Cisco router
talks to a Juniper router, they both follow OSI. When your iPhone talks to a Windows PC, they both
follow OSI. The model also helps engineers troubleshoot problems — by understanding which layer a
problem occurs at, you know exactly what to investigate.

2.1 The Seven Layers — Full Explanation

Layer # Name Data Unit Key Protocols Devices

7 Application Data HTTP, HTTPS, FTP, SMTP, Computers, servers

DNS, SSH

6 Presentation Data SSL/TLS, JPEG, MPEG, ASCII, Computers

Unicode

5 Session Data NetBIOS, RPC, PPTP, NFS Computers

4 Transport Segment TCP, UDP Computers, firewalls

3 Network Packet IP, ICMP, IGMP, ARP Routers, L3 switches

2 Data Link Frame Ethernet, Wi-Fi (802.11), PPP, Switches, bridges, NICs
MAC

1 Physical Bit Ethernet cables, fiber, radio Hubs, repeaters, cables

waves

Layer 7 — Application Layer

This is the layer closest to the end user. It provides the interface between the user's software and the
network. When you open a web browser and type in a URL, your browser (the application) uses HTTP — an
Application Layer protocol — to request the web page.

Page 7 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Important: The "Application Layer" does NOT mean your apps (like Chrome or Word) themselves are part of
this layer. It means the network services and protocols that apps USE to communicate.
• Examples of Layer 7 protocols: HTTP (web), HTTPS (secure web), FTP (file transfer), SMTP (sending
email), POP3/IMAP (receiving email), DNS (domain name lookup), SSH (secure remote access),
SNMP (network management)
• Think of it as: The waiter in a restaurant — this is what the customer (user) directly interacts with

Layer 6 — Presentation Layer

The Presentation Layer is responsible for data formatting, translation, encryption, and compression. It
ensures that data sent by the Application Layer in one system can be read by the Application Layer in
another system, regardless of how each system stores data internally.
• Data translation: Converting between different character encodings (e.g., ASCII to Unicode)
• Encryption/Decryption: SSL/TLS operates here — it encrypts your data before sending and decrypts
it upon receipt
• Compression: Reducing data size for faster transmission (e.g., JPEG images, MP3 audio)
• Think of it as: A translator who converts between languages so both parties understand each other

Layer 5 — Session Layer

The Session Layer manages sessions — conversations between two applications. It establishes, maintains,
and terminates these sessions in an orderly way. It also handles synchronization, which allows a long file
transfer to resume from a checkpoint if interrupted.
• Session establishment: Setting up the dialogue between two applications
• Synchronization: Inserting checkpoints into data streams so interrupted transfers can resume
• Session termination: Properly closing sessions when communication is complete
• Example: When you log into a remote server, the Session Layer manages the login session
• Think of it as: A moderator in a conversation who ensures turns are taken and discussions can
resume after interruption

Layer 4 — Transport Layer

The Transport Layer is one of the most important layers. It provides end-to-end communication between
applications on different hosts. It takes the data from upper layers and breaks it into smaller chunks called
segments. It also handles error recovery and flow control.
• Segmentation: Breaking large data into smaller segments for transmission
• Error recovery: Detecting and requesting retransmission of lost or corrupted segments (TCP)
• Flow control: Preventing a fast sender from overwhelming a slow receiver
• Port numbers: Identifying specific applications on a host (e.g., port 80 for HTTP, port 443 for HTTPS)

Page 8 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• Two main protocols: TCP (reliable, connection-oriented) and UDP (fast, connectionless)
• Think of it as: A shipping company that picks up packages, assigns tracking numbers, and
guarantees delivery (TCP) or just drops them off with no tracking (UDP)

Layer 3 — Network Layer

The Network Layer handles logical addressing and routing — determining the best path for data to travel
from source to destination across multiple networks. This is where IP addresses live.
• IP addressing: Every device gets a unique IP address that identifies it on the network
• Routing: Finding the best path through multiple networks to reach the destination
• Packet forwarding: Moving packets hop-by-hop through routers toward the destination
• Fragmentation: Breaking packets into smaller pieces if a network along the path has a smaller
maximum packet size
• Key protocols: IPv4, IPv6, ICMP (ping uses this), ARP
• Think of it as: A GPS navigation system — it knows the layout of all roads (networks) and calculates
the best route

Layer 2 — Data Link Layer

The Data Link Layer handles communication within a single network segment (like your local Ethernet or
Wi-Fi network). It uses MAC addresses — physical hardware addresses burned into every network interface
card (NIC). It takes packets from the Network Layer and encapsulates them into frames for transmission.
• MAC addressing: 48-bit physical addresses used to identify devices on the same local network
• Framing: Wrapping packets in a frame with source/destination MAC addresses, data, and error-
checking code
• Error detection: Using CRC (Cyclic Redundancy Check) to detect corrupted frames
• Media access control: Deciding when a device is allowed to use the shared medium (e.g., CSMA/CD
for Ethernet)
• Divided into two sublayers: LLC (Logical Link Control) interfaces with Layer 3, MAC interfaces with
Layer 1
• Think of it as: The local street rules — who gives way, how you identify houses on your street (MAC
= house number on your street)

Layer 1 — Physical Layer

The Physical Layer is responsible for the actual transmission of raw bits (0s and 1s) over a physical medium.
It defines the electrical, optical, or radio signals that represent data, the type of connectors used, and the
speeds of transmission.
• Encoding: How bits are represented as electrical voltages, light pulses, or radio waves

Page 9 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• Cable specifications: What type of cable is used, its pinout, and maximum length
• Synchronization: Making sure sender and receiver are reading bits at the same rate
• Examples: Copper Ethernet cables (Cat5e, Cat6), fiber optic cables, radio waves (Wi-Fi), coaxial
cable
• Think of it as: The physical road itself — the asphalt, lanes, and road rules that vehicles (bits) travel
on

2.2 How the Layers Work Together — Encapsulation

When you send an email, here's what actually happens as data passes DOWN through the OSI layers on
your computer (encapsulation), travels to the recipient, and passes UP through their layers (de-
encapsulation):

Step Layer What Happens Data Unit

1 Application (7) Email app hands Data

message to the network
stack

2 Presentation (6) Data is encrypted (if Data

HTTPS/SSL) and
formatted

3 Session (5) Session is established Data

with the destination
server

4 Transport (4) Data broken into Segment

segments; TCP/UDP
header added (port
numbers, sequence
numbers)

5 Network (3) IP header added (source Packet

IP, destination IP);
segment becomes a
packet

6 Data Link (2) MAC header and trailer Frame

added (source MAC,
destination MAC, CRC);
packet becomes a frame

7 Physical (1) Frame converted to bits Bits

and transmitted as
electrical signals, light, or
radio waves

Page 10 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

📌 Encapsulation Analogy
Imagine putting a letter into an envelope. The letter is your data (Layer 7). You seal it and write your
friend's apartment number on it — that's the Transport Layer (port number). Then you put it in
another envelope with street addresses — that's the Network Layer (IP address). The postal worker
wraps it in a shipping label with local sorting codes — that's the Data Link Layer (MAC address).
Finally, it's converted into a barcode scan signal — that's the Physical Layer (bits). At the destination,
all these wrappers are removed in reverse order.

2.3 Memory Aids for the OSI Layers

Top to Bottom (Layer 7 down to Layer 1): "All People Seem To Need Data Processing"
• A – Application
• P – Presentation
• S – Session
• T – Transport
• N – Network
• D – Data Link
• P – Physical

Bottom to Top (Layer 1 up to Layer 7): "Please Do Not Throw Sausage Pizza Away"

Page 11 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 3: The TCP/IP Model — The Internet's Real Framework

While the OSI model is excellent for understanding and teaching networking concepts, the actual internet
runs on the TCP/IP model. Developed in the 1970s by DARPA for the ARPANET (the precursor to the
internet), TCP/IP is the practical, real-world model used by every device connected to the internet today.

3.1 TCP/IP vs OSI — What's the Difference?

The TCP/IP model has 4 layers instead of 7. It merges some OSI layers together because, in practice, the
distinctions weren't always necessary. Here's how they map:

TCP/IP Layer OSI Layers It Covers Protocols Role

Application OSI Layers 5, 6, 7 HTTP, HTTPS, FTP, SMTP, DNS, SSH, Application services
Telnet, SNMP, DHCP, POP3, IMAP and user interface

Transport OSI Layer 4 TCP, UDP End-to-end delivery,

reliability, ports

Internet OSI Layer 3 IP (IPv4/IPv6), ICMP, ARP, RARP, Logical addressing,

IGMP routing, path selection

Network Access OSI Layers 1, 2 Ethernet, Wi-Fi (802.11), PPP, ARP, Physical transmission
LLC, MAC and local delivery

💡 OSI vs TCP/IP — Which to Learn?

Learn BOTH. OSI is the universal language for discussing and troubleshooting networking —
engineers always refer to "Layer 2 problems" or "Layer 3 routing." TCP/IP is what actually runs on
every device. In practice, networking professionals use OSI terminology but implement TCP/IP
protocols. Both frameworks are tested in every major networking certification (CCNA, CompTIA
Network+, etc.).

3.2 The Internet Layer (IP) — The Heart of TCP/IP

The Internet Layer is responsible for addressing and routing packets across multiple networks. The IP
(Internet Protocol) is its core protocol. IP is connectionless and unreliable by design — it just tries its best to
deliver packets. Reliability is handled by TCP at the Transport layer if needed.

Page 12 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

IP Packet: The fundamental unit of data at the Internet Layer. Contains a source IP address, destination IP
address, and the data (payload)
Connectionless: IP doesn't set up a connection before sending. Each packet is handled independently and
may take different routes
Best-effort delivery: IP tries to deliver packets but makes no guarantees. Packets can be lost, duplicated, or
arrive out of order

3.3 Key Protocols at Each Layer

Application Layer Protocols

HTTP/HTTPS: HyperText Transfer Protocol. The foundation of the web. HTTP is unencrypted (port 80);
HTTPS adds TLS encryption (port 443)
DNS: Domain Name System. Translates human-readable names ([Link]) into IP addresses. Uses port
53
DHCP: Dynamic Host Configuration Protocol. Automatically assigns IP addresses to devices joining a
network. Uses ports 67/68
FTP: File Transfer Protocol. Transfers files between computers. Uses ports 20 (data) and 21 (control)
SMTP: Simple Mail Transfer Protocol. Sends email. Uses port 25 (or 587 for encrypted)
SSH: Secure Shell. Encrypted remote command-line access. Uses port 22

Transport Layer Protocols

TCP: Transmission Control Protocol. Reliable, connection-oriented. Guarantees delivery, ordering, and error
checking. Used when accuracy matters
UDP: User Datagram Protocol. Fast, connectionless. No delivery guarantee. Used when speed matters more
than perfect accuracy

Internet Layer Protocols

IPv4/IPv6: The actual addressing protocols. IPv4 uses 32-bit addresses; IPv6 uses 128-bit addresses
ICMP: Internet Control Message Protocol. Used for error messages and diagnostics. ping uses ICMP Echo
Request/Reply
ARP: Address Resolution Protocol. Finds the MAC address of a device when you know its IP address

Page 13 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 4: IP Addressing — The Network Address System

An IP address is a unique numerical label assigned to every device connected to a network. It serves two
main purposes: identifying the host (who you are) and providing location information (where you are in the
network). Think of it like a home address — it tells the postal system both who to deliver to and where to
find them.

4.1 IPv4 Addressing

IPv4 (Internet Protocol version 4) uses 32-bit addresses. A 32-bit address is written as four groups of 8 bits
(octets), each converted to decimal, separated by dots. This is called dotted-decimal notation.

📌 How Binary Becomes an IP Address

An IPv4 address like [Link] is actually stored as 32 binary bits:

11000000 . 10101000 . 00000001 . 01100100

192 168 1 100

Each group of 8 bits (one octet) can range from 00000000 (0) to 11111111 (255). That's why each
octet in an IPv4 address is between 0 and 255.

4.2 IPv4 Address Classes

Originally, IPv4 addresses were divided into classes based on the first few bits of the address. The class
determined which portion of the address was the Network ID and which was the Host ID. While classful
addressing is largely replaced by CIDR today, understanding classes is still essential.

Class First Octet Default Subnet Network Host Max Hosts Intended Use
Range Mask Bits Bits

A 1 – 126 [Link] (/8) 8 24 16,777,214 Very large

organizations

B 128 – 191 [Link] (/16) 16 16 65,534 Medium

organizations

C 192 – 223 [Link] 24 8 254 Small

(/24) organizations

Page 14 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

D 224 – 239 N/A N/A N/A N/A Multicast groups

E 240 – 255 N/A N/A N/A N/A Research/

Reserved

💡 Why 127 is Missing from Class A

The range [Link]/8 is reserved for loopback addresses. The most famous is [Link], which
always refers to 'this device itself.' When you ping [Link], you're testing your own network stack
without sending anything over the wire. This is why Class A starts at 1 and jumps to 128 for Class B —
127 is its own special category.

4.3 Special and Private IP Addresses

Not all IP addresses can be used freely on the internet. Several ranges are reserved for specific purposes:

Address / Range Purpose Explanation

[Link]/8 Loopback [Link] = 'myself.' Packets to

this address never leave the
device

[Link]/8 Private (Class A) Not routed on internet. Used

internally in large orgs. 16M+
hosts

[Link]/12 Private (Class B) [Link] – [Link]. Used

in mid-size private networks

[Link]/16 Private (Class C) Most common in homes and small

offices. 192.168.1.x range

[Link]/16 APIPA / Link-Local Auto-assigned when DHCP fails.

Means 'I couldn't get a real IP'

[Link]/0 Default Route Matches all destinations — used

as the 'last resort' route

[Link] Broadcast Sends to ALL devices on the local

network segment

[Link]/4 Multicast Send once, received by multiple

subscribed devices

ℹ️ Why Private IP Addresses Exist

The internet has only about 4.3 billion IPv4 addresses. With billions of devices in the world, there
aren't enough public IPs for everyone. The solution: private IP addresses. Your home has devices

Page 15 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

with IPs like [Link], [Link], etc. These are not unique globally — millions of other homes
use the exact same private IPs. NAT (Network Address Translation) translates between your private
addresses and your single public IP when communicating with the internet. This is why billions of
devices can be connected to the internet despite the IPv4 address shortage.

4.4 Subnet Masks — Dividing Networks

A subnet mask tells you which part of an IP address is the network portion and which part is the host
portion. It's a 32-bit number written in the same dotted-decimal format as an IP address. Where there's a 1-
bit in the mask, that bit belongs to the network. Where there's a 0-bit, that bit belongs to the host.

📌 Understanding Subnet Masks

IP Address: [Link]

Subnet Mask: [Link]

In Binary:

IP: 11000000.10101000.00000001.01100100

Mask: 11111111.11111111.11111111.00000000

The 1-bits in the mask identify the NETWORK: 192.168.1

The 0-bits in the mask identify the HOST: .100

Network address: [Link] (all host bits = 0)

Broadcast address: [Link] (all host bits = 1)

Usable hosts: [Link] through [Link] (254 hosts)

4.5 CIDR Notation — The Modern Standard

CIDR (Classless Inter-Domain Routing) replaces the old class system with a more flexible approach. Instead
of fixed class boundaries, you can specify any prefix length using slash notation. /24 means the first 24 bits
are the network portion, leaving 8 bits for hosts.

CIDR Prefix Subnet Mask # Usable Hosts Typical Use

/8 [Link] 16,777,214 Very large networks,

Page 16 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

entire Class A

/16 [Link] 65,534 Large corporate

networks

/24 [Link] 254 Small office or building

segment

/25 [Link] 126 Half a /24

/26 [Link] 62 Quarter of a /24

/27 [Link] 30 Small segment

/28 [Link] 14 Small group of devices

/29 [Link] 6 Very small segment

/30 [Link] 2 Point-to-point links

between routers

/32 [Link] 1 (single host) Specific host route

Formula: Number of usable hosts = 2^(32 - prefix) - 2

We subtract 2 because the network address (all host bits = 0) and broadcast address (all host bits = 1)
cannot be assigned to hosts.

4.6 Subnetting Example — Step by Step

You have been given the network [Link]/24 and need to create 4 equal subnets. What are the
subnets?

1. Determine how many bits you need to borrow: You need 4 subnets. 2² = 4, so borrow 2 bits from
the host portion.
2. New prefix: /24 + 2 = /26 (subnet mask: [Link])
3. Hosts per subnet: 2^(32-26) - 2 = 2^6 - 2 = 64 - 2 = 62 usable hosts per subnet
4. Block size: 256 - 192 = 64. Subnets increment by 64.

Subnet Network Address First Host Last Host Broadcast

1 [Link]/26 [Link] [Link] [Link]

2 [Link]/26 [Link] [Link] [Link]

3 [Link]/26 [Link] [Link] [Link]

4 [Link]/26 [Link] [Link] [Link]

Page 17 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

4.7 IPv6 — The Future of IP Addressing

IPv6 was developed to solve the IPv4 address exhaustion problem. It uses 128-bit addresses, providing 340
undecillion (3.4 × 10^38) unique addresses — enough for every grain of sand on Earth to have trillions of
addresses.

IPv6 Address Format

Written as 8 groups of 4 hexadecimal digits separated by colons:
2001:0db8:85a3:0000:0000:8a2e:0370:7334

Simplification rules (to reduce typing):

• Rule 1: Leading zeros in each group can be omitted: 0db8 → db8, 0000 → 0
• Rule 2: One or more consecutive all-zero groups can be replaced with :: (but only once)
• Example: 2001:0db8:0000:0000:0000:0000:0000:0001 simplifies to 2001:db8::1

IPv6 Address Type Prefix Purpose Example

Loopback ::1/128 Same as [Link] in IPv4 ::1

Link-Local fe80::/10 Auto-configured, only fe80::1

works on local segment

Unique Local fc00::/7 Like private IPv4 fd00::1

addresses, not routed on
internet

Global Unicast 2000::/3 Publicly routable 2001:db8::1

internet addresses

Multicast ff00::/8 One-to-many ff02::1 (all nodes)

communication

Unspecified ::/128 Like [Link] in IPv4 ::

Feature IPv4 IPv6

Address size 32 bits 128 bits

Notation Dotted decimal ([Link]) Hex with colons (2001:db8::1)

Address space ~4.3 billion ~340 undecillion

Header size 20 bytes (variable) 40 bytes (fixed)

Fragmentation By routers and hosts By hosts only

Checksum Yes (in header) No (removed for speed)

Page 18 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

NAT required? Usually yes (due to shortage) No (enough addresses for all)

Auto-configuration DHCP (manual or server) SLAAC (fully automatic)

Security Optional (IPSec) IPSec support built-in

Broadcast Yes No (replaced by multicast)

Page 19 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 5: TCP and UDP — Transport Layer Protocols

TCP and UDP are the two main protocols at the Transport Layer. They serve different purposes and are
used in different situations. Understanding the difference between them is fundamental to understanding
how applications communicate over a network.

5.1 TCP — Transmission Control Protocol

TCP is a connection-oriented, reliable protocol. Before any data is sent, TCP establishes a connection
between sender and receiver. TCP guarantees that all data arrives correctly, in the right order, without
errors. If packets are lost, TCP detects this and retransmits them.

📌 TCP Is Like Sending a Package with Registered Mail

Before sending, you must confirm the recipient's address (connection setup). Each package gets a
tracking number (sequence number). The recipient signs for every delivery (acknowledgment). If a
package doesn't arrive, you know — and send it again (retransmission). Packages arrive in the right
order, even if they took different routes. This makes TCP perfect when accuracy matters — web
pages must display completely and correctly.

TCP Features
Connection-oriented: A connection must be established (via 3-way handshake) before any data is sent
Reliability: Every segment is acknowledged. If no acknowledgment arrives, the segment is retransmitted
Ordering: Sequence numbers ensure data is reassembled in the correct order at the destination
Flow control: The receiver tells the sender how much data it can handle (using the window size field).
Prevents overwhelming a slow receiver
Congestion control: TCP reduces sending rate when network congestion is detected (detects this via lost
packets)
Error checking: Checksum field detects corrupted data

TCP 3-Way Handshake — Establishing a Connection

Before TCP can send data, both sides must agree to communicate. This is done with the 3-way handshake:

Step Who Sends Flags Meaning

Page 20 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

1 Client → Server SYN Client says: 'I want to

communicate. My
starting sequence
number is X.'

2 Server → Client SYN + ACK Server says: 'OK, I'm

ready. My starting
sequence number is Y. I
acknowledge your
sequence X.'

3 Client → Server ACK Client says: 'Great,

connection established. I
acknowledge your
sequence Y.'

After the handshake, data can flow in both directions. The connection is "full-duplex."

TCP 4-Way Termination — Closing a Connection

Closing a TCP connection takes 4 steps because each side must independently close its half of the
connection:

Step Who Sends Flag Meaning

1 Client → Server FIN Client says: 'I'm done

sending.'

2 Server → Client ACK Server says:

'Acknowledged. But I
might still have data to
send.'

3 Server → Client FIN Server says: 'I'm also

done sending now.'

4 Client → Server ACK Client says:

'Acknowledged.
Connection fully closed.'

5.2 UDP — User Datagram Protocol

UDP is a connectionless, unreliable protocol. It simply sends packets (datagrams) to the destination without
establishing a connection first, without tracking if they arrived, and without any mechanism to retransmit
lost packets.

Page 21 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

📌 UDP Is Like Dropping Flyers from a Helicopter

You don't know if anyone picked them up. You don't know if they arrived in the right order. You
don't call back to confirm receipt. But it's extremely fast — you can distribute thousands of flyers in
seconds. UDP is perfect for situations where speed matters more than perfection: live video
streaming, online gaming, VoIP calls, DNS lookups. A slightly dropped frame in a video call is
acceptable; waiting for TCP retransmission would cause noticeable lag.

UDP Features
Connectionless: No handshake — data is sent immediately without establishing a connection
No reliability: No acknowledgments. If a packet is lost, it's gone — UDP won't retransmit it
No ordering: Packets may arrive out of order; UDP doesn't reorder them
Low overhead: UDP header is only 8 bytes (vs 20+ bytes for TCP), making it much faster
No flow/congestion control: Sender can flood the network — upper-layer applications must manage this if
needed

5.3 TCP vs UDP Comparison

Feature TCP UDP

Connection model Connection-oriented (3-way Connectionless

handshake)

Reliability Guaranteed delivery (ACKs + Best-effort only

retransmission)

Ordering In-order delivery guaranteed No ordering guarantee

Speed Slower (overhead for reliability) Much faster

Header size 20–60 bytes 8 bytes fixed

Flow control Yes (sliding window) No

Error checking Yes (checksum + retransmission) Checksum only (no

retransmission)

Congestion control Yes No

Full/half duplex Full-duplex Full-duplex

Broadcasting No Yes

Use cases HTTP, HTTPS, FTP, SSH, Email DNS, VoIP, Video streaming,
Gaming, DHCP

Page 22 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

5.4 Port Numbers — Identifying Applications

A port number is a 16-bit number (0–65535) that identifies a specific process or service on a host. Think of
the IP address as the building address and the port number as the apartment number within that building.
When data arrives at [Link]:443, the host knows it's destined for the HTTPS server (apartment
443).

Port Range Name Description

0 – 1023 Well-Known Ports Reserved for common services.

Require admin privileges to use

1024 – 49151 Registered Ports Registered by software vendors

for their applications

49152 – 65535 Dynamic/Ephemeral Ports Randomly assigned to client

connections (source ports)

Por Protocol Service Description

t (TCP/UDP)

20 TCP FTP Data File Transfer Protocol — data channel

21 TCP FTP File Transfer Protocol — command channel

Control

22 TCP SSH Secure Shell — encrypted remote access

23 TCP Telnet Unencrypted remote access (legacy, insecure)

25 TCP SMTP Simple Mail Transfer Protocol — sending email

53 UDP/TCP DNS Domain Name System (UDP for queries, TCP for zone transfers)

67/ UDP DHCP Dynamic Host Configuration Protocol

68

80 TCP HTTP HyperText Transfer Protocol — web browsing

110 TCP POP3 Post Office Protocol v3 — receive email

143 TCP IMAP Internet Message Access Protocol — receive email

161 UDP SNMP Simple Network Management Protocol

/16
2

443 TCP HTTPS HTTP Secure — encrypted web browsing (TLS)

465 TCP SMTPS SMTP with TLS encryption

/58
7

993 TCP IMAPS IMAP over SSL/TLS

Page 23 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

995 TCP POP3S POP3 over SSL/TLS

338 TCP RDP Remote Desktop Protocol (Windows)

9

Page 24 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 6: DNS — The Internet's Phone Book

DNS (Domain Name System) is one of the most critical services on the internet. Computers communicate
using IP addresses (like [Link]), but humans find it much easier to remember names (like
[Link]). DNS is the system that translates between the two.

ℹ️ Why DNS Is So Important

Without DNS, to visit Google you'd need to type [Link] into your browser. Without DNS,
email routing would break. Without DNS, the internet as we know it would not exist. It has been
called the 'phone book of the internet' — you look up a name and get an address. DNS is so critical
that when DNS servers go down, entire websites and services appear offline, even though the
servers themselves are perfectly fine.

6.1 How DNS Resolution Works — Step by Step

When you type [Link] into your browser, a process called DNS resolution begins. There are up
to 8 steps:

5. Browser cache check: Your browser first checks its own DNS cache. If it resolved [Link]
recently, it uses the cached result.
6. OS cache check: If browser cache misses, the operating system checks its own cache.
7. Recursive Resolver: If still not found, the query goes to your configured DNS server (usually
provided by your ISP or Google's [Link]). This server is called the recursive resolver.
8. Root Nameserver: The recursive resolver asks a root nameserver. There are 13 sets of root
nameservers globally. The root doesn't know [Link]'s IP, but knows which servers handle .com
domains.
9. TLD Nameserver: The resolver asks the .com Top-Level Domain (TLD) nameserver. It doesn't know
[Link]'s IP either, but knows which nameservers are authoritative for [Link].
10. Authoritative Nameserver: The resolver asks Google's authoritative nameserver. This server DOES
know the actual IP address for [Link].
11. Response returned: The IP address travels back to the recursive resolver, which caches it and
returns it to your computer.
12. Browser connects: Your browser now has the IP and can connect to [Link].

💡 DNS Caching and TTL

Page 25 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Every DNS record has a TTL (Time To Live) — a number in seconds indicating how long the record
should be cached. A TTL of 3600 means cache this for 1 hour. After that, the next query must do a
fresh lookup. Website owners set TTL values based on how often they change their IPs. A low TTL
(300 seconds) means changes propagate quickly but more DNS queries are made. A high TTL (86400
= 1 day) reduces DNS queries but means changes take longer to propagate.

6.2 DNS Record Types — Complete Guide

Record Name Purpose Example

A Address Maps hostname to IPv4 address [Link] → [Link]

AAAA IPv6 Address Maps hostname to IPv6 address [Link] → 2607:f8b0::200e

CNAM Canonical Name Creates an alias pointing to [Link] → [Link]

E another hostname

MX Mail Exchange Specifies mail servers for the Priority 10 → [Link]

domain, with priority

NS Name Server Specifies authoritative DNS servers [Link], [Link]

for the domain

PTR Pointer Reverse DNS — maps IP address to [Link] → [Link]

hostname

TXT Text Free-form text — used for SPF, v=spf1 include:[Link]

DKIM, domain verification

SOA Start of Authority Zone metadata: primary NS, admin Zone management info
email, serial, timers

SRV Service Specifies location of services _http._tcp → server:80

(hostname + port)

CAA Cert Authority Auth Which certificate authorities can Only Let's Encrypt allowed
issue SSL certs for domain

6.3 DNS Hierarchy

The DNS namespace is organized as a hierarchical tree. At the top is the root (represented by a dot). Below
the root are Top-Level Domains (TLDs) like .com, .org, .net, .uk. Below TLDs are second-level domains like
google, microsoft, amazon. Subdomains like www, mail, docs can be added below that.

Full domain name breakdown: [Link]

• Root: . (the implicit dot at the end of every fully-qualified domain name)

Page 26 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• .com: Top-Level Domain (TLD) — managed by Verisign

• google: Second-Level Domain — registered by Google
• www: Subdomain — managed by Google's DNS

Page 27 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 7: Routing — Finding the Best Path

Routing is the process of selecting the best path for network traffic to travel from source to destination
across one or more networks. Routers are the devices that perform this function. Each router maintains a
routing table — a database of known destinations and the best next-hop to reach them.

7.1 How Routing Works

When a router receives a packet, it examines the destination IP address and looks it up in its routing table.
The routing table tells the router which interface (port) to send the packet out of and what the next hop IP
address is. The packet hops from router to router until it reaches the destination network.

💡 Routing Table Analogy

Imagine you're driving cross-country with a GPS. Each time you reach an intersection (router), the
GPS (routing table) tells you which way to turn to get closer to your destination. You don't need to
know the entire route — just the next turn. The next intersection will figure out the turn after that.
This is how packet routing works — each router only needs to know the next hop, not the entire
path.

7.2 Types of Routing

Static Routing
An administrator manually configures routes in the router. The router will always use that route, regardless
of network changes.
• Advantage: No routing protocol overhead. Predictable. Secure (no routing protocol can be
attacked).
• Disadvantage: Doesn't adapt to failures. Every change must be manually made. Impractical for large
networks.
• Best used for: Small networks, default routes, specific security policies

Dynamic Routing
Routers automatically discover routes and share routing information with each other using routing
protocols. If a link fails, routers detect this and automatically calculate a new best path.
• Advantage: Automatically adapts to network changes. Scales to large networks. Less manual work.

Page 28 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• Disadvantage: Uses CPU, memory, and bandwidth for routing protocol traffic. More complex to
configure.
• Best used for: Medium to large networks, networks that change often, redundant paths

Default Route
A default route ([Link]/0) is a "catch-all" route used when no more specific route matches. In most
home/office networks, all internet-bound traffic uses a default route pointing to the ISP's router.

7.3 Routing Protocols

Routing protocols are the language routers use to share routing information. They are divided into two
main categories based on whether they operate within one organization (IGP) or between organizations
(EGP).

Category Subcategory Protocols Used Within / Between

IGP — Interior Gateway Distance Vector RIP, EIGRP Within a single

Protocol Autonomous System (AS)

IGP — Interior Gateway Link State OSPF, IS-IS Within a single

Protocol Autonomous System (AS)

EGP — Exterior Gateway Path Vector BGP Between different

Protocol Autonomous Systems
(internet routing)

Autonomous System (AS): A collection of IP networks under the control of a single organization or ISP that
presents a common routing policy to the internet. Each AS has a unique AS Number (ASN).

7.4 Key Routing Protocols — Detailed Explanation

RIP — Routing Information Protocol

RIP is the simplest and oldest dynamic routing protocol. It's a distance vector protocol, meaning routers
share their entire routing table with directly connected neighbours every 30 seconds. "Distance" is
measured in hop count — the number of routers a packet must pass through.
• Maximum hop count: 15. Any destination 16 or more hops away is considered unreachable. This
severely limits RIP to small networks.
• Convergence: Slow. When a link fails, it can take several minutes for all routers to update — this is
called the "count to infinity" problem.

Page 29 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• Versions: RIPv1 (classful, no VLSM), RIPv2 (classless, supports VLSM and authentication), RIPng (for
IPv6)
• Status: Largely obsolete, but still seen in small or legacy networks

OSPF — Open Shortest Path First

OSPF is the most widely used interior routing protocol. It's a link state protocol — instead of sharing routing
tables, OSPF routers share information about their directly connected links (link state advertisements, or
LSAs). Every router builds a complete map of the network topology, then independently runs Dijkstra's
shortest path algorithm to calculate the best routes.
• Metric: Cost, calculated based on bandwidth. Higher bandwidth = lower cost = preferred route.
• Convergence: Fast. Detects failures quickly and recalculates routes almost immediately.
• Areas: Large OSPF networks are divided into areas for scalability. Area 0 (the backbone area) must
connect all other areas.
• Neighbor relationships: OSPF routers form "adjacencies" with neighbours and exchange LSAs.
• Protocol number: Uses IP protocol 89 (not TCP or UDP)
• Standard: Open standard (not proprietary), works on equipment from any vendor

EIGRP — Enhanced Interior Gateway Routing Protocol

EIGRP is Cisco's proprietary routing protocol (though it has been partially opened). It's classified as an
"advanced distance vector" or "hybrid" protocol because it has features of both distance vector and link
state protocols.
• DUAL algorithm: Uses Diffusing Update Algorithm to calculate loop-free paths and provide fast
failover.
• Metric: Composite metric based on bandwidth AND delay (by default). Can also consider reliability
and load.
• Convergence: Very fast, comparable to OSPF.
• Bandwidth efficient: Unlike RIP, EIGRP only sends updates when something changes (not periodic
full table dumps).
• Best for: Networks with primarily Cisco equipment

BGP — Border Gateway Protocol

BGP is the routing protocol of the internet. It's the only EGP (Exterior Gateway Protocol) in widespread use.
Every internet service provider (ISP) and large organization that connects to the internet uses BGP. When
your ISP needs to know how to reach Amazon's servers, BGP is how that information is shared.
• Path vector protocol: BGP doesn't just track distance — it tracks the entire path (sequence of ASes)
to a destination. This allows sophisticated routing policies.

Page 30 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• Policy-based routing: Organizations can configure BGP to prefer certain routes for business reasons
(e.g., prefer a cheaper ISP).
• Convergence: Slow by design. The internet's routing tables are enormous (900,000+ routes), and
stability is more important than speed.
• Two types: iBGP (within an AS) and eBGP (between ASes)
• Uses TCP port 179
• The backbone: BGP is literally what holds the internet together. If BGP had a major bug, it could
take down the internet.

7.5 Administrative Distance

When a router learns about the same network from multiple sources (e.g., a static route AND OSPF both
say how to reach [Link]/8), it must decide which source to trust. Administrative Distance (AD) is a value
from 0-255 that indicates the trustworthiness of a routing source — lower is better.

Route Source Default AD Notes

Directly Connected 0 The most trusted — you're directly

attached to that network

Static Route 1 Manually configured, nearly as

trusted as connected

EIGRP (summary) 5 EIGRP summary routes

External BGP (eBGP) 20 Routes learned from other

organizations

EIGRP (internal) 90 Routes learned within EIGRP

OSPF 110 Open Shortest Path First

IS-IS 115 Intermediate System to

Intermediate System

RIP 120 Routing Information Protocol

External EIGRP 170 Routes redistributed into EIGRP

from external sources

Internal BGP (iBGP) 200 Routes learned within same AS via

BGP

Unknown/Unreachable 255 Route will never be used

Page 31 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 8: Switching, VLANs, and Spanning Tree

8.1 How Switches Learn — The MAC Address Table

When a switch is first powered on, its MAC address table (also called the CAM table) is empty. The switch
learns dynamically:

13. A frame arrives on a switch port. The switch reads the source MAC address in the frame.
14. It records: 'MAC address XX:XX:XX:XX:XX:XX is reachable via Port 3.' This entry is added to the MAC
address table.
15. The switch looks up the destination MAC address in its table.
16. If found: forward the frame only to the port where that MAC was learned (unicast forwarding).
17. If not found: flood the frame out ALL ports except the one it came in on (this is called unknown
unicast flooding).
18. The destination device responds, and the switch learns its MAC address too.

Entries in the MAC address table age out after a timeout period (typically 300 seconds / 5 minutes) to
handle devices that have been moved or disconnected.

8.2 VLANs — Virtual Local Area Networks

A VLAN (Virtual LAN) is a logical grouping of devices within a physical network. VLANs allow you to divide
one physical switch into multiple virtual switches, each with its own isolated broadcast domain. Devices in
different VLANs cannot communicate with each other directly — they need a router (or Layer 3 switch) to
communicate between VLANs.

🔑 Why Use VLANs?

Imagine a company with 200 employees: 50 in HR, 100 in Engineering, 50 in Finance. Without VLANs,
all 200 devices are on one network. HR data (including salaries and personal records) broadcasts to
everyone. A compromised engineer's PC could sniff HR traffic.

With VLANs: HR gets VLAN 10, Engineering gets VLAN 20, Finance gets VLAN 30. Now HR traffic only
goes to HR devices. Finance systems are isolated. A virus in Engineering can't reach Finance servers.
AND you can have all three departments on the same physical switch — VLANs are purely logical.

Page 32 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

VLAN Port Types

Access Port: A port assigned to exactly one VLAN. The device connected to this port is unaware of VLANs —
it just thinks it's on a normal network. Used for computers, printers, IP phones, servers.
Trunk Port: A port that carries traffic for MULTIPLE VLANs simultaneously. Used between switches and
between switches and routers. Traffic is tagged with IEEE 802.1Q VLAN tags so the receiving device knows
which VLAN each frame belongs to.
Native VLAN: On a trunk port, one VLAN is designated as the 'native' VLAN. Frames for the native VLAN are
sent UNTAGGED. Default is VLAN 1 (this is a security risk if not changed, since VLAN 1 is the management
VLAN by default).

802.1Q VLAN Tagging

When a frame travels over a trunk port, a 4-byte 802.1Q tag is inserted into the Ethernet frame header.
This tag contains:
• TPID (Tag Protocol Identifier): 0x8100 — identifies this as a tagged frame
• PCP (Priority Code Point): 3 bits for QoS priority
• DEI (Drop Eligible Indicator): 1 bit — indicates if the frame can be dropped under congestion
• VID (VLAN Identifier): 12 bits — the VLAN number (0–4095, but 0 and 4095 are reserved)

8.3 Inter-VLAN Routing

Because VLANs are separate broadcast domains, a router is needed for devices in different VLANs to
communicate. There are two main approaches:

Router on a Stick: A single router port connects to a switch trunk port. The router is configured with
subinterfaces — one per VLAN. Each subinterface has an IP address and handles routing for that VLAN.
Cheap but can be a bottleneck since all inter-VLAN traffic passes through one physical link.
Layer 3 Switch: A switch with built-in routing capabilities. Each VLAN is assigned a Switch Virtual Interface
(SVI) with an IP address. Routing happens inside the switch at hardware speed — much faster than a router
on a stick. Used in most modern enterprise networks.

8.4 Spanning Tree Protocol (STP)

Networks need redundant links — if one cable fails, traffic should automatically use an alternate path.
However, redundant links create loops. In a looped network, broadcast traffic (like ARP requests) circulates
forever in an ever-growing broadcast storm that can completely kill a network within seconds.

Page 33 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

STP (IEEE 802.1D) solves this by automatically detecting and blocking redundant links, preventing loops
while keeping the backup links available. If the active link fails, STP unblocks the backup link.

STP Operation — How It Works

19. Elect a Root Bridge: The switch with the lowest Bridge ID becomes the Root Bridge. Bridge ID =
Priority (default 32768) + MAC address. Lower priority wins; tie-break by MAC address.
20. Every non-root switch finds its Root Port: the port with the best path back to the Root Bridge
(lowest cost).
21. Every network segment finds a Designated Port: the port on the segment with the best path to the
Root Bridge.
22. All other ports become Blocking Ports: they receive STP messages (BPDUs) but don't forward data.

STP Port States

State Forwards Data? Learns MACs? Duration Description

Blocking No No 20 sec (Max Age) Listens for BPDUs;

breaks loops by not
forwarding

Listening No No 15 sec (Forward Participates in STP

Delay) election; no data
forwarding

Learning No Yes 15 sec (Forward Builds MAC table;

Delay) still no data
forwarding

Forwarding Yes Yes Until change Normal operation

— fully active

Disabled No No N/A Port

administratively
shut down

Total time for a blocked port to start forwarding after a topology change: 20 + 15 + 15 = 50 seconds. This is
why STP convergence feels slow.

Rapid STP (RSTP — IEEE 802.1w)

RSTP dramatically improves convergence time from ~50 seconds to under 1 second. It introduces new port
roles and states, and switches negotiate directly with neighbours instead of waiting for timers. RSTP is
backward compatible with STP. Most modern networks use RSTP or its extended version, Multiple Spanning
Tree (MST).

Page 34 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Page 35 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 9: Network Security

Network security is the practice of protecting a computer network from unauthorized access, attacks, and
data theft. As networks become more interconnected, security becomes increasingly critical. Every
networking professional must understand both how attacks work and how to defend against them.

9.1 The CIA Triad — Foundation of Security

All of network security revolves around protecting three properties:

Confidentiality: Only authorized parties can read the data. Achieved through encryption. Example: Your
password travels encrypted over HTTPS so eavesdroppers can't read it.
Integrity: Data cannot be tampered with without detection. Achieved through hashing and digital
signatures. Example: A file download includes a hash — you verify the hash matches to confirm the file
wasn't modified.
Availability: Systems and data are accessible when needed. Achieved through redundancy, backups, and
DoS protection. Example: Servers use load balancers and failover so they're always reachable.

9.2 Firewalls
A firewall is a security device (hardware or software) that monitors and controls network traffic based on a
set of security rules. It acts as a barrier between trusted internal networks and untrusted external networks
(like the internet).

Types of Firewalls
Packet Filtering Firewall: The simplest type. Examines each packet's headers (source/destination IP,
source/destination port, protocol) and either allows or denies it based on rules. Operates at Layer 3 and 4.
Fast but doesn't understand connection state.
Stateful Inspection Firewall: Tracks the state of active connections in a state table. Knows if a packet is part
of an established connection or is suspicious new traffic. Much smarter than packet filtering. This is the
most common type.
Application Layer Firewall (Proxy Firewall): Understands specific application protocols (HTTP, FTP, DNS)
and can filter based on content, not just headers. Very secure but adds latency. Can block specific URLs, file
types, or malicious content.

Page 36 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Next-Generation Firewall (NGFW): Combines stateful inspection + deep packet inspection + IDS/IPS +
application awareness + SSL inspection. Can identify applications regardless of port (e.g., block Facebook
even on port 443). The modern standard.
Web Application Firewall (WAF): Specifically protects web applications. Filters HTTP/HTTPS traffic to
protect against SQL injection, XSS, and other web attacks.

9.3 Common Network Attacks — Explained

DoS and DDoS

A Denial of Service (DoS) attack floods a target with so much traffic that legitimate users can't reach the
service. A Distributed DoS (DDoS) uses thousands of compromised computers (a botnet) to amplify the
attack, making it much harder to block.
• SYN Flood: Send thousands of TCP SYN packets but never complete the handshake, exhausting the
server's connection table
• UDP Flood: Send massive amounts of UDP traffic to random ports, overwhelming the target
• HTTP Flood: Send enormous numbers of HTTP GET/POST requests to crash a web server
• Amplification attacks: Use protocols like DNS or NTP to amplify traffic by 100x

Man-in-the-Middle (MitM)
The attacker secretly positions themselves between two communicating parties, intercepting and
potentially altering their communication. Both parties believe they're communicating directly with each
other.
• ARP Poisoning: Send fake ARP replies to redirect traffic through the attacker's machine
• SSL Stripping: Downgrade HTTPS connections to HTTP, removing encryption
• Evil Twin: Create a fake Wi-Fi access point with the same name as a legitimate one
• Prevention: Use TLS/HTTPS, HSTS, certificate pinning, VPNs on public Wi-Fi

SQL Injection
An attacker inserts malicious SQL code into an input field (like a login form), which is then executed by the
database. Can result in data theft, deletion, or complete database takeover.

Page 37 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

ARP Spoofing/Poisoning
ARP has no authentication. An attacker can send fake ARP replies claiming that their MAC address
corresponds to the default gateway's IP address. Victims then send all their traffic to the attacker's machine
instead of the real gateway. The attacker can read, modify, or drop the traffic.

DNS Spoofing / Cache Poisoning

An attacker corrupts a DNS resolver's cache with false records, causing users to be directed to fake IP
addresses (attacker's servers) when they look up legitimate domain names. Used to redirect users to
phishing sites.

Attack Target Prevention

DDoS Availability — overwhelm the Rate limiting, CDN, scrubbing

service centers, anycast routing

Man-in-the-Middle Confidentiality — intercept TLS/HTTPS, HSTS, certificate

communications pinning, 802.1X

ARP Spoofing Confidentiality — redirect local Dynamic ARP Inspection (DAI),

traffic static ARP entries

DNS Spoofing Integrity — fake DNS answers DNSSEC, encrypted DNS

(DoH/DoT)

SQL Injection Integrity/Confidentiality — Prepared statements, input

database attack validation, WAF

VLAN Hopping Confidentiality — cross-VLAN Disable DTP, set native VLAN away
access from data VLANs

Port Scanning Reconnaissance — discover open Firewall, IDS/IPS, rate limiting

ports

Brute Force Confidentiality — crack passwords Account lockouts, MFA, strong

password policy

Phishing All CIA properties — trick user Security awareness training, email
filtering, MFA

9.4 Encryption Protocols

TLS/SSL — Transport Layer Security

TLS (and its predecessor SSL) encrypts data in transit. When you see https:// and a padlock in your browser,
TLS is protecting your data. TLS 1.3 is the current version.

Page 38 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

• TLS Handshake: Client and server negotiate cipher suites, exchange certificates, and establish
session keys
• Certificate Authorities (CAs): Trusted third parties (like DigiCert, Let's Encrypt) that issue digital
certificates verifying a server's identity
• Perfect Forward Secrecy (PFS): TLS 1.3 uses ephemeral key exchange so past sessions can't be
decrypted even if the private key is later compromised

IPSec — Internet Protocol Security

IPSec encrypts and authenticates IP packets. It's most commonly used in VPNs. IPSec operates at the
Network Layer (Layer 3), so it protects all traffic regardless of the application.
AH (Authentication Header): Provides integrity and authentication but NOT encryption. Ensures packets
haven't been tampered with.
ESP (Encapsulating Security Payload): Provides encryption AND authentication. Used in most VPN
implementations.
Transport Mode: Encrypts only the payload (data). IP headers are left unencrypted. Used between two
hosts.
Tunnel Mode: Encrypts the entire original packet and wraps it in a new IP header. Used in VPNs between
sites.
IKE (Internet Key Exchange): The protocol used to set up the security association (SA) — negotiates keys
and algorithms.

9.5 VPNs — Virtual Private Networks

A VPN creates an encrypted "tunnel" through a public network (like the internet), allowing secure
communication as if the remote device were directly connected to the private network.

Site-to-Site VPN: Connects two entire networks across the internet. The routers or firewalls at each site
handle the VPN, so users don't need to do anything special. Used to connect branch offices to
headquarters.
Remote Access VPN: Allows individual users to securely connect to a company network from anywhere.
The user runs VPN software on their device. Used for remote workers.
SSL VPN: VPN over HTTPS (port 443). Works through firewalls that block other VPN ports. Accessible from a
browser without special software.
Split Tunneling: Only corporate/work traffic goes through the VPN; personal internet traffic (Netflix,
YouTube) goes directly to the internet. Reduces VPN load but means personal traffic is unprotected by
corporate security.

Page 39 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

VPN Protocol Encryption Port Status Notes

PPTP MPPE (weak) TCP 1723 Legacy, insecure Do not use —

easily broken

L2TP/IPSec IPSec AES UDP 1701, 500, Stable Double

4500 encapsulation;
slower

OpenVPN OpenSSL (TLS) TCP/UDP 1194 Widely used Open source, very
configurable

WireGuard ChaCha20, UDP 51820 Modern Simple, fast,

Poly1305 recommended excellent security

IKEv2/IPSec IPSec AES UDP 500, 4500 Excellent Fast reconnection,

good for mobile

SSTP SSL/TLS TCP 443 Windows-native Microsoft

proprietary

Page 40 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 10: Wireless Networking (Wi-Fi)

Wireless networking uses radio waves instead of physical cables to connect devices. Wi-Fi (based on the
IEEE 802.11 family of standards) is the dominant wireless LAN technology. Understanding how Wi-Fi works
helps explain why you get poor signal in certain locations, why some channels are better than others, and
how to secure wireless networks.

10.1 How Wi-Fi Works

A wireless access point (AP) transmits radio waves in all directions. Your device's wireless adapter picks up
these waves and converts them back to data. The conversation between device and AP is half-duplex —
only one device can transmit at a time on a given channel. Wi-Fi uses CSMA/CA (Carrier Sense Multiple
Access with Collision Avoidance) to manage who transmits when.

10.2 Wi-Fi Frequency Bands

Wi-Fi operates in different frequency bands. The band affects range, speed, and interference.

Band Frequency Range Speed Interference Best For

2.4 GHz 2.4 GHz Longer range, Lower More Coverage, IoT
penetrates interference devices
walls better (microwaves,
Bluetooth,
baby monitors)

5 GHz 5.15–5.85 GHz Shorter range, Higher Less Speed, fewer

blocked more interference obstacles
by walls

6 GHz 5.925–7.125 Shortest range Highest Least High-speed,

GHz interference close range
(new band)

10.3 Wi-Fi Standards — IEEE 802.11 Family

Standard Wi-Fi Band(s) Max Key Technology Year

Name Speed

Page 41 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

802.11b Wi-Fi 1 2.4 GHz 11 Mbps DSSS 1999

802.11a Wi-Fi 2 5 GHz 54 Mbps OFDM 1999

802.11g Wi-Fi 3 2.4 GHz 54 Mbps OFDM 2003

802.11n Wi-Fi 4 2.4 + 5 GHz 600 Mbps MIMO (multiple 2009

antennas)

802.11ac Wi-Fi 5 5 GHz 3.5 Gbps MU-MIMO, wider 2013

channels (80/160 MHz)

802.11ax Wi-Fi 2.4 + 5 + 6 GHz 9.6 Gbps OFDMA, BSS Coloring, 2019
6/6E TWT, MU-MIMO (8x8)

802.11be Wi-Fi 7 2.4 + 5 + 6 GHz 46 Gbps 320 MHz channels, Multi- 2024
Link Operation (MLO)

MIMO: Multiple Input Multiple Output — using multiple antennas to send/receive multiple data streams
simultaneously, increasing throughput
MU-MIMO: Multi-User MIMO — allows the AP to communicate with multiple devices simultaneously
instead of one at a time
OFDMA: Orthogonal Frequency Division Multiple Access (Wi-Fi 6+) — divides a channel into subchannels so
multiple devices can transmit simultaneously. More efficient in dense environments
TWT: Target Wake Time (Wi-Fi 6+) — lets the AP schedule when devices wake up to communicate, saving
battery life for IoT sensors

10.4 Wi-Fi Channels

Within each frequency band, the spectrum is divided into channels. Choosing non-overlapping channels for
nearby access points prevents interference.
• 2.4 GHz has 11 channels in North America (14 in some countries) but only 3 are non-overlapping: 1,
6, and 11
• 5 GHz has 25 non-overlapping channels — much less congestion
• Channel bonding: Combining two adjacent channels (40 MHz) or more (80/160 MHz) increases
speed but reduces number of available non-overlapping channels

10.5 Wireless Security Protocols

Protecting wireless networks is critical because the radio signal can be received by anyone within range,
including attackers outside the building.

Protocol Year Encryption Authentication Security Level Status

Page 42 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

WEP 1997 RC4 (40/104- Shared key Broken Do not use —

bit) cracked in
minutes

WPA 2003 TKIP (RC4- PSK or 802.1X Weak Deprecated —

based) avoid

WPA2-Personal 2004 AES-CCMP Pre-shared key Good Acceptable for

(PSK) home use

WPA2- 2004 AES-CCMP 802.1X/RADIUS Strong Required for

Enterprise business

WPA3-Personal 2018 AES-GCMP-256 SAE Strong Recommended

(Simultaneous
Auth of Equals)

WPA3- 2018 AES-GCMP-256 802.1X + Very Strong Best for

Enterprise RADIUS business

WPA3-SAE: Simultaneous Authentication of Equals — replaces the PSK method in WPA3. Even if an
attacker captures the 4-way handshake, they cannot brute-force the password offline. Also provides
forward secrecy.
802.1X: Port-based Network Access Control. Each user must authenticate before gaining network access.
Uses RADIUS server to verify credentials. Every user gets unique credentials — no shared password.
RADIUS: Remote Authentication Dial-In User Service. A server-based authentication protocol used with
802.1X to verify users against a central database (Active Directory, LDAP, etc.)

Page 43 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 11: NAT and DHCP

11.1 NAT — Network Address Translation

NAT is a method of remapping IP addresses in packet headers as they pass through a router. Most
commonly, NAT translates private (RFC 1918) IP addresses to a single public IP address, allowing an entire
private network to share one public IP address on the internet.

ℹ️ Why NAT Is Everywhere

Your home network has devices with private IPs like [Link], [Link], etc. Your ISP gives you
just ONE public IP address (e.g., [Link]). When your phone requests a web page, NAT
translates [Link]:49123 → [Link]:49123 before sending to the internet. When the reply
comes back to [Link]:49123, NAT knows to forward it back to [Link]. This allows 50
devices to share one public IP address — and hides your internal network structure from the
internet.

Types of NAT
Static NAT (1:1): One private IP is permanently mapped to one public IP. Used when a server inside needs
to be consistently reachable from the internet (e.g., a web server at [Link] always appears as
[Link]).
Dynamic NAT: A pool of public IP addresses is shared among private IP addresses. Devices get a public IP
from the pool when they need internet access, and it's returned when done. Not common for home use.
PAT / NAT Overload: Port Address Translation — the most common type. Many private IPs share a SINGLE
public IP by using different port numbers to track each conversation. Also called NAPT. This is what your
home router does.

How PAT Works

Step Internal IP:Port Public IP:Port Destination Direction

1 – Request [Link]:5234 [Link]:5234 [Link]:53 Outbound

5 5

2 – Request [Link]:5234 [Link]:5234 [Link]:53 Outbound

6 6

3 – Reply [Link]:5234 [Link]:5234 [Link] Inbound

5 5

Page 44 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

4 – Reply [Link]:5234 [Link]:5234 [Link] Inbound

6 6

11.2 DHCP — Dynamic Host Configuration Protocol

DHCP automatically assigns IP addresses and other network configuration (subnet mask, default gateway,
DNS servers) to devices when they join a network. Without DHCP, every device on every network would
need to be manually configured — an enormous administrative burden.

The DHCP DORA Process

When a device connects to a network, it has no IP address. It finds a DHCP server using this 4-step process
(remember: DORA):

Step Name Who Sends How Purpose

1 DISCOVER Client → DHCP Broadcast Client announces: 'I

Server ([Link]) need an IP
address! Is there a
DHCP server here?'

2 OFFER DHCP Server → Broadcast or Server responds: 'I

Client Unicast have an IP for you
— how about
[Link],
valid for 24 hours?'

3 REQUEST Client → DHCP Broadcast Client replies: 'Yes

Server please, I'd like
[Link].'
(Broadcast in case
multiple servers
offered)

4 ACKNOWLEDGE DHCP Server → Unicast Server confirms:

Client 'Done!
[Link] is
yours for 86400
seconds. Here is
your subnet mask,
gateway, and DNS.'

DHCP Lease
The IP address is not given permanently — it's leased for a period (the lease time, typically 24 hours for
home networks or 8 hours for corporate). Before the lease expires, the client renews it. If a device leaves
the network, the IP address eventually expires and returns to the pool for reassignment.

Page 45 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

DHCP Options
Beyond just the IP address, DHCP can provide many other configuration parameters to clients:
• Option 3: Default gateway (router IP)
• Option 6: DNS server addresses
• Option 51: Lease time
• Option 66/67: TFTP server and filename (used for network boot, VoIP phone provisioning)
• Option 121: Classless static routes

⚠️ APIPA — When DHCP Fails

If a device cannot find a DHCP server (server is down, cable unplugged), it automatically assigns itself
an address in the [Link]/16 range (APIPA — Automatic Private IP Addressing). This allows
communication with other devices on the same segment that also have APIPA addresses, but it
means the device has NO internet access and NO access to the corporate network. If you see a
169.254.x.x address, it means DHCP failed.

Page 46 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 12: Network Troubleshooting

Troubleshooting is a systematic process of identifying and resolving network problems. The key is to
approach problems methodically, starting with the most basic possible cause and working up to more
complex ones. The OSI model provides an excellent framework — always start at Layer 1 (is the cable
plugged in?) before investigating Layer 7 (is the web server configured correctly?).

12.1 The OSI Troubleshooting Approach

Bottom-Up Approach (most common): Start at Layer 1 and work up. Used when you have no idea what's
wrong.
• Layer 1 — Physical: Is the cable plugged in? Is the NIC showing link lights? Is the Wi-Fi card
enabled?
• Layer 2 — Data Link: Can you see other devices on the local network? Is the switch port in the right
VLAN?
• Layer 3 — Network: Does the device have a valid IP address and subnet mask? Can you ping the
default gateway?
• Layer 4 — Transport: Is the destination service listening on the right port? Is a firewall blocking the
port?
• Layer 7 — Application: Is the application running? Is it configured with the correct server
address/credentials?

12.2 Essential Networking Commands

Command Platform Purpose Example

ping All Test basic IP connectivity. Sends ICMP ping [Link] ping [Link]
Echo Requests. Reports round-trip time
and packet loss.

traceroute / Linux/Mac / Shows each hop (router) on the path to traceroute [Link] tracert
tracert Windows a destination. Identifies where packets [Link]
stop.

nslookup All DNS lookup tool. Resolves a hostname nslookup [Link] nslookup
to IP, or queries specific DNS records. -type=MX [Link]

dig Linux/Mac Advanced DNS lookup. More detailed dig [Link] dig MX
than nslookup. Shows full DNS [Link] @[Link]

Page 47 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

response.

ipconfig /all Windows Show all network interface ipconfig /all

configuration: IP, subnet, gateway,
MAC, DNS.

ip addr show Linux Show IP addresses assigned to all ip addr show ip addr show eth0
interfaces.

ip route show Linux Display the routing table. Shows how ip route show
the system routes traffic.

route print Windows Display the routing table on Windows. route print

arp -a All Display the ARP cache — known IP-to- arp -a

MAC address mappings.

netstat -an All Show all active connections and netstat -an netstat -tulnp
listening ports. (Linux)

ss -tuln Linux Faster alternative to netstat. Shows ss -tuln

TCP/UDP sockets.

nmap All Network scanner. Discovers hosts and nmap [Link]/24 nmap -sV
open ports. Essential for inventory and -p 1-1000 [Link]
security.

tcpdump Linux/Mac Capture and display live network tcpdump -i eth0 tcpdump -i
packets in the terminal. Powerful eth0 port 80
diagnostic tool.

curl All Test HTTP/HTTPS connectivity. curl [Link] curl -I

Downloads a URL or tests API [Link]
endpoints.

Wireshark All (GUI) GUI packet capture and protocol Open Wireshark, select
analysis. The gold standard for deep interface, apply filter
network analysis.

12.3 Common Problems and Solutions

Problem Symptoms Likely Cause How to Diagnose Solution

No connectivity Cannot ping Cable unplugged, Check cable, check Plug cable, enable NIC,
anything, no NIC disabled, DHCP ipconfig — is IP fix DHCP server
network icon failure 169.254.x.x?

Can reach local Ping Default gateway Ping gateway, Fix default gateway,
but not [Link] wrong, ISP down, traceroute to see reboot router, call ISP
internet works, ping router issue where it stops
[Link] fails

DNS fails but IP Ping [Link] DNS server Try nslookup Change DNS servers to

Page 48 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

works works, ping unreachable or [Link] [Link] [Link] or [Link]

[Link] misconfigured
fails

Slow network High latency on Congestion, duplex Ping for packet loss, Replace cable, fix
ping, slow file mismatch, failing check interface errors duplex settings, QoS
transfers cable with ifconfig/ipconfig

Can't reach a Connection Service not telnet/nc to check Start service, fix
service refused or running, firewall port, netstat to check firewall rules
timed out blocking port if service listens

IP conflict Duplicate IP Two devices with arp -a, check DHCP Release duplicate IP, fix
warning, same IP, DHCP leases DHCP pool
intermittent range too small
connectivity

Page 49 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 13: Modern Networking — Cloud, SDN & Beyond

13.1 SDN — Software-Defined Networking

Traditional networking embeds the control logic (routing decisions) directly inside each hardware device.
SDN separates the control plane (the brain that decides where traffic goes) from the data plane (the
hardware that actually moves traffic) and centralizes control in a software-based controller.

Control Plane: The intelligence of the network — makes routing and forwarding decisions. In SDN, this is
centralized in a software controller instead of distributed across every device.
Data Plane (Forwarding Plane): The muscle of the network — actually forwards packets based on
instructions from the control plane.
SDN Controller: A centralized software application that has a complete view of the entire network and
programs all devices. Examples: OpenDaylight, ONOS, Cisco ACI.
Southbound API: Interface between the SDN controller and network devices. OpenFlow is the most famous
protocol.
Northbound API: Interface between the SDN controller and applications/business logic. Allows applications
to request network behavior.

Benefits of SDN: Programmable networks, centralized management, easier automation, faster change
deployment, vendor independence.

13.2 Network Function Virtualization (NFV)

NFV is the practice of replacing dedicated hardware appliances (firewalls, load balancers, IDS/IPS, WAN
accelerators) with software-based virtual functions running on standard servers. Instead of buying a
$50,000 hardware firewall, you run firewall software on a VM.

NFV and SDN work together: SDN provides the programmable networking fabric, while NFV runs network
functions as software on that fabric.

13.3 Cloud Networking Fundamentals

Cloud providers (AWS, Azure, GCP) offer virtual networking services that mirror physical networking
concepts but are implemented entirely in software.

Page 50 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

VPC (Virtual Private Cloud): An isolated virtual network in the cloud. Your own private section of the cloud,
with full control over IP ranges, subnets, routing, and security. Like having your own private data center in
the cloud.
Subnet: A VPC is divided into subnets. Public subnets have routes to the internet; private subnets don't.
Internet Gateway: AWS concept — the VPC component that allows communication between the VPC and
the internet.
Security Group: A virtual firewall for cloud instances. Stateful — you define inbound/outbound rules.
Attached to individual instances.
Network ACL: Stateless subnet-level firewall in AWS. Rules are evaluated in order. More complex than
security groups but more granular.
VPC Peering: A private connection between two VPCs, allowing them to communicate as if on the same
network.
Transit Gateway: A hub that connects multiple VPCs and on-premises networks together. More scalable
than VPC peering.

13.4 Load Balancing

Load balancers distribute incoming network traffic across multiple servers to prevent any single server from
being overwhelmed. They also detect server failures and stop sending traffic to failed servers.

Load Balancing Algorithms

Round Robin: Requests are distributed to servers in rotation. Server 1 → Server 2 → Server 3 → Server 1.
Simple and fair.
Weighted Round Robin: Servers with higher capacity receive more requests. Server 1 gets 60%, Server 2
gets 40%.
Least Connections: New requests go to the server with the fewest active connections. Better for variable-
length requests.
Least Response Time: Routes to the server with the fastest current response time.
IP Hash: Client's IP address determines which server handles all their requests. Ensures session persistence.

Layer 4 vs Layer 7 Load Balancing

Layer 4 Load Balancer: Makes routing decisions based on IP and TCP/UDP port. Fast but doesn't inspect
content. Doesn't understand HTTP.
Layer 7 Load Balancer: Makes routing decisions based on application content (URL, HTTP headers, cookies,
hostnames). Can route /api requests to API servers and /images requests to image servers. More powerful
and flexible.

Page 51 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

13.5 Content Delivery Networks (CDN)

A CDN is a distributed network of servers positioned around the world. When a user requests content (an
image, video, or web page), the CDN serves it from the server closest to the user, rather than from the
origin server (which might be on the other side of the world).

Benefits: Dramatically reduced latency, reduced load on origin server, protection against DDoS (traffic is
absorbed across hundreds of nodes), better availability.
Examples: Cloudflare, Akamai, AWS CloudFront, Fastly.

13.6 Quality of Service (QoS)

QoS is a set of techniques to manage network resources and prioritize certain types of traffic. When a
network is congested, QoS ensures high-priority traffic (VoIP calls, video conferences) gets served before
low-priority traffic (file downloads, email).

Traffic Classification: Identifying traffic by type (voice, video, data) using IP headers, DSCP markings, or
deep packet inspection
Queuing: High-priority packets are placed in faster queues and sent first
Shaping: Slowing down traffic by delaying packets to fit within a defined rate limit
Policing: Dropping packets that exceed a defined rate limit
DSCP (Differentiated Services Code Point): A 6-bit field in the IP header used to mark packets with their
QoS class

Page 52 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

Chapter 14: Quick Reference & Exam Preparation

14.1 Critical Numbers to Memorize

Concept Value Why Important

IPv4 address size 32 bits Determines 4.3 billion max

addresses

IPv6 address size 128 bits Provides 340 undecillion addresses

MAC address size 48 bits (6 bytes) Written as XX:XX:XX:XX:XX:XX

Ethernet frame minimum size 64 bytes Smaller = collision detection

unreliable

Ethernet frame maximum size 1500 bytes payload Maximum Transmission Unit for
(MTU) Ethernet

UDP header size 8 bytes Fixed, minimal overhead

TCP header minimum size 20 bytes Variable up to 60 bytes with

options

IPv4 header minimum size 20 bytes Variable up to 60 bytes with

options

OSI model layers 7 All People Seem To Need Data

Processing

TCP/IP model layers 4 Application, Transport, Internet,

Network Access

Max hops in RIP 15 16 = infinity (unreachable)

OSPF uses protocol number 89 Not TCP or UDP

STP convergence time ~50 seconds Blocking(20) + Listening(15) +

Learning(15)

TCP 3-way handshake SYN → SYN-ACK → ACK Connection establishment

DHCP DORA Discover, Offer, Request, IP address assignment process

Acknowledge

Private IPv4 ranges 10/8, 172.16/12, 192.168/16 Not routed on internet

APIPA range [Link]/16 DHCP failure self-assignment

Page 53 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

14.2 Protocol Quick Reference

Protocol Port(s) Transport Layer Function

HTTP 80 TCP 7 Web browsing (unencrypted)

HTTPS 443 TCP 7 Web browsing (TLS encrypted)

FTP 20 (data), 21 (ctrl) TCP 7 File transfer

SSH 22 TCP 7 Secure remote shell

Telnet 23 TCP 7 Remote shell (insecure)

SMTP 25 TCP 7 Send email

DNS 53 UDP (TCP 7 Name resolution

for zone)

DHCP 67 (server), 68 UDP 7 IP address assignment

(client)

TFTP 69 UDP 7 Simple file transfer (no auth)

POP3 110 TCP 7 Receive email (download)

IMAP 143 TCP 7 Receive email (sync)

SNMP 161 (query), 162 UDP 7 Network device management

(trap)

LDAP 389 TCP 7 Directory services (Active Directory)

SMTPS 465/587 TCP 7 SMTP over TLS

IMAPS 993 TCP 7 IMAP over TLS

POP3S 995 TCP 7 POP3 over TLS

RDP 3389 TCP 7 Windows Remote Desktop

BGP 179 TCP 3 Internet routing (between ASes)

14.3 OSI Model Reference Card

Layer Name Protocols Devices Data Unit Key Functions

7 Application HTTP, FTP, Computers, Data User services,

SMTP, DNS, servers application
SSH, SNMP, interfaces
DHCP

6 Presentation SSL/TLS, JPEG, Computers Data Encryption,

MP3, ASCII, format
Unicode translation,
compression

Page 54 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

5 Session NetBIOS, RPC, Computers Data Session setup,

SQL sessions maintenance,
teardown

4 Transport TCP, UDP Firewalls, Segment Port numbers,

computers reliability, flow
control

3 Network IP, ICMP, ARP, Routers, L3 Packet IP addressing,

OSPF, BGP switches routing,
fragmentation

2 Data Link Ethernet, Wi-Fi, Switches, Frame MAC

PPP, MAC, bridges, NICs addressing,
VLAN framing, error
detection

1 Physical Cables, fiber, Hubs, Bit Bit

radio, NIC, repeaters, transmission,
hubs cables encoding,
signaling

14.4 Subnetting Cheat Sheet

CIDR Subnet Mask Hosts per Subnet Block Size

/8 [Link] 16,777,214 N/A

/16 [Link] 65,534 N/A

/24 [Link] 254 256

/25 [Link] 126 128

/26 [Link] 62 64

/27 [Link] 30 32

/28 [Link] 14 16

/29 [Link] 6 8

/30 [Link] 2 4

/31 [Link] 0 (2 for P2P) 2

/32 [Link] 1 host route 1

14.5 Top Exam Tips

🔑 Key Things to Always Remember

Page 55 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

1. OSI Layer numbers: If an exam says 'Layer 2,' that means Data Link (switches, MACs, Ethernet).
'Layer 3' means Network (routers, IPs).

2. TCP vs UDP: When you see VoIP, DNS, DHCP, TFTP, gaming — think UDP. When you see web,
email, file transfer, SSH — think TCP.

3. Private IP ranges: 10.x.x.x, 172.16-31.x.x, 192.168.x.x — never routed on the internet.

4. Subnet formula: Hosts = 2^(host bits) - 2. Always subtract 2.

5. Default gateway: The first-hop router that connects your local network to other networks.

6. MAC addresses change at every hop (router changes source/destination MAC). IP addresses stay
the same for the entire journey.

7. ARP resolves IP → MAC. DNS resolves hostname → IP.

8. The default route ([Link]/0) is the route of last resort.

14.6 Common Confusions Clarified

Often Confused Difference

Hub vs Switch Hub broadcasts to ALL ports. Switch learns MACs and
forwards to the CORRECT port only.

Router vs Switch Switch connects devices on the SAME network.

Router connects DIFFERENT networks.

MAC vs IP MAC is physical (Layer 2), stays on local segment, set

by manufacturer. IP is logical (Layer 3), changes as
packet traverses routers, assigned by admin/DHCP.

TCP vs UDP TCP = reliable (ACKs, retransmit, in-order). UDP = fast

(no ACKs, no ordering). Pick based on whether
accuracy or speed matters more.

Subnet Mask vs CIDR Same thing, two notations. [Link] = /24. Both
mean 24 bits for network, 8 bits for hosts.

Static NAT vs PAT Static: permanent 1-to-1 mapping. PAT (most

common): many IPs share ONE IP using different port
numbers.

DNS A Record vs CNAME A record maps name directly to IP. CNAME maps
name to another name (alias). CNAME cannot be
used at root of domain.

Authentication vs Authorization Authentication: verifying WHO you are (password,

certificate). Authorization: what you're ALLOWED to

Page 56 | Computer Networking — Complete Study Guide

 Complete Networking Study Guide

do after authentication.

Collision Domain vs Broadcast Domain Collision domain: segment where collisions can occur
(separated by switches). Broadcast domain: segment
where broadcasts reach (separated by routers).

Full-duplex vs Half-duplex Full-duplex: send and receive simultaneously

(switches). Half-duplex: send OR receive, not both
(hubs, Wi-Fi).

End of Complete Networking Study Guide

Study well, practice with labs, and remember: networking is best learned by doing!

Page 57 | Computer Networking — Complete Study Guide