Network Types

Everything is Online
“Hey Shad, are you online?” “Of course, I am!” How many of us still think about whether or
not we are “online”? We expect our devices, cell phones, tablets, laptops and desktop
computers to always be connected to the global internet. We use this network to interact with
our friends, shop, share pictures and experiences, and learn. The internet has become such a
part of everyday life that we almost take it for granted.
Normally, when people use the term internet, they are not referring to the physical
connections in the real world. Rather, they tend to think of it as a formless collection of
connections. It is the “place” people go to find or share information.
Who Owns “The Internet”?
The internet is not owned by any individual or group. The internet is a worldwide collection
of interconnected networks (internetwork or internet for short), cooperating with each other
to exchange information using common standards. Through telephone wires, fiber-optic
cables, wireless transmissions, and satellite links, internet users can exchange information in
a variety of forms, as shown in the figure.
Everything that you access online is located somewhere on the global internet. Social media
sites, multiplayer games, messaging centers that provide email, online courses — all of these
internet destinations are connected to local networks that send and receive information
through the internet.
Local Networks
Local networks come in all sizes. They can range from simple networks consisting of two
computers, to networks connecting hundreds of thousands of devices. Networks installed in
small offices, or homes and home offices, are referred to as small office/home office (SOHO)
networks. SOHO networks let you share resources such as printers, documents, pictures, and
music, between a few local users.
In business, large networks can be used to advertise and sell products, order supplies, and
communicate with customers. Communication over a network is usually more efficient and
less expensive than traditional forms of communication, such as regular mail or long distance
phone calls. Networks allow for rapid communication such as email and instant messaging,
and provide consolidation and access to information stored on network servers.
Business and SOHO networks usually provide a shared connection to the internet. The
internet is considered a "network of networks" because it is literally made up of thousands of
local networks that are connected to each other.
Small Home Networks
Small home networks connect a few computers to each other and to the internet.
Small Office and Home Office Networks
The SOHO network allows computers in a home office or a remote office to connect to a
corporate network, or access centralized, shared resources.
Medium to Large Networks
Medium to large networks, such as those used by corporations and schools, can have many
locations with hundreds or thousands of interconnected hosts.
World Wide Networks
The internet is a network of networks that connects hundreds of millions of computers world-
wide.
Mobile Devices
The internet connects more computing devices than just desktop and laptop computers. There
are devices all around that you may interact with on a daily basis that are also connected to
the internet. These include mobile devices, home devices, and a variety of other connected
devices.
Smartphones are able to connect to the internet from almost anywhere. Smartphones
combine the functions of many different products together, such as a telephone, camera, GPS
receiver, media player, and touch screen computer.
Tablets, like smartphones, also have the functionality of multiple devices. With the
additional screen size, they are ideal for watching videos and reading magazines or books.
With on-screen keyboards, users are able to do many of the things they used to do on their
laptop computer, such as composing emails or browsing the web.
A smartwatch can connect to a smartphone to provide the user with alerts and messages.
Additional functions, such as heart rate monitoring and counting steps, like a pedometer, can
help people who are wearing the device to track their health.
A wearable computer in the form of glasses, such as Google Glass, contains a tiny screen that
displays information to the wearer in a similar fashion to the Head-Up Display (HUD) of a
fighter pilot. A small touch pad on the side allows the user to navigate menus while still being
able to see through the smart glasses.
Connected Home Devices
Security System
Many of the items in a home, such as security systems, lighting, and climate controls, can be
monitored and configured remotely using a mobile device.
Appliances
Household appliances such as refrigerators, ovens, and dishwashers can be connected to the
internet. This allows the homeowner to power them on or off, monitor the status of the
appliance, and also be alerted to preset conditions, such as when the temperature in the
refrigerator rises above an acceptable level.
Smart TV
A smart TV can be connected to the internet to access content without the need for TV
service provider equipment. Also, a smart TV can allow a user to browse the web, compose
email, or display video, audio, or photos stored on a computer.
Gaming Console
Gaming consoles can connect to the internet to download games and play with friends online.
Other Connected Devices
There are also many connected devices found in the world outside your home that provide
convenience and useful, or even vital, information.
Smart Cars
Many modern cars can connect to the internet to access maps, audio and video content, or
information about a destination. They can even send a text message or email if there is an
attempted theft or call for assistance in case of an accident. These cars can also connect to
smartphones and tablets to display information about the different engine systems, provide
maintenance alerts, or display the status of the security system.
RFID Tags
Radio frequency identification (RFIDs) tags can be placed in or on objects to track them or
monitor sensors for many conditions.

Sensors and Actuators

Connected sensors can provide temperature, humidity, wind speed, barometric pressure, and
soil moisture data. Actuators can then be automatically triggered based on current conditions.
For example, a smart sensor can periodically send soil moisture data to a monitoring station.
The monitoring station can then send a signal to an actuator to begin watering. The sensor
will continue to send soil moisture data allowing the monitoring station to determine when to
deactivate the actuator.
Medical Devices
Medical devices such as pacemakers, insulin pumps, and hospital monitors provide users or
medical professionals with direct feedback or alerts when vital signs are at specific levels.

TOPIC # 2 Data Transmission

Types of Personal Data
We hear about data all of the time. Customer data, personal data, health data, census data, but
what exactly is data? Perhaps the simplest definition of data is that data is a value that
represents something. In the physical world, we represent data as numbers, formulas,
alphabetic characters, and pictures. Think about all of the data that exists just about you.
Some examples include birth records, baby pictures, school records, and health records.
Most people use networks to transmit their data in order to share with others, or for long-term
storage. Every time you hit “send” or “share” in an app or computer application, you are
telling your device to send your data to a destination somewhere on the network. Sometimes,
data is being sent by your devices and you may not even be aware that this is happening.
Examples of this are when you set up an automatic backup utility, or when your device
automatically searches for the router in a Wi-Fi hotspot
The following categories are used to classify types of personal data:
Volunteered data - This is created and explicitly shared by individuals, such as social
network profiles. This type of data might include video files, pictures, text or audio files.
Observed data - This is captured by recording the actions of individuals, such as location
data when using cell phones.
Inferred data - This is data such as a credit score, which is based on analysis of volunteered
or observed data.
The Bit
Did you know that computers and networks only work with binary digits, zeros and ones? It
can be difficult to imagine that all of our data is stored and transmitted as a series of bits.
Each bit can only have one of two possible values, 0 or 1. The term bit is an abbreviation of
“binary digit” and represents the smallest piece of data. Humans interpret words and pictures,
computers interpret only patterns of bits.
A bit is stored and transmitted as one of two possible discrete states. This can include two
directions of magnetization, two distinct voltage or current levels, two distinct levels of light
intensity, or any other physical system of two discrete states. For example, a light switch can
be either On or Off; in binary representation, these states would correspond to 1 and 0
respectively.
Every input device (mouse, keyboard, voice-activated receiver) will translate human
interaction into binary code for the CPU to process and store. Every output device (printer,
speakers, monitors, etc.) will take binary data and translate it back into human recognizable
form. Within the computer itself, all data is processed and stored as binary.
Computers use binary codes to represent and interpret letters, numbers and special characters
with bits. A commonly used code is the American Standard Code for Information Interchange
(ASCII). With ASCII, each character is represented by eight bits. For example:
Capital letter: A = 01000001
Number: 9 = 00111001
Special character: # = 00100011

Each group of eight bits, such as the representations of letters and numbers, is known as a
byte.
Codes can be used to represent almost any type of information digitally including computer
data, graphics, photos, voice, video, and music.
Common Methods of Data Transmission
After the data is transformed into a series of bits, it must be converted into signals that can be
sent across the network media to its destination. Media refers to the physical medium on
which the signals are transmitted. Examples of media are copper wire, fiber-optic cable, and
electromagnetic waves through the air. A signal consists of electrical or optical patterns that
are transmitted from one connected device to another. These patterns represent the digital bits
(i.e. the data) and travel across the media from source to destination as either a series of
pulses of electricity, pulses of light, or radio waves. Signals may be converted many times
before ultimately reaching the destination, as corresponding media changes between source
and destination.
There are three common methods of signal transmission used in networks:
Electrical signals - Transmission is achieved by representing data as electrical pulses on
copper wire.
Optical signals - Transmission is achieved by converting the electrical signals into light
pulses.
Wireless signals - Transmission is achieved by using infrared, microwave, or radio waves
through the air.
In most homes and small businesses, network signals are transmitted across copper wires
(cables) or Wi-Fi enabled wireless connections. Larger networks employ fiber-optic cables in
order to reliably carry signals for longer distances.
The figure shows three sets of PCs. Each set consists of two PCs with a type of signal
communication between them. From left to right, the first set is with a label Pulses of
electricity. The second set is labeled Pulses of light. The third set is with a label Radio waves.

TOPIC # 3 Bandwidth and Throughput

Bandwidth
Streaming a movie or playing a multiplayer game requires reliable, fast connections. To
support these “high bandwidth” applications, networks have to be capable of transmitting and
receiving bits at a very high rate.
Different physical media support the transfer of bits at different speeds. The rate of data
transfer is usually discussed in terms of bandwidth and throughput.
Bandwidth is the capacity of a medium to carry data. Digital bandwidth measures the amount
of data that can flow from one place to another in a given amount of time. Bandwidth is
typically measured in the number of bits that (theoretically) can be sent across the media in a
second. Common bandwidth measurements are as follows:
Thousands of bits per second (Kbps)
Millions of bits per second (Mbps)
Billions of bits per second (Gbps)
Physical media properties, current technologies, and the laws of physics all play a role in
determining available bandwidth.
The table shows the commonly used units of measure for bandwidth.
Unit of Bandwidth Abbreviation Equivalence
Bits per second Bps 1 bps = fundamental unit of bandwidth
Kilobits per second Kbps 1 Kbps = 1,000 bps = 103 bps
Megabits per second Mbps 1 Mbps = 1,000,000 bps = 106 bps
Gigabits per second Gbps 1 Gbps = 1,000,000,000 bps = 109 bps
Terabits per second Tbps 1 Tbps = 1,000,000,000,000 bps = 1012 bps

Throughput
Like bandwidth, throughput is the measure of the transfer of bits across the media over a
given period of time. However, due to a number of factors, throughput does not usually
match the specified bandwidth. Many factors influence throughput including:
 The amount of data being sent and received over the connection
 The types of data being transmitted
 The latency created by the number of network devices encountered between source
and destination
Latency refers to the amount of time, including delays, for data to travel from one given point
to another.
Throughput measurements do not take into account the validity or usefulness of the bits being
transmitted and received. Many messages received through the network are not destined for
specific user applications. An example would be network control messages that regulate
traffic and correct errors.
In an internetwork or network with multiple segments, throughput cannot be faster than the
slowest link of the path from sending device to the receiving device. Even if all or most of the
segments have high bandwidth, it will only take one segment in the path with lower
bandwidth to create a slowdown of the throughput of the entire network.
There are many online speed tests that can reveal the throughput of an internet connection.
TOPIC # 4 Clients and Servers
Clients and Server Roles
All computers connected to a network that participate directly in network communication are
classified as hosts. Hosts can send and receive messages on the network. In modern networks,
computer hosts can act as a client, a server, or both, as shown in the figure. The software
installed on the computer determines which role the computer plays.
Servers are hosts that have software installed which enable them to provide information, like
email or web pages, to other hosts on the network. Each service requires separate server
software. For example, a host requires web server software in order to provide web services
to the network. Every destination that you visit online is provided to you by a server located
somewhere on a network that is connected to the global internet.
Clients are computer hosts that have software installed that enables the hosts to request and
display the information obtained from the server. An example of client software is a web
browser, such as Internet Explorer, Safari, Mozilla Firefox, or Chrome.
Type Description
Email The email server runs email server software. Clients use mail client
software, such as Microsoft Outlook, to access email on the server.
Web The web server runs web server software. Clients use browser software,
such as Windows Internet Explorer, to access web pages on the server.
File The file server stores corporate and user files in a central location. The
client devices access these files with client software such as the Windows
File Explorer.

Peer-to-Peer Networks
Client and server software usually run on separate computers, but it is also possible for one
computer to run both client and server software at the same time. In small businesses and
homes, many computers function as the servers and clients on the network. This type of
network is called a peer-to-peer (P2P) network.
The simplest P2P network consists of two directly connected computers using either a wired
or wireless connection. Both computers are then able to use this simple network to exchange
data and services with each other, acting as either a client or a server as necessary.
Multiple PCs can also be connected to create a larger P2P network, but this requires a
network device, such as a switch, to interconnect the computers.
The main disadvantage of a P2P environment is that the performance of a host can be slowed
down if it is acting as both a client and a server at the same time. The figure lists some of the
advantages and disadvantages of peer-to-peer networks.
In larger businesses, because of the potential for high amounts of network traffic, it is often
necessary to have dedicated servers to support the number of service requests.
The advantages of peer-to-peer networking:
Easy to set up
 Less complex
Lower cost because network devices and dedicated servers may not be required
Can be used for simple tasks such as transferring files and sharing printers
The disadvantages of peer-to-peer networking:
No centralized administration
Not as secure
Not scalable
All devices may act as both clients and servers which can slow their performance
Peer-to-Peer Applications
A P2P application allows a device to act as both a client and a server within the same
communication, as shown in the figure. In this model, every client is a server and every
server is a client. P2P applications require that each end device provide a user interface and
run a background service.
Some P2P applications use a hybrid system where resource sharing is decentralized, but the
indexes that point to resource locations are stored in a centralized directory. In a hybrid
system, each peer accesses an index server to get the location of a resource stored on another
peer.
The figure depicts a Instant Message conversation with two machines communicating with
each other through the network. Each machine is acting as both a client and server. The
caption states. Both clients can simultaneously send and receive messages.
Multiple Roles in the Network
A computer with server software can provide services simultaneously to one or many clients,
as shown in the figure.
Additionally, a single computer can run multiple types of server software. In a home or small
business, it may be necessary for one computer to act as a file server, a web server, and an
email server.
A single computer can also run multiple types of client software. There must be client
software for every service required. With multiple clients installed, a host can connect to
multiple servers at the same time. For example, a user can check email and view a web page
while instant messaging and listening to internet radio.

TOPIC # 5 Network Infrastructure

The path that a message takes from its source to destination can be as simple as a single cable
connecting one computer to another, or as complex as a network that literally spans the globe.
This network infrastructure is the platform that supports the network. It provides the stable
and reliable channel over which our communications can occur.
The network infrastructure contains three categories of hardware components.
End devices
Intermediate devices
Network media
Devices and media are the physical elements, or hardware, of the network. Hardware is often
the visible components of the network platform such as a laptop, PC, switch, router, wireless
access point, or the cabling used to connect the devices. Occasionally, some components may
not be so visible. In the case of wireless media, messages are transmitted through the air
using invisible radio frequencies or infrared waves.
Make a list of the network infrastructure components installed in your home network. Include
the cables or wireless access points that provide your network connections.
End Devices
The network devices that people are most familiar with are called end devices, or hosts.
These devices form the interface between users and the underlying communication network.
Some examples of end devices are as follows:
Computers (workstations, laptops, file servers, web servers)
Network printers
Telephones and teleconferencing equipment
Security cameras
Mobile devices (such as smart phones, tablets, PDAs, and wireless debit/credit card
readers and barcode scanners)
An end device (or host) is either the source or destination of a message transmitted over the
network, as shown in the animation. In order to uniquely identify hosts, addresses are used.
When a host initiates communication, it uses the address of the destination host to specify
where the message should be sent.
MODULE # 2
Other Wireless Networks
Global Positioning System
The GPS uses satellites to transmit signals that cover the globe. The smartphone can receive
these signals and calculate the phone’s location to an accuracy of within 10 meters.
Wi-Fi
Wi-Fi transmitters and receivers located within the smartphone enable the phone to connect
to local networks and the internet. In order to receive and send data on a Wi-Fi network, the
phone needs to be within the range of the signal from a wireless network access point. Wi-Fi
networks are usually privately owned but often provide guest or public access hotspots. A
hotspot is an area where Wi-Fi signals are available. Wi-Fi network connections on the phone
are similar to the network connections on a laptop computer.
Bluetooth
Bluetooth is a low-power, shorter range wireless technology that is intended to replace wired
connectivity for accessories such as speakers, headphones, and microphones. Bluetooth can
also be used to connect a smartwatch to a smartphone. Because Bluetooth technology can be
used to transmit both data and voice, it can be used to create small local networks. Bluetooth
is wireless technology that allows devices to communicate over short distances. Multiple
devices can be connected at the same time with Bluetooth.
Near Field Communications

Near Field Communication (NFC) is a wireless communication technology that enables data
to be exchanged by devices that are in very close proximity to each other, usually less than a
few centimeters. For example, NFC can be used to connect a smartphone and a payment
system. NFC uses electromagnetic fields to transmit data.
TOPIC # 2 Local Network Connections
LAN Components
In addition to smart phones and mobile devices, there are many other components that can be
part of a local area network. Some examples of network components are personal computers,
servers, networking devices, and cabling. These components can be grouped into four main
categories:
 Hosts
 Peripherals
 Network devices
 Network media
Hosts:
Hosts send and receive user traffic. A host is a generic name for most end-user devices. A
host has an IP address. Examples of hosts are personal computers and network attached
printers.
Peripherals
Shared peripheral devices do not communicate directly on the network. Instead, peripherals
rely on their connected host to perform all network operations. Examples of shared
peripherals are cameras, scanners, and locally attached printers.
Network Devices
Networking devices connect other devices, mainly hosts. These devices move and control
network traffic. Examples of network devices include hubs, switches, and routers.
Network Media
Network media provides connections between hosts and network devices. Network media can
be wired, such as copper and fiber optic, or use wireless technologies.
The network components that you are probably most familiar with are hosts and shared
peripherals. Remember that hosts are any devices that send and receive messages directly
across the network.
Shared peripherals are not directly connected to the network, but instead are connected to
hosts. The host is then responsible for sharing the peripheral across the network. Hosts have
software configured to enable people on the network to use the attached peripheral devices.

The network devices, as well as the networking media, are used to interconnect hosts.
Networking devices are sometimes referred to as “intermediary devices” because they are
usually located in the path that messages take between a source host and a destination host.
The term network media describes the cables and wires used in wired networks, along with
radio frequency waves used in wireless networks. These wired and wireless networks provide
the paths over which messages travel between the various network components.
Some devices can play more than one role, depending on how they are connected. For
example, a printer that is directly connected to a host (local printer) is a peripheral. A printer
that is directly connected to a network device and participates directly in network
communications is a host.
Ethernet is technology commonly used in local area networks. Developed at Xerox PARC,
Ethernet was commercially introduced in 1980 by Digital Equipment Corporation (DEC),
Intel, and Xerox. Ethernet was later standardized in 1983 as IEEE 802.3. Devices access the
Ethernet LAN using an Ethernet Network Interface Card (NIC). Each Ethernet NIC has a
unique address permanently embedded on the card known as a Media Access Control (MAC)
address.
End Device Addressing
To physically connect to a network, an end-user device must have a network interface card
(NIC). The NIC is a piece of hardware that enables the device to connect to the network
medium, either wired or wireless. It may be integrated into the device motherboard or may be
a separately installed card.
In addition to the physical connection, some configuration of the operating system is required
for the device to participate in the network. Most networks connect to the internet and use the
internet to exchange information. An end-user device requires an Internet Protocol (IP)
address, as well as other information, to identify it to the other devices in the network. As
shown in the figure, there are three parts to the IP configuration which must be correct for the
device to send and receive information on the network:
 IP address - This identifies the host on the network.
 Subnet mask - This is used to identify the network on which the host is connected.
 Default gateway - This identifies the networking device that the host uses to access
the internet or another remote network.
Note: Most network applications use a domain name, such as [Link], instead of an
IP address when accessing information on the internet. A DNS server is used to translate the
domain name to its IP address. Without an IP address of a DNS server, the user will have
difficulty accessing the internet.
Manual and Automatic Address Assignment
An IP address can be configured manually or assigned automatically by another device
Manual IP Configuration: With manual configuration, the required values are entered into
the device via the keyboard, typically by a network administrator. The IP address that is
entered is referred to as a static address and must be unique on the network.
Dynamic IP Configuration
Most end-user devices can be set up to receive network configuration information
dynamically. This enables the device to request an address from a pool of addresses assigned
by a Dynamic Host Configuration Protocol (DHCP) server located within the network.
TOPIC # 3 Device Names and Address Planning
As a network grows in size and complexity, it becomes increasingly important that it is well
planned, logically organized, and well documented, as shown in the figure.
Many organizations develop conventions for the naming and addressing of computers and
other end-user devices. These provide guidelines and rules that can be used by network
support personnel when performing these tasks.
Computer operating systems such as Microsoft Windows allow the naming of a device such
as a computer or a printer. Device names must be unique and should have a consistent format
that conveys meaningful information. This can help to determine device type, function,
location, and sequence number based on the device name. IP addresses must also be unique
to each device.
The use of logical device naming and addressing conventions that are well documented can
greatly simplify the task of training and network management and can help as well with
troubleshooting when problems arise.
Network Topologies and Representations
In a simple network consisting of a few computers, it is easy for you to visualize how all of
the various components connect. As networks grow, it becomes more difficult to keep track
of the location of each component, and how each is connected to the network. Wired
networks require lots of cabling and network devices to provide connectivity for all network
hosts. A diagram provides an easy way to understand how the devices in a large network are
connected.
When networks are installed, a physical topology diagram is created to record where each
host is located and how it is connected to the network. The physical topology diagram also
shows where the wiring is installed and the locations of the networking devices that connect
the hosts. Such a diagram uses symbols or icons to represent the different devices and
connections that make up a network.
Logical Network Information
Documenting the physical connections and devices in your network will provide you with the
information that you need to know when connecting new devices or finding problems with
broken connectivity. But there is other information that you must have when troubleshooting
network problems. This information cannot be “seen” from the physical view of the network.
The device names, IP addressing, configuration information, and network designations are
logical pieces of information that may change more frequently than the physical connectivity.

MODULE # 3 Packet Tracer Network Simulator

Video - Introduction to Cisco Packet Tracer
Cisco Packet Tracer is an innovative network simulation and visualization tool. This free
software helps you to practice your network configuration and troubleshooting skills via your
desktop computer, or an Android or iOS based mobile device. Packet Tracer is available for
both the Linux and Windows desktop environments.
With Packet Tracer you can choose to build a network from scratch, use a pre-built sample
network, or complete classroom lab assignments. Packet Tracer allows you to easily explore
how data traverses your network. Packet Tracer provides an easy way to design and build
networks of varying sizes without expensive lab equipment. While this software is not a
replacement for practicing on physical routers, switches, firewalls, and servers, it provides
too many benefits to ignore!
TOPIC # 2 Packet Tracer Installation
Students commonly use Packet Tracer for the following purposes:
 Prepare for a certification exam.
 Practice what they learn in networking courses.
 Sharpen their skills for a job interview.
 Examine the impact of adding new technologies into existing network designs.
 Build their skills for jobs in the Internet of Things.
 Compete in global design competitions.

To obtain and install your copy of Cisco Packet Tracer, follow these simple steps:

Step 1. Log into your Cisco Networking Academy “I’m Learning” page.
Step 2. Select Resources from the menu in the upper right portion of your screen.
Step 3. Select Download Packet Tracer.
Step 4. Select the version of Packet Tracer you require.
Step 5. Save the file to your computer.
Step 6. Launch the Packet Tracer install program.
Step 7. After installation, close and restart your web browser.
Step 8. Launch Cisco Packet Tracer by selecting the appropriate icon.
Step 9. When prompted, use your Netacad login information to authenticate.
Step 10. Packet Tracer will launch and you are ready to explore its features.

TOPIC # 3 The Packet Tracer User Interface

Packet Tracer is a tool that allows you to simulate real networks. It provides three main
menus that you can use for the following:
  Add devices and connect them via cables or wireless
 Select, delete, inspect, label, and group components within your network
 Manage your network

The network management menu lets you do the following:

 Open an existing/sample network

 Save your current network
 Modify your user profile or your preferences

If you have used any program such as a word processor or spreadsheet, you are already
familiar with the File menu commands located in the top menu bar. The Open, Save, Save
As, and Exit commands work as they would for any program, but there are two commands
that are special to Packet Tracer:
The Open Samples command will display a directory of prebuilt examples of features and
configurations of various network and Internet of Things devices included within Packet
Tracer.
The Exit and Logout command will remove the registration information for this copy of
Packet Tracer and require the next user of this copy of Packet Tracer to do the login
procedure again.
Locate and Deploy Devices
Because Packet Tracer simulates networks and network traffic, the physical aspects of these
networks also need to be simulated. This includes actually finding and deploying physical
devices, customizing those devices, and cabling those devices. After the physical deployment
and cabling is done, then it is time for configuration of the interfaces used to connect the
devices.
Finding a device to deploy requires looking in the Device-Type Selection Box. The Device-
Type Selection Box works on the concept of categories and sub-categories.
The top row of icons represents the category list consisting of: [Networking Devices], [End
Devices], [Components], [Connections], [Miscellaneous], and [Multiuser]. Each category
contains at least one sub-category group.
TOPIC# 4 Packet Tracer Network Configuration
Device Configuration in Packet Tracer
After your network has been created, it is time to configure the devices and components.
Packet Tracer lets you configure the different intermediate and end devices that make up your
network. To access the configuration interface of any devices, first click the device that you
wish to configure. A popup window will appear displaying a series of tabs. Different types of
devices have different interfaces.
GUI and CLI Configuration in Packet Tracer
Packet Tracer also provides a variety of tabs for device configuration including the following:
1. Physical
 2. Configuration
3. CLI
4. Desktop
5. Services
The tabs that are shown depend on the device you are currently configuring.
Physical Tab

The Physical tab provides an interface for interacting with the device including powering it on or off or
installing different modules, such as a wireless network interface card (NIC).

Physical Tab

The Physical tab provides an interface for interacting with the device including powering it on or off or
installing different modules, such as a wireless network interface card (NIC).

CLI Tab

The CLI tab provides access to the CLI interface, which requires knowledge of device configuration. Here,
you can practice configuring the device at the command line. CLI configuration is a necessary skill for
more advanced networking implementations.

Note: Any commands that were entered from the Config tab are also shown here in the CLI tab.

Desktop Tab

For some of the end devices, such as PCs and laptops, Packet Tracer provides a desktop interface that
gives you access to IP configuration, wireless configuration, a command prompt, a web browser, and much
more.

Services Tab

If you are configuring a server, the server has all of the functions of a host with the addition of one more
tab, the Services tab. This tab allows a server to be configured as a web server, a DHCP server, a DNS
server, or various other servers visible in the graphic.

MODULE# 4 Network Media Types

Three Media Types
Communication transmits across a network on media. The media provides the channel over
which the message travels from source to destination.
Modern networks primarily use three types of media to interconnect devices.
Metal wires within cables - Data is encoded into electrical impulses.
Glass or plastic fibers within cables (fiber-optic cable) - Data is encoded into pulses of
light.
Wireless transmission - Data is encoded via modulation of specific frequencies of
electromagnetic waves.

Common Network Cables

The three most common network cables are twisted-pair, coaxial cable, and fiber-optic cable.
Twisted-Pair Cable

Ethernet technology generally uses twisted-pair cables to interconnect devices. Because

Ethernet is the foundation for most local networks, twisted-pair is the most commonly
encountered type of network cabling.
In twisted-pair, wires are grouped in pairs and twisted together to reduce interference. The
pairs of wires are colored so that you can identify the same wire at each end. Typically, in
each pair, one of the wires is a solid color and its partner is the same color striped onto a
white background.
Coaxial Cable
Coaxial was one of the earliest types of network cabling developed. Coaxial cable is the kind
of copper cable used by cable TV companies. It is also used for connecting the various
components which make up satellite communication systems. Coaxial cable has a single rigid
copper core that conducts the signal. This core is typically surrounded by a layer of
insulation, braided metal shielding, and a protective jacket. It is used as a high-frequency
transmission line to carry high-frequency or broadband signals.
Fiber-Optic Cable
Fiber-optic cable can be either glass or plastic with a diameter about the same as a human
hair and it can carry digital information at very high speeds over long distances. Because light
is used instead of electricity, electrical interference does not affect the signal. Fiber-optic
cables have many uses as well as communications. They are also used in medical imaging,
medical treatment, and mechanical engineering inspection.
They have a very high bandwidth, which enables them to carry very large amounts of data.
Fiber is used in backbone networks, large enterprise environments, and large data centers. It
is also used extensively by telephone companies.
TOPIC# 2 Ethernet Cabling
Twisted-Pair Cables
The networks in most homes and schools are wired with twisted-pair copper cable. This type
of cable is inexpensive compared to other types of cabling, and it is readily available. The
Ethernet patch cables that you can purchase through the internet or at a retail store are an
example of copper twisted-pair cable.
Twisted-pair cables consist of one or more pairs of insulated copper wires that are twisted
together and housed in a protective jacket. Like all copper cables, twisted-pair uses pulses of
electricity to transmit data.
Data transmission over copper cable is sensitive to electromagnetic interference (EMI), which
can reduce the data throughput rate that a cable can provide. Common items in a home that
can create EMI include microwave ovens and fluorescent light fixtures.
 Another source of interference, known as crosstalk, occurs when cables are bundled together
for long lengths. The electrical impulses from one cable can cross over to an adjacent cable.
This occurs most frequently when cables are improperly installed and terminated. When data
transmission is corrupted due to interference such as crosstalk, the data must be retransmitted.
This can degrade the data carrying capacity of the medium.
1. A pure digital signal is transmitted.
2. On the medium, there is an interference signal.
3. The digital signal is corrupted by the interference signal.
4. The receiving computer reads a changed signal. Notice that a 0 bit is now interpreted
as a 1 bit.
Types of Twisted-Pair Cables
There are two commonly installed types of twisted-pair cable:
Unshielded twisted-pair (UTP) - This is the most commonly encountered type of network
cable in North America and many other areas.
Shielded cables (STP) - These are used almost exclusively in European countries.
UTP Cable

UTP cable is inexpensive, offers a high bandwidth, and is easy to install. This
type of cable is used to connect workstations, hosts and network devices. It can
come with many different numbers of pairs inside the jacket, but the most
common number of pairs is four. Each pair is identified by a specific color code.

Many different categories of UTP cables have been developed over time, as
shown in the table. Each category of cable was developed to support a specific
technology and most are no longer encountered in homes or offices. The cable
types which are still commonly found include Categories 3, 5, 5e, and 6.

STP Cable

Category Speed Features

Cat 3 UTP 10 Mbps at 16 MHz  Suitable for Ethernet LANs
 Most often used for phone line.

Cat 5 UTP 100 Mbps at 100 MHz Manufactured with higher standard than Cat 3 to allow for higher data
transfer rates
Cat 5e 1000 Mbps at 100 MHz Manufactured with higher standard than Cat 5 to allow for higher data
UTP transfer rates
  More twists per foot than Cat 5 to better prevent EMI and RFI from
outside sources

Cat 6 UTP 1000 Mbps at 250 MHz Manufactured with higher standard than Cat 5e
Cat 6a 1000 Mbps at 500 MHz More twists per foot than Cat 5 to better prevent EMI and RFI from
UTP outside sources
Cat 7 ScTP 10 Gbps at 600 MHz
There are electrical environments in which EMI and RFI are so strong that shielding is a
requirement to make communication possible, such as in a factory. In this instance, it may be
necessary to use a cable that contains shielding, such as shielded twisted-pair (STP).
Unfortunately, STP cables are very expensive, not as flexible, and have additional

All categories of data grade UTP cable are traditionally terminated into an RJ-45 connector.
There are still some applications that require the smaller RJ-11 connector, such as analog
phones and some fax machines. In the figure below, an example of an RJ-11 connector is on
the left. The RJ-45 connector is on the right.

TOPIC# 3 Coaxial and Fiber-Optic Cabling

Cable TV and Satellite Cables
Like twisted-pair, coaxial cable (or coax) carries data in the form of electrical signals. It
provides improved shielding compared to UTP and can therefore carry more data. Coaxial
cable is usually constructed of either copper or aluminum. It is used by cable television
companies to provide service and for connecting the various components that make up
satellite communication systems. You are probably familiar with the coaxial cables used to
connect a TV set to the signal source, be it a cable TV outlet, satellite TV, or conventional
antenna in your home. With the addition of a cable modem, the cable television provider can
offer data and internet service, as well as television signals and telephone over the same
coaxial cable.
Although coax has improved data carrying characteristics, twisted-pair cabling has replaced
coax in local area networking uses. Among the reasons for the replacement is that compared
to UTP, coax is physically harder to install, more expensive, and harder to troubleshoot.
Fiber-Optic Cables
Unlike UTP and coax, fiber-optic cables transmit data using pulses of light. Although not
normally found in home or small business environments, fiber-optic cabling is widely used in
enterprise environments and large data centers.
Fiber-optic cable is constructed of either glass or plastic, neither of which conducts
electricity. This means that it is immune to EMI and RFI, and is suitable for installation in
environments where interference is a problem. Fiber connections are a good choice to extend
networks from one building to another, both because of distance considerations and because
fiber cables are more resistant to outdoor environmental conditions than copper cables. Each
fiber-optic circuit is actually two fiber cables. One is used to transmit data; the other is used
to receive data.
 Jacket - Typically a PVC jacket that protects the fiber against abrasion, moisture, and other
contaminants. This outer jacket composition can vary depending on the cable usage.
 Strengthening Material - Surrounds the buffer, prevents the fiber cable from being stretched
when it is being pulled. The material used is often the same material used to produce
bulletproof vests.
 Buffer - Used to help shield the core and cladding from damage.
 Cladding - Made from slightly different chemicals than those used to create the core. It tends
to act like a mirror by reflecting light back into the core of the fiber. This keeps light in the
core as it travels down the fiber.
 Core - The core is actually the light transmission element at the center of the optical fiber.
This core is typically silica or glass. Light pulses travel through the fiber core.

Fiber-optic cables can reach distances of several miles or kilometers before the signal needs
to be regenerated. Either lasers or light emitting diodes (LEDs) generate the light pulses that
are used to represent the transmitted data as bits on the media. In addition to its resistance to
EMI, fiber-optic cables support a large amount of bandwidth, making them ideally suited for
high-speed data networks. Bandwidth on fiber-optic links can reach speeds of 100 Gbps and
is continually increasing as standards are developed and adopted. Fiber-optic links are found
in many corporations and are also used to connect ISPs on the internet.

TOPIC#4 Twisted-Pair Operation

Twisted-Pair Wiring Schemes
Have you ever looked closely at the plastic RJ-45 connector at the end of an Ethernet patch
cable? Did you ever wonder why each of the wires terminating in the connector has a specific
color or pattern? The color coding of the wire pairs in an UTP cable is determined by the type
of standard that is used to make the cable. Different standards have different purposes and are
closely governed by the standards organizations.
For typical Ethernet installations, there are two standards that are widely implemented. The
TIA/EIA organization defines two different patterns, or wiring schemes, called T568A and
T568B, as shown in the figure. Each wiring scheme defines the pinout, or order of wire
connections, on the end of the cable.
On a network installation, one of the two wiring schemes (T568A or T568B) should be
chosen and followed. It is important that the same wiring scheme is used for every
termination in that project.
Twisted-Pair Transmit and Receive Pairs
Ethernet NICs and the ports on networking devices are designed to send data over UTP
cables. Specific pins on the connector are associated with a transmit function and a receive
function. The interfaces on each device are designed to transmit and receive data on
designated wires within the cable.
When two devices are directly connected using an UTP Ethernet cable, it is important that the
transmit function and the receive function on each end of the cable are reversed. One device
sends data on a specific set of wires and the device on the other end of the cable listens for
the data on the same wires.
Two devices that use different wires for transmit and receive are known as unlike devices.
They require a straight-through cable to exchange data. Straight-through cables have the
same color patterns on both ends of the cable.
Devices that are directly connected and use the same pins for transmit and receive, are known
as like devices. They require the use of a crossover cable in order to reverse the transmit
function and receive function so that the devices can exchange data.
TOPIC# 5 Verify Connectivity
Using the ping Command
Every device that sends messages across the internet must have an Internet Protocol (IP)
address to identify it to the other devices in the network. IP addresses are assigned by
network administrators. When a new device is added to a network, or if an existing device is
having problems, it may be necessary to test the network to determine if the IP address
assigned to the device can be reached by other devices on the network.
The ping utility tests end-to-end connectivity between the IP address of the source of the
message and the IP address of its destination. It measures the time that it takes test messages
to make a round trip from the source to the destination, and whether the transmission is
successful. However, if the test message does not reach the destination, or if delays are
encountered along the way, there is no way to determine where the problem is located.
The format of the ping command is universally implemented. Almost all network attached
devices provide a way to perform a ping test. The format of the ping command is ping
x.x.x.x, where x.x.x.x is an IP address or domain name:
For example, ping [Link].

The traceroute Command

The internet is not really a place; it is the interconnection of many different networks that
provide services to the users. We can see this connectivity by using a network utility
call traceroute.

As shown in the figure, the traceroute utility traces the route a message takes from its source
to the destination. Each individual network through which the message travels is referred to
as a hop. The traceroute command displays each hop along the way and the time it takes for
the message to get to that network and back.

If a problem occurs, use the output of the traceroute utility to help determine where a
message was lost or delayed. The traceroute utility is called tracert in the Windows
environment.
MODULE# 5 Communication Principles

TOPIC# 1 The Rules

The Three Elements

The primary purpose of any network is to provide us with a method to communicate and
share information. From the very earliest primitive human societies to the most advanced
technological societies of today, sharing information with others has been crucial for human
advancement.

All communication begins with a message, or information, that must be sent from one
individual or device to another. The methods used to send, receive, and interpret messages
change over time as technology advances.

All communication methods have three elements in common. The first of these elements is
the message source, or sender. Message sources are people, or electronic devices, that need to
communicate a message to other individuals or devices. The second element of
communication is the destination, or receiver, of the message. The destination receives the
message and interprets it. The third element is called a transmission medium, or channel. It
provides the pathway over which the message can travel from source to destination.

Analogy

Prior to communicating, they must agree on how to communicate. If the communication is

using voice, they must first agree on the language. Next, when they have a message to share,
they must be able to format that message in a way that is understandable.

If someone uses the English language, but poor sentence structure, the message can easily be
misunderstood. Each of these tasks describe protocols that are used to accomplish
communication.

Network

Prior to communicating, the devices must agree on how to communicate. They must also
format the message in a way that is understandable.
 Communication Protocols

Communication in our daily lives takes many forms and occurs in many environments. We
have different expectations depending on whether we are chatting via the internet or
participating in a job interview. Each situation has its corresponding expected behaviors and
styles.

Before beginning to communicate with each other, we establish rules or agreements to govern
the conversation. These agreements include the following:

 What method of communication should we use?

 What language should we use?
 Do we need to confirm that our messages are received?

Method / Language / Protocol

The three figures each show two people determining how they will communicate. The method figure is
about reaching an agreement on the method of communication.

These rules, or protocols, must be followed in order for the message to be successfully delivered and
understood. Among the protocols that govern successful human communication are these:

 An identified sender and receiver

 Agreed upon method of communicating (face-to-face, telephone, letter, photograph)
 Common language and grammar
 Speed and timing of delivery
 Confirmation or acknowledgment requirements

The techniques that are used in network communications share these fundamentals with human
conversations.

Why Protocols Matter

Just like humans, computers use rules, or protocols, in order to communicate. Protocols are required for
computers to properly communicate across the network. In both a wired and wireless environment, a local
network is defined as an area where all hosts must "speak the same language", which, in computer terms
means they must "share a common protocol".

If everyone in the same room spoke a different language, they would not be able to communicate.
Likewise, if devices in a local network did not use the same protocols, they would not be able to
communicate.

Networking protocols define many aspects of communication over the local network. As shown in the
table, these include message format, message size, timing, encoding, encapsulation, and message patterns.

Protocol
Description
Characteristic

When a message is sent, it must use a specific format or structure. Message formats depend on the
Message format
type of message and the channel that is used to deliver the message.
Protocol
Description
Characteristic

The rules that govern the size of the pieces communicated across the network are very strict. They
can also be different, depending on the channel used. When a long message is sent from one host
Message size
to another over a network, it may be necessary to break the message into smaller pieces in order to
ensure that the message can be delivered reliably.

Many network communication functions are dependent on timing. Timing determines the speed at
Timing which the bits are transmitted across the network. It also affects when an individual host can send
data and the total amount of data that can be sent in any one transmission.

Messages sent across the network are first converted into bits by the sending host. Each bit is
encoded into a pattern of sounds, light waves, or electrical impulses depending on the network
Encoding
media over which the bits are transmitted. The destination host receives and decodes the signals in
order to interpret the message.

Each message transmitted on a network must include a header that contains addressing
information that identifies the source and destination hosts, otherwise it cannot be delivered.
Encapsulation Encapsulation is the process of adding this information to the pieces of data that make up the
message. In addition to addressing, there may be other information in the header that ensures that
the message is delivered to the correct application on the destination host.

Some messages require an acknowledgment before the next message can be sent. This type of
request/response pattern is a common aspect of many networking protocols. However, there are
Message pattern
other types of messages that may be simply streamed across the network, without concern as to
whether they reach their destination.

TOPIC# 2 Communication Standards

The Internet and Standards

With the increasing number of new devices and technologies coming online, how is it possible to manage
all the changes and still reliably deliver services such as email? The answer is internet standards.

A standard is a set of rules that determines how something must be done. Networking and internet
standards ensure that all devices connecting to the network implement the same set of rules or protocols in
the same manner. Using standards, it is possible for different types of devices to send information to each
other over the internet. For example, the way in which an email is formatted, forwarded, and received by
all devices is done according to a standard. If one person sends an email via a personal computer, another
person can use a mobile phone to receive and read the email as long as the mobile phone uses the same
standards as the personal computer.

Network Standards Organizations

An internet standard is the end result of a comprehensive cycle of discussion, problem solving, and testing.
These different standards are developed, published, and maintained by a variety of organizations, as shown
in the figure. When a new standard is proposed, each stage of the development and approval process is
recorded in a numbered Request for Comments (RFC) document so that the evolution of the standard is
 tracked. RFCs for internet standards are published and managed by the Internet Engineering Task Force
(IETF).

TOPIC# 3 Network Communication Models

The Protocol Stack

Successful communication between hosts requires interaction between a number of protocols. These
protocols are implemented in software and hardware that are installed on each host and networking device.

The interaction between the different protocols on a device can be illustrated as a protocol stack, as shown
in the figure. A stack illustrates the protocols as a layered hierarchy, with each higher-level protocol
depending on the services of the protocols shown in the lower levels.

The separation of functions enables each layer in the stack to operate independently of others. For
example, you can use your laptop computer connected to a cable modem at home to access your favorite
website, or view the same website on your laptop using a wireless connection at the library. The function
of the web browser is not affected by the change in the physical location, nor the method of connectivity.

The protocols are described as follows:

 Hypertext Transfer Protocol (HTTP) - This protocol governs the way a web server and a web client
interact. HTTP defines the content and formatting of the requests and responses that are exchanged
between the client and server. Both the client and the web server software implement HTTP as part of the
application. HTTP relies on other protocols to govern how the messages are transported between the client
and server.
 Transmission Control Protocol (TCP) - This protocol manages the individual conversations. TCP is
responsible for guaranteeing the reliable delivery of the information and managing flow control between
the end devices.
 Internet Protocol (IP) - This protocol is responsible for delivering messages from the sender to the
receiver. IP is used by routers to forward the messages across multiple networks.
 Ethernet - This protocol is responsible for the delivery of messages from one NIC to another NIC on the
same Ethernet local area network (LAN).

The TCP/IP Model

Layered models help us visualize how the various protocols work together to enable network
communications. A layered model depicts the operation of the protocols occurring within each layer, as
well as the interaction with the layers above and below it. The layered model has many benefits:

 Assists in protocol design, because protocols that operate at a specific layer have defined information that
they act upon and a defined interface to the layers above and below.
 Fosters competition because products from different vendors can work together.
 Enables technology changes to occur at one level without affecting the other levels.
 Provides a common language to describe networking functions and capabilities.

The first layered model for internetwork communications was created in the early 1970s and is referred to
as the internet model. It defines four categories of functions that must occur in order for communications
to be successful. The suite of TCP/IP protocols that are used for internet communications follows the
 structure of this model, as shown in the figure. Because of this, the internet model is commonly referred to
as the TCP/IP model.

TCP/IP Model Layer Description

Application Represents data to the user, plus encoding and dialog control.

Transport Supports communication between various devices across diverse networks.

Internet Determines the best path through the network.

Network Access Controls the hardware devices and media that make up the network.

The OSI Reference Model

There are two basic types of models that we use to describe the functions that must occur in order for
network communications to be successful: protocol models and reference models.

 Protocol model - This model closely matches the structure of a particular protocol suite. A protocol suite
includes the set of related protocols that typically provide all the functionality required for people to
communicate with the data network. The TCP/IP model is a protocol model because it describes the
functions that occur at each layer of protocols within the TCP/IP suite.
 Reference model - This type of model describes the functions that must be completed at a particular layer,
but does not specify exactly how a function should be accomplished. A reference model is not intended to
provide a sufficient level of detail to define precisely how each protocol should work at each layer. The
primary purpose of a reference model is to aid in clearer understanding of the functions and processes
necessary for network communications.

The most widely known internetwork reference model was created by the Open Systems Interconnection
(OSI) project at the International Organization for Standardization (ISO). It is used for data network
design, operation specifications, and troubleshooting. This model is commonly referred to as the OSI
model.

OSI Model
Description
Layer

7-
The application layer contains protocols used for process-to-process communications.
Application

6- The presentation layer provides for common representation of the data transferred between application layer
Presentation services.

The session layer provides services to the presentation layer to organize its dialogue and to manage data
5 - Session
exchange.

The transport layer defines services to segment, transfer, and reassemble the data for individual
4 - Transport
communications between the end devices.

The network layer provides services to exchange the individual pieces of data over the network between
3 - Network
identified end devices.
OSI Model
Description
Layer

The data link layer protocols describe methods for exchanging data frames between devices over a common
2 - Data Link
media

The physical layer protocols describe the mechanical, electrical, functional, and procedural means to
1 - Physical
activate, maintain, and de-activate physical connections for a bit transmission to and from a network device.

Upper and Lower Layers of the OSI Model

Moving data across a network can be visualized using the seven layers of the OSI model, as shown in the
figure. The OSI model breaks network communications down into multiple processes. Each process is a
small part of the larger task.

For example, in a vehicle manufacturing plant, the entire vehicle is not assembled by one person. Rather,
the vehicle moves from station to station where specialized teams add specific components. The complex
task of assembling a vehicle is made easier by breaking it into manageable and logical tasks. This process
also makes troubleshooting easier. When a problem occurs in the manufacturing process, it is possible to
isolate the problem to the specific task where the defect was introduced, and then fix it.

In a similar manner, the OSI model helps us troubleshoot by focusing on a specific layer to identify and
resolve network problems. Networking teams often refer to different functions occurring on a network by
the number of the OSI model layer that specifies that functionality. For example, the process of encoding
the data bits for transmission across the media occurs at Layer 1, the physical layer. The formatting of data
so it can be interpreted by the network connection in your laptop or phone is described at Layer 2, the data
link layer.

Layer
Group Layer Name Common Network Components Associated with this Layer
Number

7 Application
 Network aware applications
 Email
6 Presentation  Web browsers and servers
Upper Layers
 File transfer
 Name resolution
5 Session

 Video and voice streaming mechanisms

4 Transport  Firewall filtering lists

Lower Layers
 IP addressing
3 Network  Routing
 Layer
Group Layer Name Common Network Components Associated with this Layer
Number

 Network interface cards and drivers

 Network switching
2 Data Link
 WAN connectivity

 Physical medium (copper twisted pair, fiber-optic cables, wireless

transmitters)
1 Physical  Hubs and repeaters

OSI Model and TCP/IP Model Comparison

Because TCP/IP is the protocol suite in use for internet communications, why do we need to learn the OSI
model as well?

The TCP/IP model is a method of visualizing the interactions of the various protocols that make up the
TCP/IP protocol suite. It does not describe general functions that are necessary for all networking
communications. It describes the networking functions specific to those protocols in use in the TCP/IP
protocol suite. For example, at the network access layer, the TCP/IP protocol suite does not specify which
protocols to use when transmitting over a physical medium, nor the method of encoding the signals for
transmission. OSI Layers 1 and 2 discuss the necessary procedures to access the media and the physical
means to send data over a network.

The protocols that make up the TCP/IP protocol suite can be described in terms of the OSI reference
model. The functions that occur at the internet layer in the TCP/IP model are contained in the network
layer of the OSI Model, as shown in the figure. The transport layer functionality is the same between both
models. However, the network access layer and the application layer of the TCP/IP model are further
divided in the OSI model to describe discrete functions that must occur at these layers.

The key similarities are in the transport and network layers; however, the two models differ in how they
relate to the layers above and below each layer:

 OSI Layer 3, the network layer, maps directly to the TCP/IP internet layer. This layer is used to describe
protocols that address and route messages through an internetwork.
 OSI Layer 4, the transport layer, maps directly to the TCP/IP transport layer. This layer describes general
services and functions that provide ordered and reliable delivery of data between source and destination
hosts.
 The TCP/IP application layer includes several protocols that provide specific functionality to a variety of
end user applications. The OSI model Layers 5, 6, and 7 are used as references for application software
developers and vendors to produce applications that operate on networks.
 Both the TCP/IP and OSI models are commonly used when referring to protocols at various layers.
Because the OSI model separates the data link layer from the physical layer, it is commonly used when
referring to these lower layers.

TOPIC# 4 Ethernet

The Rise of Ethernet

 In the early days of networking, each vendor used its own proprietary methods of interconnecting network
devices and networking protocols. If you bought equipment from different vendors, there was no guarantee
that the equipment would work together. Equipment from one vendor might not communicate with
equipment from another.

As networks became more widespread, standards were developed that defined rules by which network
equipment from different vendors operated. Standards are beneficial to networking in many ways:

 Facilitate design
 Simplify product development
 Promote competition
 Provide consistent interconnections
 Facilitate training
 Provide more vendor choices for customers

There is no official local area networking standard protocol, but over time, one technology, Ethernet, has
become more common than the others. Ethernet protocols define how data is formatted and how it is
transmitted over the wired network. The Ethernet standards specify protocols that operate at Layer 1 and
Layer 2 of the OSI model. Ethernet has become a de facto standard, which means that it is the technology
used by almost all wired local area networks,

Ethernet Evolution
The Institute of Electrical and Electronic Engineers, or IEEE (pronounced eye-triple-e), maintains the
networking standards, including Ethernet and wireless standards. IEEE committees are responsible for
approving and maintaining the standards for connections, media requirements and communications
protocols. Each technology standard is assigned a number that refers to the committee that is responsible
for approving and maintaining the standard. The committee responsible for the Ethernet standards is 802.3.

Since the creation of Ethernet in 1973, standards have evolved for specifying faster and more flexible
versions of the technology. This ability for Ethernet to improve over time is one of the main reasons that it
has become so popular. Each version of Ethernet has an associated standard. For example, 802.3
100BASE-T represents the 100 Megabit Ethernet using twisted-pair cable standards. The standard notation
translates as:

 100 is the speed in Mbps

 BASE stands for baseband transmission
 T stands for the type of cable, in this case, twisted-pair.

Early versions of Ethernet were relatively slow at 10 Mbps. The latest versions of Ethernet operate at 10
Gigabits per second and more. Imagine how much faster these new versions are than the original Ethernet
networks.

The Ethernet MAC Address

All communication requires a way to identify the source and destination. The source and destination in
human communication are represented by names.

When your name is called, you listen to the message and respond. Other people in the room may hear the
message, but they ignore it because it is not addressed to them.
On Ethernet networks, a similar method exists for identifying source and destination hosts. Each host
connected to an Ethernet network is assigned a physical address which serves to identify the host on the
network.

Every Ethernet network interface has a physical address assigned to it when it is manufactured. This
address is known as the Media Access Control (MAC) address. The MAC address identifies each source
and destination host on the network.

MODULE# 6 Network Design and the Access Layer

TOPIC# 1 Encapsulation and the Ethernet Frame

Encapsulation
When sending a letter, the letter writer uses an accepted format to ensure that the letter is delivered and
understood by the recipient. In the same way, a message that is sent over a computer network follows
specific format rules in order for it to be delivered and processed.

The process of placing one message format (the letter) inside another message format (the envelope) is
called encapsulation. De-encapsulation occurs when the process is reversed by the recipient and the letter
is removed from the envelope. Just as a letter is encapsulated in an envelope for delivery, so computer
messages are encapsulated.

Each computer message is encapsulated in a specific format, called a frame, before it is sent over the
network. A frame acts like an envelope; it provides the address of the intended destination and the address
of the source host. The format and contents of a frame are determined by the type of message being sent
and the channel over which it is communicated. Messages that are not correctly formatted are not
successfully delivered to or processed by the destination host.

Analogy

A common example of requiring the correct format in human communications is when sending a letter.
Click Play in the figure to view an animation of formatting and encapsulating a letter.

An envelope has the address of the sender and receiver, each located at the proper place on the envelope. If
the destination address and formatting are not correct, the letter is not delivered.

The process of placing one message format (the letter) inside another message format (the envelope) is
called encapsulation. De-encapsulation occurs when the process is reversed by the recipient and the letter
is removed from the envelope.

Network

Similar to sending a letter, a message that is sent over a computer network follows specific format rules for
it to be delivered and processed.

Internet Protocol (IP) is a protocol with a similar function to the envelope example. In the figure, the fields
of the Internet Protocol version 6 (IPv6) packet identify the source of the packet and its destination. IP is
responsible for sending a message from the message source to destination over one or more networks.

Note: The fields of the IPv6 packet are discussed in detail in another module.
 Ethernet Frame
The Ethernet protocol standards define many aspects of network communication including frame format,
frame size, timing, and encoding.

When messages are sent between hosts on an Ethernet network, the hosts format the messages into the
frame layout that is specified by the standards. Frames are also referred to as Layer 2 protocol data units
(PDUs). This is because the protocols that provide the rules for the creation and format of the frame
perform the functions that are specified at the data link layer (Layer 2) of the OSI model.

The format for Ethernet frames specifies the location of the destination and source MAC addresses, and
additional information including:

 Preamble for sequencing and timing

 Start of frame delimiter
 Length and type of frame
 Frame check sequence to detect transmission errors

The size of Ethernet frames is normally limited to a maximum of 1518 bytes and a minimum size of 64
bytes from the Destination MAC Address field through the Frame Check Sequence (FCS). The preamble
and the Start of Frame Delimiter (SFD) are used to indicate the beginning of the frame. They are not used
in the calculation of the frame size. Frames that do not match these limits are not processed by the
receiving hosts. In addition to the frame formats, sizes and timing, Ethernet standards define how the bits
making up the frames are encoded onto the channel. Bits are transmitted as either electrical impulses over
copper cable or as light impulses over fiber-optic cable.

Ethernet Frame Fields

TOPIC# 2 Hierarchical Network Design

Physical and Logical Addresses

A person's name usually does not change. A person's address on the other hand, relates to
where the person lives and can change. On a host, the MAC address does not change; it is
physically assigned to the host NIC and is known as the physical address. The physical
address remains the same regardless of where the host is placed on the network.

The IP address is similar to the address of a person. It is known as a logical address because it
is assigned logically based on where the host is located. The IP address, or network address,
is assigned to each host by a network administrator based on the local network.

IP addresses contain two parts. One part identifies the network portion. The network portion
of the IP address will be the same for all hosts connected to the same local network. The
second part of the IP address identifies the individual host on that network. Within the same
local network, the host portion of the IP address is unique to each host, as shown in the
figure.

Both the physical MAC and logical IP addresses are required for a computer to communicate
on a hierarchical network, just like both the name and address of a person are required to send
a letter.

The figure shows two networks connected by a router. The left network is 192 dot 168 dot
200 dot 0. The right network is 192 dot 168 dot 1 dot 0. Each network has 4 hosts connected
by a switch, H1 192 dot 168 dot 200 dot 1, H2 192 dot 168 dot 200 dot 2, H3 192 dot 168 dot
200 dot 3, and H4 192 dot 168 dot 200 dot 4 in the left network and H5 192 dot 168 dot 1 dot
1, H6 192 dot 168 dot 1 dot 2, H7 192 dot 168 dot 1 dot 3, and H8 192 dot 168 dot 1 dot 4 in
the right network. The ending number of each host address is in red.

Hierarchical Analogy
Imagine how difficult communication would be if the only way to send a message to someone was to use
the person's name. If there were no street addresses, cities, towns, or country boundaries, delivering a
message to a specific person across the world would be nearly impossible.

North America/ Canada/ Nova Scotia/ Halifax

On an Ethernet network, the host MAC address is similar to a person's name. A MAC address indicates the
individual identity of a specific host, but it does not indicate where on the network the host is located. If all
hosts on the internet (millions and millions of them) were each identified by their unique MAC address
only, imagine how difficult it would be to locate a single one.

Additionally, Ethernet technology generates a large amount of broadcast traffic in order for hosts to
communicate. Broadcasts are sent to all hosts within a single network. Broadcasts consume bandwidth and
slow network performance. What would happen if the millions of hosts attached to the internet were all in
one Ethernet network and were using broadcasts?

For these two reasons, large Ethernet networks consisting of many hosts are not efficient. It is better to
divide larger networks into smaller, more manageable pieces. One way to divide larger networks is to use a
hierarchical design model.

Benefits of a Hierarchical Design

 In networking, hierarchical design is used to group devices into multiple networks that are organized in a
layered approach. This method of designing networks consists of smaller, more manageable groups that
allow local traffic to remain local. Only traffic that is destined for other networks is moved to a higher
layer.

A hierarchical, layered design provides increased efficiency, optimization of function, and increased speed.
It allows the network to scale as required because additional local networks can be added without
impacting the performance of the existing ones.

As shown in the figure, the hierarchical design has three basic layers:

 Access Layer - This layer provides connections to hosts in a local Ethernet network.
 Distribution Layer - This layer interconnects the smaller local networks.
 Core Layer - This layer provides a high-speed connection between distribution layer devices.

With a hierarchical design, there is a need for a logical addressing scheme that can identify the location of
a host. The most common addressing scheme on the internet is Internet Protocol version 4 (IPv4). Internet
Protocol version 6 (IPv6) is the network layer protocol currently being implemented as a replacement for
IPv4. IPv4 and IPv6 will coexist for the foreseeable future. From this point on in this course, the term IP
will refer to both IPv4 and IPv6.

Access, Distribution, and Core

IP traffic is managed based on the characteristics and devices associated with each of the three layers of
the hierarchical network design model: Access, Distribution and Core.

Access Layer

The access layer provides a connection point for end user devices to the network and allows multiple hosts
to connect to other hosts through a network device, usually a switch, such as the Cisco 2960-XR shown in
the figure, or a wireless access point. Typically, all devices within a single access layer will have the same
network portion of the IP address.

If a message is destined for a local host, based on the network portion of the IP address, the message
remains local. If it is destined for a different network, it is passed up to the distribution layer. Switches
provide the connection to the distribution layer devices, usually a Layer 3 device such as a router or Layer
3 switch.

Distribution Layer

The distribution layer provides a connection point for separate networks and controls the flow of
information between the networks. It typically contains more powerful switches, such as the Cisco C9300
series shown in the figure, than the access layer as well as routers for routing between networks.
Distribution layer devices control the type and amount of traffic that flows from the access layer to the
core layer.

Core Layer

The core layer is a high-speed backbone layer with redundant (backup) connections. It is responsible for
transporting large amounts of data between multiple end networks. Core layer devices typically include
very powerful, high-speed switches and routers, such as the Cisco Catalyst 9600 shown in the figure. The
main goal of the core layer is to transport data quickly.
TOPIC# 3 The Access Layer

Access Layer Devices

The access layer is the basic level of the network. It is the part of the network in which people
gain access to other hosts and to shared files and printers. The access layer provides the first
line of networking devices that connect hosts to the wired Ethernet network.

Networking devices enable us to connect many hosts with each other and also provide those
hosts access to services offered over the network. Unlike the simple network consisting of
two hosts connected by a single cable, in the access layer, each host is connected to a
networking device. This type of connectivity is shown in the figure.

Within an Ethernet network, each host is able to connect directly to an access layer
networking device using an Ethernet cable. These cables are manufactured to meet specific
Ethernet standards. Each cable is plugged into a host NIC and then into a port on the
networking device. There are several types of networking devices that can be used to connect
hosts at the access layer, including Ethernet switches.

The figure displays a network consists of a access layer switch and eight PCs labeled H1 -
H8.

Ethernet Hubs
The original Ethernet networks connected all hosts with a single cable, similar to how cable TV cables are
connected in your home. All users on the network shared the bandwidth available on the cable. As Ethernet
networks became more popular, connecting everyone on a single cable was no longer practical, nor even
possible. Engineers developed a different type of network technology that made it easier to connect and
reconnect multiple devices to the network. The first of these types of networking devices were Ethernet
hubs.

Hubs contain multiple ports that are used to connect hosts to the network. Hubs are simple devices that do
not have the necessary electronics to decode the messages sent between hosts on the network. Hubs cannot
determine which host should get any particular message. A hub simply accepts electronic signals from one
port and regenerates (or repeats) the same message out all of the other ports. All hosts attached to the hub
share the bandwidth, and will receive the message. Hosts ignore the messages that are not addressed to
them. Only the host specified in the destination address of the message processes the message and
responds to the sender.

Only one message can be sent through an Ethernet hub at a time. It is possible for two or more hosts
connected to a hub to attempt to send a message at the same time. If this happens, the electronic signals
that make up the messages collide with each other at the hub. This is known as a collision. The message is
unreadable by hosts and must be retransmitted. The area of the network where a host can receive a garbled
message resulting from a collision is known as a collision domain.

Because excessive retransmissions can clog up the network and slow down network traffic, hubs are now
considered obsolete and have been replaced by Ethernet switches.
Ethernet Switches
An Ethernet switch is a device that is used at the access layer. When a host sends a message to another host
connected to the same switched network, the switch accepts and decodes the frames to read the physical
(MAC) address portion of the message.

A table on the switch, called a MAC address table, contains a list of all of the active ports and the host
MAC addresses that are attached to them. When a message is sent between hosts, the switch checks to see
if the destination MAC address is in the table. If it is, the switch builds a temporary connection, called a
circuit, between the source and destination ports. This new circuit provides a dedicated channel over which
the two hosts can communicate. Other hosts attached to the switch do not share bandwidth on this channel
and do not receive messages that are not addressed to them. A new circuit is built for every new
conversation between hosts. These separate circuits allow many conversations to take place at the same
time, without collisions occurring. Ethernet switches also allow for the sending and receiving of frames
over the same Ethernet cable simultaneously. This improves the performance of the network by
eliminating collisions.

The MAC Address Table

What happens when the switch receives a frame addressed to a new host that is not yet in the MAC address
table? If the destination MAC address is not in the table, the switch does not have the necessary
information to create an individual circuit. When the switch cannot determine where the destination host is
located, it uses a process called flooding to forward the message out to all attached hosts except for the
sending host. Each host compares the destination MAC address in the message to its own MAC address,
but only the host with the correct destination address processes the message and responds to the sender.

How does the MAC address of a new host get into the MAC address table? A switch builds the MAC
address table by examining the source MAC address of each frame that is sent between hosts. When a new
host sends a message or responds to a flooded message, the switch immediately learns its MAC address
and the port to which it is connected. The table is dynamically updated each time a new source MAC
address is read by the switch. In this way, a switch quickly learns the MAC addresses of all attached hosts.

TOPIC#4 Broadcast Containment

Ethernet Broadcasts in the Local Network

Within the local network it is often necessary for one host to be able to send messages to all the other hosts
at the same time. This can be done using a message known as a broadcast. Broadcasts are useful when a
host needs to find information without knowing exactly what other host can supply it, or when a host wants
to provide information to all other hosts in the same network in a timely manner.

A message can only contain one destination MAC address. So, how is it possible for a host to contact
every other host on the local network without sending out a separate message to each individual MAC?

To solve this problem, broadcast messages are sent to a unique MAC address that is recognized by all
hosts. The broadcast MAC address is actually a 48-bit address made up of all ones. Because of their length,
MAC addresses are usually represented in hexadecimal notation. The broadcast MAC address in
 hexadecimal notation is [Link]. Each F in the hexadecimal notation represents four ones in the
binary address.

Broadcast Domains
When a host receives a message addressed to the broadcast address, it accepts and processes the message
as though the message was addressed directly to it. When a host sends a broadcast message, switches
forward the message to every connected host within the same local network. For this reason, a local area
network, a network with one or more Ethernet switches, is also referred to as a broadcast domain.

If too many hosts are connected to the same broadcast domain, broadcast traffic can become excessive.
The number of hosts and the amount of network traffic that can be supported on the local network is
limited by the capabilities of the switches used to connect them. As the network grows and more hosts are
added, network traffic, including broadcast traffic, increases. To improve performance, it is often
necessary to divide one local network into multiple networks, or broadcast domains, as shown in the
figure. Routers are used to divide the network into multiple broadcast domains.

Access Layer Communication

On a local Ethernet network, a NIC only accepts a frame if the destination address is either the broadcast
MAC address, or else corresponds to the MAC address of the NIC.

Most network applications, however, rely on the logical destination IP address to identify the location of
the servers and clients. The figure illustrates the problem that arises if a sending host only has the logical
IP address of the destination host. How does the sending host determine what destination MAC address to
place within the frame?

The sending host can use an IPv4 protocol called address resolution protocol (ARP) to discover the MAC
address of any host on the same local network. IPv6 uses a similar method known as Neighbor Discovery.

ARP
ARP uses a three step process to discover and store the MAC address of a host on the local network when
only the IPv4 address of the host is known:

1. The sending host creates and sends a frame addressed to a broadcast MAC address. Contained in the frame is
a message with the IPv4 address of the intended destination host.
2. Each host on the network receives the broadcast frame and compares the IPv4 address inside the message
with its configured IPv4 address. The host with the matching IPv4 address sends its MAC address back to
the original sending host.
3. The sending host receives the message and stores the MAC address and IPv4 address information in a table
called an ARP table.

When the sending host has the MAC address of the destination host in its ARP table, it can send frames
directly to the destination without doing an ARP request. Because ARP messages rely on broadcast frames
to deliver the requests, all hosts in the local IPv4 network must be in the same broadcast domain.
 MODULE# 7 Routing Between Networks

TOPIC# 1 The Need for Routing

Criteria for Dividing the Local Network

As networks grow, it is often necessary to divide one access layer network into multiple access layer
networks. There are many ways to divide networks based on different criteria:

 Broadcast containment
 Security requirements
 Physical locations
 Logical grouping

The distribution layer connects these independent local networks and controls the traffic flowing between
them. It is responsible for ensuring that traffic between hosts on the local network stays local. Only traffic
that is destined for other networks is passed on. The distribution layer can also filter incoming and
outgoing traffic for security and traffic management.

Networking devices that make up the distribution layer are designed to interconnect networks, not
individual hosts. Individual hosts are connected to the network via access layer devices, such as switches.
The access layer devices are connected to each other via the distribution layer device, such as a router.

Broadcast Containment

Routers in the distribution layer can limit broadcasts to the local network where they need to be heard.
Although broadcasts are necessary, too many hosts connected on the same local network can generate
excessive broadcast traffic and slow down the network.

Security

Routers in the distribution layer can separate and protect certain groups of computers where confidential
information resides. Routers can also hide the addresses of internal computers from the outside world to
help prevent attacks, and control who can get into or out of the local network.

Locations

Routers in the distribution layer can be used to interconnect local networks at various locations of an
organization that are geographically separated.

Logical Grouping

Routers in the distribution layer can be used to logically group users, such as departments within a
company, who have common needs or for access to resources.

Now We Need Routing

In most situations we want our devices to be able to connect beyond our local network: out to other homes,
businesses, and the internet. Devices that are beyond the local network segment are known as remote hosts.
When a source device sends a packet to a remote destination device, then the help of routers and routing is
needed. Routing is the process of identifying the best path to a destination.

A router is a networking device that connects multiple Layer 3, IP networks. At the distribution layer of
the network, routers direct traffic and perform other functions critical to efficient network operation.
Routers, like switches, are able to decode and read the messages that are sent to them. Unlike switches,
which make their forwarding decision based on the Layer 2 MAC address, routers make their forwarding
decision based on the Layer 3 IP address.

The packet format contains the IP addresses of the destination and source hosts, as well as the message
data being sent between them. The router reads the network portion of the destination IP address and uses
it to find which one of the attached networks is the best way to forward the message to the destination.

Anytime the network portion of the IP addresses of the source and destination hosts do not match, a router
must be used to forward the message. If a host located on network [Link] needs to send a message to a
host on network [Link], the host will forward the message to the router. The router receives the message,
de-encapsulates the Ethernet frame, and then reads the destination IP address in the IP packet. It then
determines where to forward the message. It re-encapsulates the packet back into a new frame, and
forwards the frame on to its destination.

TOPIC# 2 The Routing Table

Path Selection
How does the router determine which interface to use to send the message on a path to get to the
destination network?

Each port, or interface, on a router connects to a different local network. Every router contains a table of
all locally connected networks and the interfaces that connect to them. These routing tables can also
contain information about the routes, or paths, that the router uses to reach other remote networks that are
not locally attached.

When a router receives a frame, it decodes the frame to get to the packet containing the destination IP
address. It matches the network portion of the destination IP address to the networks that are listed in the
routing table. If the destination network address is in the table, the router encapsulates the packet in a new
frame in order to send it out. (Note that it will insert a new destination MAC address as well, and
recalculate the FCS field, in the new frame). It forwards the new frame out of the interface associated with
the path, to the destination network. The process of forwarding the packets toward their destination
network is called routing.

Router interfaces do not forward messages that are addressed to the local network broadcast IP address. As
a result, local network broadcasts are not sent across routers to other local networks.

Packet Forwarding
A router forwards a packet to one of two places: a directly connected network containing the actual
destination host, or to another router on the path to reach the destination host. When a router encapsulates
the frame to forward it out an Ethernet interface, it must include a destination MAC address.
 This is the MAC address of the actual destination host, if the destination host is part of a network that is
locally connected to the router. If the router must forward the packet to another router through an Ethernet
interface, it will use the MAC address of the connected router. Routers obtain these MAC addresses from
ARP tables.

Each router interface is part of the local network to which it is attached and maintains its own ARP table
for that network. The ARP tables contain the MAC addresses and IPv4 addresses of all the individual hosts
on that network.

Routing Table Entries

Routers move information between local and remote networks. To do this, routers must use routing tables
to store information. Routing tables are not concerned with the addresses of individual hosts. Routing
tables contain the addresses of networks, and the best path to reach those networks. Entries can be made to
the routing table in two ways: dynamically updated by information received from other routers in the
network, or manually entered by a network administrator. Routers use the routing tables to determine
which interface to use to forward a message to its intended destination.

If the router cannot determine where to forward a message, it will drop it. Network administrators
configure a static default route that is placed into the routing table so that a packet will not be dropped due
to the destination network not being in the routing table. A default route is the interface through which the
router forwards a packet containing an unknown destination IP network address. This default route usually
connects to another router that can forward the packet towards its final destination network.

Type Network Port

C [Link]/8 FastEthernet0/0

C [Link]/16 FastEthernet0/1

 Type - The connection type. C stands for directly connected.

 Network - The network address.
 Port - The interface used to forward packets to the network.

The Default Gateway

The method that a host uses to send messages to a destination on a remote network differs from the way a
host sends messages on the same local network. When a host needs to send a message to another host
located on the same network, it will forward the message directly. A host will use ARP to discover the
MAC address of the destination host. The IPv4 packet contains the destination IPv4 address and
encapsulates the packet into a frame containing the MAC address of the destination and forwards it out.

When a host needs to send a message to a remote network, it must use the router. The host includes the IP
address of the destination host within the packet just like before. However, when it encapsulates the packet
into a frame, it uses the MAC address of the router as the destination for the frame. In this way, the router
will receive and accept the frame based on the MAC address.

How does the source host determine the MAC address of the router? A host is given the IPv4 address of
the router through the default gateway address configured in its TCP/IP settings. The default gateway
address is the address of the router interface connected to the same local network as the source host. All
hosts on the local network use the default gateway address to send messages to the router. When the host
knows the default gateway IPv4 address, it can use ARP to determine the MAC address. The MAC address
of the router is then placed in the frame, destined for another network.

It is important that the correct default gateway be configured on each host on the local network. If no
default gateway is configured in the host TCP/IP settings, or if the wrong default gateway is specified,
messages addressed to hosts on remote networks cannot be delivered.

TOPIC# 3 Create a LAN

Local Area Networks

The term local area network (LAN) refers to a local network, or a group of interconnected
local networks that are under the same administrative control. In the early days of
networking, LANs were defined as small networks that existed in a single physical location.
Although LANs can be a single local network installed in a home or small office, the
definition of LAN has evolved to include interconnected local networks consisting of many
hundreds of hosts, installed in multiple buildings and locations.

The important thing to remember is that all the local networks within a LAN are under one
administrative control. Other common characteristics of LANs are that they typically use
Ethernet or wireless protocols, and they support high data rates.

The term intranet is often used to refer to a private LAN that belongs to an organization, and
is designed to be accessible only by the members of the organization , employees, or others
with authorization.

The figure shows router 1 with 3 LANs. The left LAN is 192 dot 168 dot 1 dot 0 with 3 hosts.
The bottom LAN is network 192 dot 168 dot 3 dot 0 with 3 hosts. The right LAN is net 192
dot 168 dot 2 dot 0 with 3 hosts.

Local and Remote Network Segments

Within a LAN, it is possible to place all hosts on a single local network or divide them up between
multiple networks connected by a distribution layer device. How this placement is determined depends on
desired results.

All Hosts in One Local Segment

Placing all hosts on a single local network allows them to be seen by all other hosts. This is because there
is one broadcast domain and hosts use ARP to find each other.

In a simple network design, it may be beneficial to keep all hosts within a single local network. However,
as networks grow in size, increased traffic will decrease network performance and speed. In this case, it
may be beneficial to move some hosts onto a remote network.

Advantages of a single local segment:

 Appropriate for simpler networks
 Less complexity and lower network cost
 Allows devices to be "seen" by other devices
 Faster data transfer - more direct communication
 Ease of device access

Disadvantages of a single local segment:

 All hosts are in one broadcast domain which causes more traffic on the segment and may slow network
performance
 Harder to implement QoS
 Harder to implement security

Hosts on a Remote Segment

Placing additional hosts on a remote network will decrease the impact of traffic demands. However, hosts
on one network will not be able to communicate with hosts on the other network without the use of
routing. Routers increase the complexity of the network configuration and can introduce latency, or time
delay, on packets sent from one local network to the other.

Advantages:

 More appropriate for larger, more complex networks

 Splits up broadcast domains and decreases traffic
 Can improve performance on each segment
 Makes the machines invisible to those on other local network segments
 Can provide increased security
 Can improve network organization

Disadvantages:

 Requires the use of routing (distribution layer)

 Router can slow traffic between segments
 More complexity and expense (requires a router)

MODULE# 8 The Internet Protocol

TOPIC# 1 Purpose of the IPv4 Address

The IPv4 Address

A host needs an IPv4 address to participate on the internet and almost all LANs today. The IPv4 address is
a logical network address that identifies a particular host. It must be properly configured and unique within
the LAN, for local communication. It must also be properly configured and unique in the world, for remote
communication. This is how a host is able to communicate with other devices on the internet.

An IPv4 address is assigned to the network interface connection for a host. This connection is usually a
network interface card (NIC) installed in the device. Examples of end-user devices with network interfaces
include workstations, servers, network printers, and IP phones. Some servers can have more than one NIC
and each of these has its own IPv4 address. Router interfaces that provide connections to an IP network
will also have an IPv4 address.
 Every packet sent across the internet has a source and destination IPv4 address. This information is
required by networking devices to ensure the information gets to the destination and any replies are
returned to the source.

TOPIC# 2 Binary Conversion of an IPv4 Address

IPv4 Addressing
An IPv4 address is simply a series of 32 binary bits (ones and zeros). There are over 4 billion possible IPv4
addresses using a 32-bit addressing scheme.

It is very difficult for humans to read a binary IPv4 address. For this reason, the 32 bits are grouped into
four 8-bit bytes called octets. An IPv4 address in this format is hard for humans to read, write, and
remember. To make the IPv4 address easier to understand, each octet is presented as its decimal value,
separated by a decimal point or period. This is referred to as dotted-decimal notation.

When a host is configured with an IPv4 address, it is entered as a dotted decimal number such as
[Link], as shown in the figure. The 32-bit binary equivalent is
11000000101010000000000100000101. If you mistyped just one bit, the address would be different, and
the host may not be able to communicate on the network.

Binary to Decimal
When a host receives an IPv4 address, it looks at all 32 bits as they are received by the NIC. Humans, on
the other hand, need to convert those 32 bits into their four octet decimal equivalent. Each octet is made up
of 8 bits and each bit has a value. The four groups of 8 bits have the same set of values. The rightmost bit
in an octet has a value of 1 and the values of the remaining bits, from right to left, are 2, 4, 8, 16, 32, 64,
and 128.

As shown in the figure, you can determine the value of the octet by adding the values of positions
wherever there is a binary 1 present:

 If there is a 0 in a position, do not add the value.

 If all 8 bits are 0s, 00000000 the value of the octet is 0.
 If all 8 bits are 1s, 11111111 the value of the octet is 255 (128+64+32+16+8+4+2+1).
 If the 8 bits are mixed, such as the example 00100111, the value of the octet is 39 (32+4+2+1).

So the value of each of the four octets can range from 0 to a maximum of 255.

Activity - Binary to Decimal Conversions

Instructions

This activity allows you to practice 8-bit binary to decimal conversion as much as necessary. We
recommend that you work with this tool until you are able to do the conversion without error. Convert the
binary number shown in the octet to its decimal value.
Activity - Decimal to Binary Conversions
Instructions

This activity allows you to practice decimal conversions to 8-bit binary values. We recommend that you
work with this tool until you are able to do the conversion without error. Convert the decimal number
shown in the Decimal Value row to its binary bits.

TOPIC# 3 The IPv4 Address Structure

Networks and Hosts

The logical 32-bit IPv4 address is hierarchical and is made up of two parts, the network and the host. In the
figure, the network portion is blue, and the host portion is red. Both parts are required in an IPv4 address.
Both networks have the subnet mask [Link].

As an example, there is a host with an IPv4 address [Link] with a subnet mask of [Link].
The first three octets, (192.168.5), identify the network portion of the address, and the last octet, (11)
identifies the host. This is known as hierarchical addressing because the network portion indicates the
network on which each unique host address is located. Routers only need to know how to reach each
network, rather than needing to know the location of each individual host.

With IPv4 addressing, multiple logical networks can exist on one physical network, if the network portion
of the logical network host addresses is different. For example: three hosts on a single, physical local
network have the same network portion of their IPv4 address (192.168.18) and three other hosts have
different network portions of their IPv4 addresses (192.168.5). The hosts with the same network number in
 their IPv4 addresses will be able to communicate with each other, but will not be able to communicate with
the other hosts without the use of routing. In this example, there is one physical network and two logical
IPv4 networks.

Another example of a hierarchical network is the telephone system. With a telephone number, the country
code, area code and exchange represent the network address and the remaining digits represent a local
phone number.

Logical AND
A logical AND is one of three basic binary operations used in digital logic. The other two are
OR and NOT. Although all three are used in data networks, only AND is used in determining
the network address. Therefore, our discussion here will be limited to the logical AND
operation.

Logical AND is the comparison of two bits that produce the results shown in the following.
Note how only a 1 AND 1 produce a 1.

 1 AND 1 = 1
 0 AND 1 = 0
 1 AND 0 = 0
 0 AND 0 = 0

To identify the network address of an IPv4 host, the IPv4 address is logically ANDed, bit by
bit, with the subnet mask. ANDing between the address and the subnet mask yields the
network address.

To illustrate how AND is used to discover a network address, consider a host with IPv4
address [Link] and subnet mask of [Link]. The following figure displays the
host IPv4 address and converted binary address. The host subnet mask binary address is
ANDed.

The diagram shows the ANDing process between an IPv4 host address and a subnet mask
resulting in the IPv4 network address of the host. The IPv4 host address is [Link].
Below that, the address is converted into 11000000 10101000 00001010 00001010. Below
that, the subnet mask of [Link] is written. Below that, the subnet mask is converted to
11111111 11111111 11111111 00000000. A line is drawn underneath the binary equivalent
of the subnet mask. Below the line is the dotted-decimal and binary equivalent of the IPv4
network address as determined by the ANDing process. A blue shaded box shows the first bit
of the IPv4 host address, a 1, compared to the first bit of the subnet mask, also a 1, resulting
in a 1 as the first bit value in the IPv4 network address. The IPv4 network address is
[Link] with a binary equivalent of 11000000 101001000 00001010 00000000.

Calculate Whether the Destination is Local or

Remote
How do hosts know which portion of an IPv4 address is the network and which is the host? This is the job
of the subnet mask.

When an IPv4 host is configured, a subnet mask is assigned along with an IPv4 address. Like the IPv4
address, the subnet mask is 32 bits long. The subnet mask signifies which part of the IPv4 address is
network and which part is host.

The subnet mask is compared to the IPv4 address from left to right, bit for bit. The 1s in the subnet mask
represent the network portion; the 0s represent the host portion. In the example shown, the first three octets
are network, and the last octet represents the host.

When a host sends a packet, it compares its subnet mask to its own IPv4 address and the destination IPv4
address. If the network bits match, both the source and destination host are on the same network and the
packet can be delivered locally. If they do not match, the sending host forwards the packet to the local
router interface to be sent on to the other network.

Calculate the Number of Hosts

The subnet masks we see most often with home and small business networking are: [Link] (8-bits),
[Link] (16 bits) and [Link] (24 bits). A subnet mask of [Link] (decimal) or
11111111.11111111.1111111.00000000 (binary) uses 24 bits to identify the network number which leaves
8 bits to number the hosts on that network, as shown in the figure.

To calculate the number of hosts that can be on that network, take the number 2 to the power of the
number of host bits (2 ^ 8 = 256). From this number, we must subtract 2 (256-2). The reason we subtract 2
is that all 1s within the host portion of an IPv4 address is a broadcast address for that network and cannot
be assigned to a specific host. All 0s within the host portion indicate the network ID and again, cannot be
assigned to a specific host. Powers of 2 can be calculated easily with the calculator that comes with any
Windows operating system.

Another way to determine the number of hosts available is to add up the values of the available host bits
(128+64+32+16+8+4+2+1 = 255). From this number, subtract 1 (255-1 = 254), because the host bits
cannot be all 1s. It is not necessary to subtract 2 because the value of all 0s is 0 and is not included in the
addition.

With a 16-bit mask, there are 16 bits (two octets) for host addresses and a host address could have all 1s
(255) in one of the octets. This might appear to be a broadcast but as long as the other octet is not all 1s, it
is a valid host address. Remember that the host looks at all host bits together, not at octet values.

The figure shows a binary network address mask of three octets, each with eight ones. There is a fourth
octet for the host, with 8 zeroes. The text on this figure reads With 8 host bits, there are 254 host addresses
possible.

Activity - ANDing to Determine the Network

Address
Instructions:
 Use the ANDing process to determine the network address (in binary and decimal formats).

TOPIC# 4 Classful IPv4 Addressing

Classful and Classless Addressing

In 1981, internet IPv4 addresses were assigned using classful addressing. Customers were allocated a
network address based on one of three classes, A, B, or C. The addresses were divided into the following
ranges or classes:

 Class A ([Link]/8 to [Link]/8) - Designed to support extremely large networks with more than 16
million host addresses. It used a fixed /8 prefix ([Link]) with the first octet to indicate the network
address and the remaining three octets for host addresses.
 Class B ([Link] /16 - [Link] /16) - Designed to support the needs of moderate to large size
networks with up to approximately 65,000 host addresses. It used a fixed /16 prefix ([Link]) with the
two high-order octets to indicate the network address and the remaining two octets for host addresses.
 Class C ([Link] /24 - [Link] /24) - Designed to support small networks with a maximum of 254
hosts. It used a fixed /24 prefix ([Link]) with the first three octets to indicate the network and the
remaining octet for the host addresses.

TOPIC# 5 Public and Private IPv4 Addresses

Private IPv4 Addressing

Public IPv4 addresses are addresses which are globally routed between ISP (internet service provider)
routers. However, not all available IPv4 addresses can be used on the internet. There are blocks of
addresses called private addresses that are used by most organizations to assign IPv4 addresses to internal
hosts.

In the mid-1990s private IPv4 addresses were introduced because of the depletion of IPv4 address space.
Private IPv4 addresses are not unique and can be used by an internal network.

Specifically, the private address blocks are:

 [Link] /8 or [Link] to [Link]

 [Link] /12 or [Link] to [Link]
 [Link] /16 or [Link] to [Link]

It is important to know that addresses within these address blocks are not allowed on the internet and must
be filtered (discarded) by internet routers. For example, in the figure, users in networks 1, 2, or 3 are
sending packets to remote destinations. The ISP routers would see that the source IPv4 addresses in the
packets are from private addresses and would, therefore, discard the packets.

Note: Private addresses are defined in RFC 1918.

Assignment of IPv4 Addresses

For a company or organization to support network hosts, such as web servers that are accessible from the
internet, that organization must have a block of public addresses assigned. Remember that public addresses
must be unique, and use of these public addresses is regulated and allocated to each organization
separately. This is true for IPv4 and IPv6 addresses.

Both IPv4 and IPv6 addresses are managed by the Internet Assigned Numbers Authority (IANA)
([Link] The IANA manages and allocates blocks of IP addresses to the Regional Internet
Registries (RIRs).

RIRs are responsible for allocating IP addresses to ISPs who in turn provide IPv4 address blocks to
organizations and smaller ISPs. Organizations can get their addresses directly from an RIR subject to the
policies of that RIR.

Regional Internet Registries

 AfriNIC (African Network Information Centre) - Africa Region
 APNIC (Asia Pacific Network Information Centre) - Asia/Pacific Region
 ARIN (American Registry for Internet Numbers) - North America Region
 LACNIC (Regional Latin-American and Caribbean IP Address Registry) - Latin America and some
Caribbean Islands
 RIPE NCC (Réseaux IP Européens Network Coordination Centre) - Europe, the Middle East, and Central
Asia

TOPIC# 6 Unicast, Broadcast and Multicast Addresses

Unicast Transmission
Unicast communication is used for normal host-to-host communication in both a client/server and a peer-
to-peer network. Unicast packets use the address of the destination device as the destination address and
can be routed through an internetwork.

Click Play in the figure to see an animation of a unicast transmission.

In an IPv4 network, the unicast address applied to an end device is referred to as the host address. For
unicast communication, the addresses assigned to the two end devices are used as the source and
destination IPv4 addresses. During the encapsulation process, the source host uses its IPv4 address as the
source address and the IPv4 address of the destination host as the destination address. Regardless of
whether the destination specified a packet as a unicast, broadcast or multicast; the source address of any
packet is always the unicast address of the originating host.

Broadcast Transmission
Broadcast packets are sent to all hosts in the network using a broadcast address. With a broadcast, the
packet contains a destination IPv4 address with all ones (1s) in the host portion. This means that all hosts
on that local network (broadcast domain) will receive and look at the packet. Many network protocols,
such as DHCP, use broadcasts. When a host receives a packet sent to the network broadcast address, the
host processes the packet as it would a packet addressed to its unicast address.

Broadcast may be directed or limited. A directed broadcast is sent to all hosts on a specific network. For
example, a host on the [Link]/24 network sends a packet to [Link]. A limited broadcast is sent
to [Link]. By default, routers do not forward broadcasts.

Multicast Transmission
Multicast transmission reduces traffic by allowing a host to send a single packet to a selected set of hosts
that subscribe to a multicast group.

IPv4 has reserved the [Link] to [Link] addresses as a multicast range. The IPv4 multicast
addresses [Link] to [Link] are reserved for multicasting on the local network only. These
addresses are to be used for multicast groups on a local network. A router connected to the local network
recognizes that these packets are addressed to a local network multicast group and never forwards them
further. A typical use of reserved local network multicast address is in routing protocols using multicast
transmission to exchange routing information. For instance, [Link] is the multicast address used by
Routing Information Protocol (RIP) version 2 to communicate with other RIPv2 routers.

Hosts that receive particular multicast data are called multicast clients. The multicast clients use services
requested by a client program to subscribe to the multicast group.

Each multicast group is represented by a single IPv4 multicast destination address. When an IPv4 host
subscribes to a multicast group, the host processes packets addressed to this multicast address, and packets
addressed to its uniquely allocated unicast address.

Activity - Unicast, Broadcast, or Multicast

Instructions:

Click Start to see a destination IP address. Next, click the host or hosts which will receive a
packet based on the address type (unicast, broadcast, or multicast). Click Check to verify
your answer. Click New Problem again to get a new problem.
MODULE# 9 Dynamic Addressing with DHCP

TOPIC# 1 Static and Dynamic Addressing

Static IPv4 Address Assignment

IPv4 addresses can be assigned either statically or dynamically.

With a static assignment, the network administrator must manually configure the network information for a
host. At a minimum, this includes the host IPv4 address, subnet mask, and default gateway, as shown in
the figure.

Static addresses have some advantages. For instance, they are useful for printers, servers, and other
networking devices that need to be accessible to clients on the network. If hosts normally access a server at
a particular IPv4 address, it would not be good if that address changed.

Static assignment of addressing information can provide increased control of network resources, but it can
be time consuming to enter the information on each host. When IPv4 addresses are entered statically, the
host only performs basic error checks on the IPv4 address. Therefore, errors are more likely to occur.

When using static IPv4 addressing, it is important to maintain an accurate list of which IPv4 addresses are
assigned to which devices. Additionally, these are permanent addresses and are not normally reused.

Dynamic IPv4 Address Assignment

On local networks it is often the case that the user population changes frequently. New users arrive with
laptops and need a connection. Others have new workstations that need to be connected. Rather than have
the network administrator assign IPv4 addresses for each workstation, it is easier to have IPv4 addresses
assigned automatically. This is done using a protocol known as Dynamic Host Configuration Protocol
(DHCP).

DHCP automatically assigns addressing information such as IPv4 address, subnet mask, default gateway,
and other configuration information, as shown in the figure.

DHCP is generally the preferred method of assigning IPv4 addresses to hosts on large networks because it
reduces the burden on network support staff and virtually eliminates entry errors.

Another benefit of DHCP is that an address is not permanently assigned to a host but is only leased for a
period of time. If the host is powered down or taken off the network, the address is returned to the pool for
reuse. This is especially helpful with mobile users that come and go on a network.

DHCP Servers
If you enter an airport or coffee shop with a wireless hotspot, DHCP makes it possible for you to access the
internet. As you enter the area, your laptop DHCP client contacts the local DHCP server via a wireless
connection. The DHCP server assigns an IPv4 address to your laptop.

Various types of devices can be DHCP servers as long as they are running DHCP service software. With
most medium to large networks, the DHCP server is usually a local dedicated PC-based server.

With home networks, the DHCP server may be located at the ISP and a host on the home network receives
its IPv4 configuration directly from the ISP, as shown in the figure.
Many home networks and small businesses use a wireless router and modem. In this case, the wireless
router is both a DHCP client and a server. The wireless router acts as a client to receive its IPv4
configuration from the ISP and then acts as a DHCP server for internal hosts on the local network. The
router receives the public IPv4 address from the ISP, and in its role as a DHCP server, it distributes private
addresses to internal hosts.

In addition to PC-based servers and wireless routers, other types of networking devices such as dedicated
routers can provide DHCP services to clients, although this is not as common.

Note: DHCP for IPv6 (DHCPv6) provides similar services for IPv6 clients. One important difference is
that DHCPv6 does not provide a default gateway address. This can only be obtained dynamically from the
Router Advertisement message of the router.

TOPIC# 2 DHCPv4 Configuration

DCHPv4 Operation
When a host is first configured as a DHCP client, it does not have an IPv4 address, subnet mask, or default
gateway. It obtains this information from a DHCP server, either on the local network or one located at the
ISP. The DHCP server is configured with a range, or pool, of IPv4 addresses that can be assigned to DHCP
clients.

The DHCP server may be located on another network. DHCP clients are still able to obtain IPv4 addresses
as long as the routers in-between are configured to forward DHCP requests.
A client that needs an IPv4 address will send a DHCP Discover message which is a broadcast with a
destination IPv4 address of [Link] (32 ones) and a destination MAC address of FF-FF-FF-FF-
FF-FF (48 ones). All hosts on the network will receive this broadcast DHCP frame, but only a DHCP
server will reply. The server will respond with a DHCP Offer, suggesting an IPv4 address for the client.
The host then sends a DHCP Request asking to use the suggested IPv4 address. The server responds with a
DHCP Acknowledgment, as shown in the figure.

The IPv4 address of [Link] and subnet mask of [Link] are the defaults for the internal router
interface. This is the default gateway for all hosts on the local network and also the internal DHCP server
IPv4 address. Most home wireless routers have DHCP Server enabled by default.

On the DHCP configuration screen a default DHCP range is available. You can also specify a starting
address for the DHCP range (do not use [Link] because the router is assigned this address) and the
number of addresses to be assigned. The lease time can also be modified (default in the graphic is 24
hours). The DHCP configuration feature on most routers gives information about connected hosts and IPv4
addresses, their associated MAC address, and lease times.

MODULE# 10 IPv4 and IPv6 Address Management

TOPIC# 1 Network Boundaries

Routers as Gateways
The router provides a gateway through which hosts on one network can communicate with hosts on
different networks. Each interface on a router is connected to a separate network.

The IPv4 address assigned to the interface identifies which local network is connected directly to it.

Every host on a network must use the router as a gateway to other networks. Therefore, each host must
know the IPv4 address of the router interface connected to the network where the host is attached. This
address is known as the default gateway address. It can be either statically configured on the host, or
received dynamically by DHCP.

When a wireless router is configured to be a DHCP server for the local network, it automatically sends the
correct interface IPv4 address to the hosts as the default gateway address. In this manner, all hosts on the
network can use that IPv4 address to forward messages to hosts located at the ISP and get access to hosts
on the internet. Wireless routers are usually set to be DHCP servers by default.

The IPv4 address of that local router interface becomes the default gateway address for the host
configuration. The default gateway is provided, either statically or by DHCP.

Routers as Boundaries Between Networks

The wireless router acts as a DHCP server for all local hosts attached to it, either by Ethernet cable or
wirelessly. These local hosts are referred to as being located on an internal, or inside, network. Most
DHCP servers are configured to assign private addresses to the hosts on the internal network, rather than
internet routable public addresses. This ensures that, by default, the internal network is not directly
accessible from the internet.

The default IPv4 address configured on the local wireless router interface is usually the first host address
on that network. Internal hosts must be assigned addresses within the same network as the wireless router,
either statically configured, or through DHCP. When configured as a DHCP server, the wireless router
provides addresses in this range. It also provides the subnet mask information and its own interface IPv4
address as the default gateway, as shown in the figure.

Many ISPs also use DHCP servers to provide IPv4 addresses to the internet side of the wireless router
installed at their customer sites. The network assigned to the internet side of the wireless router is referred
to as the external, or outside, network.

When a wireless router is connected to the ISP, it acts like a DHCP client to receive the correct external
network IPv4 address for the internet interface. ISPs usually provide an internet-routable address, which
enables hosts connected to the wireless router to have access to the internet.

The wireless router serves as the boundary between the local internal network and the external internet.

TOPIC# 2 Network Address Translation

NAT Operation
The wireless router receives a public address from the ISP, which allows it to send and receive packets on
the internet. It, in turn, provides private addresses to local network clients. Because private addresses are
not allowed on the internet, a process is needed for translating private addresses into unique public
addresses to allow local clients to communicate on the internet.

The process used to convert private addresses to internet-routable addresses is called Network Address
Translation (NAT). With NAT, a private (local) source IPv4 address is translated to a public (global)
address. The process is reversed for incoming packets. The wireless router is able to translate many
internal IPv4 addresses to the same public address, by using NAT.

Only packets destined for other networks need to be translated. These packets must pass through the
gateway, where the wireless router replaces the private IPv4 address of the source host with its own public
IPv4 address.

Although each host on the internal network has a unique private IPv4 address assigned to it, the hosts must
share the single internet-routable address assigned to the wireless router.
TOPIC# 3 IPv4 Issues

Need for IPv6

You already know that IPv4 is running out of addresses. That is why you need to learn about IPv6.

IPv6 is designed to be the successor to IPv4. IPv6 has a larger 128-bit address space, providing 340
undecillion (i.e., 340 followed by 36 zeroes) possible addresses. However, IPv6 is more than just larger
address space.

When the IETF began its development of a successor to IPv4, it used this opportunity to fix the limitations
of IPv4 and include enhancements. One example is Internet Control Message Protocol version 6
(ICMPv6), which includes address resolution and address autoconfiguration not found in ICMP for IPv4
(ICMPv4) IPv6 addresses.

The depletion of IPv4 address space has been the motivating factor for moving to IPv6. As Africa, Asia
and other areas of the world become more connected to the internet, there are not enough IPv4 addresses to
accommodate this growth. As shown in the figure, four out of the five RIRs have run out of IPv4
addresses. AfriNIC will run out of IPv4 addresses very soon.

IPv4 has a theoretical maximum of 4.3 billion addresses. Private addresses in combination with Network
Address Translation (NAT) have been instrumental in slowing the depletion of IPv4 address space.
However, NAT is problematic for many applications, creates latency, and has limitations that severely
impede peer-to-peer communications.

With the ever-increasing number of mobile devices, mobile providers have been leading the way with the
transition to IPv6. The top two mobile providers in the United States report that over 90% of their traffic is
over IPv6.
 Most top ISPs and content providers such as YouTube, Facebook, and NetFlix, have also made the
transition. Many companies like Microsoft, Facebook, and LinkedIn are transitioning to IPv6-only
internally. In 2018, broadband ISP Comcast reported a deployment of over 65% and British Sky
Broadcasting over 86%.

Internet of Things

The internet of today is significantly different than the internet of past decades. The internet of today is
more than email, web pages, and file transfers between computers. The evolving internet is becoming an
Internet of Things (IoT). No longer will the only devices accessing the internet be computers, tablets, and
smartphones. The sensor-equipped, internet-ready devices of tomorrow will include everything from
automobiles and biomedical devices, to household appliances and natural ecosystems.

With an increasing internet population, a limited IPv4 address space, issues with NAT and the IoT, now is
the time to transition to IPv6.

IPv6 Address Size

IPv6 addressing will eventually replace IPv4 addressing, although both types of addresses will coexist for
the foreseeable future. IPv6 overcomes the limitations of IPv4 and has features that better suit current and
foreseeable network demands. The 32-bit IPv4 address space provides approximately 4,294,967,296
unique addresses.

IPv6 address space provides 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses, or 340

undecillion addresses, which is roughly equivalent to the number of grains of sand on Earth. The figure
provides a visual to compare the IPv4 and IPv6 address space. Other benefits of the IPv6 protocol include
these:

 No need for NAT. Each device can have its own globally routable address.
 Autoconfiguration capabilities simplify address administration.

The designers of IPv6 thought that it would be adopted quickly, as the number of remaining available IPv4
address blocks was decreasing rapidly. Initial estimates were that IPv6 would be globally deployed by
2003. Obviously, these estimates were incorrect.

Number Name Scientific Notation Number of Zeros

1 Thousand 103 1,000

1 Million 106 1,000,000

1 Billion 109 1,000,000,000

1 Trillion 1012 1,000,000,000,000

1 Quadrillion 1015 1,000,000,000,000,000

1 Quintillion 1018 1,000,000,000,000,000,000

1 Sextillion 1021 1,000,000,000,000,000,000,000

 Number Name Scientific Notation Number of Zeros

1 Septillion 1024 1,000,000,000,000,000,000,000,000

1 Octillion 1027 1,000,000,000,000,000,000,000,000,000

1 Nonillion 1030 1,000,000,000,000,000,000,000,000,000,000

1 Decillion 1033 1,000,000,000,000,000,000,000,000,000,000,000

1 Undecillion 1036 1,000,000,000,000,000,000,000,000,000,000,000,000

IPv4 and IPv6 Coexistence

There is no specific date to move to IPv6. Both IPv4 and IPv6 will coexist in the near future and the
transition is taking several years. The IETF has created various protocols and tools to help network
administrators migrate their networks to IPv6. The migration techniques can be divided into three
categories:

Dual Stack
Dual stack allows IPv4 and IPv6 to coexist on the same network segment. Dual stack devices run both
IPv4 and IPv6 protocol stacks simultaneously. Known as native IPv6, this means the customer network has
an IPv6 connection to its ISP and is able to access content found on the internet over IPv6.

Tunneling
Tunneling is a method of transporting an IPv6 packet over an IPv4 network. The IPv6 packet is
encapsulated inside an IPv4 packet, similar to other types of data.
Translation
Network Address Translation 64 (NAT64) allows IPv6-enabled devices to communicate with IPv4-
enabled devices using a translation technique similar to NAT for IPv4. An IPv6 packet is translated to an
IPv4 packet and an IPv4 packet is translated to an IPv6 packet. The NAT64 router translates the different
IP addresses between networks (the solid line) so that the PCs with different IP addresses can
communicate (the dotted line).

TOPIC# 4 IPv6 Features

IPv6 Autoconfiguration and Link-Local

Addresses
In addition to the increase in length, IPv6 addresses have other characteristics that are different than IPv4
addresses. Among the differences are the following:

 Address autoconfiguration - Stateless Address Autoconfiguration (SLAAC) allows a host to create its
own internet-routable address (global unicast address or GUA), without the need for a DHCP server. As
shown in the figure, with the default method the host receives the prefix (network address), prefix length
(subnet mask), and default gateway from the Router Advertisement message of the router. The host can
then create its own unique interface ID (host portion of the address) to give itself a routable global unicast
address.
 Link-local address - Use of link-local address when communicating with a device on the same network.

The developers of IPv6 have made improvements to IP and related protocols such as ICMPv6. These
improvements included features related to efficiency, scalability, mobility, and flexibility for future
enhancements.

IPv6 Address Representation

It is no problem for computers to read the new 128-bit IPv6 addressing. IPv6 just adds more 1s and zeros
to the source and destination addresses in the packet. For humans, though, the change from a 32-bit
address written in dotted decimal notation to an IPv6 address written as a series of 32 hexadecimal digits
can be quite an adjustment. Techniques have been developed to compress the written IPv6 address into a
more manageable format.

Compressing IPv6 Addresses

IPv6 addresses are written as a string of hexadecimal values. Every 4 bits is represented by a single
hexadecimal digit for a total of 32 hexadecimal values. The figure shows a fully expanded IPv6 address
and two methods of making it more easily readable. There are two rules that help reduce the number of
digits needed to represent an IPv6 address.

Rule 1 - Omit Leading Zeros

The first rule to help reduce the notation of IPv6 addresses is to omit any leading 0s (zeros) in any 16-bit
section. For example:

 0DB8 can be represented as DB8

 0000 can be represented as 0
 0200 can be represented as 200

Rule 2 - Omit One “all zero” Segment

The second rule to help reduce the notation of IPv6 addresses is that a double colon (::) can replace any
group of consecutive segments that contain only zeros. The double colon (::) can only be used once within
an address, otherwise there would be more than one possible resulting address.

Fully expanded 2001:0DB8:0000:1111:0000:0000:0000:0200

No leading 0s 2001:DB8:0:1111:0:0:0:200

Compressed 2001:DB8:0:1111::200

Activity - IPv6 Address Representation

Instructions:
Convert the IPv6 addresses into short (omit the leading zeroes) and compressed forms. Enter letters using
lowercase. Click Check to verify your answer, and then click Next to advance the activity to the next
address.

MODULE# 11 Transport Layer Services

TOPIC# 1 The Client Server Relationship

Client and Server Interaction

Every day, we use the services available over networks and the internet to communicate with
others and to perform routine tasks. We rarely think of the servers, clients, and networking
devices that are necessary in order for us to receive an email, update our status on social
media, or shop for the best bargains in an online store. Most of the commonly used internet
applications rely on complicated interactions between various servers and clients.

The term server refers to a host running a software application that provides information or
services to other hosts that are connected to the network. A well-known example of an
application is a web server. There are millions of servers connected to the internet, providing
services such as web sites, email, financial transactions, music downloads, etc. A crucial
factor to enable these complex interactions to function is that they all use agreed upon
standards and protocols.

This figure depicts a client PC and a server connected through a cloud symbolizing the
Internet

An example of client software is a web browser, like Chrome or FireFox. A single computer can also run
multiple types of client software. For example, a user can check email and view a web page while instant
messaging and listening to an audio stream. The table lists three common types of server software.
 Type Description

The email server runs email server software. Clients use mail client software, such as
Email
Microsoft Outlook, to access email on the server.

The web server runs web server software. Clients use browser software, such as
Web
Windows Internet Explorer, to access web pages on the server.

The file server stores corporate and user files in a central location. The client devices
File
access these files with client software such as the Windows File Explorer.

Client Requests a Web Page

Much of the information that we receive over the internet is provided in the form of web page documents.
To request and view a web page, a person uses a device that is running web client software, such as a web
browser.

The key characteristic of client/server systems is that the client sends a request to a server, and the server
responds by carrying out a function, such as sending the requested document back to the client. The
combination of a web browser and a web server is perhaps the most commonly used instance of a
client/server system. A web server is usually in a part of the network with other servers called a server
farm, or within a data center.

A data center is a facility used to house computer systems and associated components. A data center can
occupy one room of a building, one or more floors, or an entire building. Data centers are typically very
expensive to build and maintain. For this reason, only large organizations use privately built data centers to
house their data and provide services to users. Smaller organizations that cannot afford to maintain their
own private data center can reduce the overall cost of ownership by leasing server and storage services
from a larger data center organization in the cloud.

URI, URN, and URL

Web resources and web services such as RESTful APIs are identified using a Uniform Resource Identifier
(URI). A URI is a string of characters that identifies a specific network resource. As shown in the figure, a
URI has two specializations:

 Uniform Resource Name (URN) - This identifies only the namespace of the resource (web page,
document, image, etc.) without reference to the protocol.
 Uniform Resource Locator (URL) - This defines the network location of a specific resource on the
network. HTTP or HTTPS URLs are typically used with web browsers. Other protocols such as FTP,
SFTP, SSH, and others can use a URL. A URL using SFTP might look like: s[Link]

These are the parts of a URI, as shown in the figure:

 Protocol/scheme - HTTPS or other protocols such as FTP, SFTP, mailto, and NNTP
 Hostname - [Link]
 Path and file name - /author/[Link]
 Fragment - #page155
 TOPIC# 2 TCP and UDP

Protocol Operations
A web server and a web client use specific protocols and standards in the process of exchanging
information to ensure that the messages are received and understood, as shown in the figure. The various
protocols necessary to deliver a web page function at the four different levels of the TCP/IP model are as
follows:

 Application Layer Protocol - Hypertext Transfer Protocol (HTTP) governs the way that a web server and
a web client interact. HTTP defines the format of the requests and responses exchanged between the client
and server. HTTP relies on other protocols to govern how the messages are transported between client and
server.
 Transport Layer Protocol - Transmission Control Protocol (TCP) ensures that IP packets are sent
reliably, and any missing packets are resent. TCP provides proper ordering of packets received out of
order.
 Internetwork Layer Protocol - The most common internetwork protocol is Internet Protocol (IP). IP is
responsible for taking the formatted segments from TCP, assigning the logical addressing, and
encapsulating them into packets for routing to the destination host.
 Network Access Layer - The specific protocol at the network access layer, such as Ethernet, depends on
the type of media and transmission methods used in the physical network.

TCP and UDP

Each service available over the network has its own application protocols that are implemented in the
server and client software. In addition to the application protocols, all of the common internet services use
Internet Protocol (IP) to address and route messages between source and destination hosts, as shown in the
figure.

IP is concerned only with the structure, addressing, and routing of packets. IP does not specify how the
delivery or transportation of the packets takes place. The application decides which transport protocol to
use. Transport protocols specify how to manage the transfer of messages between hosts. The two most
common transport protocols are Transmission Control Protocol (TCP) and User Datagram Protocol (UDP).
The IP protocol uses these transport protocols to enable hosts to communicate and transfer data.

TCP Reliability
With all of the millions and millions of web pages being transmitted at any time over the internet, how can
a server be certain that the page it sent is received by the client that requested it? One of the mechanisms
that helps ensure reliable delivery is the Transmission Control Protocol (TCP).

When an application requires acknowledgment that a message is delivered, it uses TCP. TCP breaks up a
message into small pieces known as segments. The segments are numbered in sequence and passed to the
IP process for assembly into packets. TCP keeps track of the number of segments that have been sent to a
specific host from a specific application. If the sender does not receive an acknowledgment within a certain
period of time, it assumes that the segments were lost and retransmits them. Only the portion of the
message that is lost is resent, not the entire message.
On the receiving host, TCP is responsible for reassembling the message segments and passing them to the
application. FTP and HTTP are examples of applications that use TCP to ensure delivery of data.

UDP Best Effort Delivery

In some cases, the TCP acknowledgment protocol is not required and actually slows down information
transfer, as shown in the figure. In those cases, UDP may be a more appropriate transport protocol.

UDP is a 'best effort' delivery system that does not require acknowledgment of receipt. UDP is preferable
with applications such as streaming audio and voice over IP (VoIP). Acknowledgments would slow down
delivery and retransmissions are undesirable.

An example of an application that uses UDP is internet radio. If some of the message is lost during its
journey over the network, it is not retransmitted. If a few packets are missed, the listener might hear a
slight break in the sound. If TCP were used and the lost packets were resent, the transmission would pause
to receive them, and the disruption would be more noticeable.

To illustrate how UDP is used, consider how a host resolves domain names to IP addresses using DNS.
DNS does not require the services of TCP because most DNS queries are resolved in one packet. DNS will
use UDP to resolve a name. The example in the figure illustrates this. Notice how the client does not know
the IP address of [Link]. It therefore sends a DNS request to the DNS server using UDP. The
server responds with the IP address of [Link] in one packet.

TOPIC# 3 Port Numbers

 TCP and UDP Port Numbers
There are many services that we access through the internet in the course of a day. DNS, web, email, FTP,
IM and VoIP are just some of these services that are provided by client/server systems around the world.
These services may be provided by a single server or by several servers in large data centers.

When a message is delivered using either TCP or UDP, the protocols and services requested are identified
by a port number, as shown in the figure. A port is a numeric identifier within each segment that is used to
keep track of specific conversations between a client and server. Every message that a host sends contains
both a source and destination port.

When a message is received by a server, it is necessary for the server to be able to determine which service
is being requested by the client. Clients are preconfigured to use a destination port that is registered on the
internet for each service. An example of this is web browser clients which are preconfigured to send
requests to web servers using port 80, the well-known port for HTTP web services.

Ports are assigned and managed by an organization known as the Internet Corporation for Assigned Names
and Numbers (ICANN). Ports are broken into three categories and range in number from 1 to 65,535:

 Well-Known Ports - Destination ports that are associated with common network applications are
identified as well-known ports. These ports are in the range of 1 to 1023.
 Registered Ports - Ports 1024 through 49151 can be used as either source or destination ports. These can
be used by organizations to register specific applications such as IM applications.
 Private Ports - Ports 49152 through 65535 are often used as source ports. These ports can be used by any
application.

The table displays some common well-known port numbers and their associated applications.

Port Number Transport Application Protocol

20 TCP File Transfer Protocol (FTP) - Data

 Port Number Transport Application Protocol

21 TCP File Transfer Protocol (FTP) - Control

22 TCP Secure Shell (SSH)

23 TCP Telnet

25 TCP Simple Mail Transfer Protocol (SMTP)

53 UDP, TCP Domain Name System (DNS)

67 UDP Dynamic Host Configuration Protocol (DHCP) - Server

68 UDP Dynamic Host Configuration Protocol - Client

69 UDP Trivial File Transfer Protocol (TFTP)

80 TCP Hypertext Transfer Protocol (HTTP)

110 TCP Post Office Protocol version 3 (POP3)

143 TCP Internet Message Access Protocol (IMAP)

161 UDP Simple Network Management Protocol (SNMP)

443 TCP Hypertext Transfer Protocol Secure (HTTPS)

Some applications may use both TCP and UDP. For example, DNS uses UDP when clients send requests
to a DNS server. However, communication between two DNS servers always uses TCP.

Destination and Source Port Numbers

The source port number is associated with the originating application on the local host. The destination
port number is associated with the destination application on the remote host.

Source Port

The source port number is dynamically generated by the sending device to identify a conversation between
two devices. This process allows multiple conversations to occur simultaneously. It is common for a
device to send multiple HTTP service requests to a web server at the same time. Each separate HTTP
conversation is tracked based on the source ports.

Destination Port

The client places a destination port number in the segment to tell the destination server what service is
being requested, as shown in the figure. For example, when a client specifies port 80 in the destination
port, the server that receives the message knows that web services are being requested. A server can offer
more than one service simultaneously, such as web services on port 80 at the same time that it offers FTP
connection establishment on port 21.

Socket Pairs
The source and destination ports are placed within the segment. The segments are then encapsulated within
an IP packet. The IP packet contains the IP address of the source and destination. The combination of the
source IP address and source port number, or the destination IP address and destination port number is
known as a socket.

In the example, the FTP request generated by the PC includes the Layer 2 MAC addresses and the Layer 3
IP addresses. The request also identifies the source port number 1305 (dynamically generated by the host)
and destination port, identifying the FTP services on port 21. The host also has requested a web page from
the server using the same Layer 2 and Layer 3 addresses. However, it is using the source port number 1099
(dynamically generated by the host) and destination port identifying the web service on port 80.

The socket is used to identify the server and service being requested by the client. A client socket might
look like this, with 1099 representing the source port number: [Link]:1099

The socket on a web server might be [Link]:80

Together, these two sockets combine to form a socket pair: [Link]:1099, [Link]:80

Sockets enable multiple processes, running on a client, to distinguish themselves from each other, and
multiple connections to a server process to be distinguished from each other.

The source port number acts as a return address for the requesting application. The transport layer keeps
track of this port and the application that initiated the request so that when a response is returned, it can be
forwarded to the correct application.

The netstat Command

Unexplained TCP connections can pose a major security threat. They can indicate that something or
someone is connected to the local host. Sometimes it is necessary to know which active TCP connections
are open and running on a networked host. Netstat is an important network utility that can be used to verify
those connections. As shown below, enter the command netstat to list the protocols in use, the local
address and port numbers, the foreign address and port numbers, and the connection state.
 By default, the netstat command will attempt to resolve IP addresses to domain names and port numbers
to well-known applications. The -n option can be used to display IP addresses and port numbers in their
numerical form.

MODULE# 12 Application Layer Services

TOPIC# 1 Network Application Services

Common Network Application Services

What are the most common internet services that you use on a regular basis? For most people, the list
includes services such as internet searches, social media sites, video and audio streaming, on-line shopping
sites, email and messaging. Each of these services relies on protocols from the TCP/IP protocol suite to
reliably communicate the information between the clients and the servers.

Some of the most common servers that provide these services are shown in the figure. A brief description
of each service is shown in the table.

The figure depicts a data center with 6 servers. The servers each provide a service: DNS, SSH, Email,
DHCP, Web, and FTP.

Protocol Description

Domain Name System (DNS) Resolves internet names to IP addresses.

Secure Shell (SSH) Used to provide remote access to servers and networking devices.

Sends email messages and attachments from clients to servers and

Simple Mail Transfer Protocol (SMTP)
from servers to other email servers.

Used by email clients to retrieve email and attachments from a

Post Office Protocol (POP)
remote server.

Used by email clients to retrieve email and attachments from a

Internet Message Access Protocol (IMAP)
remote server.

Used to automatically configure devices with IP addressing and other

Dynamic Host Configuration Protocol
necessary information to enable them to communicate over the
(DHCP)
internet.

Used by web browsers to request web pages and web servers to

Hypertext Transfer Protocol (HTTP)
transfers the files that make up web pages of the World Wide Web.

File Transfer Protocol (FTP) Used for interactive file transfer between systems.

TOPIC# 2 Domain Name System

Domain Name Translation

Thousands of servers, installed in many different locations, provide the services that we use daily over the
internet. Each of these servers is assigned a unique IP address that identifies it on the local network where
it is connected.

It would be impossible to remember all of the IP addresses for all of the servers hosting services on the
internet. Instead, there is an easier way to locate servers by associating a name with an IP address.

The Domain Name System (DNS) provides a way for hosts to use this name to request the IP address of a
specific server, as shown in the figure. DNS names are registered and organized on the internet within
specific high level groups, or domains. Some of the most common high level domains on the internet are
.com, .edu, and .net.

DNS Servers
A DNS server contains a table that associates hostnames in a domain with corresponding IP addresses.
When a client has the name of server, such as a web server, but needs to find the IP address, it sends a
request to the DNS server on port 53. The client uses the IP address of the DNS server configured in the
DNS settings of the host IP configuration.

When the DNS server receives the request, it checks its table to determine the IP address associated with
that web server. If the local DNS server does not have an entry for the requested name, it queries another
DNS server within the domain. When the DNS server learns the IP address, that information is sent back to
the client. If the DNS server cannot determine the IP address, the request will time out and the client will
not be able to communicate with the web server.

TOPIC# 3 Web Clients and Servers

HTTP and HTML

When a web client receives the IP address of a web server, the client browser uses that IP address and port
80 to request web services. This request is sent to the server using the Hypertext Transfer Protocol
(HTTP).

When the server receives a port 80 request, the server responds to the client request and sends the web
page to the client. The information content of a web page is encoded using specialized 'mark-up'
languages. The HyperText Markup Language (HTML) coding tells the browser how to format the web
page and what graphics and fonts to use. HTML is the most commonly used language.

The HTTP protocol is not a secure protocol; information could easily be intercepted by other users as data
is sent over the network. In order to provide security for the data, HTTP can be used with secure transport
protocols. Requests for secure HTTP are sent to port 443. These requests use https in the site address in
the browser, rather than http.

There are many different web servers and web clients available on the market. The HTTP protocol and
HTML standards make it possible for these servers and clients from many different manufacturers to work
together seamlessly.

TOPIC# 4 FTP Clients and Servers

File Transfer Protocol
In addition to web services, another common service used across the internet is one that allows users to
transfer files.

The File Transfer Protocol (FTP) provides an easy method to transfer files from one computer to another.
A host running FTP client software can access an FTP server to perform various file management
functions including file uploads and downloads.

The FTP server enables a client to exchange files between devices. It also enables clients to manage files
remotely by sending file management commands such as delete or rename. To accomplish this, the FTP
service uses two different ports to communicate between client and server.

The example in the figure illustrates how FTP operates. To begin an FTP session, control connection
requests are sent to the server using destination TCP port 21. When the session is opened, the server uses
TCP port 20 to transfer the data files.

FTP client software is built into computer operating systems and into most web browsers. Stand-alone FTP
clients offer many options in an easy-to-use GUI-based interface.

FTP Client Software

Most client operating systems such as Windows, Mac OS, and Linux include a command-line interface for
FTP. There is also GUI-based FTP client software that provides a simple drag-and-drop interface for FTP.
After logging into the FTP server with a username and password, the user drags files between the local
host window and the remote site (FTP server) window to transfer files.

TOPIC# 5 Virtual Terminals

Telnet
Long before desktop computers with sophisticated graphical interfaces existed, people used text-based
systems which were often just display terminals physically attached to a central computer. After networks
became available, people needed a way to remotely access the computer systems in the same manner that
they did with the directly-attached terminals.

Telnet was developed to meet that need. Telnet dates back to the early 1970s and is among the oldest of the
application layer protocols and services in the TCP/IP suite. Telnet provides a standard method of
emulating text-based terminal devices over the data network. Both the protocol itself and the client
software that implements the protocol are commonly referred to as Telnet. Telnet servers listen for client
requests on TCP port 23.

Appropriately enough, a connection using Telnet is called a virtual terminal (vty) session, or connection.
Rather than using a physical device to connect to the server, Telnet uses software to create a virtual device
that provides the same features of a terminal session with access to the server’s command line interface
(CLI).
In the figure, the client has remotely connected to the server via Telnet. The client is now able to execute
commands as if it were locally connected to the server.

Note: Telnet is not considered to be a secure protocol. SSH should be used in most environments instead
of Telnet. Telnet is used in several examples in this course for simplicity of configuration.

Security Issues with Telnet

After a Telnet connection is established, users can perform any authorized function on the server, just as if
they were using a command line session on the server itself. If authorized, they can start and stop
processes, configure the device, and even shut down the system.

Although the Telnet protocol can require a user to login, it does not support transporting encrypted data.
All data exchanged during Telnet sessions is transported as plaintext across the network. This means that
the data can be easily intercepted and understood.

The Secure Shell (SSH) protocol offers an alternate and secure method for server access. SSH provides the
structure for secure remote login and other secure network services. It also provides stronger authentication
than Telnet and supports transporting session data using encryption. As a best practice, network
professionals should always use SSH in place of Telnet, whenever possible.

The figure illustrates how SSH is more secure than Telnet. Notice how the data captured by the hacker
when Telnet is used is clearly readable while the data captured when SSH is used is encrypted and
therefore more secure.

TOPIC# 6 Email and Messaging

Email Clients and Servers
Email is one of the most popular client/server applications on the internet. Email servers run server
software that enables them to interact with clients and with other email servers over the network.

Each mail server receives and stores mail for users who have mailboxes configured on the mail server.
Each user with a mailbox must then use an email client to access the mail server and read these messages.
Many internet messaging systems use a web-based client to access email. Examples of this type of client
include Microsoft 365, Yahoo, and Gmail.

Mailboxes are identified by the format: user@[Link]

Various application protocols used in processing email include SMTP, POP3, and IMAP4.

Email Protocols
Simple Mail Transfer Protocol (SMTP)

SMTP is used by an email client to send messages to its local email server. The local server then decides if
the message is destined for a local mailbox or if the message is addressed to a mailbox on another server.

If the server has to send the message to a different server, SMTP is used between those two servers as well.
SMTP requests are sent to port 25.

Click Play in the figure to see how SMTP is used to send email.

Post Office Protocol (POP3)

A server that supports POP clients receives and stores messages addressed to its users. When the client
connects to the email server, the messages are downloaded to the client. By default, messages are not kept
on the server after they have been accessed by the client. Clients contact POP3 servers on port 110.

Internet Message Access Protocol (IMAP4)

A server that supports IMAP clients also receives and stores messages addressed to its users. However,
unlike POP, IMAP keeps the messages in the mailboxes on the server, unless they are deleted by the user.
The most current version of IMAP is IMAP4 which listens for client requests on port 143.

Many different email servers exist for the various network operating system platforms.

Text Messaging
Text messaging, shown in the figure, is one of the most popular communication tools in use today. In
addition, text messaging software is built into many online applications, smart phone apps, and social
media sites.
Text messages may also be called instant messages, direct messages, private messages, and chat messages.
Text messaging enables users to communicate or chat over the internet in real-time. Text messaging
services on a computer are usually accessed through a web-based client that is integrated into a social
media or information sharing site. These clients usually only connect to other users of the same site.

There are also a number of standalone text message clients such as Cisco Webex Teams, Microsoft Teams,
WhatsApp, Facebook Messenger, and many others. These applications are available for a wide variety of
operating systems and devices. A mobile version is typically offered. In addition to text messages, these
clients support the transfer of documents, video, music, and audio files.

Internet Phone Calls

Making telephone calls over the internet is becoming increasingly popular. An internet telephony client
uses peer-to-peer technology similar to that used by instant messaging, as shown in the figure. IP
telephony makes use of Voice over IP (VoIP) technology, which converts analog voice signals into digital
data. The voice data is encapsulated into IP packets which carry the phone call through the network.

When the IP phone software has been installed, the user selects a unique name. This is so that calls can be
received from other users. Speakers and a microphone, built-in or separate, are required. A headset is
frequently plugged into the computer to serve as a phone.

Calls are made to other users of the same service on the internet, by selecting the username from a list. A
call to a regular telephone (landline or cell phone) requires using a gateway to access the Public Switched
Telephone Network (PSTN). Depending on the service, there may be charges associated with this type of
call. The protocols and destination ports used by internet telephony applications can vary based on the
software.
MODULE# 13 Build a Home Network

TOPIC# 1 Home Network Basics

Connecting Home Devices

Not long ago, home networks consisted of a desktop PC, a modem for internet, and perhaps a
printer. In the homes of today, there are dozens of devices that rely on network connectivity.
We can watch our security cameras from apps on our smart phones, make a telephone call
from our PCs, and stream live video content from anywhere in the world.

A home network is a small LAN with devices that usually connect to an integrated router and
to each other in order to exchange information. The router is connected to the internet, as
shown in the figure. Most likely, the home router is equipped with both wired and wireless
capabilities. Wireless technology offers many advantages compared to traditional wired
networks.

One of the main advantages of wireless is the ability to provide anytime, anywhere
connectivity. Within a home LAN, items such as smart phones and tablets are mobile.
Televisions and other audio/video devices may be mounted in more permanent locations and
may benefit from wired connectivity.

Wireless technology is fairly easy and inexpensive to install. The cost of home and business
wireless devices continues to decrease. Yet, despite the decrease in cost, the data rate and
capabilities of these devices have increased, allowing faster, more reliable wireless
connections.

Wireless technology enables networks to be easily expanded, without the limitations of

cabled connections. New and visiting users can join the network quickly and easily.

The figure shows 4 PCs, an AP, and a cloud depicting Internet. From left to right, the PCs are
connected to the AP wirelessly. The AP is using a cable to connect to the cloud. Under the
physical network topology, text information lists the benefits of wireless LAN technology
including the following: Mobility – allows for easy connection of both stationary and mobile
clients. Scalability – can be easily expanded to allow more users to connect and to increase
the coverage area. Flexibility – provides anytime, anywhere connectivity. Cost savings –
Equipment costs continue to fall as the technology matures. Reduction installation time –
installation of a single piece of equipment can provide connectivity for a large number of
 people. Reliability in harsh environments – easy to install in emergency and hostile
environments.

The benefits of wireless LAN technology include the following:

 Mobility - allows for easy connection of both stationary and mobile clients
 Scalability - can be easily expanded to allow more users to connect and to increase the coverage area
 Flexibility - provides anytime, anywhere connectivity
 Cost savings - Equipment costs continue to fall as the technology matures
 Reduced installation time - installation of a single piece of equipment can provide connectivity for a
large number of people
 Reliability in harsh environments - easy to install in emergency and hostile environments

Components of a Home Network

In addition to an integrated router, there are many different types of devices that might be
connecting to a home network, as shown in the figure. Here are a few examples:

 Desktop computers
 Gaming systems
 Smart TV systems
 Printers
 Scanners
 Security cameras
 Telephones
 Climate control devices

As the new technologies come on the market, more and more household functions will rely
on the network to provide connectivity and control.

The figure shows a house with a connection to a cloud depicting Internet Service Provider
(ISP). Multiple labels are used to point to devices inside the house. The label Router points to
the wireless router. The label Smart TV points to a TV with wireless connection. The label
Laptop points a laptop computer in front of TV. The label Gaming Console points to a device
 next to a desktop computer. The label Smartphone points to a device on a night table. The
label Entertainment System points to a device under the computer desk.

Home Wireless Local Area Network (WLAN)

Typical Home Network Routers

Small business and home routers typically have two primary types of ports:

 Ethernet Ports - These ports connect to the internal switch portion of the router. These ports are usually
labeled “Ethernet” or “LAN”, as shown in the figure. All devices connected to the switch ports are on the
same local network.
 Internet Port - This port is used to connect the device to another network. The Internet port connects the
router to a different network than the Ethernet ports. This port is often used to connect to the cable or DSL
modem in order to access the internet.

In addition to the wired ports, many home routers include a radio antenna and a built-in wireless access
point. By default, the wireless devices are on the same local network as the devices that are physically
plugged into the LAN switch ports. The Internet port is the only port that is on a different network in the
default configuration.

TOPIC# 2 Network Technologies in the Home

The Electromagnetic Spectrum

What would we do without wireless? Because of the ever-increasing number of things that have the
capability of connecting to the internet using wireless technologies, most home networks include some
type of wireless network functionality.
Wireless technologies use electromagnetic waves to carry information between devices. The
electromagnetic spectrum includes such things as radio and television broadcast bands, visible light, x-rays
and gamma-rays. Each of these has a specific range of wavelengths and associated energies, as shown in
the figure.

Some types of electromagnetic waves are not suitable for carrying data. Other parts of the spectrum are
regulated by governments and licensed to various organizations for specific applications. Certain areas of
the spectrum have been set aside to allow public use without the restriction of having to apply for special
permits. These unlicensed sections of the spectrum are incorporated into consumer products, including the
Wi-Fi routers found in most homes.

LAN Wireless Frequencies

The wireless technologies most frequently used in home networks are in the unlicensed 2.4 GHz and 5
GHz frequency ranges.

Bluetooth is a technology that makes use of the 2.4 GHz band. It is limited to low-speed, short-range
communications, but has the advantage of communicating with many devices at the same time. This one-
to-many communication has made Bluetooth technology the preferred method for connecting computer
peripherals such as wireless mice, keyboards and printers. Bluetooth is a good method for transmitting
audio to speakers or headphones.

Other technologies that use the 2.4 GHz and 5 GHz bands are the modern wireless LAN technologies that
conform to the various IEEE 802.11 standards. Unlike Bluetooth technology, 802.11 devices transmit at a
much higher power level giving them a great range and improved throughput.
Wired Network Technologies
Although many home network devices support wireless communications, there are still a few applications
where devices benefit from a wired switch connection that is not shared with other users on the network.

The most commonly implemented wired protocol is the Ethernet protocol. Ethernet uses a suite of
protocols that allow network devices to communicate over a wired LAN connection. An Ethernet LAN can
connect devices using many different types of wiring media.

Directly connected devices use an Ethernet patch cable, usually unshielded twisted-pair. These cables can
be purchased with the RJ-45 connectors already installed, and they come in various lengths. Recently
constructed homes may have Ethernet jacks already wired in the walls of the home. For those homes that
do not have UTP wiring, there are other technologies, such as powerline, that can distribute wired
connectivity throughout the premises.

Category 5e Cable

Category 5e is the most common wiring used in a LAN. The cable is made up of 4 pairs of wires that are
twisted to reduce electrical interference.

Coaxial Cable

Coaxial cable has an inner wire surrounded by a tubular insulating layer, that is then surrounded by a
tubular conducting shield. Most coax cables also have an external insulating sheath or jacket.

Fiber-Optic Cable

Fiber-optic cables can be either glass or plastic with a diameter about the same as a human hair and it can
carry digital information at very high speeds over long distances. Fiber-optic cables have a very high
bandwidth, which enables them to carry very large amounts of data.
 TOPIC# 3 Wireless Standards

Wi-Fi Networks
A number of standards have been developed to ensure that wireless devices can communicate. They
specify the RF spectrum used, data rates, how the information is transmitted, and more. The main
organization responsible for the creation of wireless technical standards is the IEEE.

The IEEE 802.11 standard governs the WLAN environment. There are amendments to the IEEE 802.11
standard that describe characteristics for different standards of wireless communications. Wireless
standards for LANs use the 2.4 GHz and 5 GHz frequency bands. Collectively these technologies are
referred to as Wi-Fi.

Another organization, known as the Wi-Fi Alliance, is responsible for testing wireless LAN devices from
different manufacturers. The Wi-Fi logo on a device means that this equipment meets standards and should
operate with other devices that use the same standard.

Wireless standards are constantly improving the connectivity and speed of Wi-Fi networks. It is important
to be aware of new standards as they are introduced because manufacturers of wireless devices will
implement these standards quickly in their new products.

Wireless Settings
The Packet Tracer Basic Wireless Settings interface is shown in the figure. Wireless routers using the
802.11 standards have multiple settings that have to be configured. These settings include the following:

 Network mode - Determines the type of technology that must be supported. For
example, 802.11b, 802.11g, 802.11n or Mixed Mode.
 Network Name (SSID) - Used to identify the WLAN. All devices that wish to participate in the WLAN
must have the same SSID.
 Standard Channel - Specifies the channel over which communication will occur. By default, this is set
to Auto to allow the AP to determine the optimum channel to use.
 SSID Broadcast - Determines if the SSID will be broadcast to all devices within range. By default, set
to Enabled.

 Network Mode

 The 802.11 protocol can provide increased throughput based on the wireless network
environment. If all wireless devices connect with the same 802.11 standard, maximum speeds can
be obtained for that standard. If the access point is configured to accept only one 802.11 standard,
devices that do not use that standard cannot connect to the access point.

 A mixed mode wireless network environment can include devices that use any of the existing Wi-
Fi standards. This environment provides easy access for older devices that need a wireless
connection but do not support the latest standards.

 When building a wireless network, it is important that the wireless components connect to the
appropriate WLAN. This is done using the SSID.
  The SSID is a case-sensitive, alphanumeric string that contains up to 32 characters. It is sent in the
header of all frames transmitted over the WLAN. The SSID is used to tell wireless devices, called
wireless stations (STAs), which WLAN they belong to and with which other devices they can
communicate.

 We use the SSID to identify a specific wireless network. It is essentially the name of the network.
Wireless routers usually broadcast their configured SSIDs by default. The SSID broadcast allows
other devices and wireless clients to automatically discover the name of the wireless network.
When the SSID broadcast is disabled, you must manually enter the SSID on wireless devices.

 Disabling SSID broadcasting can make it more difficult for legitimate clients to find the wireless
network. However, simply turning off the SSID broadcast is not sufficient to prevent unauthorized
clients from connecting to the wireless network. All wireless networks should use the strongest
available encryption to restrict unauthorized access.

TOPIC# 4 Wireless Traffic Controls

Wireless Channels
Wireless devices that transmit over the same frequency range create interference in a Wi-Fi network.
Home electronic devices, such as cordless phones, other wireless networks, and baby monitors, may use
this same frequency range. These devices can slow down the Wi-Fi performance and potentially break
network connections.

Channels

Channels are created by dividing up the available RF spectrum. Each channel is capable of carrying a
different conversation, as shown in the figure. This is similar to the way that multiple television channels
are transmitted across a single medium. Multiple APs can function in close proximity to one another as
long as they use different channels for communication. Normally each wireless conversation makes use of
a separate channel. Some of the 5 GHz wireless technologies combine multiple channels to create a single
wide channel, which provides more bandwidth and increases the data rate.

Wireless as a Shared Media

In a shared media Ethernet wired network, collisions occur when two or more devices attempt to send
messages on the network at the same time. Ethernet protocols detect the collisions and all devices stop
transmitting for a period of time in order to ensure that there is no additional contention for the media.

Within a wireless LAN, the lack of well-defined boundaries makes it impossible to detect if collisions
occur during transmission. Therefore, it is necessary to use an access method on a wireless network that
ensures collisions do not occur.

Wireless technology uses an access method called Carrier Sense Multiple Access with Collision
Avoidance (CSMA/CA). CSMA/CA creates a reservation on the channel for a specific conversation
between devices. While a reservation is in place, no other device may transmit on the channel, thus
possible collisions are avoided.

How does this reservation process work? If a device requires use of a specific communication channel in
the wireless network, it must ask permission from the AP. This is known as a Request to Send (RTS). If
the channel is available, the wireless access point (AP) will respond to the device with a Clear to Send
(CTS) message indicating that the device may transmit on the channel. A CTS is broadcast to all devices
within the network. Therefore, all devices in the network know that the requested channel is now in use.

When the conversation is complete, the device that requested the channel sends another message to the AP
known as an acknowledgment (ACK). The ACK indicates to the AP or the router that the channel can be
released. This message is also broadcast to all devices on the WLAN. All devices within the network
receive the ACK and know that the channel is now available.

TOPIC# 5 Set Up a Home Router

First Time Setup

Many wireless routers designed for home use have an automatic setup utility that can be used to configure
the basic settings on the router. These utilities usually require a PC or laptop to be connected to a wired
port on the router. If no device is available that has a wired connection, it may be necessary to configure
the wireless client software on the laptop or tablet first.

To connect to the router using a wired connection, plug an Ethernet patch cable into the network port on
the computer. Plug the other end into a LAN port on the router. Do not plug the cable into the port or
interface that is labeled “Internet”. The Internet port will connect to the DSL or cable modem. Some home
routers may have a built-in modem for internet connections. If this is the case, verify that the type of
connection is correct for your internet service. A cable modem connection will have a coaxial terminal to
accept a BNC-type connector. A DSL connection will have a port for a telephone-type cable, usually an
RJ-11 connector.

After confirming that the computer is connected to the network router and the link lights on the NIC
indicate a working connection, the computer needs an IP address. Most network routers are set up so that
the computer receives an IP address automatically from a local DHCP server automatically configured on
the wireless router. If the computer does not have an IP address, check the router documentation and
configure the PC or tablet with a unique IP address, subnet mask, default gateway, and DNS information.

Design Considerations
Before entering the configuration utility, or manually configuring the router through a web browser, you
should consider how your network will be used. You do not want to configure the router and have that
configuration limit what you are able to do on the network, nor do you want to leave your network
unprotected.

What should my network be called?

If SSID broadcasting is on, the SSID name will be seen by all wireless clients within your signal range.
Many times the SSID gives away too much information about the network to unknown client devices. It is
not a good practice to include the device model or brand name as part of the SSID. Wireless devices have
default settings that are easy to find on the internet, as well as known security weaknesses.

What types of devices will attach to my network?

Wireless devices contain radio transmitter/receivers that function within a specific frequency range. If a
device only has the necessary radio for 802.11 b/g, it will not connect if the wireless router or access point
is configured to only accept 802.11n or 802.11ac standards. If all devices support the same standard, the
network will work at its optimum speed. If you have devices that do not support the n or ac standards, then
you will have to enable legacy mode. A legacy mode wireless network environment varies between router
models but can include a combination of 802.11a, 802.11b, 802.11g, 802.11n, and 802.11ac. This
environment provides easy access for legacy devices that need a wireless connection.

MAC Address Filtering

The decision regarding who can access your home network should be determined by how you plan to use
the network. Many routers support MAC address filtering. As shown in the figure, this enables you to
specifically identify who is allowed on the wireless network. For example, the two top devices are allowed
to connect, but the device at the lower right of the figure is not. You would have to add the MAC address
of the lower right device so it could connect to the network.

This makes the wireless network more secure, but it also reduces the flexibility when connecting new
devices. As an example, if you want to allow any of your friends and family to access the network from
any device, it would be difficult and time consuming to configure MAC address filtering on the router.

On some wireless routers, it is possible to set up guest access. This is a special SSID coverage area that
allows open access, but restricts that access to using the internet only. Devices on the protected LAN are
not accessible to guest users. Not all wireless routers support this function. Research the website of the
router vendor to determine if you can create a guest SSID on your model router.

If there is no guest mode on the router, then you must restrict who can authenticate into the router to use
the services. Authentication methods on wireless routers require a password or passphrase to connect to the
SSID. The combination of non-broadcast SSID and a passphrase ensures that your guests will need
information from you in order to access your network.
MODULE# 14 Connect to the Internet

TOPIC# 1 ISP Connectivity Options

ISP Services
An Internet Service Provider (ISP) provides the link between the home network and the internet. An ISP
can be the local cable provider, a landline telephone service provider, the cellular network that provides
your smart phone service, or an independent provider who leases bandwidth on the physical network
infrastructure of another company.

Many ISPs also offer additional services to their contract subscribers, as shown in the figure. These
services can include email accounts, network storage, and website hosting and automated backup or
security services.

ISPs are critical to communications across the global internet. Each ISP connects to other ISPs to form a
network of links that interconnect users all over the world. ISPs are connected in a hierarchical manner that
ensures that internet traffic generally takes the shortest path from the source to the destination.

The internet backbone is like an information super highway that provides high-speed data links to connect
the various service provider networks in major metropolitan areas around the world. The primary medium
that connects the internet backbone is fiber-optic cable. This cable is typically installed underground to
connect cities within continents. Fiber-optic cables also run under the sea to connect continents, countries,
and cities.
 ISP Connections
The interconnection of ISPs that forms the backbone of the internet is a complex web of fiber-optic cables
with expensive networking switches and routers that direct the flow of information between source and
destination hosts. Average home users are not aware of the infrastructure outside of their network. For a
home user, connecting to the ISP is a fairly uncomplicated process.

The top portion of the figure displays the simplest ISP connection option. It consists of a modem that
provides a direct connection between a computer and the ISP. This option should not be used though,
because your computer is not protected on the internet.

As shown in the bottom portion of the figure, a router is required to securely connect a computer to an ISP.
This is the most common connection option. It consists of using a wireless integrated router to connect to
the ISP. The router includes a switch to connect wired hosts and a wireless AP to connect wireless hosts.
The router also provides client IP addressing information and security for inside hosts.

Cable and DSL Connections

Most home network users do not connect to their service providers with fiber-optic cables. The figure
illustrates common connection options for small office and home users. The two most common methods
are as follows:

 Cable - Typically offered by cable television service providers, the internet data signal is carried on the
same coaxial cable that delivers cable television. It provides a high bandwidth, always on, connection to
the internet. A special cable modem separates the internet data signal from the other signals carried on the
cable and provides an Ethernet connection to a host computer or LAN.
 DSL - Digital Subscriber Line provides a high bandwidth, always on, connection to the internet. It
requires a special high-speed modem that separates the DSL signal from the telephone signal and provides
an Ethernet connection to a host computer or LAN. DSL runs over a telephone line, with the line split into
 three channels. One channel is used for voice telephone calls. This channel allows an individual to receive
phone calls without disconnecting from the internet. A second channel is a faster download channel, used
to receive information from the internet. The third channel is used for sending or uploading information.
This channel is usually slightly slower than the download channel. The quality and speed of the DSL
connection depends mainly on the quality of the phone line and the distance from the central office of your
phone company The farther you are from the central office, the slower the connection.

Additional Connectivity Options

Other ISP connection options for home users include the following:

 Cellular - Cellular internet access uses a cell phone network to connect. Wherever you can get a cellular
signal, you can get cellular internet access. Performance will be limited by the capabilities of the phone
and the cell tower to which it is connected. The availability of cellular internet access is a real benefit for
people in areas that would otherwise have no internet connectivity at all, or for people who are constantly
on the move. The downside of cellular connectivity is that the carrier usually meters the bandwidth usage
of the connection and may charge extra for bandwidth that exceeds the contract data plan.
 Satellite - Satellite service is a good option for homes or offices that do not have access to DSL or cable.
Satellite dishes (see figure) require a clear line of sight to the satellite and so might be difficult in heavily
wooded areas or places with other overhead obstructions. Speeds will vary depending on the contract,
though they are generally good. Equipment and installation costs can be high (although check the provider
for special deals), with a moderate monthly fee thereafter. Like cellular access, the availability of satellite
internet access is a real benefit in areas that would otherwise have no internet connectivity at all.
 Dial-up Telephone - An inexpensive option that uses any phone line and a modem. To connect to the ISP,
a user calls the ISP access phone number. The low bandwidth provided by a dial-up modem connection is
usually not sufficient for large data transfer, although it is useful for mobile access while traveling. A
modem dial-up connection should only be considered when higher speed connection options are not
available.

In metropolitan areas, many apartments and small offices are being connected directly with fiber-optic
cables. This enables an internet service provider to provide higher bandwidth speeds and support more
services such as internet, phone, and TV.

TOPIC# 2 Network Virtualization

Cloud Computing
Cloud computing is one of the ways that we access and store data. Cloud computing allows us to store
personal files, even backup an entire drive on servers over the internet. Applications such as word
processing and photo editing can be accessed using the cloud. Cloud computing is possible because of data
centers. Data centers house servers, storage devices, and other network infrastructure equipment.

Types of Clouds
There are four primary cloud models, as shown in the figure.
 Public clouds - Cloud-based applications and services offered in a public cloud are made available to the
general population. Services may be free or are offered on a pay-per-use model, such as paying for online
storage. The public cloud uses the internet to provide services.
 Private clouds - Cloud-based applications and services offered in a private cloud are intended for a
specific organization or entity, such as the government. A private cloud can be set up using the private
network of an organization, though this can be expensive to build and maintain. A private cloud can also
be managed by an outside organization with strict access security.
 Hybrid clouds - A hybrid cloud is made up of two or more clouds (example: part private, part public),
where each part remains a separate object, but both are connected using a single architecture. Individuals
on a hybrid cloud would be able to have degrees of access to various services based on user access rights.
 Community clouds - A community cloud is created for exclusive use by a specific community. The
differences between public clouds and community clouds are the functional needs that have been
customized for the community. For example, healthcare organizations must remain compliant with policies
and laws (e.g., HIPAA) that require special authentication and confidentiality.

Cloud Services
Cloud services are available in a variety of options, tailored to meet customer requirements. The three
main cloud computing services defined by the National Institute of Standards and Technology (NIST) in
their Special Publication 800-145 are as follows:

 Software as a Service (SaaS) - The cloud provider is responsible for access to applications and services,
such as email, communication, and Microsoft 365, that are delivered over the internet. The user does not
manage any aspect of the cloud services except for limited user-specific application settings. The user only
needs to provide data.
 Platform as a Service (PaaS) - The cloud provider is responsible for providing users access to the
development tools and services used to deliver the applications. These users are typically programmers and
may have control over the configuration settings of the application hosting environment of the cloud
provider.
 Infrastructure as a Service (IaaS) - The cloud provider is responsible for giving IT managers access to
the network equipment, virtualized network services, and supporting network infrastructure. Using this
cloud service allows IT managers to deploy and run software code, which can include operating systems
and applications.

Cloud service providers have extended this model to also provide IT support for each of the cloud
computing services (ITaaS), as shown in the figure. For businesses, ITaaS can extend the capability of the
network without requiring investment in new infrastructure, training new personnel, or licensing new
software. These services are available on demand and delivered economically to any device anywhere in
the world without compromising security or function.

Cloud Computing and Virtualization

The terms “cloud computing” and “virtualization” are often used interchangeably; however, they mean
different things. Virtualization is the foundation of cloud computing. Without it, cloud computing, as it is
most-widely implemented, would not be possible.

Over a decade ago, VMware developed a virtualizing technology that enabled a host OS to support one or
more client OSs. Most virtualization technologies are now based on this technology. The transformation of
dedicated servers to virtualized servers has been embraced and is rapidly being implemented in data center
and enterprise networks.
 Virtualization means creating a virtual rather than physical version of something, such as a computer. An
example would be running a "Linux computer" on your Windows PC, which you will do later in the lab.

To fully appreciate virtualization, it is first necessary to understand some of the history of server
technology. Historically, enterprise servers consisted of a server OS, such as Windows Server or Linux
Server, installed on specific hardware, as shown in the figure. All server RAM, processing power, and hard
drive space were dedicated to the service provided (e.g., web, email services, etc.).

Dedicated Servers

The major problem with this configuration is that when a component fails, the service that is
provided by this server becomes unavailable. This is known as a single point of failure.
Another problem was that dedicated servers were underused. Dedicated servers often sat idle
for long periods of time, waiting until there was a need to deliver the specific service they
provide. These servers wasted energy and took up more space than was warranted by the
amount of service provided. This is known as server sprawl.

Advantages of Virtualization
One major advantage of virtualization is overall reduced cost:

 Less equipment is required - Virtualization enables server consolidation, which requires fewer physical
devices and lowers maintenance costs.
 Less energy is consumed - Consolidating servers lowers the monthly power and cooling costs.
 Less space is required - Server consolidation reduces the amount of required floor space.

These are additional benefits of virtualization:

 Easier prototyping - Self-contained labs, operating on isolated networks, can be rapidly created for
testing and prototyping network deployments.
 Faster server provisioning - Creating a virtual server is far faster than provisioning a physical server.
 Increased server uptime - Most server virtualization platforms now offer advanced redundant fault
tolerance features.
 Improved disaster recovery - Most enterprise server virtualization platforms have software that can help
test and automate failover before a disaster happens.
 Legacy support - Virtualization can extend the life of OSs and applications providing more time for
organizations to migrate to newer solutions.

Hypervisors
The hypervisor is a program, firmware, or hardware that adds an abstraction layer on top of the physical
hardware. The abstraction layer is used to create virtual machines which have access to all the hardware of
the physical machine such as CPUs, memory, disk controllers, and NICs. Each of these virtual machines
runs a complete and separate operating system. With virtualization, it is not uncommon for 100 physical
servers to be consolidated as virtual machines on top of 10 physical servers that are using hypervisors.

Type 1 Hypervisor - “Bare Metal” Approach

Type 1 hypervisors are also called the “bare metal” approach because the hypervisor is installed directly on
the hardware. Type 1 hypervisors are usually used on enterprise servers and data center networking
devices.

With Type 1 hypervisors, the hypervisor is installed directly on the server or networking hardware. Then,
instances of an OS are installed on the hypervisor, as shown in the figure. Type 1 hypervisors have direct
access to the hardware resources; therefore, they are more efficient than hosted architectures. Type 1
hypervisors improve scalability, performance, and robustness.

Type 2 Hypervisor - “Hosted” Approach

A Type 2 hypervisor is software that creates and runs VM instances. The computer, on which a hypervisor
is supporting one or more VMs, is a host machine. Type 2 hypervisors are also called hosted hypervisors.
This is because the hypervisor is installed on top of the existing OS, such as macOS, Windows, or Linux.
Then, one or more additional OS instances are installed on top of the hypervisor, as shown in the figure. A
big advantage of Type 2 hypervisors is that management console software is not required.
 Note: It is important to make sure that the host machine is robust enough to install and run the VMs, so
that it does not run out of resources.

Network Virtualization
Virtualization separates the operating system (OS) from the hardware.

Server virtualization takes advantage of idle resources and consolidates the number of required servers.
This also allows for multiple operating systems to exist on a single hardware platform.

For example, in the figure, the previous eight dedicated servers have been consolidated into two servers
using hypervisors to support multiple virtual instances of the operating systems.

Network virtualization combines traditional networking hardware and software network resources into a
software-based entity, which is a virtual network. Could the network infrastructure also benefit from
virtualization? If so, then how? The answer is found in how a networking device operates using a data
plane and a control plane.

Control Plane and Data Plane

A network device contains the following planes:

 Control plane - This is typically regarded as the brains of a device. It is used to make forwarding
decisions. The control plane contains Layer 2 and Layer 3 route forwarding mechanisms, such as the IPv4
and IPv6 routing tables, and the ARP table. Information sent to the control plane is processed by the CPU.
 Data plane - Also called the forwarding plane, this plane is typically the switch fabric connecting the
various network ports on a device. The data plane of each device is used to forward traffic flows. Routers
and switches use information from the control plane to forward incoming traffic out the appropriate egress
(outgoing) interface. Information in the data plane is typically processed by a special data plane processor
without the CPU getting involved.

Network Virtualization and SDN

 Network virtualization combines networking hardware and software network resources into a software-
based entity which is a virtual network.

Software-Defined Networking (SDN) is a network architecture that virtualizes the network, offering a new
approach to network administration and management that seeks to simplify and streamline the
administration process

SDN is basically the separation of the control plane and data plane. The control plane function is removed
from each device and is performed by a centralized controller, as shown in the figure. The centralized
controller communicates control plane functions to each device. Each device can now focus on forwarding
data while the centralized controller manages data flow, increases security, and provides other services.

SDN Architecture
In a traditional router or switch architecture, the control plane and data plane functions occur in the same
device. Routing decisions and packet forwarding are the responsibility of the device operating system. In
SDN, management of the control plane is moved to a centralized SDN controller.

The SDN controller is a logical entity that enables network administrators to manage and dictate how the
data plane of switches and routers should handle network traffic. It typically runs on a server. It
orchestrates, mediates, and facilitates communication between applications and network elements.
TOPIC# 3 Mobile Device Connectivity

Mobile Devices and Wi-Fi

Mobile devices give us the freedom to work, learn, play, and communicate wherever we want. People
using mobile devices do not need to be tied to a physical location to send and receive voice, video, and
data communications. In addition, wireless facilities, such as internet cafes, are available in many
countries. College campuses use wireless networks to allow students to sign up for classes, watch lectures,
and submit assignments in areas where physical connections to the network are unavailable. With mobile
devices becoming more powerful, many tasks that needed to be performed on large computers connected
to physical networks can now be completed using mobile devices on wireless networks.

Almost all mobile devices are capable of connecting to Wi-Fi networks. It is advisable to connect to Wi-Fi
networks when possible because data used over Wi-Fi does not count against the cellular data plan. Also,
because Wi-Fi radios use less power than cellular radios, connecting to Wi-Fi networks conserves battery
power. Like other Wi-Fi-enabled devices, it is important to use security when connecting to Wi-Fi
networks. These precautions should be taken to protect Wi-Fi communications on mobile devices:

 Never send login or password information using unencrypted text (plaintext).

 Use a VPN connection when possible if you are sending sensitive data.
 Enable security on home networks.
 Use WPA2 or higher encryption for security.

Wi-Fi Settings
 Two of the most popular operating systems for mobile devices are Android and Apple iOS. Each
operating system has settings that enable you to configure your device to connect to wireless networks.

Android Wi-Fi Switch/ iOS Wi-Fi Switch

To connect an Android or iOS device when it is within the coverage range of a Wi-Fi network, turn on Wi-
Fi and the device then searches for all available Wi-Fi networks and displays them in a list. Touch a Wi-Fi
network in the list to connect. Enter a password if needed.

When a mobile device is out of the range of the Wi-Fi network, it attempts to connect to another Wi-Fi
network in range. If no Wi-Fi networks are in range, the mobile device connects to the cellular data
network. When Wi-Fi is on, it will automatically connect to any Wi-Fi network that it has connected to
previously. If the network is new, the mobile device either displays a list of available networks that can be
used or asks if it should connect to it.

Configure Mobile Wi-Fi Connectivity

If your mobile device does not prompt to connect to a Wi-Fi network, the network SSID broadcast may be
turned off, or the device may not be set to connect automatically. Manually configure the Wi-Fi settings on
the mobile device. Remember that SSIDs and passphrases must be typed exactly as entered on the wireless
router setup or the device will not connect properly

To connect to a Wi-Fi network manually on an Android device, follow these steps:

Step 1. Select Settings > Add network.

Step 2. Enter the network SSID.

Step 3. Touch Security and select a security type.

Step 4. Touch Password and enter the password.

Step 5. Touch Save.

Operating systems for mobile devices are updated frequently and may be customized by the device
manufacturer. The commands listed above may not be exactly the same on your device. There are online
manuals for every type of device which are usually accessible from the website of the manufacturer.

To connect to a Wi-Fi network manually on an iOS device, follow these steps:

Step 1. Select Settings > Wi-Fi > Other.

Step 2. Enter the network SSID.

Step 3. Touch Security and select a security type.

Step 4. Touch Other Network.

Step 5. Touch Password and enter the password.

 Step 6. Touch Join.

Configure Cellular Data Settings

Cellular data plans are offered by most cell phone carriers, but the bandwidth limitations and charges for
usage vary widely by carrier, and by plan within carriers. As a result, many mobile device users only use
their cellular data plans when Wi-Fi service is not available.

Android Cellular Data

To turn on or off cellular data on an Android device, as shown in the figure, use the following path:

Settings > touch More under Wireless and Networks > touch Mobile Networks > touch Data enabled

iOS Cellular Data

To turn on or off cellular data on an iOS device, as shown in the figure, use the following path:

Settings > Cellular Data > turn cellular data on or off

Mobile devices are preprogrammed to use a Wi-Fi network for internet if one is available and the device can
connect to the access point and receive an IP address. If no Wi-Fi network is available, the device uses the
cellular data capability if it is configured. Most of the time, transitions from one network to another are not
obvious to the user. For example, as a mobile device moves from an area of 4G coverage to 3G coverage, the
4G radio shuts off and turns on the 3G radio. Connections are not lost during this transition.

Simple Connectivity with Bluetooth

Mobile devices connect using many different methods. Cellular and Wi-Fi can be difficult to configure,
and require extra equipment such as towers and access points. Cable connections are not always practical
when connecting headsets or speakers. Bluetooth technology provides a simple way for mobile devices to
connect to each other and to wireless accessories. Bluetooth is wireless, automatic, and uses very little
power, which helps conserve battery life. Up to eight Bluetooth devices can be connected together at any
one time.

These are some examples of how devices use Bluetooth:

 Hands-free headset - A small earpiece with a microphone can be used for making and receiving calls.
 Keyboard or mouse - A keyboard or mouse can be connected to a mobile device to make input easier.
 Stereo control - A mobile device can connect to a home or car stereo to play music.
 Car speakerphone - A device that contains a speaker and a microphone can be used for making and
receiving calls.
 Tethering - A mobile device can connect to another mobile device or computer to share a network
connection. Tethering can also be performed with a Wi-Fi connection or a cable connection such as USB.
 Mobile speaker - Portable speakers can connect to mobile devices to provide high-quality audio without a
stereo system.
 Bluetooth Pairing
Bluetooth pairing occurs when two Bluetooth devices establish a connection to share resources. In order
for the devices to pair, the Bluetooth radios are turned on, and one device begins searching for other
devices. Other devices must be set to discoverable mode, also called visible, so that they can be detected.
When a Bluetooth device is in discoverable mode, it transmits the following information when another
Bluetooth device requests it:

 Name
 Bluetooth class
 Services that the device can use
 Technical information, such as the features or the Bluetooth specification that it supports

During the pairing process, a personal identification number (PIN) may be requested to authenticate the
pairing process. The PIN is often a number, but can also be a numeric code or passkey. The PIN is stored
using pairing services, so it does not have to be entered the next time the device tries to connect. This is
convenient when using a headset with a smart phone, because they are paired automatically when the
headset is turned on and within range.

To pair a Bluetooth device with an Android device, follow these steps:

Step 1. Follow the instructions for your device to place it in discoverable mode.

Step 2. Check the instructions for your device to find the connection PIN.

Step 3. Select Settings > Wireless and networks.

Step 4. Touch Bluetooth to turn it on.

Step 5. Touch the Bluetooth tab.

Step 6. Touch Scan for devices.

Step 7. Touch the discovered device to select it.

Step 8. Type the PIN.

Step 9. Touch the device name again to connect to it.

To pair a Bluetooth device with an iOS device, follow these steps:

Step 1. Follow the instructions for your device to place it in discoverable mode.

Step 2. Check the instructions for your device to find the connection PIN.

Step 3. Select Settings > Bluetooth.

Step 4. Touch Bluetooth to turn it on.

Step 5. Touch the discovered device to select it.

 Step 6. Type the PIN.

Remember that mobile device operating systems are updated frequently. Always refer to the
documentation of the manufacturer for your specific model device for the latest command reference.

MODULE# 15 Security Considerations

TOPIC# 1 Security Threats

Types of Threats
Whether wired or wireless, computer networks are essential to everyday activities. Individuals and
organizations alike depend on their computers and networks for functions such as email, accounting,
organization, and file management. Intrusion by an unauthorized person can result in costly network
outages and loss of work. Attacks to a network can be devastating and can result in a loss of time and
money due to damage or theft of important information or assets.

Intruders can gain access to a network through software vulnerabilities, hardware attacks, or even through
less high-tech methods, such as guessing usernames and passwords. Intruders who gain access by
modifying software or exploiting software vulnerabilities are often called threat actors.

When the threat actor gains access to the network, four types of threat may arise:

 Information theft
 Data loss and manipulation
 Identity theft
 Disruption of service

Information Theft

Information theft is breaking into a computer to obtain confidential information. Information can be used
or sold for various purposes such as when someone is stealing proprietary information of an organization,
like research and development data.

Data Loss and Manipulation

Data loss and manipulation is breaking into a computer to destroy or alter data records. An example of
data loss is a threat actor sending a virus that reformats a computer hard drive. An example of data
manipulation is breaking into a records system to change information, such as the price of an item.

Identity theft

Identity theft is a form of information theft where personal information is stolen for the purpose of taking
over the identity of someone. Using this information, a threat actor can obtain legal documents, apply for
credit, and make unauthorized online purchases. Identify theft is a growing problem costing billions of
dollars per year.

Disruption of Service

Disruption of service is preventing legitimate users from accessing services to which they are entitled.
Examples include denial of service (DoS) attacks on servers, network devices, or network communications
links.
Internal and External Threats
Security threats from network intruders can come from both internal and external sources, as shown in the
figure.

External Threats

External threats arise from individuals working outside of an organization. They do not have authorized
access to the computer systems or network. External attackers work their way into a network mainly from
the internet through wireless links or dialup access servers.

Internal Threats

Internal threats occur when someone has authorized access to the network through a user account, or has
physical access to the network equipment. Internal attackers know the internal politics and people. They
often know what information is both valuable and vulnerable, and how to get to it.

However, not all internal attacks are intentional. In some cases, an internal threat can come from a
trustworthy employee who picks up a virus or security threat while outside the company and unknowingly
brings it into the internal network.

Most companies spend considerable resources defending against external attacks, however; some of the
most damaging incidents are the result of actions by trusted internal users. Lost smart phones and
removable storage devices, misplaced or stolen laptops, and the failure to properly remove data from
devices before disposal are common ways that user data ends up in the hands of the wrong people.

TOPIC# 2 Social Engineering Attacks

Overview of Social Engineering
One of the easiest ways for an intruder to gain access, whether internal or external, is by exploiting human
behavior. One of the more common methods of exploiting human weaknesses is called social engineering.

Social engineering is a term that refers to the ability of something or someone to influence the behavior of
a person or group of people. In the context of computer and network security, social engineering refers to a
collection of techniques used to deceive internal users into performing specific actions or revealing
confidential information.

With these techniques, the attacker takes advantage of unsuspecting legitimate users to gain access to
internal resources and private information, such as bank account numbers or passwords.

Social engineering attacks exploit the fact that users are generally considered one of the weakest links in
security. Social engineers can be internal or external to the organization, but most often do not come face-
to-face with their victims.

Types of Social Engineering Attacks

Three of the most common methods threat actors use to obtain information directly from
authorized users go by unusual names: pretexting, phishing, and vishing.

Pretexting

Pretexting is a form of social engineering where an invented scenario (the pretext) is used on
a victim in order to get the victim to release information or perform an action. The target is
typically contacted over the telephone. For pretexting to be effective, the attacker must be
able to establish legitimacy with the intended target, or victim. This often requires some prior
knowledge or research on the part of the attacker. For example, if a threat actor knows the
social security number of the target, the threat actor may use that information to gain the trust
of the target. The target is then more likely to release further information.

Phishing

Phishing is a form of social engineering where the phisher pretends to represent a legitimate
person from another organization. The phisher typically contacts the target individual via
email, as shown in the figure, or text messaging. The phisher might ask for verification of
information, such as passwords or usernames in order to prevent some terrible consequence
from occurring.

Vishing / Phone Phishing

A new form of social engineering that uses Voice over IP (VoIP) is known as vishing. With
vishing, unsuspecting users are sent a voice mail instructing them to call a number which
appears to be a legitimate telephone-banking service. The call is then intercepted by a thief.
Bank account numbers or passwords entered over the phone for verification are then stolen.
TOPIC# 3 Malware

Malicious Software
In addition to social engineering, there are other types of attacks launched by malicious software which
exploit the vulnerabilities in computer software. Malware is the short name for malicious software.

Examples of malware attacks include viruses, worms, and Trojan horses. All of these are types of malware
introduced onto a host. They can damage a system, destroy data, as well as deny access to networks,
systems, or services. They can also forward data and personal details from unsuspecting PC users to
criminals. In many cases, they can replicate themselves and spread to other hosts connected to the network.
Imagine how difficult it would be to recreate saved files, such as game files, license key files, photographs,
and videos.

Sometimes these techniques are used in combination with social engineering to trick an unsuspecting user
into executing the attack.

Types of Malware
Viruses

A virus is a program that spreads by modifying other programs or files. A virus cannot start by itself; it
needs to be activated. When activated, a virus may do nothing more than replicate itself and spread.
Though simple, even this type of virus is dangerous as it can quickly use all available memory and bring a
system to a halt. A more serious virus may be programmed to delete or corrupt specific files before
spreading. Viruses can be transmitted via email, downloaded files, and instant messages, or via CD or USB
devices.

Worms

A worm is similar to a virus, but unlike a virus, it does not need to attach itself to an existing program. A
worm uses the network to send copies of itself to any connected hosts. Worms can run independently and
spread quickly. They do not necessarily require activation or human intervention. Self-spreading network
worms can have a much greater impact than a single virus and can infect large parts of the internet quickly.

Trojan Horses

A Trojan horse is a program that is written to appear like a legitimate program, when in fact it is an attack
tool. It cannot replicate itself. A Trojan horse relies upon its legitimate appearance to deceive the victim
into initiating the program. It may be relatively harmless or may contain code that can damage the hard
drive content of the computer. Trojans can also create a back door into a system that then allows threat
actors to gain access.

Spyware
 Not all attacks do damage or prevent legitimate users from having access to resources. Many
threats are designed to collect information about users which can be used for advertising,
marketing, and research purposes. These include spyware, tracking cookies, adware, and
popups. While these may not damage a computer, they invade privacy and can be annoying.

Spyware

Spyware is any program that gathers personal information from your computer without your
permission or knowledge. This information is sent to advertisers or others on the internet and
can include passwords and account numbers.

Spyware is usually installed unknowingly when downloading a file, installing another

program, or clicking a popup. It can slow down a computer and make changes to internal
settings which creates more vulnerabilities for other threats. In addition, spyware can be very
difficult to remove.

Tracking Cookies

Cookies are a form of spyware but are not always bad. They are used to record information
about an internet user when the user visits websites. Cookies may be useful or desirable by
allowing personalization and other time saving techniques. Many websites require that
cookies be enabled in order to allow the user to connect.

Adware and Popups

Adware

Adware is a form of spyware that is used to collect information about a user based on websites the user
visits. That information is then used for targeted advertising. Adware is commonly installed by a user in
exchange for a "free" product. When a user opens a browser window, adware can start new browser
instances which attempt to advertise products or services based on the surfing practices of a user. The
unwanted browser windows can open repeatedly, and can make surfing the internet very difficult,
especially with slow internet connections. Adware can be very difficult to uninstall.

Popups and pop-unders

Popups and pop-unders are additional advertising windows that display when a website is visited. Unlike
adware, popups and pop-unders are not intended to collect information about the user and are typically
associated only with the website being visited.

 Popups - These open in front of the current browser window.

 Pop-unders - These open behind the current browser window.

They can be annoying and usually advertise products or services that are not wanted by the user.

Botnets and Zombies

 Another annoying by-product of our increasing reliance on electronic communications is unwanted bulk
email. Sometimes merchants do not want to bother with targeted marketing. They want to send their email
advertising to as many end users as possible hoping that someone is interested in their product or service.
This widely distributed approach to marketing on the internet is called spam. One of the ways that spam
can be sent is by using a botnet or bot.

"Bot" is derived from the word "robot" which describes how the devices act when they are infected.
Malicious bot software infects a host, usually through an email or web page link, by downloading and
installing a remote control function. When infected, the “zombie” computer contacts servers managed by
the botnet creator. These servers act as a command and control (C&C) center for an entire network of
compromised devices, which is called a botnet. Infected machines can often pass the software to other
unprotected devices in their network, increasing the size of the botnet. Some botnets include many
thousands of infected devices.

Bot software programs can also cause security issues on the infected machines. This is because the
installed software may include the ability to log keystrokes, gather passwords, capture and analyze packets,
gather financial information, launch DoS attacks, and relay spam. Bots take advantage of time zones, often
waking up the zombie systems during the idle times in each time zone. Many users keep their computers
always connected to the internet, even when they are away from home or sleeping. This creates the perfect
environment for botnet creators to use the bandwidth and processing power of the idle devices.

TOPIC# 4 Denial of Service Attacks

Denial of Service
Sometimes the goal of a threat actor is to shut down the normal operations of a network.

Denial of Service (DoS)

DoS attacks are aggressive attacks on an individual computer or groups of computers with the intent to
deny services to intended users. DoS attacks can target end user systems, servers, routers, and network
links. DoS attacks are relatively simple and can be initiated by an unskilled threat actor.

A threat actor uses a DoS attack to perform these functions:

 Flood a network, host, or application with traffic to prevent legitimate network traffic from flowing.
 Disrupt connections between a client and server to prevent access to a service.

There are several types of DoS attacks. Security administrators need to be aware of the types of DoS
attacks that can occur and ensure that their networks are protected. These are two common DoS attacks:

 SYN (synchronous) flooding - This is when a flood of packets are sent to a server requesting a client
connection. The packets contain invalid source IP addresses. The server becomes occupied trying to
respond to these fake requests and therefore cannot respond to legitimate ones.
 Ping of death - This is when a packet that is greater in size than the maximum allowed by IP (65,535
bytes) is sent to a device. This can cause the receiving system to crash.

Distributed Denial of Service

DoS attacks that are coming from a single IP address can disrupt a website for a period of time until the
attack can be isolated and defended against. More sophisticated types of attacks can bring web services
offline for much longer lengths of time.

Distributed Denial of Service (DDoS)

DDoS is a more sophisticated and potentially damaging form of the DoS attack. It is designed to saturate
and overwhelm network links with useless data. DDoS operates on a much larger scale than DoS attacks.
Typically hundreds or thousands of attack points attempt to overwhelm a target simultaneously. The attack
points may be unsuspecting computers that have been previously infected by the DDoS code. The systems
that are infected with the DDoS code attack the target site when invoked. This group of infected computers
is often called a botnet.

Click Play in the figure to see an animation about how a DDoS attack occurs.

Brute Force

Not all attacks that cause network outages are specifically DoS attacks. A brute force attack is another type
of attack that may result in denial of services.

With brute force attacks, a fast computer is used to try to guess passwords or to decipher an encryption
code. The attacker tries a large number of possibilities in rapid succession to gain access or crack the code.
Brute force attacks can cause a denial of service due to excessive traffic to a specific resource, or by
locking out user accounts.

TOPIC# 5 Security Tools

Security Practices and Procedures

It is never wise to assume that your device or network will not be the next target of an attack. Taking
protective measures can guard you from loss of sensitive or confidential data, and can protect your systems
from being damaged or compromised. Security procedures can range from simple, inexpensive tasks such
as maintaining up-to-date software releases, to complex implementations of firewalls and intrusion
detection systems.

Some of the most effective security procedures are simple to implement and do not require extensive
technical knowledge. A username and password are two pieces of information that a user needs to log on
to a computer or application.

BIOS Password/ Windows Login/ Network Login

When a threat actor knows one of these entries, the attacker needs only to crack or discover the other entry
to gain access to the computer system. It is important to change the default username for accounts such as
administrator or guest, because these default usernames are widely known. Whenever possible, change the
default usernames of all users on computers and network equipment.

Most users select passwords that can be easily guessed or derived from known information about the user
such as birthdays, pet names, or a favorite sports team. It is important to view passwords as a key to
valuable data and to make them as secure as possible. A password that is actually a passphrase is easy to
remember, but would be more difficult to crack. An example would be “My-pets_name-1s_Ginger”, rather
than just “Ginger”.
 Security Tools and Applications
Internet security is a major concern around the world. As a result, many tools are available to network
users to protect the devices from attacks and to help remove malware from infected machines.

Some of the security tools and applications used in securing a network are briefly described in the table.

Security Tool or Application Description

Firewall A security tool that controls traffic to and from a network.

Software that is applied to an OS or application to correct a known security vulnerability or

Patches and updates
add functionality.

Antivirus software is installed on an end-user workstation or server to detect and remove

Virus protection
viruses, worms, and Trojan horses from files and email.

Antispyware software is installed on an end-user workstation to detect and remove spyware

Spyware protection
and adware.

Software is installed on an end-user workstation or server to identify and remove unwanted

Spam blocker
emails.

Software is installed on an end-user workstation to prevent popup and pop-under

Popup blocker
advertisement windows from displaying.

Patches and Updates

One of the most common methods that a threat actor uses to gain access to hosts or networks is through
software vulnerabilities. It is important to keep software applications up-to-date with the latest security
patches and updates to help deter threats. A patch is a small piece of code that fixes a specific problem. An
update, on the other hand, may include additional functionality to the software package as well as patches
for specific issues.

OS and application vendors continuously provide updates and security patches that can correct known
vulnerabilities in the software. In addition, vendors often release collections of patches and updates called
service packs. Fortunately, many operating systems offer an automatic update feature that allows OS and
application updates to be automatically downloaded and installed on a host.

TOPIC# 6 Antimalware Software

Signs of Infections
Even when the OS and applications have all the current patches and updates, they may still be susceptible
to attack. Any device that is connected to a network is susceptible to viruses, worms, and Trojan horses.
These may be used to corrupt OS code, affect computer performance, alter applications, and destroy data.
So how do you know if your computer has been infected?

Some of the signs that a virus, worm, or Trojan horse may be present include the following:
 Computer starts acting abnormally
 Program does not respond to mouse and keystrokes
 Programs starting or shutting down on their own
 Email program begins sending out large quantities of email
 CPU usage is very high
 There are unidentifiable processes or a large number of processes running
 Computer slows down significantly or crashes, such as the when the Windows “blue screen of death”
(BSoD) appears, as shown in the figure.

Antimalware includes a variety of software available to detect and prevent these types of intrusions and
infections including antivirus software, antispam software, and antispyware software.

Antivirus Software
Antivirus software can be used as both a preventive tool and as a reactive tool. It prevents infection. It
detects and removes viruses, worms, and Trojan horses. Antivirus software should be installed on all
computers connected to the network.

Antivirus software relies on known “virus signatures” to find and prevent new viruses from infecting the
computer. Virus signatures are patterns within the programs that are common to other malicious programs
that have already been identified as harmful. When new virus programs are found on the internet, the
signature files for the antivirus are updated with the new information. It is important to keep virus checker
software updated with the latest signature files to protect the system from infection.

Some of the features that can be included in antivirus programs are:

 Email checking - Scans incoming and outgoing emails, and identifies spam and suspicious attachments.
 Resident dynamic scanning - Checks program files and documents when they are accessed.
 Scheduled scans - Virus scans can be scheduled to run at regular intervals and check specific drives or the
entire computer.
 Automatic Updates - Checks for and downloads known virus characteristics and patterns. Can be
scheduled to check for updates on a regular basis.

There are many antivirus programs available. Some are free from the manufacturer while others may
charge a fee to download and use the program.

Antispam Software
No one likes opening their email and being overwhelmed by unwanted messages. Spam is not only
annoying; it can overload email servers and potentially carry viruses and other security threats.
Additionally, people who send spam may use links within the emails to take control of a host by planting
code on it in the form of a virus or a Trojan horse. The host is then used to send spam mail without the
knowledge of the user, consuming the local bandwidth and processor resources.

Antispam software protects hosts by identifying spam and performing an action, such as placing it into a
junk folder or deleting it. Spam filters can be loaded on individual devices, but can also be loaded on email
servers. In addition, many ISPs offer spam filters. Antispam software does not recognize all spam, so it is
important to open email carefully. It may also accidentally identify wanted email as spam and treat it as
such.
 Antispyware Software
Antispyware and Adware

Spyware and adware can also cause virus-like symptoms. In addition to collecting unauthorized
information, they can use important computer resources and affect performance. Antispyware software
detects and deletes spyware applications, as well as prevents future installations from occurring. Many
antispyware applications also include detection and deletion of cookies and adware. Some antivirus
packages include antispyware functionality.

Popup Blockers

Popup blocking software can be installed to prevent popups and pop-unders. Many web browsers include a
popup blocker feature by default. Note that some programs and web pages create necessary and desirable
popups. Most popup blockers offer an override feature for this purpose.

Additional Safeguards
One of the most common types of spam forwarded is a virus warning. Although some virus warnings sent
via email are true, a large number of them are hoaxes and do not really exist. This type of spam can create
problems because people warn others of the impending disaster and so flood the email system. In addition,
network administrators may overreact and waste time investigating a problem that does not exist. Finally,
many of these emails can actually contribute to the spread of viruses, worms, and Trojan horses.

In addition to using spam blockers, other actions to prevent the spread of spam include the following:

 Apply OS and application updates when available.

 Run an antivirus program regularly and keep it up to date.
 Do not forward suspicious emails.
 Do not open email attachments, especially from people you do not know.
 Set up rules in your email to delete spam that bypass the antispam software.
 Identify sources of spam and report it to a network administrator so it can be blocked.
 Report incidents to the governmental agency that deals with abuse by spam.

MODULE# 16 Configure Network and Device Security

TOPIC# 1 Wireless Security Measures

Wireless Vulnerabilities
One of the primary benefits of wireless networking is ease and convenience of connecting devices.
Unfortunately, that ease of connectivity and the fact that the information is transmitted through the air also
makes your network vulnerable to interception and attacks, as shown in the figure. Before your wireless
network is installed, it is important to consider how you plan to secure access to it.
 War Driving, War Walking, and War Chalking
War-driving is the process of driving around an area searching for wireless LANs. When a wireless LAN
is discovered, the location of the WLAN is logged and shared. The goal of war-driving may be to access
the WLAN to steal information. In some cases, the goal is to bring attention to the fact that most wireless
networks are insecure.

A similar process to war-driving is known as war-walking where the person walks around an area to
discover wireless access. When a WLAN is discovered, a chalk mark is placed in front of the location to
indicate the status of the wireless connection.

With wireless connectivity, the attacker does not need a physical connection to your computer or any of
your devices to access your network. It is possible for an attacker to tune into signals from your wireless
network, much like tuning into a radio station.

The attacker can access your network from any location your wireless signal reaches. After they have
access to your network, they can use your Internet services for free, as well as access computers on the
network to damage files, or steal personal and private information.

These vulnerabilities in wireless networking require special security features and implementation methods
to help protect your WLAN from attacks. These include simple steps performed during initial setup of the
wireless device, as well as more advanced security configurations

A Comprehensive Security Plan

Security measures should be planned and configured before connecting the home wireless router to the
network or ISP.

Basic Wireless Settings

 Change the default Service Set Identifier (SSID).

 Disable SSID broadcast.

Wireless Security

Set the security profile for each band:

 Configure the security mode to use WPA2 Personal.

 Set the encryption to Advanced Encryption Standard (AES).
 Configure a passphrase.

MAC Address Filtering

 Configure the MAC addresses that you want to prevent or permit on the WLAN.

Port Forwarding

 Configure the ports that should be forwarded to a specific device, such as a web server in your
demilitarized zone (DMZ).
Demilitarized Zone (DMZ)

 Configure the IPv4 address for the server in the DMZ.

Keep in mind that no single security measure will keep your wireless network completely secure.
Combining multiple techniques will strengthen the integrity of your security plan.

When configuring the clients, it is essential that the SSID matches the SSID configured on the AP. SSIDs
are case sensitive, so the character string must match exactly. Additionally, encryption keys and
authentication keys must also match.

SSID Broadcasts
One easy way to gain entry to a wireless network is through the network name, or SSID.

All computers connecting to the wireless network must be configured with or connect to the appropriate
SSID. By default, wireless routers and access points broadcast SSIDs to all computers within the wireless
range. With SSID broadcast activated, as shown in the figure, any wireless client can detect the network
and connect to it, if no other security features are in place.

The SSID broadcast feature can be turned off. When it is turned off, the fact that the network is there is no
longer made public. Any computer trying to connect to the network must already know the SSID. Turning
off SSID broadcast alone does not protect the wireless network from experienced threat actors. The SSID
can be determined by capturing and analyzing the wireless packets that are exchanged between the clients
and the access point. Even with SSID broadcasting disabled, it is possible for someone to get into your
network using the well-known default SSID. Additionally, if other default settings, such as passwords and
IP addresses are not changed, attackers can access an AP and make changes themselves. Default
information should be changed to something more secure and unique.

Changing Default Settings

What are default settings and why are they there? Most wireless access points and routers are
preconfigured with settings such as SSIDs, administrator passwords, and IP addresses. These settings make
it easier for the novice user to set up and configure the device in the home LAN environment.
Unfortunately, these defaults can also make it easy for an attacker to identify and infiltrate a network.

Changing the default settings on a wireless router will not protect your network by itself. For example,
SSIDs are transmitted in plaintext. There are devices that will intercept wireless signals and read plaintext
messages. Even with SSID broadcast turned off and default values changed, attackers can learn the name
of a wireless network through the use of these devices that intercept wireless signals. This information will
be used to connect to the network. It takes a combination of several methods to protect your WLAN.

MAC Address Filtering

One way to limit access to the wireless network is to control exactly which devices are allowed on the
wireless network (or on some routers/APs the configuration is what devices are not allowed) by filtering
MAC addresses. If MAC address filtering is configured for devices that are allowed on the network, when
a wireless client attempts to connect, or associate, with an AP it will send MAC address information. The
wireless router or AP will look up the MAC address of the connecting client and permit or allow the device
onto the wireless network based on the configuration.

There are some issues with this type of security. The person setting up the wireless router/AP will have to
enter MAC addresses, so this measure does not scale well. Additionally, it is possible for an attacking
device to clone the MAC address of another device that has access.

TOPIC# 2 Implement Wireless Security

Open Authentication
In addition to MAC address filtering, another way to control who can connect to your network is to
implement authentication. Authentication is the process of permitting entry to a network based on a set of
credentials. It is used to verify that the device that is attempting to connect to the network is trusted.

The use of a username and password is a most common form of authentication. In a wireless environment,
authentication still ensures that the connected host is verified, but handles the verification process in a
slightly different manner. Authentication, if enabled, must occur before the client is allowed to connect to
the WLAN. There are different types of wireless authentication methods including open authentication,
PSK, EAP, and SAE. PSK, EAP, and SAE are beyond the scope of this course.

By default, wireless devices do not require authentication. Any and all clients are able to associate
regardless of what they are, as shown in the figure. This is referred to as open authentication. Open
authentication should only be used on public wireless networks such as those found in many schools and
restaurants. It can also be used on networks where authentication will be done by other means after a
device is connected to the network. The setup utility on many routers disables open authentication and
automatically sets up more secure user authentication on the wireless LAN.

Authentication and Association

After authentication is enabled, regardless of the method used, the client must successfully pass
authentication before it can associate with the AP and join your network. If both authentication and MAC
address filtering are enabled, authentication occurs first.

When authentication is successful, the AP will then check the MAC address against the MAC address
table. After verification, the AP adds the host MAC address into its host table. The client is then said to be
associated with the AP and can connect to the network.

Authentication Protocols
Early wireless routers used a form of encryption known as Wired Equivalency Protocol (WEP) to secure
wireless transmissions between clients and access points. WEP is a security feature that encrypts network
traffic as it travels through the air. WEP uses pre-configured keys to encrypt and decrypt data. A WEP key
is entered as a string of numbers and letters and is generally 64 bits or 128 bits long. In some cases, WEP
supports 256 bit encryption keys.
 However, there are weaknesses within WEP, including the use of a static key on all WEP-enabled devices
on the wireless LAN. There are applications, which are readily available on the internet, that threat actors
can use to discover the WEP key. After the attacker has extracted the key, they have complete access to all
transmitted information. The latest authentication is WPA3 that includes both personal and enterprise
versions.

One way to overcome this vulnerability is to change the key frequently. Another way is to use a more
advanced and secure form of encryption known as Wi-Fi Protected Access (WPA).

WPA2 also uses encryption keys from 64 bits up to 256 bits. However, WPA2, unlike WEP, generates
new, dynamic keys each time a client establishes a connection with the AP. For this reason, WPA2 is
considered more secure than WEP because it is significantly more difficult to crack. The version of WPA2
designed for home networks is designated as WPA2-PSK. The PSK indicates that this encryption method
is based on a pre-shared key, in this case, your configured passphrase.

TOPIC# 3 Configure a Firewall

Firewall Overview
A firewall prevents undesirable traffic from entering protected areas of the network, as shown in the figure.

A firewall is one of the most effective security tools available for protecting internal network users from
external threats. A firewall is usually installed between two or more networks and controls the traffic
between them, as well as helping to prevent unauthorized access. Firewall products use various techniques
for determining what is permitted or denied access to a network.

Firewall Operation
Firewalls can be implemented in software which is to be loaded onto PCs, networking devices, or servers.
Firewalls may also be hardware devices that are installed for the single purpose of protecting areas within
the network. A hardware firewall is a freestanding unit that does not use the resources of the computers it
is protecting, so there is no impact on processing performance. The firewall can be configured to block
multiple individual external devices by IP address, to permit or deny packets matching the range of TCP or
UDP ports that you specify, or even traffic that is specific to an application such as a multiplayer video
game.

Typically a hardware firewall passes two different types of traffic into your network:

 Responses to traffic that originates from inside your network

 Traffic that originated from outside the organization that is destined for a port that you have intentionally
permitted

Additionally, firewalls often perform Network Address Translation (NAT). NAT translates an internal
private address or group of addresses into registered IP addresses that can be sent across the internet. This
allows internal IP addresses to be concealed from outside users.

The DMZ
Many home network devices, such as wireless routers, frequently include multifunction
firewall software. This firewall typically provides NAT in addition to IP, application, and
website filtering capabilities. They also support demilitarized zone (DMZ) capabilities, as
shown in the figure.

The figure shows that the wireless router resides between the internet and an internal
network. The internal components of the wireless router are the internal router which routes
packets for all hosts, the internal firewall which protects hosts on the internal network. And
an Ethernet switch which connects all wired hosts. Hosts H1 and H2 are on the internal
network. A web server also attaches to the Ethernet switch.

In computer networking, a demilitarized zone (DMZ) refers to an area of the network that is accessible and
controlled for both internal and external users. It is more secure than the external network but not as secure
as the internal network. With the wireless router, a simple DMZ can be set up that allows an internal server
to be accessible by outside hosts. To accomplish this, the server requires a static IP address that must be
specified in the DMZ configuration. The wireless router isolates traffic destined to the IP address specified.
This traffic is then forwarded only to the switch port where the server is connected. All other hosts are still
protected by the firewall. Game servers and other devices that need to be accessed directly by users located
on the internet may need to be configured in the DMZ network.

Port Forwarding
One of the ways that you can permit other users to reach devices on your network through the internet is a
function called port forwarding. Port forwarding is a rule-based method of directing traffic between
devices on separate networks. This method of exposing your devices to the internet is much safer than
using a DMZ.

When incoming traffic from the internet reaches your router, the firewall in the router determines if the
traffic should be forwarded to a certain device based on the port number found with the traffic. Port
numbers are associated with specific services, such as FTP, HTTP, HTTPS, and POP3. The rules that you
configure in the firewall settings determine which traffic is permitted on to the LAN. For example, a router
might be configured to forward port 80, which is associated with HTTP. When the router receives a packet
with the destination port of 80, the router forwards the traffic to the device inside the network that serves
web pages.

Port Triggering
Playing a game over the internet may require more than just a data connection between you and the other
players. You may want to talk with your friends, or chat, while playing. In many multiplayer games, a
number of TCP and UDP connections could exist between the players while the game is active. Leaving a
large number of ports open to the internet can represent a security risk.

Port triggering allows the router to temporarily forward data through inbound TCP or UDP ports to a
specific device. You can use port triggering to forward data to a computer only when a designated port
range is used to make an outbound request. For example, a video game might use ports 27000 to 27100 for
connecting with other players. These are the trigger ports. A chat client might use port 56 for connecting
the same players so that they can communicate with each other while playing the game. In this instance, if
there is gaming traffic on an outbound port within the triggered port range, inbound chat traffic on port 56
is forwarded to the computer that is being used to play the video game and chat with friends. When the
game is over and the triggered ports are no longer in use, port 56 is no longer allowed to send traffic of any
type to this computer.

MODULE# 17 Cisco Switches and Routers

TOPIC# 1 Cisco Switches

Connect More Devices

Home and small business networks usually do not require more than one or two networking devices in
order to function efficiently. A wireless router, equipped with wireless connections and a few wired
connections, is the only piece of networking equipment that is necessary in order to provide sufficient
connectivity for the average small group of users. These routers are configured through a web browser and
have an easy to use Graphical User Interface (GUI) that guides you through the most common
configuration items.

Wireless routers that are designed primarily for home use are not appropriate for most business networks
that must support more than a few users. Modern networks use a variety of devices for connectivity. Each
device has certain capabilities for controlling the flow of data across a network. A general rule is that the
higher the device is in the OSI model, the more intelligent it is. What this means is that a higher level
device can better analyze the data traffic and forward it based on information not available at lower layers.
As an example, a Layer 2 switch can filter the data and send it only out of the port that is connected to the
destination, based on the MAC address.

As switches and routers evolve, the distinction between them may seem blurred. One simple distinction
remains: LAN switches provide connectivity within the local-area networks of the organization, while
routers interconnect local networks and are needed in a wide area network (WAN) environment. In other
words, a switch is used to connect devices on the same network. A router is used to connect multiple
networks to each other.

Switches/ Routers
 Cisco 4300 Series Routers

In addition to switches and routers, there are other connectivity options available for LANs. Wireless
access points that are deployed in enterprises enable computers and other devices, such as IP phones, to
wirelessly connect to the network, or share broadband connectivity. Firewalls guard against network
threats and provide security, network control, and containment.

Cisco LAN Switches

When a LAN network grows to the point where the four Ethernet ports provided by the wireless router are
not enough for all of the devices that need to attach to the wired network, it is time to add a LAN switch to
the network. A switch can provide connectivity at the access layer of a network, connecting devices to a
LAN. A switch can allow the network to grow without replacing central devices. When choosing a switch,
there are a number of factors to consider, including the following:

 Type of ports
 Speed required
 Expandability
 Manageability

Type of Ports

When selecting a switch for your LAN, choosing the appropriate number and type of ports is critical. Most
lower-cost switches support only copper twisted-pair interface ports. Higher priced switches may have
fiber-optic connections. These are used to link the switch to other switches that may be located over long
distances. The Cisco Catalyst 9300 series has a variety of options depending on your environment.

Speed Required

Ethernet twisted-pair interfaces on a switch have defined speeds. A 10/100 Ethernet port can only function
at either 10 megabits per second (Mbps), or at 100 Mbps. What this means is that even if the device that
you are connecting to the 10/100 switch interface port is capable of connecting at gigabit speeds, the
maximum speed at which it will be able to communicate will be 100 Mbps. Switches may also include
gigabit Ethernet ports. If your internet connection is more than 100 Mbps, then a gigabit port is necessary
to take advantage of the higher internet bandwidth. Gigabit Ethernet ports will also operate at 10/100
Mbps. Gigabit Ethernet is sometimes represented as 1000 Mbps. The Cisco Catalyst 9300 48S switch in
the figure has two 40 Gbps uplink ports to provide a fast path for the 48 ports to access the rest of the
network and the internet.
Similar to a switch port, Ethernet NICs operate at specific bandwidths such as 10/100 or 10/100/1000
Mbps. The actual bandwidth of the attached device will be the highest common bandwidth between the
NIC on the device and the switch port.

Expandability

Networking devices come in both fixed and modular physical configurations. Fixed configurations have a
specific type and number of ports or interfaces. Modular devices have expansion slots that provide the
flexibility to add new modules as required. The figure shows a Cisco Catalyst 9600 chassis in which you
can install different configurations of hardware to address your particular environment.

Manageability

Many basic, inexpensive switches are not configurable. A managed switch that uses a Cisco operating
system enables control over individual ports or over the switch as a whole. Controls include the ability to
change the settings for a device, add port security, and monitor performance. The network administrator in
the figure is directly connecting to a Cisco Catalyst switch using a console cable.

LAN Switch Components

The Cisco Catalyst 9300 switch shown in the figure is suitable for small- and medium-sized networks. It
provides 24 1 Gbps data ports with Power over Ethernet (PoE) so that some device types can be directly
powered from the switch. It also has two modular 40 Gbps uplink ports. The LEDs indicate the port and
system status of the switch. The switch is equipped with a console and storage ports for device
management.

The figure shows the front of a Cisco 9300 switch. From left to right are the status L E Ds, console port,
storage port, LAN access ports, and uplink ports.

Cisco Catalyst 9300 24 UPOE Switch

TOPIC# 2 Switch Boot Process

Power Up the Switch

Cisco switches, like most switches, are preconfigured to operate in a LAN as soon as they are powered on.
All of the interface ports on the switch are active and will begin forwarding traffic immediately when
devices are plugged into them. It is important to remember that no security settings are enabled by default.
You will need to configure the basic security settings before placing the switch into the network.

The three basic steps for powering up a switch are as follows:

Step 1. Check the components.

Step 2. Connect the cables to the switch.
Step 3. Power up the switch.

Note: You can also attach cables after power is applied.

When the switch is on, the power-on self-test (POST) begins. During POST, the LEDs blink while a series
of tests determine that the switch is functioning properly.

POST is completed when the SYST LED rapidly blinks green. If the switch fails POST, the SYST LED
turns amber. When a switch fails POST, it is necessary to return the switch for repairs.

When all startup procedures are finished, the Cisco switch is ready to configure.

Step 1. Check the components.

Ensure all the components that came with the switch are available. These could include a console cable,
power cord, Ethernet cable, and switch documentation.

Step 2. Connect the cables to the switch.

Connect the PC to the switch with a console cable and start a terminal emulation session. Connect the AC
power cord to the switch and to a grounded AC outlet

Step 3. Power up the switch.

Some Cisco switch models do not have an on/off switch, like the Cisco Catalyst 9300 48S switch shown in
the figure. To power on the switch, plug one end of the AC power cord into the switch AC power
connector, and plug the other end into an AC power outlet.

In-Band and Out-of-Band Management

There are two methods to connect a PC to a network device to perform configuration and monitoring tasks:
out-of-band management and in-band management.

Out-of-band Management

Out-of-band management requires a computer to be directly connected to the console port of the network
device that is being configured. This type of connection does not require the local network connections on
the device to be active. Technicians use out-of-band management to initially configure a network device,
because until properly configured, the device cannot participate in the network. Out-of-band management
is also useful when the network connectivity is not functioning correctly, and the device cannot be reached
over the network. Performing out-of-band management tasks requires a terminal emulation client installed
on the PC.
 In-band Management

Use in-band management to monitor and make configuration changes to a network device over a network
connection. For a computer to connect to the device and perform in-band management tasks, at least one
network interface on the device must be connected to the network and have an IP address configured on it.
Either Telnet, HTTP or SSH can be used to access a Cisco device for in-band management, monitor the
network device, or make configuration changes.

IOS Startup Files

As shown in the figure, a Cisco device loads the following two files into RAM when it is booted:

 IOS image file - The IOS facilitates the basic operation of the device’s hardware components. The IOS
image file is stored in flash memory.
 Startup configuration file - The startup configuration file contains commands that are used to initially
configure a router and switch and create the running configuration file stored in RAM. The startup
configuration file is stored in NVRAM. All configuration changes are stored in the running configuration
file and are implemented immediately by the IOS.

The running configuration file is modified when the network administrator performs device configuration.
When changes are made to the running-config file, it should be saved to NVRAM as the startup
configuration file in case the router is restarted or loses power.

TOPIC# 3 Cisco Routers

Router Components
Regardless of their function, size, or complexity, all router models are essentially computers. Just like
computers, tablets, and smart devices, routers also require the following:

 Operating system (OS)

 Central processing unit (CPU)
 Random-access memory (RAM)
 Read-only memory (ROM)
 Nonvolatile random-access memory (NVRAM)

Like all computers, tablets, and smart devices, Cisco routers require a CPU to execute OS instructions,
such as system initialization, routing functions, and switching functions.

The CPU requires an OS to provide routing and switching functions. The Cisco Internetwork Operating
System (IOS) is the system software used for most Cisco devices, regardless of the size and type of the
device. It is used for routers, LAN switches, small wireless access points, large routers with dozens of
interfaces, and many other devices.

Router Interface Ports

 Although there are several different types and models of routers, every Cisco router has the same general
hardware components.

The figure shows a Cisco 4321 Integrated Services Router (ISR). The router includes the following
connections:

 Console ports - Two console ports for the initial configuration and command-line interface (CLI)
management access using a regular RJ-45 port and a USB Type-B (mini-B USB) connector.
 Two LAN interfaces - Two Gigabit Ethernet interfaces for LAN access labeled GE 0/0/0 and GE 0/0/1.
The GE 0/0/0 port can be accessed through an RJ-45 connection or by using a small form-factor pluggable
(SFP) attachment to provide a fiber-optics connection.
 Network Interface Modules (NIMs) - Two NIM expansion slots that provide modularity and flexibility
by enabling the router to support different types of interface modules, including serial, digital subscriber
line (DSL), switch ports, and wireless.

The Cisco 4321 ISR also has a USB port, a management interface, and an auxiliary port. The USB port can
be use for file transfers. The management port can be used for remote management access when the two
Gigabit Ethernet interfaces are unavailable. The auxiliary port provides legacy support for a method for
connecting a dial-up modem to the router for remote access. The auxiliary port is rarely used in networks
today.

The figure shows a Cisco 4321 labeled from left to right: power switch, power input, management
interface / USB port, auxiliary port / RJ-45 and USB console ports, 2 Gigabit Ethernet ports, SFP-based
port, and 2 N I M slots.

TOPIC# 5 Router Boot Process

Power Up the Router

Before beginning any equipment installation, it is important to be sure to read the Quick Start guide and
other documentation that is included with the device. The documentation contains important safety and
procedural information.

Step 1. Securely mount the device to the rack.

Note: The figure shows a typical scenario of mounting the chassis in a rack.
Step 2. Ground the device.
Step 3. Connect the power cable.

Step 4. Connect a console cable.

Configure the terminal emulation software on the laptop and connect the laptop to the console port.

Step 5. Turn on the router.

Step 6. Observe the startup messages on the laptop as the router boots up.

Management Ports
Similar to a Cisco switch, there are several ways to access the command line interface on a Cisco router.
The most common methods are as follows:
 Console - Uses a low speed serial or USB connection to provide direct connect, out-of-band management
access to a Cisco device.
 SSH - Method for remotely accessing a CLI session across an active network interface, including the
management interface.
 AUX port - Used for remote management of the router using a dial-up telephone line and modem.

The console port is a physical port located on the router. When using SSH, there must be an active network
interface that is configured with a valid IP address for the network. This can be one of the active network
interfaces used for network traffic or it can be the management interface.

In addition to these management ports, routers also have network interfaces to receive and forward IP
packets. Most routers have multiple interfaces that are used to connect to multiple networks. Typically, the
interfaces connect to various types of networks, as shown in the figure, which means that different types of
media and connectors are required.

TOPIC# 1 Navigate the IOS

The Cisco IOS Command Line Interface

The Cisco IOS command line interface (CLI) is a text-based program that enables entering and executing
Cisco IOS commands to configure, monitor, and maintain Cisco devices. The Cisco CLI can be used with
either in-band or out-of-band management tasks.

CLI commands are used to alter the configuration of the device and to display the current status of
processes on the router. For experienced users, the CLI offers many time-saving features for creating both
simple and complex configurations. Almost all Cisco networking devices use a similar CLI. When the
router has completed the power-up sequence and the Router> prompt appears, the CLI can be used to
enter Cisco IOS commands, as shown in the command output.

Technicians familiar with the IOS commands and operation of the CLI find it easy to monitor and
configure a variety of different networking devices because the same basic commands are used for
configuring a switch and a router. The CLI has an extensive help system that assists users in setting up and
monitoring devices.

Primary Command Modes

 In the previous topic, you learned that all network devices require an OS and that they can be configured
using the CLI or a GUI. Using the CLI may provide the network administrator with more precise control
and flexibility than using the GUI. This topic discusses using CLI to navigate the Cisco IOS.

As a security feature, the Cisco IOS software separates management access into the following two
command modes:

 User EXEC Mode - This mode has limited capabilities but is useful for basic operations. It allows only a
limited number of basic monitoring commands but does not allow the execution of any commands that
might change the configuration of the device. The user EXEC mode is identified by the CLI prompt that
ends with the > symbol.
 Privileged EXEC Mode - To execute configuration commands, a network administrator must access
privileged EXEC mode. Higher configuration modes, like global configuration mode, can only be reached
from privileged EXEC mode. The privileged EXEC mode can be identified by the prompt ending with the
# symbol.

The table summarizes the two modes and displays the default CLI prompts of a Cisco switch and router.

Table caption

Default Device
Command Mode Description
Prompt

 Mode allows access to only a limited number of basic monitoring

User Exec Mode commands. Switch>
 It is often referred to as “view-only" mode. Router>

 Mode allows access to all commands and features.

Privileged EXEC  The user can use any monitoring commands and execute Switch#
Mode configuration and management commands. Router#

A Note About Syntax Checker Activities

When you are learning how to modify device configurations, you might want to start in a safe, non-
production environment before trying it on real equipment. NetAcad gives you different simulation tools to
help build your configuration and troubleshooting skills. Because these are simulation tools, they typically
do not have all the functionality of real equipment. One such tool is the Syntax Checker. In each Syntax
Checker, you are given a set of instructions to enter a specific set of commands. You cannot progress in
Syntax Checker unless the exact and full command is entered as specified. More advanced simulation
tools, such as Packet Tracer, let you enter abbreviated commands, much as you would do on real
equipment.

TOPIC# 2 The Command Structure

 Basic IOS Command Structure
A network administrator must know the basic IOS command structure to be able to use the CLI for device
configuration.

A Cisco IOS device supports many commands. Each IOS command has a specific format, or syntax, and
can only be executed in the appropriate mode. The general syntax for a command, shown in the figure, is
the command followed by any appropriate keywords and arguments.

 Keyword - This is a specific parameter defined in the operating system (in the figure, ip protocols).
 Argument - This is not predefined; it is a value or variable defined by the user (in the
figure, [Link]).

After entering each complete command, including any keywords and arguments, press the Enter key to
submit the command to the command interpreter.

IOS Command Syntax

A command might require one or more arguments. To determine the keywords and arguments required for
a command, refer to the command syntax. The syntax provides the pattern, or format, that must be used
when entering a command.

As identified in the table, boldface text indicates commands and keywords that are entered as shown. Italic
text indicates an argument for which the user provides the value.

Table caption

Convention Description

boldface Boldface text indicates commands and keywords that you enter literally as shown.

italics Italic text indicates arguments for which you supply values.
 Table caption

Convention Description

[x] Square brackets indicate an optional element (keyword or argument).

{x} Braces indicate a required element (keyword or argument).

Braces and vertical lines within square brackets indicate a required choice within an optional element. Space
[x { y | z }]
delineate parts of the command.

For instance, the syntax for using the description command is description string. The argument is
a string value provided by the user. The description command is typically used to identify the purpose of
an interface. For example, entering the command, description Connects to the main headquarter office
switch, describes where the other device is at the end of the connection.

The following examples demonstrate conventions used to document and use IOS commands:

 ping ip-address - The command is ping and the user-defined argument of ip-address is the IP address of
the destination device. For example, ping [Link].
 traceroute ip-address - The command is traceroute and the user-defined argument of ip-address is the IP
address of the destination device. For example, traceroute [Link].

If a command is complex with multiple arguments, you may see it represented like this:

Switch(config-if)# switchport port-security aging { static | time time | type {absolute | inactivity}}

The command will typically be followed with a detailed description of the command and each argument in
the Cisco IOS Command Reference.

The Cisco IOS Command Reference is the ultimate source of information for a particular IOS command.

Hotkeys and Shortcuts

The IOS CLI provides hot keys and shortcuts that make configuring, monitoring, and troubleshooting
easier.

Commands and keywords can be shortened to the minimum number of characters that identify a unique
selection. For example, the configure command can be shortened to conf because configure is the only
command that begins with conf. An even shorter version, con, will not work because more than one
command begins with con. Keywords can also be shortened.

The table lists keystrokes to enhance command line editing.

 Table caption
Keystroke Description

Tab Completes a partial command name entry.

Backspace Erases the character to the left of the cursor.

Ctrl+D Erases the character at the cursor.

Ctrl+K Erases all characters from the cursor to the end of the command line.

Esc D Erases all characters from the cursor to the end of the word.

Ctrl+U or Ctrl+X Erases all characters from the cursor back to the beginning of the command line.

Ctrl+W Erases the word to the left of the cursor.

Ctrl+A Moves the cursor to the beginning of the line.

Left Arrow or Ctrl+B Moves the cursor one character to the left.

Esc B Moves the cursor back one word to the left.

Esc F Moves the cursor forward one word to the right.

Right Arrow or Ctrl+F Moves the cursor one character to the right.

Ctrl+E Moves the cursor to the end of command line.

Recalls the previous command in the history buffer, beginning with the most recent
Up Arrow or Ctrl+P
command.

Down Arrow or Ctrl+N Goes to the next line in the history buffer.

Ctrl+R or Ctrl+I or Ctrl+L Redisplays the system prompt and command line after a console message is received.

Note: While the Delete key typically deletes the character to the right of the prompt, the IOS command
structure does not recognize the Delete key.

When a command output produces more text than can be displayed in a terminal window, the IOS will
display a “--More--” prompt. The following table describes the keystrokes that can be used when this
prompt is displayed.

Table caption
Keystroke Description

Enter Displays the next line.

Space Displays the next screen.

Any other Ends the display string, returning to previous prompt.

key* *Except "y", which answers "yes" to the --More-- prompt, and acts like the Space.

This table lists commands used to exit out of an operation.

 Table caption
Keystroke Description

When in any configuration mode, ends the configuration mode and returns to privileged
Ctrl-C
EXEC mode. When in setup mode, aborts back to the command prompt.

When in any configuration mode, ends the configuration mode and returns to privileged
Ctrl-Z
EXEC mode.

Ctrl- All-purpose break sequence used to abort DNS lookups, traceroutes, pings, and to
Shift-6 interrupt an IOS process.

TOPIC# 3 View Device Information

Show Commands
The Cisco IOS provides commands to verify the operation of router and switch interfaces.

The Cisco IOS CLI show commands display relevant information about the configuration and operation of
the device. Network technicians use show commands extensively for viewing configuration files, checking
the status of device interfaces and processes, and verifying the device operational status. The status of
nearly every process or function of the router can be displayed using a show command.

Commonly used show commands and when to use them are listed in the table.

Command Used to

show running-config Verify the current configuration and settings.

show interfaces Verify the interface status and see if there are any error messages.

show ip interface Verify the Layer 3 information of an interface.

show arp Verify the list of known hosts on the local Ethernet LANs.

show ip route Verify the Layer 3 routing information.

show protocols Verify which protocols are operational.

show version Verify the memory, interfaces, and licenses of the device.

MODULE# 19 Build a Small Cisco Network

TOPIC# 1 Basic Switch Configuration

Basic Switch Configuration Steps

 The Cisco switch comes preconfigured and only needs to be assigned basic security information before
being connected to the network. Elements that are usually configured on a LAN switch include: host name,
management IP address information, passwords, and descriptive information.

The switch host name is the configured name of the device. Just like each computer or printer is assigned a
name, networking equipment should be configured with a descriptive name. It is helpful if the device name
includes the location where the switch will be installed. An example might be: SW_Bldg_R-Room_216.

A management IP address is only necessary if you plan to configure and manage the switch through an in-
band connection on the network. A management address enables you to reach the device through Telnet,
SSH, or HTTP clients. The IP address information that must be configured on a switch is essentially the
same as you configure on a PC: IP address, subnet mask, and default gateway.

In order to secure a Cisco LAN switch, it is necessary to configure passwords on each of the various
methods of access to the command line. The minimum requirements include assigning passwords to
remote access methods, such as Telnet, SSH and the console connection. You must also assign a password
to the privileged mode in which configuration changes can be made.

Note: Telnet sends the username and password in plaintext and is not considered secure. SSH encrypts the
username and password and is, therefore, a more secure method.

Configuration Tasks

Before configuring a switch, review the following initial switch configuration tasks:

Configure the device name.

 hostname name

Secure user EXEC mode.

 line console 0
 password password
 login

Secure remote Telnet / SSH access.

 line vty 0 15
 password password
 login

Secure privileged EXEC mode.

 enable secret password

Secure all passwords in the config file.

 service password-encryption

Provide legal notification.

 banner motd delimiter message delimiter

 Configure the management SVI.

 interface vlan 1
 ip address ip-address subnet-mask
 no shutdown

Save the configuration.

 copy running-config startup-config

Switch Virtual Interface Configuration

To access the switch remotely, an IP address and a subnet mask must be configured on the switch virtual
interface (SVI). To configure an SVI on a switch, use the interface vlan 1 global configuration command.
Vlan 1 is not an actual physical interface but a virtual one. Next, assign an IPv4 address using the ip
address ip-address subnet-mask interface configuration command. Finally, enable the virtual interface
using the no shutdown interface configuration command.

After the switch is configured with these commands, the switch has all the IPv4 elements ready for
communication over the network.

Note: Similar to Windows hosts, switches configured with an IPv4 address will typically also need to have
a default gateway assigned. This can be done using the ip default-gateway ip-address global configuration
command. The ip-address parameter would be the IPv4 address of the local router on the network, as
shown in the example. However, in this topic you will only be configuring a network with switches and
hosts. Routers will be configured later.

TOPIC# 2 Configure Initial Router Settings

Basic Router Configuration Steps

The following tasks should be completed when configuring initial settings on a router.

Step 1. Configure the device name.

Router(config)# hostname hostname

Step 2. Secure privileged EXEC mode.

Router(config)# enable secret password

Step 3. Secure user EXEC mode.

Router(config)# line console 0

Router(config-line)# password password

Router(config-line)# login

Step 4. Secure remote Telnet / SSH access.

Router(config-line)# line vty 0 4

Router(config-line)# password password

Router(config-line)# login

Router(config-line)# transport input {ssh | telnet | none | all}

Step 5. Secure all passwords in the config file.

 Router(config-line)# exit

Router(config)# service password-encryption

Step 6. Provide legal notification.

Router(config)# banner motd delimiter message delimiter

Step 7. Save the configuration.

Router(config)# copy running-config startup-config

Basic Router Configuration Example

In this example, router R1 will be configured with initial settings. To configure the device name for R1,
use the following commands.

Router> enable

Router# configure terminal

Enter configuration commands, one per line.

End with CNTL/Z.

Router(config)# hostname R1

R1(config)#

Note: Notice how the router prompt now displays the router host name.

All router access should be secured. Privileged EXEC mode provides the user with complete access to the
device and its configuration, so you must secure it.

The following commands secure privileged EXEC mode and user EXEC mode, enable Telnet and SSH
remote access, and encrypt all plaintext (i.e., user EXEC and vty line) passwords. It is very important to
use a strong password when securing privileged EXEC mode because this mode allows access to the
configuration of the device.

R1(config)# enable secret class

R1(config)#

R1(config)# line console 0

R1(config-line)# password cisco

 R1(config-line)# login

R1(config-line)# exit

R1(config)#

R1(config)# line vty 0 4

R1(config-line)# password cisco

R1(config-line)# login

R1(config-line)# transport input ssh telnet

R1(config-line)# exit

R1(config)#

R1(config)# service password-encryption

R1(config)#

The legal notification warns users that the device should only be accessed by permitted users. Legal
notification is configured as follows:

R1(config)# banner motd #

Enter TEXT message. End with the character '#'.

***********************************************

WARNING: Unauthorized access is prohibited!

***********************************************#

R1(config)#

If the router were to be configured with the previous commands and it accidently lost power, the router
configuration would be lost. For this reason, it is important to save the configuration when changes are
implemented. The following command saves the configuration to NVRAM:

R1# copy running-config startup-config

Destination filename [startup-config]?

Building configuration...

[OK]

R1#
 Syntax Checker - Configure Initial Router
Settings
Use this syntax checker to practice configuring the initial settings on a router.

 Configure the device name.

 Secure the privileged EXEC mode.
 Secure and enable remote SSH and Telnet access.
 Secure all plaintext passwords.
 Provide legal notification.

Enter global configuration mode to configure the name of the router as “R1”.

Router>

TOPIC# 3 Secure the Devices

Password Recommendations
To protect network devices, it is important to use strong passwords. Here are standard guidelines to follow:

 Use a password length of at least eight characters, preferably 10 or more characters. A longer password is a
more secure password.
 Make passwords complex. Include a mix of uppercase and lowercase letters, numbers, symbols, and
spaces, if allowed.
 Avoid passwords based on repetition, common dictionary words, letter or number sequences, usernames,
relative or pet names, biographical information, such as birthdates, ID numbers, ancestor names, or other
easily identifiable pieces of information.
 Deliberately misspell a password. For example, Smith = Smyth = 5mYth or Security = 5ecur1ty.
 Change passwords often. If a password is unknowingly compromised, the window of opportunity for the
threat actor to use the password is limited.
 Do not write passwords down and leave them in obvious places such as on the desk or monitor.

The tables show examples of strong and weak passwords.

Table caption

Weak Password Why it is Weak

secret Simple dictionary password

smith Maiden name of mother

toyota Make of a car

 Table caption

Weak Password Why it is Weak

bob1967 Name and birthday of the user

Blueleaf23 Simple words and numbers

Table caption

Strong Password Why it is Strong

b67n42d39c Combines alphanumeric characters

12^h u4@1p7 Combines alphanumeric characters, symbols, and includes a space

On Cisco routers, leading spaces are ignored for passwords, but spaces after the first character are not.
Therefore, one method to create a strong password is to use the space bar and create a phrase made of
many words. This is called a passphrase. A passphrase is often easier to remember than a simple password.
It is also longer and harder to guess.

Secure Remote Access

There are multiple ways to access a device to perform configuration tasks. One of these ways is to use a
PC attached to the console port on the device. This type of connection is frequently used for initial device
configuration.

Setting a password for console connection access is done in global configuration mode. These commands
prevent unauthorized users from accessing user mode from the console port.

Switch(config)# line console 0

Switch(config-line)# password password

Switch(config-line)# login

When the device is connected to the network, it can be accessed over the network connection using SSH or
Telnet. SSH is the preferred method because it is more secure. When the device is accessed through the
network, it is considered a vty connection. The password must be assigned to the vty port. The following
configuration is used to enable SSH access to the switch.

Switch(config)# line vty 0 15

Switch(config-line)# password password

 Switch(config-line)# transport input ssh

Switch(config-line)# login

An example configuration is shown in the command window.

S1(config)# line console 0

S1(config-line)# password cisco

S1(config-line)# login

S1(config-line)# exit

S1(config)#

S1(config)# line vty 0 15

S1(config-line)# password cisco

S1(config-line)# login

S1(config-line)#

By default, many Cisco switches support up to 16 vty lines that are numbered 0 to 15. The number of vty
lines supported on a Cisco router varies with the type of router and the IOS version. However, five is the
most common number of vty lines configured on a router. These lines are numbered 0 to 4 by default,
though additional lines can be configured. A password needs to be set for all available vty lines. The same
password can be set for all connections.

To verify that the passwords are set correctly, use the show running-config command. These passwords
are stored in the running-configuration in plaintext. It is possible to set encryption on all passwords stored
within the router so that they are not easily read by unauthorized individuals. The global configuration
command service password-encryption ensures that all passwords are encrypted.

With remote access secured on the switch, you can now configure SSH.

Configure SSH
Before configuring SSH, the switch must be minimally configured with a unique hostname and the correct
network connectivity settings.

Step 1. Verify SSH support.

Use the show ip ssh command to verify that the switch supports SSH. If the switch is not running an IOS
that supports cryptographic features, this command is unrecognized.

Step 2. Configure the IP domain.

Configure the IP domain name of the network using the ip domain-name domain-name global
configuration mode command. In the example configuration below, the domain-name value is [Link].

Step 3. Generate RSA key pairs.

Not all versions of the IOS default to SSH version 2, and SSH version 1 has known security flaws. To
configure SSH version 2, issue the ip ssh version 2 global configuration mode command. Generating an
RSA key pair automatically enables SSH. Use the crypto key generate rsa global configuration mode
command to enable the SSH server on the switch and generate an RSA key pair. When generating RSA
keys, the administrator is prompted to enter a modulus length. The sample configuration in the figure uses
a modulus size of 1,024 bits. A longer modulus length is more secure, but it takes more time to generate
and to use.

Note: To delete the RSA key pair, use the crypto key zeroize rsa global configuration mode command.
After the RSA key pair is deleted, the SSH server is automatically disabled.

Step 4. Configure user authentication.

The SSH server can authenticate users locally or use an authentication server. To use the local
authentication method, create a username and password pair with
the username username secret password global configuration mode command. In the example, the
user admin is assigned the password ccna.

Step 5. Configure the vty lines.

Enable the SSH protocol on the vty lines using the transport input ssh line configuration mode command.
The Catalyst 2960 has vty lines ranging from 0 to 15. This configuration prevents non-SSH (such as
Telnet) connections and limits the switch to accept only SSH connections. Use the line vty global
configuration mode command and then the login local line configuration mode command to require local
authentication for SSH connections from the local username database.

Step 6. Enable SSH version 2.

By default, SSH supports both versions 1 and 2. When supporting both versions, this is shown in the show
ip ssh output as supporting version 1.99. Version 1 has known vulnerabilities. For this reason, it is
recommended to enable only version 2. Enable SSH version using the ip ssh version 2 global
configuration command.

S1# show ip ssh

SSH Disabled - version 1.99

%Please create RSA keys (of at least 768 bits size) to enable SSH v2.

Authentication timeout: 120 secs; Authentication retries: 3

S1# configure terminal

S1(config)# ip domain-name [Link]

S1(config)# crypto key generate rsa

The name for the keys will be: [Link]

 ...

How many bits in the modulus [512]: 1024

...

S1(config)# username admin secret ccna

S1(config-line)# line vty 0 15

S1(config-line)# transport input ssh

S1(config-line)# login local

S1(config-line)# exit

S1(config)# ip ssh version 2

S1(config)# exit

S1#

Syntax Checker - Configure SSH

Use this Syntax Checker to configure SSH on switch S1

Set the domain name to [Link] and generate the 1024 bit rsa key.

S1(config)#

Verify SSH
On a PC, an SSH client such as PuTTY, is used to connect to an SSH server. For the examples, the
following have been configured:

 SSH enabled on switch S1

 Interface VLAN 99 (SVI) with IPv4 address [Link] on switch S1
 PC1 with IPv4 address [Link]

 After clicking Open in PuTTY, the user is prompted for a username and password. Using the
configuration from the previous example, the username admin and password ccna are entered.
After entering the correct combination, the user is connected via SSH to the CLI on the Catalyst
2960 switch.

 To display the version and configuration data for SSH on the device that you configured as an
SSH server, use the show ip ssh command. In the example, SSH version 2 is enabled. To check
the SSH connections to the device, use the show ssh command.

Login as: admin

 Using keyboard-interactive authentication.

Password: <ccna>

S1> enable

Password: <class>

S1# show ip ssh

SSH Enabled - version 2.0

Authentication timeout: 90 secs; Authentication retries: 2

Minimum expected Diffie Hellman key size : 1024 bits

IOS Keys in SECSH format(ssh-rsa, base64 encoded):

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCdLksVz2QlREsoZt2f2scJHbW3aMDM8

/8jg/srGFNL

i+f+qJWwxt26BWmy694+6ZIQ/j7wUfIVNlQhI8GUOVIuKNqVMOMtLg8Ud4qAiLbGJfAaP3fyrKmViPp

eOZof6tnKgKKvJz18Mz22XAf2u/7Jq2JnEFXycGMO88OUJQL3Q==

S1# show ssh

Connection Version Mode Encryption Hmac State Username

0 2.0 IN aes256-cbc hmac-sha1 Session started admin

0 2.0 OUT aes256-cbc hmac-sha1 Session started admin

%No SSHv1 server connections running.

S1#

TOPIC# 4 Connecting the Switch to the Router

Default Gateway for a Host

If your local network has only one router, it will be the gateway router and all hosts and switches on your
network must be configured with this information. This topic explains how to configure the default
gateway on hosts and switches.

For an end device to communicate over the network, it must be configured with the correct IP address
information, including the default gateway address. The default gateway is only used when the host wants
to send a packet to a device on another network. The default gateway address is generally the router
interface address attached to the local network of the host. The IP address of the host device and the router
interface address must be in the same network.

For example, assume an IPv4 network topology consisting of a router interconnecting two separate LANs.
G0/0/0 is connected to network [Link], while G0/0/1 is connected to network [Link]. Each
host device is configured with the appropriate default gateway address.

In this example, if PC1 sends a packet to PC2, then the default gateway is not used. Instead, PC1 addresses
the packet with the IPv4 address of PC2 and forwards the packet directly to PC2 through the switch.

What if PC1 sent a packet to PC3? PC1 would address the packet with the IPv4 address of PC3, but would
forward the packet to its default gateway, which is the G0/0/0 interface of R1. The router accepts the
packet and accesses its routing table to determine that G0/0/1 is the appropriate exit interface based on the
destination address. R1 then forwards the packet out of the appropriate interface to reach PC3.
The same process would occur on an IPv6 network, although this is not shown in the topology. Devices
would use the IPv6 address of the local router as their default gateway.

Default Gateway on a Switch

A switch that interconnects client computers is typically a Layer 2 device. As such, a Layer 2 switch does
not require an IP address to function properly. However, an IP configuration can be configured on a switch
to give an administrator remote access to the switch.

To connect to and manage a switch over a local IP network, it must have a switch virtual interface (SVI)
configured. The SVI is configured with an IPv4 address and subnet mask on the local LAN. The switch
must also have a default gateway address configured to remotely manage the switch from another network.

The default gateway address is typically configured on all devices that will communicate beyond their
local network.

To configure an IPv4 default gateway on a switch, use the ip default-gateway ip-address global
configuration command. The ip-address that is configured is the IPv4 address of the local router interface
connected to the switch.
In this example, the administrator host would use its default gateway to send the packet to the G0/0/1
interface of R1. R1 would forward the packet to S1 out of its G0/0/0 interface. Because the packet source
IPv4 address came from another network, S1 would require a default gateway to forward the packet to the
G0/0/0 interface of R1. Therefore, S1 must be configured with a default gateway to be able to reply and
establish an SSH connection with the administrative host.

Note: Packets originating from host computers connected to the switch must already have the default
gateway address configured on their host computer operating system.

A workgroup switch can also be configured with an IPv6 address on an SVI. However, the switch does not
require the IPv6 address of the default gateway to be configured manually. The switch will automatically
receive its default gateway from the ICMPv6 Router Advertisement message from the router.
 MODULE# 20 Troubleshoot Common Network Problems

TOPIC# 1 The Troubleshooting Process

Network Troubleshooting Overview

Troubleshooting is the process of identifying, locating and correcting problems. Experienced individuals
often rely on instinct to troubleshoot. However, there are structured techniques that can be used to
determine the most probable cause and solution.

When troubleshooting, proper documentation must be maintained. This documentation should include as
much information as possible about the following:

 The problem encountered

 Steps taken to determine the cause of the problem
 Steps to correct the problem and ensure that it will not reoccur

Document all steps taken in troubleshooting, even the ones that did not solve the issue. This documentation
becomes a valuable reference should the same or similar problem occur again. Even in a small home
network, good documentation saves hours of trying to remember how a problem was fixed in the past.

Gather Information
When a problem is first discovered in the network, it is important to verify it and determine how much of
the network is affected by it. After the problem is confirmed, the first step in troubleshooting is to gather
information. The following checklist provides some of the important information you should check.

Nature of problem

 End-user reports
 Problem verification report

Equipment

 Manufacturer
 Make / model
 Firmware version
 Operating system version
 Ownership / warranty information

Configuration and Topology

 Physical and logical topology

 Configuration files
 Log files

Previous Troubleshooting
 Steps taken
 Results achieved

One of the first ways to gather information is to question the individual who reported the problem, as well
as any other affected users. Questions can include end user experiences, observed symptoms, error
messages, and information about recent configuration changes to devices or applications.

Next, collect information about any equipment that may be affected. This can be gathered from
documentation. A copy of all log files and a listing of any recent changes made to equipment
configurations is also necessary. Log files are generated by the equipment itself and are usually obtainable
through the management software. Other information on the equipment includes the manufacturer, make
and model of devices affected, as well as ownership and warranty information. The version of any
firmware or software on the device is also important because there may be compatibility problems with
particular hardware platforms.

Information about the network can also be gathered using network monitoring tools. Network monitoring
tools are complex applications often used on large networks to continually gather information about the
state of the network and network devices. These tools may not be available for smaller networks.

After all necessary information is gathered, start the troubleshooting process.

Structured Troubleshooting Methods

There are several structured troubleshooting approaches that can be used. Which one to use will depend on
the situation. Each approach has its advantages and disadvantages. This topic describes methods and
provides guidelines for choosing the best method for a specific situation.

Bottom-Up

In bottom-up troubleshooting, you start with the physical layer and the physical components of the
network as shown in the figure, and move up through the layers of the OSI model until the cause of the
problem is identified.

Bottom-up troubleshooting is a good approach to use when the problem is suspected to be a physical one.
Most networking problems reside at the lower levels, so implementing the bottom-up approach is often
effective.

The disadvantage with the bottom-up troubleshooting approach is it requires that you check every device
and interface on the network until the possible cause of the problem is found. Remember that each
conclusion and possibility must be documented so there can be a lot of paper work associated with this
approach. A further challenge is to determine which devices to start examining first.

Top-Down

As shown in the figure, top-down troubleshooting starts with the end-user applications and moves down
through the layers of the OSI model until the cause of the problem has been identified.

End-user applications of an end system are tested before tackling the more specific networking pieces. Use
this approach for simpler problems, or when you think the problem is with a piece of software.
The disadvantage with the top-down approach is it requires checking every network application until the
possible cause of the problem is found. Each conclusion and possibility must be documented. The
challenge is to determine which application to start examining first.

Divide-and-Conquer

The figure shows the divide-and-conquer approach to troubleshooting a networking problem.

The network administrator selects a layer and tests in both directions from that layer.

In divide-and-conquer troubleshooting, you start by collecting user experiences of the problem, document
the symptoms and then, using that information, make an informed guess as to which OSI layer to start your
investigation. When a layer is verified to be functioning properly, it can be assumed that the layers below it
are functioning. The administrator can work up the OSI layers. If an OSI layer is not functioning properly,
the administrator can work down the OSI layer model.

For example, if users cannot access the web server, but they can ping the server, then the problem is above
Layer 3. If pinging the server is unsuccessful, then the problem is likely at a lower OSI layer.

Follow-the-Path

This is one of the most basic troubleshooting techniques. The approach first discovers the traffic path all
the way from source to destination. The scope of troubleshooting is reduced to just the links and devices
that are in the forwarding path. The objective is to eliminate the links and devices that are irrelevant to the
troubleshooting task at hand. This approach usually complements one of the other approaches.

Substitution

This approach is also called swap-the-component because you physically swap the problematic device with
a known, working one. If the problem is fixed, then the problem is with the removed device. If the problem
remains, then the cause may be elsewhere.

In specific situations, this can be an ideal method for quick problem resolution, such as with a critical
single point of failure. For example, a border router goes down. It may be more beneficial to simply
replace the device and restore service, rather than to troubleshoot the issue.

If the problem lies within multiple devices, it may not be possible to correctly isolate the problem.

Comparison

This approach is also called the spot-the-differences approach and attempts to resolve the problem by
changing the nonoperational elements to be consistent with the working ones. You compare
configurations, software versions, hardware, or other device properties, links, or processes between
working and nonworking situations and spot significant differences between them.

The weakness of this method is that it might lead to a working solution, without clearly revealing the root
cause of the problem.

Educated Guess

This approach is also called the shoot-from-the-hip troubleshooting approach. This is a less-structured
troubleshooting method that uses an educated guess based on the symptoms of the problem. Success of this
method varies based on your troubleshooting experience and ability. Seasoned technicians are more
successful because they can rely on their extensive knowledge and experience to decisively isolate and
solve network issues. With a less-experienced network administrator, this troubleshooting method may too
random to be effective.

Guidelines for Selecting a Troubleshooting

Method
To quickly resolve network problems, take the time to select the most effective network troubleshooting
method.

For instance, software problems are often solved using a top-down approach, while hardware-based
problems are solved using the bottom-up approach. New problems may be solved by an experienced
technician using the divide-and-conquer method. Otherwise, the bottom-up approach may be used.

Troubleshooting is a skill that is developed by doing it. Every network problem you identify and solve
adds to your skill set.

TOPIC# 2 Physical Layer Problems

Common Layer 1 Problems

A large proportion of networking problems are related to physical components or problems with the
physical layer. Physical problems are concerned mainly with the hardware aspects of computers and
networking devices, and the cables that interconnect them. Physical problems do not include the logical
(software) configuration of devices.
 Remember, the physical layer (Layer 1) deals with the physical connectivity of the network devices. Some
of the more common Layer 1 problems include the following:

 Device power turned off

 Device power unplugged
 Loose network cable connection
 Incorrect cable type
 Faulty network cable
 Faulty wireless access point

To troubleshoot at Layer 1, first check that all devices have the proper power supplied, and that the devices
are turned on. This may seem to be an obvious solution, but many times the person reporting the problem
may overlook a device that is within the network path from source to destination. Ensure there are no
errors showing on any LEDs that display the connectivity status. If on-site, visually inspect all network
cabling and reconnect cables to ensure a proper connection. If the problem is with wireless, verify that the
wireless access point is operational and that wireless settings are configured correctly.

The Sense of Sight

Vision is used to detect problems such as improperly connected or poorly constructed cables:

 Cables which are not connected

 Cables connected to the wrong port
 Loose cable connections
 Damaged cables and connectors
 Use of the wrong type of cable

Vision also allows us to view the condition and function of various network devices with LEDs.

The Senses of Smell and Taste

Smell can alert troubleshooters to components which are overheating. The smell of burning insulation or
components is very distinct and is a sure sign that something is seriously wrong.

The sense of taste is directly related to the sense of smell because both use the same receptors. You may
also taste the acridness of something burning.

The Sense of Touch

Troubleshooters can use touch to feel for overheated components as well as to detect mechanical problems
with devices such as cooling fans. These devices usually create a small vibration in the component that can
be detected using touch. The absence of this vibration or the presence of excessive amounts of vibration
can indicate that the cooling fan has failed or is about to do so.
The Sense of Hearing
Hearing is used to detect major problems such as electrical issues and the proper operation of cooling fans
and disk drives. All devices have characteristic sounds and any change from the normal sounds usually
indicate a problem of some sort.

Wireless Router LEDs

Regardless of whether the fault is present on the wireless or wired network, one of the first steps in a
bottom-up strategy of troubleshooting should be to examine the LEDs, which indicate the current state or
activity of a piece of equipment or connection. LEDs may change color or flash to convey information.
 The exact configuration and meaning of LEDs varies between manufacturers and devices. The figure
shows a typical wireless router with LEDs including ones for power, system, WLAN, wired ports, and
internet (labeled WAN in the figure), USB, and Quick Security Setup (QSS, also known as Wi-Fi
Protected Setup [WPS]).

On some devices, a single LED may convey multiple pieces of information depending on the current status
of the device. It is important to check the equipment documentation for the exact meaning of all indicators,
but some commonality does exist.

Most devices will have activity LEDs, which are often called link lights. A normal condition is for these
LEDs to flash indicating that traffic is flowing through the port. A solid green light typically indicates that
a device is plugged into the port, but no traffic is flowing. No light typically indicates one or more of the
following:

 Nothing is plugged into the port.

 There is an issue with the wired or wireless connection.
 A device or port has failed.
 There is a cabling issue.
 The wireless router is improperly configured, for example, a port was administratively shut down.
 The wireless router has a hardware fault.
 The device does not have power.

Whether the network is wired or wireless, verify that the device and ports are up and functional before
spending large amounts of time trying to troubleshoot other issues.

Cabling Problems
If the wired client is unable to connect to the wireless router, one of the first things to check is the physical
connectivity and cabling. Cabling is the central nervous system of wired networks and one of the most
common issues when experiencing inactivity.

There are several issues to watch for when cabling:

 Be sure to use the correct type of cable. Two types of UTP cables are commonly encountered in
networking: straight-through cables and crossover cables. Using the wrong type of cable may prevent
connectivity.
 Improper cable termination is one of the main problems encountered in networks. To avoid this, cables
should be terminated according to standards. Terminate cables via the T568A or the T568B termination
standard. Avoid untwisting too much of the wire pairs during termination. Crimp connectors on the cable
jacket to provide strain relief.
 Maximum cable run lengths exist based on characteristics of the different cables. Exceeding these run
lengths can have a serious negative impact on network performance.
 If connectivity is a problem, verify that the correct ports are being used between the networking devices.
 Protect cables and connectors from physical damage. Support cables to prevent strain on connectors and
run cable through areas that will not be in the way.

TOPIC# 3 Troubleshooting Commands

Overview of Troubleshooting Commands

 A number of software utility programs are available that can help identify network problems. Most of these
utilities are provided by the operating system as command line interface (CLI) commands. The syntax for
the commands may vary between operating systems.

Some of the available utilities include:

 ipconfig - Displays IP configuration information.

 ping - Tests connections to other IP hosts.
 netstat - Displays network connections.
 tracert - Displays the route taken to the destination.
 nslookup - Directly queries the name server for information on a destination domain.

The ipconfig Command

When a device does not get an IP address, or has an incorrect IP configuration, it cannot communicate on
the network nor access the internet. On Windows devices, you can view the IP configuration information
with the ipconfig command at the command prompt. The ipconfig command has several options that are
helpful including /all, /release, and /renew.

ipconfig

The ipconfig command is used to display the current IP configuration information for a host. Issuing this
command from the command prompt will display the basic configuration information including IP address,
subnet mask, and default gateway.

ipconfig /all

The command ipconfig /all displays additional information including the MAC address, IP addresses of
the default gateway, and the DNS servers. It also indicates if DHCP is enabled, the DHCP server address,
and lease information.

How can this utility assist in the troubleshooting process? Without an appropriate IP configuration, a host
cannot participate in communications on a network. If the host does not know the location of the DNS
servers, it cannot translate names into IP addresses.
ipconfig /release and ipconfig /renew

If IP addressing information is assigned dynamically, the command ipconfig /release will release the
current DHCP bindings. ipconfig /renew will request fresh configuration information from the DHCP
server. A host may contain faulty or outdated IP configuration information and a simple renewal of this
information is all that is required to regain connectivity.

If, after releasing the IP configuration, the host is unable to obtain fresh information from the DHCP
server, it could be that there is no network connectivity. Verify that the NIC has an illuminated link light,
indicating that it has a physical connection to the network. If this does not solve the problem, it may be an
issue with the DHCP server or network connections to the DCHP server.
The ping Command
Probably the most commonly used network utility is ping. Most IP enabled devices support some form of
the ping command in order to test whether or not network devices are reachable through the IP network.

If the IP configuration appears to be correctly configured on the local host, next, test network connectivity
by using ping. The ping command can be followed by either an IP address or the name of a destination
host. In the example, the user pings the default gateway at [Link] and then pings [Link].
When a ping is sent to an IP address, a packet known as an echo request is sent across the network to the
IP address specified. If the destination host receives the echo request, it responds with a packet known as
an echo reply. If the source receives the echo reply, connectivity is verified by the reply from the specific
IP address. The ping is not successful if a message such as request timed out or general failure appears.

If a ping command is sent to a name, such as [Link], a packet is first sent to a DNS server to
resolve the name to an IP address. After the IP address is obtained, the echo request is forwarded to the IP
address and the process proceeds. If a ping to the IP address succeeds, but a ping to the name does not,
there is most likely a problem with DNS.

Ping Results
If ping commands to both the name and IP address are successful, but the user is still unable to access the
application, then the problem most likely resides in the application on the destination host. For example, it
may be that the requested service is not running.

If neither ping is successful, then network connectivity along the path to the destination is most likely the
problem. If this occurs, it is common practice to ping the default gateway. If the ping to the default
gateway is successful, the problem is not local. If the ping to the default gateway fails, the problem resides
on the local network.

In some cases, the ping may fail but network connectivity is not the problem. A ping may fail due to the
firewall on the sending or receiving device, or a router along the path that is blocking the pings.
The basic ping command usually issues four echoes and waits for the replies to each one. It can, however,
be modified to increase its usefulness. The options listed in the figure display additional features available.

Divide and Conquer with ping

Connectivity problems occur on wireless networks, wired networks, and networks that use both. When
troubleshooting a network with both wired and wireless connections, it is often best to troubleshoot using a
divide-and-conquer technique to isolate the problem to either the wired or the wireless network. The
easiest way to determine if the problem is with the wired or the wireless network is to do the following:
 Ping from a wireless client to the default gateway. This verifies if the wireless client is connecting as
expected.
 Ping from a wired client to the default gateway. This verifies if the wired client is connecting as expected.
 Ping from the wireless client to a wired client. This verifies if the wireless router is functioning as
expected.

After the problem is isolated, it can be corrected.

The tracert Command

Although ping is the most commonly used network troubleshooting command, there are other useful
commands that are available on Windows devices.

The ping command can verify end-to-end connectivity. However, if a problem exists and the device cannot
ping the destination, the ping command does not indicate where the connection was really dropped. To
accomplish this, another command known as traceroute or tracert must be used. Microsoft Windows uses
the tracert command, while other operating systems commonly use the command traceroute.

The tracert utility provides connectivity information about the path a packet takes to reach the destination
and about every router (hop) along the way. It also indicates how long a packet takes to get from the source
to each hop and back (round trip time). The tracert utility can help identify where a packet may have been
lost or delayed due to bottlenecks or slowdowns in the network.

In the figure, the user is tracing the path to Cisco. The path is unique to this user. Your path will have a
different listing of hops and may be shorter or longer (number of hops).

Note: Notice in the output that the 2nd hop failed. This is most likely due to a firewall configuration on
that device which does not permit responding packets from the tracert command. However, the device
does forward the packets to the next hop.

The basic tracert command will only allow up to 30 hops between a source and destination device before
it assumes that the destination is unreachable. This number is adjustable by using the -h parameter. Other
modifiers, displayed as options in the figure, are also available.
The netstat Command
Sometimes it is necessary to know which active TCP connections are open and running on a networked
host. The netstat command is an important network utility that can be used to verify those connections. As
shown in the example, the netstat command lists the protocol in use, the local address and port number,
the foreign address and port number, and the state of the connection.

Unexplained TCP connections can pose a major security threat. This is because they can indicate that
something or someone is connected to the local host. Additionally, unnecessary TCP connections can
consume valuable system resources thus slowing down the performance of the host. Netstat should be used
to examine the open connections on a host when performance appears to be compromised.

Many useful options are available for the netstat command. These options can be viewed by
typing netstat /? at the command prompt, as shown in the example.

The nslookup Command

When a network device is being configured, one or more DNS server addresses are provided that the DNS
client can use for name resolution. Usually the ISP provides the addresses to use for the DNS servers.
When a user application requests to connect to a remote device by name, the requesting DNS client queries
the name server to resolve the name to a numeric address.
 Computer operating systems also have a utility called nslookup that allows the user to manually query the
name servers to resolve a given host name. This utility can also be used to troubleshoot name resolution
issues and to verify the current status of the name servers.

In this figure, when the nslookup command is issued, the default DNS server configured for your host is
displayed. The name of a host or domain can be entered at the nslookup prompt. The nslookup utility has
many options available for extensive testing and verification of the DNS process.

TOPIC# 4 Troubleshoot Wireless Issues

Causes of Wireless Issues

If the wireless client is unable to connect to the AP, it may be because of wireless connectivity problems.
Wireless communications rely on radio frequency (RF) signals to carry data. Many factors can affect our
ability to connect hosts using RF:

 Not all wireless standards are compatible. The 802.11ac (5 GHz band) is not compatible with the
802.11b/g/n standards (2.4 GHz band). Within the 2.4 GHz band, each standard uses different technology.
Unless specifically configured, equipment that conforms to one standard may not function with equipment
that conforms to another. In the figure, the 2.4 GHz network is configured to support legacy devices.
 Each wireless conversation must occur on a separate, non-overlapping channel. Some AP devices can be
configured to select the least congested or highest throughput channel. Although automatic settings work,
manual setting of the AP channel provides greater control and may be necessary in some environments.
 The strength of an RF signal decreases with distance. If the signal strength is too low, devices will be
unable to reliably associate and move data. The signal may be dropped. The NIC client utility can be used
to display the signal strength and connection quality.
 RF signals are susceptible to interference from outside sources, including other devices functioning on the
same frequency. A site survey should be used to detect for this.
 APs share the available bandwidth between devices. As more devices associate with the AP, the bandwidth
for each individual device will decrease causing network performance problems. The solution is to reduce
the number of wireless clients using each channel.
 Authentication and Association Errors
Modern WLANs incorporate various technologies to help secure the data on the WLAN. Incorrect
configuration of any of these can prevent communication. Some of the most common settings that are
configured incorrectly include the SSID, authentication, and encryption.

 The SSID is a case-sensitive, alphanumeric string that is up to 32-characters. It must match on both the AP
and client. If the SSID is broadcast and detected, this is not an issue. If the SSID is not broadcast, it must
be manually entered onto the client. If the client is configured with the wrong SSID, it will not associate
with the AP. Additionally, if another AP is present that has broadcasted the SSID, the client may
automatically associate to it.
 On most APs, open authentication is configured by default, allowing all devices to connect. If a more
secure form of authentication is configured, a key is necessary. Both the client and the AP must be
configured with the same key. If the keys do not match, authentication will fail, and the devices will not
associate.
 Encryption is the process of altering the data so that it is not usable by anyone without the proper
encryption key. If encryption is enabled, the same encryption key must be configured on both the AP and
the client. If the client associates with the AP but cannot send or receive data, the encryption key may be
the issue.

TOPIC# 5 Common Internet Connectivity Issues

DHCP Server Configuration Errors

If the physical connection to the wired or wireless host appears to be connecting as expected but the host
cannot communicate on remote networks or the internet, then check the IP configuration of the client.

The IP configuration can have a major impact on the ability for a host to connect to the network. A
wireless router acts as a DHCP server for local wired and wireless clients and provides IP configuration,
including the IP address, subnet mask, default gateway, and commonly the IP addresses of DNS servers.
The DHCP server binds the IP address to a client MAC address and stores that information in a client
table. It is usually possible to view this table using the configuration GUI included with the router.

The client table information should match the local host information, which you can see using the ipconfig
/all command. Additionally, the IP address on the client must be on the same network as the LAN interface
of the wireless router. The LAN interface of the wireless router should be set as the default gateway. If the
client configuration information does not agree with information in the client table, the address should be
released (ipconfig /release) and renewed (ipconfig /renew) to form a new binding.

In most cases, the wireless router receives its own IP address through DHCP from the ISP. Check to make
sure that the router has an IP address, and attempt to release and renew the address using the GUI utility.

Check Internet Configuration

If hosts on the wired and wireless local network can connect to the wireless router and with other hosts on
the local network, but not to the internet, as shown in the example, the problem may be in the connection
between the router and the ISP.
 There are many ways to verify connectivity between the router and the ISP. Using the GUI, one way to
check connectivity is to examine the router status page. As shown in the figure, it should show the IP
address assigned by the ISP ([Link] in this example).

Check Firewall Settings

If Layers 1 through 3 all appear to be operating normally and you can successfully ping the IP address of
the remote server, it is time to check the higher layers. For example, if a network firewall is used along the
path, it is important to check that the application TCP or UDP port is open and no filter lists are blocking
traffic to that port.

If all clients are obtaining the correct IP configuration, and can connect to the wireless router but are
unable to ping each other or cannot access a remote server or application, the problem may be with rules
on the router. Check all settings on the router to ensure no security restrictions could be causing the issue.
Verify that the local firewalls on the client devices are not preventing network functionality.

TOPIC# 6 Customer Support

Sources of Help
If, during the troubleshooting process, you are unable to determine the problem and its resolution, it might
be necessary to obtain assistance from outside sources. Some of the most common sources for help include
these:

 Documentation - Good documentation can save a great deal of time and effort by directing the
troubleshooter to the most likely cause of the problem. It can also provide the technical information
required to isolate, verify, and correct the issue. The documentation provided with many networking
devices, however, often does not provide sufficient information to troubleshoot anything except the most
basic issues.
 Online FAQs (Frequently Asked Questions) - Most manufacturers provide a series of FAQs about their
product or technology on their website. Usually based on previous requests for help, FAQs are a good
source of current information and should be consulted whenever possible.
 Internet searches - With the increased availability of support forums, troubleshooters can now obtain
assistance from people around the world in real time.
 Colleagues - Colleagues are often a wealth of information; there is no substitute for troubleshooting
experience.
 When to Call for Help
Sometimes we cannot solve networking issues by ourselves. It may be necessary to contact
the vendor or ISP support desk for assistance, as shown in the figure. The customer support
line or support desk is the first stop for end user assistance. The support desk is a group of
individuals with the knowledge and tools required to help diagnose and correct common
problems. It provides assistance for the end user to determine if a problem exists, the nature
of the problem, and the solution.

Many companies and ISPs establish support desks to assist their users with networking
problems. Most large IT companies run support desks for their individual products or
technologies. For example, Cisco Systems offers support desk assistance for problems
integrating Cisco equipment into a network, or problems that may occur after installation.

There are many ways to contact a support desk, including email, live chat, and phone. While
email is good for non-urgent problems, phone or live chat is better for network emergencies.
This is especially important in organizations such as banks where small amounts of downtime
can cost large amounts of money.

If necessary, the support desk can take control of a local host through remote access software.
This allows support desk technicians to run diagnostic programs and interact with the host
and network without having to physically travel to a job site. This greatly reduces the wait
time for problem resolution and allows the support desk to assist more users.

The figure is an image of a woman calling the support desk. A text box shows their
conversation. Support Desk: Good Afternoon Ms. Smith, Thank you for calling the support
desk. My name is Pat. How may I be of assistance? Customer: I cannot connect to the Cisco
web site. Support Desk: In order to help you I will have to gather some additional
information.

Support Desk Interaction

As an end user, it is important to give the support desk as much information as possible, as
shown in the figure. The support desk will require information on any service or support
plans that are in place along with specific details of the affected equipment. This can include
make, model, and serial number along with the version of firmware or operating system
running on the device. They may also require the IP and MAC address of the malfunctioning
device. The support desk will require information specific to the problem:

 What symptoms were encountered?

 Who encountered the problem?
 When did the problem manifest?
 What steps have been taken to identify the problem?
 What were the results of steps taken?
 If this is a follow-up call, be prepared to provide the date and time of the previous call, the
ticket number, and name of the technician. Be at the affected equipment, and be prepared to
provide the support desk staff with access to the equipment if requested.

The figure is an image of a man calling the support desk. A text box shows their
conversation. Support Desk: When did this start to occur? Customer: The Internet was
working fine until 30 minutes ago. Support Desk: Where do you live? Customer: East of the
river in Dodge City. Support Desk: We are showing a lightning strike in that area. We have a
team at the scene so connectivity should be restored within the hour.

Issue Resolution
A support desk is generally organized in a series of levels of experience and knowledge. If the first-level
support desk staff is unable to solve the problem they may escalate the problem to a higher level. Higher
level staff are generally more knowledgeable and have access to resources and tools that the first-level
support desk does not.

Record all information regarding the interaction with the support desk, such as:

 Time/date of call
 Name/ID of technician
 Problem reported
 Course of action taken
 Resolution/escalation
 Next steps (follow-up)

By working together with the support desk, most problems can be resolved quickly and easily. When
resolved, be sure to update all documentation accordingly for future reference.

Support Desk Tickets and Work Orders

When a Level 1 support desk technician receives a call, there is a process followed to gather information.
There are also specific systems for storing and retrieving relevant information. It is extremely important to
gather the information correctly in the event that a call has to be escalated to a Level 2 technician, or
require an on-site visit.

The information gathering and recording process starts as soon as the technician answers the phone. After
customer identification, the technician accesses the relevant customer information. Typically, a database
application is used to manage the customer information.

The information is transferred to a trouble ticket, or incident report. This document can be a piece of paper
in a paper filing system or an electronic tracking system designed to follow the troubleshooting process
from beginning to end. Each person who works on the problem is expected to record what was done on the
trouble ticket. When an on-site call is required, the trouble ticket information can be converted to a work
order that the on-site technician can take to the customer site.

When a problem is resolved, the solution is documented in the customer work order or trouble ticket, and
in a knowledge base document for future reference.