Summary
Highlights
A topology defines the layout of how a network's devices communicate. Common wired topologies include Star, where devices connect to a central hub/switch, offering fault isolation but a single point of failure. Mesh topology connects every computer to every other, providing high redundancy at a high cost, mainly used in WANs like the internet. Point-to-point is a direct connection between two hosts. Hybrid topologies combine different types, and Spine-Leaf creates a full mesh for low latency and redundancy in data centers. Cisco's three-tier hierarchical model (Core, Distribution, Access) and the two-tier collapsed core model are used for large enterprise networks. Traffic flow is categorized as East-West (within a data center) or North-South (to/from external networks).
The OSI (Open Systems Interconnection) model breaks down data communication into seven layers for standardized communication. These layers are Physical (raw data transmission, topology), Data Link (frames, MAC addresses, switches), Network (routing, IP addresses, routers, layer 3 switches), Transport (data transfer, TCP/UDP protocols for reliability vs. speed), Session (dialogue control, starting/ending communication), Presentation (data translation, compression/encryption), and Application (user-facing applications like email, HTTP, FTP).
Common networking devices include switches (connect devices on a local network, learn MAC addresses), routers (forward data between networks based on IP addresses), firewalls (prevent unauthorized access by filtering traffic), IDS/IPS (detect and prevent outside attacks), load balancers (evenly distribute data activity across servers), QoS (prioritize bandwidth for critical applications), and proxy servers (act as intermediaries for client requests, enhancing security, anonymity, logging, content filtering, and speed via caching).
Network-attached storage (NAS) is a dedicated storage device for homes and small businesses. Storage Area Networks (SANs) are high-speed networks for large-scale data storage, offering fault tolerance but at high cost for large enterprises. Wireless Access Points (WAPs) connect wireless devices to wired networks, often managed by Wireless LAN Controllers (WLCs) in larger organizations. Content Delivery Networks (CDNs) speed up website loading by caching content on edge servers globally, reducing latency.
Virtualization simulates hardware and software, allowing multiple virtual machines (VMs) and different operating systems to run on a single physical server using a hypervisor. Virtual Private Clouds (VPCs) create isolated private networks within public clouds for enhanced security and control. Cloud computing offers scalability, elasticity, and multi-tenancy. Deployment models include public, private, and hybrid. Service models are Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).
Network ports are logical connections identified by numbers (e.g., 80 for HTTP, 443 for HTTPS, 25 for SMTP). TCP (Transmission Control Protocol) is connection-oriented, guarantees data delivery, and uses a three-way handshake. UDP (User Datagram Protocol) is connectionless, faster, but does not guarantee delivery, suitable for streaming. IPSec (Internet Protocol Security) provides network-layer security through encryption and authentication for VPNs, operating in transport and tunnel modes. GRE (Generic Route Encapsulation) creates tunnels for VPNs. Traffic types include broadcast (to all devices), unicast (one-to-one), multicast (to multiple specific devices), and anycast (to the nearest device).
Wi-Fi uses radio waves based on IEEE 802.11 standards, including various generations with different speeds and frequencies (2.4 GHz, 5 GHz, 6 GHz). Cellular networks (2G, 3G, 4G LTE, 5G) and satellite internet provide internet access in different areas. Ethernet standards (IEEE 802.3) define wired network speeds and cable types (e.g., 10BASE-T, 100BASE-TX, 1000BASE-T). Twisted pair cables (UTP, STP) are categorized by performance (Cat 3 to Cat 8). Direct Attach Copper (DAC) cables are for high-speed, short-distance data centers. Plenum-rated cables are used in air circulation spaces due to fire safety requirements. Coaxial cables (RG6, RG59) are used for internet and video. Fiber optic cables (single mode, multimode) use light pulses for long-distance, high-speed data.
Common connectors include RJ11 (telephone, modem to LAN), RJ45 (Ethernet), F-Type (coaxial for cable/satellite), BNC (coaxial for video/audio). Fiber optic connectors include SC (standard connector, push-pull), LC (lucent connector, small, latching), MPO (multifiber push-on, high-density), and ST (straight tip, bayonet lock).
IPv4 addresses are 32-bit numeric identifiers. Public IPs are globally unique and internet-routable. Private IPs (RFC1918 ranges) are for internal networks, conserved by Network Address Translation (NAT) which translates private to public IPs and vice versa, often with Port Address Translation (PAT) using port numbers. Private IP classes (A, B, C) are used for different network sizes. An IP address consists of a network and host part, determined by the subnet mask. Subnetting breaks large networks into smaller ones by borrowing bits from the host portion, reducing broadcast traffic. Subnet masks can be expressed in CIDR notation (slash notation). IP address classes determine host capacity. IPv6 (128-bit hexadecimal) provides a vast number of addresses and uses abbreviation methods. Transition technologies like tunneling, dual-stack, and NAT64 are used for IPv4-IPv6 coexistence.
VLANs (Virtual Local Area Networks) logically segment a LAN regardless of physical location, improving security and managing traffic. 802.1Q tagging allows multiple VLANs to communicate over a single physical link (trunk). Native VLAN carries untagged frames for older devices. VXLAN (Virtual Extensible LAN) overcomes VLAN limitations by supporting 16 million virtual networks and routability across geographical areas (DCI - Data Center Interconnect). Layer 2 switches use MAC addresses, while Layer 3 switches (multilayer switches) can also route using IP addresses. Link aggregation bundles multiple cables for increased bandwidth. Duplex modes are half (one-way at a time) and full (simultaneous two-way). Interface speed ratings and autonegotiation are crucial for optimal performance. Maximum Transmission Unit (MTU) defines the largest data packet size; jumbo frames are larger for high-speed internal networks.
Routers forward data using routing tables, which are populated by directly connected networks, static routes (manual), and dynamic routes (automatic via routing protocols). Dynamic routing protocols include RIP (Routing Information Protocol), OSPF (Open Shortest Path First), BGP (Border Gateway Protocol), and EIGRP (Enhanced Interior Gateway Routing Protocol). Route selection prioritizes paths based on administrative distance (reliability), prefix length (specificity), and metric (cost/preference).
Wi-Fi frequencies (2.4 GHz, 5 GHz, 6 GHz) offer different ranges, speeds, and interference levels, with channels within each band. IEEE 802.11h standards (DFS, TPC) in the 5 GHz band prevent interference with radar. Band steering automatically connects devices to the optimal frequency band. SSID (Service Set Identifier) is the Wi-Fi network name. BSSID (Basic Service Set Identifier) is a unique identifier (MAC address) for a Wi-Fi device. ESSID (Extended Service Set Identifier) represents a whole Wi-Fi network with multiple access points. Wireless network types include infrastructure (wired and wireless devices), ad hoc (peer-to-peer without infrastructure), mesh (multiple routers for blanket coverage), and point-to-point (direct wireless link between two access points).
Wi-Fi security protocols evolved from WEP to WPA, WPA2 (using AES), and WPA3 (stronger encryption, OWE for open networks). Guest networks isolate visitors from the main network. Captive portals are web pages for authentication or terms of service agreement on public Wi-Fi. Pre-shared key authentication is for homes; enterprise authentication uses unique credentials and RADIUS servers. Antennas are omnidirectional (all directions) or directional (focused beam). Lightweight access points rely on a WLC for management, autonomous APs are self-managed for smaller networks.
Server racks organize IT equipment with standardized widths and heights (rack units). Rack types (open/closed) depend on cooling and security needs. UPS (Uninterrupted Power Supply) provides battery backup and surge protection. PDUs (Power Distribution Units) distribute power, often plugged into UPS. Port side intake/exhaust refer to airflow direction in network devices. Patch panels organize cables, available in Ethernet, fiber, and coaxial types. MDF (Main Distribution Frame) is the central wiring point, IDFs (Intermediate Distribution Frames) are smaller distribution points. Data centers require humidity control (45-55% RH) and temperature management (64-81°F) to prevent static discharge, condensation, and overheating. Fire suppression systems (gas-based, fog systems like FM200) are crucial for safety.
Physical diagrams show specific hardware; logical diagrams focus on functionality and data flow. Rack diagrams detail equipment placement. Cable maps show cable connections and routing. OSI Layer 1, 2, and 3 diagrams illustrate physical, data link, and network layer architectures. Asset inventory tracks all company assets. IPAM (IP Address Management) manages IP addresses. SLAs (Service Level Agreements) define service quality. Wireless survey heat maps visualize Wi-Fi signal strength. EOL (End of Life) and EOS (End of Service) indicate product life cycles. Decommissioning involves safe and environmentally sound removal of devices and data erasure. Software and firmware management ensure updates for security and performance. Change management plans and documents network changes. Configuration management maintains device configurations. Baseline metrics establish normal network performance. Log aggregation centralizes log data, often using syslog. SIEM (Security Information and Event Management) analyzes security events in real-time. Port mirroring copies traffic for analysis. Network discovery (SNMP, scanners, LLDP) identifies network resources. Network traffic analysis monitors and evaluates traffic. Performance monitoring tracks key metrics. Availability monitoring observes resource uptime. Configuration monitoring tracks device settings.
Disaster recovery involves plans and strategies to restore IT infrastructure after a disaster. Key metrics include RPO (Recovery Point Objective - maximum data loss), RTO (Recovery Time Objective - maximum downtime), MTTR (Mean Time To Repair - average repair time), and MTBF (Mean Time Between Failures - reliability indicator). Disaster recovery sites can be hot sites (fully functional, ready to go), warm sites (some equipment, partial functionality), or cold sites (basic location, no equipment). High availability ensures continuous operation, with active-active (all devices share load) or active-passive (some devices on standby) setups. Tabletop exercises simulate emergencies to test plans.
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses (dynamic IPs) from a scope, along with subnet mask, default gateway, and DNS server. Static IP addresses are manually assigned. DHCP reservations assign a specific IP address to a device based on its MAC address. DHCP exclusions prevent the server from assigning certain IP addresses. IP addresses are assigned as leases, which are automatically renewed. APIPA (Automatic Private IP Addressing) is a self-assigned IPv4 address (169.254.x.x) when a DHCP server is unreachable, allowing local network communication. SLAAC (Stateless Address Autoconfiguration) is for IPv6 devices to autoconfigure IPs, using router advertisements and MAC addresses, and is routable. DHCP relays (IP helpers) on routers forward DHCP broadcasts across subnets.
DNS (Domain Name System) resolves domain names to IP addresses through a hierarchy of root, TLD, and authoritative name servers. Common DNS records include A (IPv4 address), quad A (IPv6 address), CNAME (canonical name/alias for another domain), MX (mail exchanger for email servers), NS (name server), PTR (pointer, reverse DNS lookup for IP to domain), and TXT (miscellaneous information, spam prevention). DNSSEC (DNS Security Extensions) adds digital signatures to records for security. DoH (DNS over HTTPS) and DoT (DNS over TLS) encrypt DNS queries for privacy. DNS zones (forward, reverse) handle name-to-IP and IP-to-name resolution. Host files provide local hostname-to-IP mapping. NTP (Network Time Protocol) synchronizes computer clocks. NTS (Network Time Security) secures NTP synchronization with encryption and verification.
VPNs (Virtual Private Networks) establish secure connections over unsecure networks like the internet, protecting online activity and disguising identity. Site-to-site VPNs connect two remote networks. Client-to-site (point-to-site) VPNs connect individual users to a remote network, with options for full tunneling (all traffic encrypted) or split tunneling (only specific traffic encrypted). Clientless VPNs use web browsers (SSL/TLS) for remote access without software installation. SSH (Secure Shell) provides secure command-line access. GUI (Graphical User Interface) offers user-friendly access. API integration links software applications. Console connections provide direct serial access to devices. In-band management uses the same network for control, out-of-band uses a separate connection.
Network devices discover MAC addresses by broadcasting. Redundancy with multiple switches can create broadcast loops. STP (Spanning Tree Protocol) prevents these loops by blocking redundant ports. STP elects a root bridge (switch with lowest bridge ID – priority + VLAN + MAC address). Ports on the root bridge are designated ports. On non-root switches, root ports are chosen based on the lowest path cost to the root bridge. STP then blocks other redundant ports to break loops, reactivating them if a primary link fails.
Encryption scrambles data, making it unreadable for security during transit and at rest. PKI (Public Key Infrastructure) uses digital certificates and public/private key encryption for authentication and secure communication. IAM (Identity Access Management) manages digital identities and controls resource access. LDAP (Lightweight Directory Access Protocol) accesses and manages directory services. Authentication verifies identity, often using MFA (Multifactor Authentication). SSO (Single Sign-On) allows logging into multiple apps with one credential set. TACACS+ (Terminal Access Controller Access-Control System Plus) provides centralized AAA for Cisco systems. Physical security includes cameras and locks. Deceptive technologies like honeypots (trap for cybercriminals) and honeynets (network of honeypots) gather threat intelligence. Key terminologies include risk, vulnerability, exploit, cyber security threat, and the CIA triad (Confidentiality, Integrity, Availability). Data locality processes data where it's stored to reduce network traffic. PCI DSS (Payment Card Industry Data Security Standard) and GDPR (General Data Protection Regulation) are crucial data protection standards. IoT and IIoT connect everyday and industrial devices, respectively. SCADA, ICS, and OT systems control and monitor industrial processes. BYOD (Bring Your Own Device) programs allow employees to use personal devices for work, posing security risks.
DDoS (Distributed Denial of Service) attacks flood networks/servers with traffic to disrupt operation. VLAN hopping allows unauthorized access to VLANs. MAC flooding overwhelms switch MAC tables, turning switches into hubs and exposing traffic. ARP spoofing impersonates devices to intercept data, leading to on-path (man-in-the-middle) attacks. DNS poisoning/spoofing alters DNS data to redirect users to malicious websites. Rogue devices like unauthorized DHCP servers can cause IP conflicts or man-in-the-middle attacks. Rogue APs (Access Points) or evil twins trick users into connecting to malicious networks. Dumpster diving retrieves discarded data. Shoulder surfing steals private information by observation. Phishing is a social engineering attack for credentials. Malware (viruses, Trojans, worms, ransomware, spyware) is malicious software. Tailgating is physical security bypass by following authorized personnel.
Device hardening reduces attack surface by disabling unused ports/services and changing default passwords. NAC (Network Access Control) enforces policies (e.g., posture checks, port security, MAC filtering) for device access. ACLs (Access Control Lists) on firewalls filter traffic by IP, URL, or content. Trusted zones have high security (internal networks); untrusted zones (internet) are risky. DMZ (Demilitarized Zone) segregates public-facing servers from the internal network for security.
Congestion (shared resource at capacity) and contention (multiple devices accessing same resource) cause poor performance. Bottlenecking is a point of hindered data flow. Bandwidth is the maximum data transfer rate. Latency (lag) is the response time. Packet loss is when data packets fail to reach their destination. Jitter is variation in packet arrival time. Wireless issues include channel overlap (interference), signal degradation (weak/corrupted signals), client disassociation (unexpected disconnections), insufficient wireless coverage (weak Wi-Fi signal), and roaming misconfiguration (problems with device handoffs between APs).
Command-line tools are essential for troubleshooting. Ping checks network connectivity and latency. Tracert (traceroute) traces the path of data packets and identifies hops/bottlenecks. Nslookup resolves domain names to IP addresses. ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses and displays the ARP cache. Netstat shows current network connections and open ports. Ipconfig (Windows) or Ifconfig (Linux) displays network configuration (IP, MAC, DNS, gateway). TCPdump captures and analyzes network traffic. Nmap is an open-source tool for network scanning and security audits. LLDP (Link Layer Discovery Protocol) and CDP (Cisco Discovery Protocol) discover neighboring devices. A speed tester measures internet connection speeds. Cable testers verify cable continuity and wiring. A tone generator (fox and hound) traces cables. A Wi-Fi analyzer assesses wireless network operation. A visual fault locator (VFL) finds fiber optic cable faults. A network tap mirrors traffic for monitoring. Cisco's 'show' commands (e.g., show MAC address table, show route, show interface, show config, show ARP, show VLAN, show power) display device-specific information.
A structured approach to troubleshooting involves gathering information (questioning users, identifying symptoms, establishing changes), duplicating the problem if possible, identifying probable cause (starting with simple solutions), testing the theory, establishing an action plan (considering potential effects), implementing the solution (or escalating), verifying full functionality, and documenting the solution and process for future reference and prevention.