Bits and Bytes of Networking

Key Concepts

• The OSI model (Open Systems Interconnection) is a conceptual 7-layer framework for understanding how network communication works. It's a teaching tool - real protocols don't map perfectly to it.
• The TCP/IP model (4 layers) is the practical implementation used on the internet today. It merges OSI layers 5-7 into one Application layer.
• Encapsulation - each layer wraps data with its own header (and sometimes trailer) as it travels down the stack toward the wire.
• Decapsulation - headers are stripped at each layer as data moves up the stack at the receiving end.
• A PDU (Protocol Data Unit) is the name for data at each layer: bit → frame → packet → segment → data.
• Mnemonic (top→bottom): "All People Seem To Need Data Processing" → Application, Presentation, Session, Transport, Network, Data Link, Physical.

OSI Model - 7 Layers

TCP/IP Model - 4 Layers

Encapsulation Flow

Key Terms

IPv4 Basics

• 32-bit address written as four octets in dotted-decimal notation (e.g., 192.168.1.100).
• Each octet ranges from 0–255.
• Two portions: network part (identifies the subnet) + host part (identifies the device).
• The subnet mask determines where the network/host boundary falls. Written as dotted-decimal (e.g., 255.255.255.0) or CIDR prefix (/24 = 24 network bits).
• The logical AND of an IP and its mask gives the network address.

Address Classes (classful - historical context)

Special / Private Ranges

Subnetting Math

Common CIDR Prefix Reference

IPv6 Basics

• 128-bit address - written as 8 groups of 4 hex digits separated by colons.
• Leading zeros within a group can be omitted; consecutive all-zero groups can be replaced with :: (once per address).
• ::1 - loopback (equivalent to IPv4 127.0.0.1)
• fe80::/10 - link-local (auto-configured, not routable)
• 2000::/3 - global unicast (public routable range)
• No broadcast - replaced by multicast and anycast.
• IPv6 uses NDP (Neighbor Discovery Protocol) instead of ARP.

IPv6 Address Compression - Rules

Worked Examples

IPv6 Compression Practice

Routing Concepts

• Default gateway - the router IP your device sends traffic to when the destination is outside the local subnet.
• Routing table - an ordered list of network prefixes and their next-hop addresses. Routers consult this for every packet.
• TTL (Time To Live) - decremented by each router. Packet is dropped at 0 to prevent routing loops. Starting value is typically 64 (Linux/Mac) or 128 (Windows).
• Static routes - manually configured; predictable but don't auto-adjust to failures.
• Dynamic routing - protocols like OSPF (interior), BGP (exterior), and EIGRP automatically discover routes and adapt to changes.

MAC Addresses

• 48-bit (6-byte) address burned into the NIC by the manufacturer. Written in hex - e.g., AA:BB:CC:DD:EE:FF.
• First 3 bytes = OUI (Organizationally Unique Identifier) - identifies the manufacturer.
• Last 3 bytes = device-unique identifier assigned by the manufacturer.
• Broadcast MAC: FF:FF:FF:FF:FF:FF - received by every device on the segment.
• MACs operate only within a single network segment (they're not routed).
• Can be spoofed in software - important for security.

Ethernet Frame Structure

ARP - Address Resolution Protocol

• Resolves IP addresses to MAC addresses on the local network (Layer 3 → Layer 2).
• ARP Request: broadcast to FF:FF:FF:FF:FF:FF asking "Who has 192.168.1.1?"
• ARP Reply: unicast response "I have 192.168.1.1 - my MAC is AA:BB:CC:DD:EE:FF"
• Mappings are stored in the ARP cache (view with arp -a) to avoid repeated lookups.
• Gratuitous ARP: a device broadcasts its own IP→MAC mapping. Used in failover/HA and (maliciously) for ARP spoofing.

Switches vs Hubs

VLANs

• Virtual LANs logically segment a switch into separate broadcast domains without needing separate physical hardware.
• IEEE 802.1Q - standard for VLAN tagging; inserts a 4-byte tag into the Ethernet frame.
• Access port: carries traffic for a single VLAN; used for end devices.
• Trunk port: carries traffic for multiple VLANs between switches or switch-to-router; tags identify the VLAN.
• Native VLAN: traffic on a trunk port that arrives untagged is assigned to the native VLAN (default VLAN 1).

TCP vs UDP

TCP Three-Way Handshake

TCP Flags

Port Numbers

Common Port Numbers to Memorize

DNS - Domain Name System

• Translates human-readable hostnames (example.com) into IP addresses. Often called "the phonebook of the internet."
• Hierarchical structure: root (.) → TLD (.com) → authoritative nameserver → record.
• DNS queries use UDP port 53 (most common); TCP port 53 for large responses and zone transfers.
• TTL (Time To Live): how long a record is cached before re-querying.

DNS Record Types

DNS Resolution Process

DHCP - Dynamic Host Configuration Protocol

• Automatically assigns IP configuration to devices on a network.
• Assigns: IP address, subnet mask, default gateway, DNS servers, and a lease time.
• Uses UDP: client listens on port 68, server on port 67.
• Initial discovery uses broadcasts (source: 0.0.0.0, dest: 255.255.255.255).

DORA Process

• Lease renewal: client tries to renew at 50% of lease time (T1), then again at 87.5% (T2).
• DHCP reservation: server assigns a fixed IP based on the client's MAC address.
• DHCP relay agent: forwards DHCP broadcasts across router boundaries so one server can serve multiple subnets.

NAT - Network Address Translation

• Translates private IP addresses to a public IP (and back) as packets cross the router. Extends IPv4 address space.
• Static NAT: one-to-one mapping - one private IP always maps to one specific public IP.
• Dynamic NAT: many-to-many - private IPs share a pool of public IPs.
• PAT (Port Address Translation) / NAT overload / masquerade: many-to-one - all private devices share a single public IP, differentiated by port numbers. This is what home routers do.

HTTP / HTTPS

• HTTP methods: GET (retrieve), POST (submit), PUT (replace), PATCH (partial update), DELETE, HEAD (headers only), OPTIONS (capabilities).
• HTTPS = HTTP + TLS - adds encryption, server authentication via certificates, and data integrity (port 443).

HTTP Status Codes

Systematic Connectivity Troubleshooting

Windows Troubleshooting Commands

ipconfig                 # Show IP configuration (all adapters)
ipconfig /all            # Detailed - includes MAC, DHCP server, lease times
ipconfig /release        # Release DHCP lease
ipconfig /renew          # Request new DHCP lease
ipconfig /flushdns       # Clear the local DNS cache

ping 8.8.8.8             # Test ICMP connectivity
ping -t 8.8.8.8         # Continuous ping (Ctrl+C to stop)
ping -n 10 8.8.8.8     # Send exactly 10 packets

tracert google.com       # Trace route hop-by-hop
pathping google.com      # Combined ping + tracert with statistics

nslookup google.com     # DNS lookup
nslookup -type=MX gmail.com  # Query specific record type

arp -a                   # Show ARP table (IP ↔ MAC mappings)
route print             # Show routing table
netstat -an             # Show all connections and listening ports
netstat -b              # Show which executable owns each connection

Linux / macOS Commands

ip addr                  # Show IP addresses (modern Linux)
ip route                 # Show routing table
ifconfig                 # Show IP config (legacy, still common on macOS)

ping -c 4 8.8.8.8       # Send 4 ICMP echo requests
traceroute google.com   # Trace route (Linux/macOS)

dig google.com          # Detailed DNS lookup
dig MX gmail.com        # Query MX records
dig +short google.com  # Just the answer
nslookup google.com     # Simpler DNS lookup

ss -tulpn               # Show listening ports and processes (modern)
netstat -tulpn          # Same, legacy command

arp -n                   # Show ARP table
curl -I https://example.com  # Show HTTP response headers only
tcpdump -i eth0 -n     # Capture packets on interface eth0

VPNs - Virtual Private Networks

• Purpose: create an encrypted tunnel over an untrusted network (the internet), allowing secure communication as if on a private network.
• Site-to-site VPN: connects two entire networks (e.g., HQ ↔ branch office). Always-on tunnel between routers/firewalls.
• Remote access VPN: individual device connects to a corporate network. The user's device gets a virtual IP on the remote subnet.
• Split tunneling: only traffic destined for the remote network goes through the VPN; other traffic goes direct. Reduces VPN load but reduces security.

VPN Protocols

Proxy Servers

Firewalls

Wireless Troubleshooting Notes

• 2.4 GHz non-overlapping channels: 1, 6, 11 (US). Use these to avoid co-channel interference.
• 5 GHz: more channels, less interference, shorter range.
• RSSI (Received Signal Strength Indicator): measure of signal strength. More negative = weaker (e.g., -70 dBm is weaker than -50 dBm).
• Authentication failures: wrong passphrase, expired certificate (WPA2-Enterprise), or mismatch in security standard.
• Check DHCP exhaustion if new devices can't get an IP - the pool may be full.

The mental model - OSI layers for troubleshooting

Use the 4-layer TCP/IP model bottom-up. Every real-world problem maps to one of these layers - it stops you from chasing DNS when the cable is unplugged.

IP addressing & subnetting - needs to be automatic

• CIDR notation, what the prefix length means, how to derive the network address, broadcast address, and usable host range from any prefix.
• Memorize the private RFC 1918 ranges cold: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
• Understanding why subnetting exists - traffic segmentation, security boundaries, broadcast domain control - matters more long-term than binary math speed. But the math still needs to be solid.

TCP vs UDP - know when each is appropriate

DNS - the system everything depends on

• Resolution chain: recursive resolver → root → TLD → authoritative.
• Record types in practical priority order: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail routing), PTR (reverse lookup), NS (delegation).
• TTL as an operational lever - lower it before migrations so changes propagate quickly.
• The real skill: isolating "is this DNS or connectivity?" quickly with nslookup or dig.

DHCP - understand the lease lifecycle

• DORA: Discover → Offer → Request → Acknowledge. Discover and Request are broadcasts; Offer and Acknowledge come from the server.
• Lease renewal behavior: client tries at 50% of lease time (T1), then at 87.5% (T2).
• Reservations (MAC-to-IP binding) give devices a stable address without full static config.
• IP helper addresses forward DHCP broadcasts across subnets so one server can serve multiple VLANs.

NAT - the bridge between private and public

• PAT (the common form) maps many internal hosts to one public IP via port tracking.
• The NAT table is what makes return traffic work - if the entry times out or the device reboots, return traffic has nowhere to go.
• Inbound connections to NATted hosts require explicit port forwarding rules.

Routing fundamentals

• Static routes: manually configured, predictable, fragile at scale.
• Dynamic routing protocols (OSPF interior, BGP exterior): know the names and use cases even before you configure them.
• The default gateway is the "if I don't know where else to send it" rule.
• TTL is both a routing safety mechanism (drops loops) and the engine behind traceroute.

Troubleshooting tools - daily instruments

IPv6 - know it well enough to work with it

• 128-bit addresses, colon-hex notation. Two compression rules: drop leading zeros per group; replace the longest consecutive all-zero run with :: once (leftmost on ties).
• Address types that matter: global unicast (2000::/3, publicly routable), link-local (fe80::/10, auto-configured, non-routable, always present on every interface), loopback (::1).
• No broadcast - replaced by multicast. No NAT needed at scale.
• Dual-stack is the real-world transition reality - most production networks run both IPv4 and IPv6 simultaneously.

The bigger picture