CCNA

Switch

• Primary Role: Forwards data within the same Local Area Network (LAN).

• Port Density: High number of ports/interfaces (typically 24, 48, or more).

• Scope: Connects end hosts (computers, printers, local servers) together on a single floor or office network.

• Cisco Example Series: Catalyst 9200, Catalyst 3650.

• Limitation: Switches do not route traffic between different LANs or across the Internet on their own.

Router

• Primary Role: Routes and forwards traffic between different LANs and over the Internet.

• Port Density: Relatively few network interfaces compared to switches.

• Scope: Connects branch offices (e.g., New York branch to Tokyo branch) across Wide Area Networks (WAN) or the Internet.

• Cisco Example Series: ISR 900, ISR 1000, ISR 4000.

Firewall

• Primary Role: Monitors, filters, and controls incoming and outgoing network traffic based on configured security rules.

• Placement: Can be placed outside the router (facing the Internet) or inside the local network (protecting internal subnets).

• Hardware vs. Software:

  • Network Firewalls (Hardware): Dedicated appliances filtering traffic between network segments (e.g., Cisco ASA 5500-X, Firepower 2100).

  • Host-Based Firewalls (Software): Software running directly on an endpoint (e.g., Windows Defender Firewall).

• Next-Generation Firewalls (NGFW): Modern firewalls incorporating deep packet inspection and integrated security services like Intrusion Prevention Systems (IPS).

LAN (Local Area Network)

A network connecting devices within a limited geographical area (e.g., home, office, building).

Ethernet UTP Standards - 802.3 (10Base-T) - Ethernet

10 Mbps, 2 pairs (4 wires)

802.3u (100Base-TX) - Fast Ethernet

100 Mbps, 2 pairs (4 wires)

802.3ab (1000Base-T) - Gigabit Ethernet

1 Gbps, 4 pairs (8 wires)

802.3an (10GBase-T) - 10G Ethernet

10 Gbps, 4 pairs (8 wires)

What pins do PCs, Routers, and Firewalls transmit and receive on?

Transmit (TX) on pins 1 & 2; Receive (RX) on pins 3 & 6

What pins do Switches transmit and receive on?

Transmit (TX) on pins 3 & 6; Receive (RX) on pins 1 & 2

Straight-Through Cable

Used to connect dissimilar pin-type devices (e.g., PC to Switch, Router to Switch)

Crossover Cable

Swaps pairs 1/2 with 3/6; used to connect similar pin-type devices (e.g., Switch to Switch, Router to Router, PC to Router)

Auto MDI-X

Modern network interfaces automatically detect needed pin assignments, allowing straight-through cables to work even between similar devices

Fiber Optic Cabling

Fiber optic cables use light signals through glass strands and connect via SFP (Small Form-factor Pluggable) transceivers rather than built-in RJ-45 ports

Single-Mode Fiber (SMF)

Narrow core diameter; uses laser light entering at a single angle. Offers high distance capabilities (up to 10–30 km+), but equipment is more expensive

Multimode Fiber (MMF)

Wider core diameter; uses LED transmitters allowing multiple light angles (modes). Lower cost than SMF, but maximum distance is shorter (~400–550 meters)

Fiber Standards - 1000Base-LX

1 Gbps | MMF (up to 550m) or SMF (up to 5km)

10GBASE-SR

10 Gbps | MMF (up to 400m)

10GBASE-LR

10 Gbps | SMF (up to 10km)

10GBASE-ER

10 Gbps | SMF (up to 30km)

Copper vs. Fiber Comparison Summary

Feature	UTP Copper	Fiber Optic
Cost	Lower cable & port cost [26:43]	Higher transceiver & cable cost [27:26]
Max Reach	100 meters [26:50]	Up to 30 km+ [27:35]
EMI Interference	Vulnerable to EMI [26:56]	Immune to EMI [27:45]
Security	Minor signal bleed risk [27:18]	No external signal emissions [27:50]

IEEE (Institute of Electrical and Electronics Engineers)

• Focuses on physical and data link standards for Local Area Networks (LANs) and Metropolitan Area Networks (MANs).

  • 802.3: Ethernet (cables, signaling, MAC frame formats).

  • 802.11: Wi-Fi (radio frequencies, wireless frame structures).

IETF (Internet Engineering Task Force)

• An open international community defining core protocols across the Internet stack.

  • Publishes standards in RFCs (Request for Comments). For instance, RFC 791 defines IPv4, RFC 793 defines TCP, and RFC 768 defines UDP.

5 Layer Hybrid OSI Model

+-------------------------------------------------------+

|  Layer 5: Application   (HTTP, HTTPS, SSH, DNS, FTP)  |

+-------------------------------------------------------+

|  Layer 4: Transport     (TCP, UDP)                    |

+-------------------------------------------------------+

|  Layer 3: Network       (IPv4, IPv6, ICMP)            |

+-------------------------------------------------------+

|  Layer 2: Data Link     (Ethernet, Wi-Fi)             |

+-------------------------------------------------------+

|  Layer 1: Physical      (Bits, Cables, Transceivers)  |

+-------------------------------------------------------+

As data moves down through the layers, each layer prepends its own Header (and in Layer 2's case, appends a Trailer)

1. Application Data: Raw message generated by the app.

2. Layer 4 (Transport): Adds L4 Header (Source & Destination Port Numbers).

3. Layer 3 (Network): Adds L3 Header (Source & Destination IP Addresses).

4. Layer 2 (Data Link): Adds L2 Header (Source & Destination MAC Addresses) and L2 Trailer (FCS).

5. Layer 1 (Physical): Converts the L2 Frame into physical signals (electrical, optical, or radio) to travel over the medium.

[ L2 Header ][ L3 Header ][ L4 Header ][ Application Data ][ L2 Trailer ]

Why a Layer 2 Trailer?

The Layer 2 trailer contains a Frame Check Sequence (FCS) computed via a Cyclic Redundancy Check (CRC). The receiving host or switch calculates this mathematical value to instantly verify that bits were not corrupted or flipped during transit over the physical medium.

Layer 4 PDU (Protocol Data Unit) Name

Segment (TCP)/Datagram (UDP)

Layer 3 PDU Name

Packet

Layer 2 PDU Name

Frame

7 Layer OSI Model

OSI 7-Layer Model              5-Layer Hybrid Model          4-Layer Original TCP/IP

+-------------------+          +-------------------+          +-------------------+

| 7. Application    |          |                   |          |                   |

| 6. Presentation   | -------> | 5. Application    | -------> | Application       |

| 5. Session        |          |                   |          |                   |

+-------------------+          +-------------------+          +-------------------+

| 4. Transport      | -------> | 4. Transport      | -------> | Transport         |

+-------------------+          +-------------------+          +-------------------+

| 3. Network        | -------> | 3. Network        | -------> | Internet          |

+-------------------+          +-------------------+          +-------------------+

| 2. Data Link      | -------> | 2. Data Link      | \        |                   |

+-------------------+          +-------------------+  ======> | Network Access    |

| 1. Physical       | -------> | 1. Physical       | /        |                   |

+-------------------+          +-------------------+          +-------------------+

Application Layer Naming: Network engineers frequently call the Application layer "Layer 7" because of its position in the 7-layer OSI model.

The Cisco Internetwork Operating System (IOS) enforces a strict privilege hierarchy [05:49]. Each mode unlocks specific administrative permissions and changes the terminal prompt indicator.

 [ Power-On / Reboot ]

                 │

                 ▼

       ┌───────────────────┐

       │  User Exec Mode   │  Prompt: Router>

       └─────────┬─────────┘

                 │ Command: enable

                 ▼

       ┌───────────────────┐

       │ Privilege Exec    │  Prompt: Router#

       └─────────┬─────────┘

                 │ Command: configure terminal

                 ▼

       ┌───────────────────┐

       │ Global Config     │  Prompt: Router(config)#

       └───────────────────┘

User Exec Mode (>)

• Prompt: Router>

• Capabilities: Extremely limited read-only visibility. Used primarily for basic non-disruptive monitoring. Configuration changes cannot be made.

Privileged Exec Mode (#)

• Prompt: Router#

• Capabilities: Complete administrative inspection rights. Allows viewing full configurations, initiating software reloads, clearing counters, and running diagnostic tools.

Global Configuration Mode ((config)#)

• Prompt: Router(config)#

• Capabilities: Modifies system-wide operational characteristics (e.g., hostname, password policies, routing engines).

• Transition In: Execute configure terminal from Privileged Exec Mode.

Context-Sensitive Help (?)

• e? -> Displays commands beginning with the letter "e" (e.g., enable, exit).

• enable ? -> Displays valid parameters that can follow the keyword.

Running Configuration (running-config)

Stored in RAM. Changes take effect immediately upon keypress. All unsaved changes in RAM are erased if the device loses power.

Startup Configuration (startup-config)

Stored in non-volatile memory (NVRAM). Read into RAM during the device boot cycle.

To persist running changes from volatile RAM to NVRAM, execute one of three options in Privileged Exec Mode:

! Method 1: Canonical CCNA command syntax

Router# copy running-config startup-config

! Method 2: Shortened command

Router# write

! Method 3: Extended legacy syntax

Router# write memory

Device Security Commands

enable password <pwd> [22:53]	Global Config	Sets a basic plain-text Privileged Exec password [22:53]. Code snippet R1(config)# enable password CCNA R1(config)# exit R1# exit R1> enable Password: CCNA R1#
service password-encryption [23:04]	Global Config	Converts stored plain-text passwords into Type 7 format [23:04].
enable secret <pwd> [23:13]	Global Config	Sets a Type 5 MD5 hashed password (overrides enable password) [23:13]. Code snippet R1(config)# enable secret Cisco R1(config)# exit R1# exit R1> enable Password: Cisco R1#
no <command> [23:30]	Global Config	Negates, revokes, or disables a previously applied command [23:30].
show running-config [23:35]	Privileged Exec	Displays the active operational configuration in RAM [23:35].
show startup-config [23:39]	Privileged Exec	Displays the saved startup configuration stored in NVRAM [23:39].
copy running-config startup-config [23:57]	Privileged Exec	Saves active RAM changes to NVRAM [23:57].
write / write memory [23:50]	Privileged Exec	Legacy shorthand commands to write RAM configuration to NVRAM [23:50].

Ethernet Frame Architecture: Break down the standard Ethernet frame fields (Layer 2 PDU), total size (26 bytes of header/trailer overhead), and field functions:

• Preamble (7 bytes): Alternating 10101010 bits used for clock synchronization.

• Start Frame Delimiter / SFD (1 byte): Ends with 10101011 to signify the end of the preamble and the start of the frame.

• Destination MAC Address (6 bytes / 48 bits): Hardware address of the recipient.

• Source MAC Address (6 bytes / 48 bits): Hardware address of the sender.

• Type / Length (2 bytes): Values less than 1500 indicate payload length; values greater than 1536 (0x0600) indicate the encapsulated Layer 3 protocol (e.g., 0x0800 for IPv4, 0x86DD for IPv6).

• Frame Check Sequence / FCS (4 bytes): Located in the trailer; uses a Cyclic Redundancy Check (CRC) algorithm to detect transmission errors.

MAC / Burned-In Address (BIA)

Globally unique 48-bit (6-byte) physical layer address assigned during manufacturing.

Organizationally Unique Identifier (OUI)

The first 3 bytes (24 bits) identify the vendor (e.g., Cisco). The last 3 bytes are unique to the physical device interface.

1. What is the OUI of MAC address e8ba.7011.2874?

   • Answer: e8ba.70 (first 24 bits / 3 bytes)

How Switches Learn MAC Addresses & Forward Frames

• Populating the MAC Address Table: Switches inspect the Source MAC address of incoming frames and associate that address with the ingress port.

• Dynamic MAC Aging: On Cisco switches, dynamic MAC entries age out after 5 minutes (300 seconds) of inactivity.

• Unknown Unicast Flooding: If a switch receives a frame destined for a MAC address not in its table, it floods the frame out of all active ports except the receiving port.

• Known Unicast Forwarding: Once the destination MAC address is stored in the switch's MAC table, frames are directly forwarded to the specific destination port.

Ethernet Frame Structure & Padding

• Header + Trailer: 18 bytes (destination MAC, source MAC, EtherType, and FCS trailer). Preamble and SFD are transmitted with the frame but generally excluded from header size counts.

• Minimum Frame Size: 64 bytes total. Subtracting the 18-byte header/trailer leaves a minimum payload size of 46 bytes.

• Padding: If payload data is less than 46 bytes (such as a small 36-byte ping), the sender appends trailing zero bytes to meet the 46-byte payload requirement.

Address Resolution Protocol (ARP)

• Purpose: Maps a known Layer 3 (IP) address to an unknown Layer 2 (MAC) address on a local segment.

• ARP Request: Sent as a Broadcast (FFFF.FFFF.FFFF) to all devices on the LAN.

• ARP Reply: Sent back as a Unicast frame directly to the requester.

• ARP Tables: Used by hosts and routers to cache IP-to-MAC mappings (arp -a on Windows/Linux/Mac; show arp on Cisco IOS)

• When the PC’s realize that the ARP does not match their IP, they drop the packet. The PC who matches the IP will process it.

ICMP & Ping Utility

• Operation: Uses ICMP Echo Request and ICMP Echo Reply to verify network connectivity and round-trip time.

• Packet Drops: The first ping in a sequence often drops (showing .!!!!) because the host must pause to resolve the destination MAC address via ARP before sending the packet.

ARP Table (Router) vs MAC Table (Switch)

Feature	ARP Table	MAC (CAM) Table
Primary Mapping	IP Address —> MAC Address	MAC Address —> Switch Port
OSI Layer	Layer 3 (Network)	Layer 2 (Data Link)
Primary Device	Routers, L3 Switches, End Hosts	Layer 2 & Layer 3 Switches
Purpose	Finds physical address for a target IP	Determines which port to output a frame

Why do we need ARP when we have IP addresses?

To understand why PC1 needs PC2's MAC address, you have to look down at how physical networking hardware works on a wire or over Wi-Fi.

Your network card (NIC) and local network switches are built in hardware to only read Ethernet frames, not IP packets directly.

Here is why knowing PC2's IP address isn't enough on its own:

1. IP Packets Are Wrapped Inside Ethernet Frames

An IP packet cannot float through a physical cable or airwaves by itself. It has to be put inside an Ethernet frame (like putting a letter inside a stamped envelope).

• The IP Packet (The Letter): Contains Source IP: PC1 and Destination IP: PC2.

• The Ethernet Frame (The Envelope): Requires a Source MAC and a Destination MAC.

Your physical network card literally cannot construct or transmit that envelope over the wire until it fills in the Destination MAC box.

MAC Address Table Management Commands

• Viewing Table: show mac address-table displays VLAN, MAC address, entry type (dynamic/static), and destination port.

• Aging: Dynamic entries age out after 300 seconds (5 minutes) of inactivity.

• Clearing Commands:

  • Clear all dynamic entries: clear mac address-table dynamic

  • Clear by specific address: clear mac address-table dynamic address <MAC>

  • Clear by specific interface: clear mac address-table dynamic interface <interface-id>

Key Rule on Routers & Broadcasts

Layer 2 switches extend a single broadcast domain. When a router is added between switches, it splits the network into distinct subnets and stops Layer 2 broadcast frames from crossing between LANs

IPv4 Address Length:

An IPv4 address is 32 bits (4 bytes) in length, divided into four 8-bit sections called octets (so 4 of the following: 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1)

Bit Position	8th	7th	6th	5th	4th	3rd	2nd	1st
Decimal Value	128	64	32	16	8	4	2	1

Binary to Decimal Conversion

1. Write the bit weights (128, 64, 32, 16, 8, 4, 2, 1) above each binary digit.

2. Add up all positional values where the bit is 1.

Example (10001111): 128 + 0 + 0 + 0 + 8 + 4 + 2 + 1 = 143

Decimal to Binary Conversion

1. Compare your decimal number to 128. If greater or equal, write 1 and subtract 128. Otherwise, write 0.

2. Move right to the next bit (64, 32, 16...) and repeat the test with the remaining remainder until you reach 0.

Every IPv4 address contains two parts:

1. Network Portion: Identifies the specific network segment.

2. Host Portion: Identifies a specific device (PC, router interface, printer) on that network.

Prefix Length

Notation Type	Format	Example	Description
Prefix Length	Slash (/X)	/24	Indicates the first 24 bits are for the network.

Subnet Mask

Notation Type	Format	Example	Description
Dotted-Decimal Mask	4-Octet Decimal	255.255.255.0	Converts network bits to 1s and host bits to 0s.

Define IPv4 class ranges/prefix length/private ranges/loopback/APIPA

• Know the Default Subnet Masks & Ranges:

  • Class A: 1.0.0.0 to 127.255.255.255 (/8 or 255.0.0.0)

  • Class B: 128.0.0.0 to 191.255.255.255 (/16 or 255.255.0.0)

  • Class C: 192.0.0.0 to 223.255.255.255 (/24 or 255.255.255.0)

  • Class D (Multicast): 224.0.0.0 to 239.255.255.255

  • Class E (Experimental): 240.0.0.0 to 255.255.255.255

• Know RFC 1918 Private Ranges: You must instantly recognize private IPv4 blocks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

• RFC 1918 Private Ranges are designated IPv4 address blocks reserved for internal use within private networks, such as homes, offices, and corporate enterprise LANs. Unlike public IP addresses, private IP addresses are non-routable on the global public Internet.

• 
  

  Class Boundary	CIDR Block	IP Range	Total Addresses	Common Usage
  Class A	10.0.0.0/8	10.0.0.0 – 10.255.255.255	16,777,216	Large enterprise networks, data centers, complex subnets
  Class B	172.16.0.0/12	172.16.0.0 – 172.31.255.255	1,048,576	Medium-to-large business networks, VPN pools, virtualization
  Class C	192.168.0.0/16	192.168.0.0 – 192.168.255.255	65,536

• Know Reserved Addresses: Loopback (127.0.0.0/8) and APIPA (169.254.0.0/16).

• The 0.x.x.x Range: Reserved for default routes / system hosts.

• While theoretical Class A starts at 0, the usable Class A range for host assignments is 1.0.0.0 to 126.255.255.255.

Calculate Host Bits, Total Addresses, and Usable Hosts for a /24 Prefix Length

Class C Example (/24 Prefix Length)

• Host Bits (n): 32 - 24 = 8 bits

• Total Addresses: 2^8 = 256

• Usable Hosts: 2^8 - 2 = 254

Address Component	Calculation / Rule	Example (192.168.1.0/24)
Network ID	All host bits = 0	192.168.1.0
First Usable IP	Network ID + 1	192.168.1.1
Last Usable IP	Broadcast IP - 1	192.168.1.254
Broadcast IP	All host bits = 1	192.168.1.255

Calculate host bits, total addresses, usable hosts, network id, first usable, last usable, and broadcast for /16 address length:

• Host Bits (n): 32 - 16 = 16 bits

• Total Addresses: 2^16 = 65,536

• Usable Hosts: 2^16 - 2 = 65,534

• Network ID: 172.16.0.0

• First Usable: 172.16.0.1

• Last Usable: 172.16.255.254

• Broadcast: 172.16.255.255

Calculate host bits, total addresses, usable hosts, network id, first usable, last usable, and broadcast for /8 address length:

• Host Bits (n): 32 - 8 = 24 bits

• Total Addresses: 2^24 = 16,777,216

• Usable Hosts: 2^24 - 2 = 16,777,214

• Network ID: 10.0.0.0

• First Usable: 10.0.0.1

• Last Usable: 10.255.255.254

• Broadcast: 10.255.255.255

What show command helps you understand interface states on a Cisco Router/Switch?

show ip interface brief

What is the difference between the Status and Protocol columns when issuing the ‘show ip interface brief’ command?

• Status (Layer 1 - Physical): Indicates hardware cabling, power, and administrative state.

  • administratively down: Disabled manually or by default (shutdown command is active).

  • up: Layer 1 connection established.

• Protocol (Layer 2 - Data Link): Indicates framing / encapsulation (e.g., Ethernet).

  • up: Layer 2 communication operational.

  • down: Communication failed (cannot be up if Status is down).

Are router interfaces up or down by default? What about switches?

Router vs. Switch Defaults: Cisco router interfaces are administratively down by default and require no shutdown. Cisco switch interfaces are enabled by default.

CLI commands for adding an IPv4 address to an interface on a router:

! 1. Enter Privileged EXEC Mode

Router> enable

! 2. Enter Global Configuration Mode

Router# configure terminal

! 3. Target the Specific Interface (each router interface gets assigned a unique ip addresses)

Router(config)# interface gigabitethernet 0/0

! Shortcuts permitted: "int g0/0" or "interface g0/0"

! 4. Assign IPv4 Address and Subnet Mask (Dotted Decimal)

Router(config-if)# ip address 10.255.255.255 255.0.0.0

! 5. Enable the Interface

Router(config-if)# no shutdown

Verification commands for adding an IPv4 address to an interface on a router:

show ip interface brief	Concise summary of IP addresses, assignment method (manual), and Layer 1 / Layer 2 status [09:54].
show interfaces [interface]	Detailed Layer 1, Layer 2, MAC address (Burned-In Address / BIA), and Layer 3 details [20:41].

Note: Key Takeaway: Plugging an active network cable into an unconfigured switch port will immediately bring the interface to up / up. On a router, it remains administratively down until you explicitly run no shutdown.

note

What interface verification command is specifically designed for switchport inspection?

show interfaces status

• Port: Interface designation (e.g., FastEthernet0/1).

• Name: Description assigned to the interface.

• Status: connected, notconnect, or disabled (administratively shut down).

• VLAN: Assigned VLAN ID (e.g., VLAN 1) or operating mode (e.g., trunk).

• Duplex: auto, a-full, a-half, full, or half (the a- prefix indicates auto-negotiated value).

• Speed: auto, a-100, a-10, 100, etc.

• Type: Transceiver type or ethernet standard (e.g., 10/100BaseTX).

What is the difference between half-duplex and full-duplex?

• Half-Duplex: The interface cannot send and receive data simultaneously.

  • Required when connected to legacy hubs.

  • Operates within a shared collision domain.

• Full-Duplex: The interface can send and receive data simultaneously.

  • Standard mode for modern switched networks.

  • Eliminates collisions; each switchport is an isolated collision domain.

What is CSMA/CD (Carrier Sense Multiple Access with Collision Detection)?

Used in half-duplex networks to manage channel access and handle collisions:

1. Listen (Carrier Sense): Device listens to the line before transmitting.

2. Transmit: Sends data only if the channel is idle.

3. Collision Detection & Jamming Signal: If two devices transmit at once, a collision occurs; a jamming signal is sent to notify all nodes.

4. Random Backoff: Each device waits a random duration before re-listening and retrying.

By default, what are Cisco switchport speed and duplex settings set to?

speed auto and duplex auto

Explain speed detection for Cisco switchports:

1. Speed Detection: The switch attempts to sense the speed of incoming electrical signals.

   • If speed sensing succeeds —> Matches remote speed.

   • If speed sensing fails —> Defaults to the lowest supported speed (e.g., 10 Mbps).

Explain duplex determination for Cisco switchports:

1. Duplex Determination: Duplex cannot be sensed without negotiation signals.

   • If speed is 10 Mbps or 100 Mbps -> Defaults to Half-Duplex.

   • If speed is >= 1000 Mbps (1 Gbps) -> Defaults to Full-Duplex.

⚠ Duplex Mismatch Warning: If Remote is fixed at 100/Full and Local is set to Auto, Local detects 100 Mbps but defaults to Half-Duplex. This causes a Duplex Mismatch, resulting in late collisions, dropped packets, and poor network performance.

What are runts?

Runts: Frames received that are smaller than 64 bytes (minimum Ethernet frame size).

What are giants?

Frames received that are larger than 1518 bytes (standard maximum Ethernet frame size).

Commands/Configuration for shutting down unused switch ports and setting speed and duplex settings

! Step 1: Enter Interface or Interface Range Mode

Switch(config)# interface range fastEthernet 0/5 - 12

! Step 2: Assign an Interface Description

Switch(config-if-range)# description Unused Ports     

! Step 3: Administratively Shutdown Unused Ports (Security Best Practice)

Switch(config-if-range)# shutdown                   

! Step 4: Manually Configure Speed & Duplex (If required)

Switch(config)# interface fastEthernet 0/1          

Switch(config-if)# speed 100                         

Switch(config-if)# duplex full                        

Switch(config-if)# description Connected to R1      

What happens when a switch port with speed auto / duplex auto connects to a device hardcoded to 100/Full?

Answer: The switch senses 100 Mbps speed, but defaults to half-duplex, causing a duplex mismatch

Which CLI command shows description, operational status, VLAN, speed, and duplex on switch ports in a clean table?

Answer: show interfaces status

What is the min size and max size of an IPv4 header?

The standard minimum size of an IPv4 header is 20 bytes (without options) and can be up to 60 bytes (with maximum options)

Name the 14 parts of the IPv4 header

1. Version

2. IHL

3. DSCP

4. ECN

5. Total Length

6. ID

7. Flags

8. Fragment Offset

9. TTL

10. Protocol

11. Header Checksum

12. Source IP

13. Destination IP

14. Options

IPv4 Header — Version

• Size: 4 bits

• Purpose: Identifies the IP version.

• Key Detail: For IPv4, this value is always set to 4 (0100 in binary).

IPv4 Header — IHL (Internet Header Length)

• Size: 4 bits

• Purpose: Specifies the total length of the IPv4 header in 4-byte increments.

• Key Detail:

  • Minimum value: 5 (5 * 4 = 20 bytes, standard header with no options).

  • Maximum value: 15 (15 * 4 = 60 bytes, header with full options).

IPv4 Header — DSCP (Differentiated Services Code Point)

• Size: 6 bits

• Purpose: Quality of Service (QoS) classification.

• Key Detail: Used by routers to classify and prioritize delay-sensitive traffic such as VoIP and interactive video.

IPv4 Header — ECN (Explicit Congestion Notification)

• Size: 2 bits

• Purpose: Congestion management.

• Key Detail: Signals network congestion between routers and endpoints without needing to drop packets.

IPv4 Header — Total Length

• Size: 16 bits

• Purpose: Defines the total size of the IP packet in bytes (Header + Payload).

• Key Detail: Minimum size is 20 bytes (header only); maximum total size is 65,535 bytes.

IPv4 Header — Identification

• Size: 16 bits

• Purpose: Packet fragment reassembly.

• Key Detail: Contains a unique ID assigned by the sender so the receiver can reassemble fragments that belong to the same original packet.

IPv4 Header — Flags

• Size: 3 bits

• Purpose: Controls and identifies packet fragmentation.

• Key Detail:

  • Bit 0: Reserved (always 0).

  • Bit 1 (DF - Don't Fragment): 1 = router must not fragment this packet.

  • Bit 2 (MF - More Fragments): 1 = more fragments follow; 0 = last fragment or unfragmented.

IPv4 Header — Fragment Offset

• Size: 13 bits

• Purpose: Reordering packet fragments.

• Key Detail: Specifies the position of a fragment relative to the start of the original unfragmented payload, allowing correct reassembly even if fragments arrive out of order.

IPv4 Header — TTL (Time to Live)

• Size: 8 bits

• Purpose: Prevents packets from circulating indefinitely in routing loops.

• Key Detail: Each router that forwards the packet decrements TTL by 1. If TTL hits 0, the packet is dropped and an ICMP Time Exceeded message is returned.

IPv4 Header — Protocol

• Size: 8 bits

• Purpose: Identifies the upper-layer payload carried inside the IP packet.

• Key Protocol Numbers to Memorize:

  • 1 = ICMP

  • 6 = TCP

  • 17 = UDP

  • 89 = OSPF

IPv4 Header — Header Checksum

• Size: 16 bits

• Purpose: Error detection for the IPv4 header.

• Key Detail: Covers only the header (not the data payload). Recomputed at every hop because the TTL field changes. Corrupt headers cause immediate packet dropping.

IPv4 Header — Source IP Address

• Size: 32 bits (4 bytes)

• Purpose: The IPv4 address of the original sending device.

IPv4 Header — Destination IP Address

• Size: 32 bits (4 bytes)

• Purpose: The IPv4 address of the ultimate recipient device.

IPv4 Header — Options

• Size: 0–320 bits (0 to 40 bytes)

• Purpose: Optional extensions for testing, security, or routing features (e.g., Source Routing).

• Key Detail: Rarely used in production; causes variable header size up to 60 bytes maximum.

What is the difference between the IHL field and the Total Length field?

The key difference comes down to what part of the packet each field measures: IHL measures only the header, while Total Length measures the entire packet (header plus payload data).

How are errors detected in an IPv4 packet's payload/data?

Answer: By the encapsulated upper-layer protocol (e.g., TCP or UDP checksum), not the IP header checksum.

Which flag bit is set to 1 on all packet fragments except the final one?

Answer: More Fragments (MF) bit.

Routing

Routing is the process routers use to determine the path IP packets should take across a network to reach their destination.

Routing Table

A table stored in a router's RAM containing known destination networks and instructions on how to reach them

Switch vs. Router Comparison

• Switches use a MAC Address Table to forward Layer 2 Ethernet frames based on destination MAC addresses.

• Routers use a Routing Table to forward Layer 3 IP packets based on destination IP networks

Next-Hop Route

Send the packet to the next router in the path (e.g., "To reach Network X, send to Next-Hop Y").

Direct Connection

If the destination network is attached directly to the router, send the packet directly to the destination device.