Comprehensive Network Engineering and Operations Review

Vocabulary practice flashcards covering OSI layers, networking hardware, topologies, protocols, port numbers, IPv4/IPv6 addressing, cloud architectures, wireless standards, security controls, and network operations.

Encapsulation

The process where data is covered and packaged with layer-specific headers from the top layer to the bottom layer of the OSI model.

Decapsulation

The process where data is uncovered and stripped of headers from the bottom layer to the top layer of the OSI model.

Physical Layer (Layer 1)

The OSI layer focused on the physics of the network, including signaling, cabling, connectors, and symbols, with a protocol data unit of bits or symbols.

Data Link Layer (Layer 2)

The switching layer of the OSI model responsible for DLC protocols and physical MAC addressing, with a protocol data unit of frames.

Network Layer (Layer 3)

The routing layer of the OSI model responsible for logical IP addressing and frame fragmentation across networks, with a protocol data unit of packets or datagrams.

Transport Layer (Layer 4)

The OSI layer described as the 'post office' layer that chunks data and manages end-to-end delivery using TCP or UDP segments.

Session Layer (Layer 5)

The OSI layer that manages communication sessions between devices using control protocols and tunneling protocols.

Presentation Layer (Layer 6)

The OSI layer responsible for character encoding and data encryption/decryption (such as SSL/TLS), often combined with Layer 7.

Application Layer (Layer 7)

The user-facing OSI layer containing the applications and protocols people interact with, such as HTTP, FTP, DNS, and POP3.

Application-Specific Integrated Circuit (ASIC)

Custom-designed hardware chips in network switches that enable high-speed frame switching and hardware bridging.

Next-Generation Firewall (NGFW)

An advanced firewall capable of filtering network traffic by identifying application-level data rather than merely filtering by port numbers.

Intrusion Detection System (IDS)

A security system that monitors network traffic for vulnerabilities, buffer overflows, and exploits, generating an alarm or alert without stopping traffic.

Intrusion Prevention System (IPS)

An active security system that monitors network traffic to detect exploits and stop malicious attacks before they can enter the network.

Network Attached Storage (NAS)

A shared storage device connected across the network that provides clients with file-level access.

Storage Area Network (SAN)

A high-speed, isolated network architecture providing block-level access that behaves like a locally attached physical disk.

Wireless LAN Controller (WLC)

A centralized management hardware system used to deploy, configure, secure, monitor, and update multiple access points.

Content Delivery Network (CDN)

A geographically distributed network of caching servers that duplicates content locally so end users experience lower access latency.

Quality of Service (QoS)

A traffic management technique (traffic/packet shaping) used to control bandwidth and prioritize critical applications over standard traffic.

Time to Live (TTL)

A field in IP packets decremented by $1$ at every router hop to prevent packets from looping indefinitely on a network until reaching zero and being dropped.

Network Function Virtualization (NFV)

The virtualization of traditional physical network equipment (routers, switches, firewalls) to run directly inside software managed by a hypervisor.

Virtual Private Cloud (VPC)

A pool of isolated, configurable computing and networking resources provisioned within a public cloud environment.

Network Security List (NSL)

A cloud security mechanism that applies broad inbound and outbound filtering rules to an entire IP subnet.

Network Security Group (NSG)

A cloud security configuration applied directly to a specific virtual NIC (VNIC), offering fine-grained access control across devices in the same subnet.

Software as a Service (SaaS)

An on-demand cloud software model requiring no local installation or developer maintenance, where an entire application (e.g., Gmail) is provided.

Infrastructure as a Service (IaaS)

A cloud computing model where the customer outsources physical hardware equipment while retaining full responsibility for the OS, configuration, and security management.

Platform as a Service (PaaS)

A cloud model where third-party providers manage all hardware, OS, and maintenance, providing developer building blocks to build custom applications.

Transmission Control Protocol (TCP)

A connection-oriented Layer 4 protocol providing reliable delivery, packet acknowledgment, flow control, and error recovery.

User Datagram Protocol (UDP)

A connectionless Layer 4 protocol providing fast, unreliable delivery with no formal setup, retransmissions, or flow control.

Ephemeral Ports

Temporary client port numbers dynamically assigned by an operating system, spanning from port $1023$ through $65535$.

Non-ephemeral Ports

Permanent, well-known port numbers typically associated with services and servers, spanning from port $0$ through $1023$.

File Transfer Protocol (FTP)

A generic file transfer protocol that authenticates with username/password and operates over tcp/20 (active data) and tcp/21 (control).

Secure Shell (SSH)

An encrypted text-based console communication protocol operating over tcp/22.

Secure File Transfer Protocol (SFTP)

A secure file transfer protocol operating over tcp/22 that leverages SSH to provide directory navigation and file transfer capabilities.

Telnet

An unencrypted in-the-clear console communication protocol operating over tcp/23.

Simple Mail Transfer Protocol (SMTP)

A protocol used to transfer mail between servers and send mail from clients, running on tcp/25 (plaintext) or tcp/587 (TLS).

Domain Name System (DNS)

A distributed name-resolution service that translates fully qualified domain names into IP addresses, using udp/53 for lookups and tcp/53 for large transfers.

Dynamic Host Configuration Protocol (DHCP)

An automated IP address and network configuration service operating over udp/67 and udp/68.

Trivial File Transfer Protocol (TFTP)

A simple UDP-based file transfer protocol operating over udp/69 with no authentication, frequently used to transfer boot files and configurations.

Network Time Protocol (NTP)

A clock synchronization protocol operating over udp/123 that aligns device clocks across a network with millisecond precision.

Simple Network Management Protocol (SNMP)

A protocol operating on udp/161 that gathers metrics from network devices using an organized MIB database, and receives unsolicited alerts on udp/162.

Lightweight Directory Access Protocol (LDAP)

A protocol used to query and update directory service databases, operating over tcp/389 (LDAP) and tcp/636 (LDAPS).

Server Message Block (SMB)

A Windows file and printer sharing protocol (also known as CIFS) that operates directly across tcp/445 without NetBIOS.

Syslog

A standard message logging protocol that collects and forwards consolidated device logs to a central server or SIEM over udp/514.

Remote Desktop Protocol (RDP)

A proprietary Microsoft protocol operating over tcp/3389 that shares an entire graphical desktop or application from a remote server.

Session Initiation Protocol (SIP)

A VoIP signaling protocol operating over tcp/5060 and tcp/5061 used to establish, manage, and terminate voice, video, and messaging sessions.

Internet Control Message Protocol (ICMP)

An IP-carried administrative messaging protocol (neither TCP nor UDP) used by devices to verify connectivity, report routing failures, and note TTL expiration.

Generic Routing Encapsulation (GRE)

A tunneling protocol that encapsulates a wide variety of network-layer protocols inside IP tunnels between two endpoints without native encryption.

Internet Protocol Security (IPSec)

A Layer 3 security framework offering packet authentication, integrity, and confidentiality through Authentication Header (AH) and Encapsulation Security Payload (ESP).

Authentication Header (AH)

An IPSec component protocol that validates packet integrity and authentication by calculating a cryptographic hash using MD5, SHA-1, or SHA-2.

Encapsulating Security Payload (ESP)

An IPSec protocol that provides data confidentiality and packet encryption using 3DES or AES, along with integrity hashing.

Internet Key Exchange (IKE)

A protocol operating on udp/500 using Diffie-Hellman to create Security Associations (SAs) and securely establish shared symmetric keys between IPSec peers.

Unicast

A one-to-one transmission method that routes traffic from a single source host directly to a single destination host.

Multicast

A one-to-many delivery method where data packets are addressed and routed only to specific subscribed endpoint systems.

Anycast

A one-to-one-of-many addressing method where multiple systems share identical IP addresses, and routing protocols direct clients to the topologically nearest instance.

Broadcast

A one-to-all communication method in IPv4 where a single packet is processed by every active device inside a broadcast domain.

Multimode Fiber (MMF)

Optical fiber designed for short-range communication up to $2\,\text{km}$ that utilizes inexpensive LED light sources.

Single-Mode Fiber (SMF)

High-distance optical fiber cabling capable of carrying laser-generated light signals up to $100\,\text{km}$ without active signal regeneration.

Twinaxial Cable

A shielded copper cable featuring two inner conductors commonly deployed for $10\,\text{Gigabit Ethernet}$ SFP+ connections up to $5\,\text{meters}$.

Plenum-Rated Cable

Network cable with a fire-resistant jacket composed of fluorinated ethylene polymer (FEP) or low-smoke PVC, designed for drop ceilings and air ducts.

Small Form-Factor Pluggable (SFP)

A compact, hot-pluggable network interface transceiver commonly used to provide $1\,\text{Gbit/s}$ fiber or copper connections.

Enhanced Small Form-Factor Pluggable (SFP+)

A transceiver of identical physical size to standard SFP that supports data transmission rates up to $16\,\text{Gbit/s}$, standard for $10\,\text{Gigabit Ethernet}$.

Quad Small Form-Factor Pluggable (QSFP)

A modular transceiver integrating four distinct SFP channels to deliver $4\,\text{Gbit/s}$ or $40\,\text{Gbit/s}$ (QSFP+) throughput.

Spine and Leaf Architecture

A data center network design where every leaf switch attaches to every spine switch, offering high-throughput, low-latency east-west traffic switching.

East-West Traffic

Network traffic flows that travel internally between devices and servers residing within the same data center.

North-South Traffic

Network traffic moving in and out of a data center from external clients and remote networks.

Loopback Address

A non-routable IPv4 address range from $127.0.0.1$ to $127.255.255.254$ reserved for a host to send packets to itself.

Automatic Private IP Addressing (APIPA)

An automatic link-local IPv4 addressing feature assigning a functional IP within $169.254.1.0$ through $169.254.254.255$ when DHCP fails.

RFC 1918

The standard document defining the private, non-internet-routable IPv4 address allocations ($10.0.0.0/8$, $172.16.0.0/12$, and $192.168.0.0/16$).

Classless Inter-Domain Routing (CIDR)

A flexible subnetting method introduced in 1993 that replaced rigid classful boundaries by using a forward slash followed by the prefix bit length.

Variable Length Subnet Mask (VLSM)

A subnetting technique that applies different subnet masks to subnets carved out of the same parent network block.

Data Plane

The SDN operational component (infrastructure layer) responsible for the physical processing, switching, forwarding, and tagging of packets.

Control Plane

The SDN logical layer that defines network forwarding behavior and populates routing tables, dynamic paths, and NAT tables.

Management Plane

The operational plane used by network administrators to connect to and configure a device using SSH, APIs, or web GUIs.

SD-WAN

Software-defined networking deployed across wide area networks that dynamically directs traffic across multiple connection types based on application priority.

Virtual Extensible LAN (VXLAN)

A network encapsulation protocol that overlays Layer 2 Ethernet frames onto Layer 3 networks, supporting up to $16\,\text{million}$ virtual segments.

Zero Trust

A comprehensive security model operating on continuous verification where no user, device, or process inside or outside the network is inherently trusted.

Secure Access Service Edge (SASE)

A cloud architecture combining wide-area networking capabilities with comprehensive cloud-hosted security services deployed close to endpoints.

Infrastructure as Code (IaC)

The practice of provisioning, managing, and tracking physical and cloud infrastructure using declarative, version-controlled definition files.

Security Orchestration, Automation, and Response (SOAR)

A security platform integrating disparate third-party tools and data feeds to automate incident response playbooks and streamline remediation.

Neighbor Discovery Protocol (NDP)

An ICMPv6 protocol that eliminates broadcasts to perform address autoconfiguration, router discovery, and layer-2 MAC address resolution.

Stateless Address Autoconfiguration (SLAAC)

An automated IPv6 feature where clients configure an address without a DHCP server by combining received network prefixes with modified EUI-64 addresses.

Dual-Stack Routing

A network migration deployment where interfaces simultaneously maintain separate IPv4 and IPv6 addresses, tables, and routing protocols.

NAT64

A network translation technology that converts traffic seamlessly between IPv6-only devices and legacy IPv4-only network resources.

Open Shortest Path First (OSPF)

A standardized interior gateway link-state routing protocol that calculates shortest loop-free paths within an autonomous system based on link cost.

Border Gateway Protocol (BGP)

The standard exterior gateway routing protocol used across the public internet to exchange reachability information between distinct Autonomous Systems.

Enhanced Interior Gateway Routing Protocol (EIGRP)

A dynamic routing protocol partially proprietary to Cisco that provides fast convergence, loop-free routing, and low network bandwidth overhead.

Administrative Distance

A trustworthiness rating assigned by routers to evaluate and select the preferred path when multiple routing protocols publish the same destination route.

First Hop Redundancy Protocol (FHRP)

A protocol suite that groups multiple physical routers behind a shared Virtual IP (VIP) to ensure high-availability default gateway routing.

Link Aggregation Control Protocol (LACP)

A protocol that bonds multiple physical Ethernet interfaces into a single high-bandwidth, redundant logical link.

Maximum Transmission Unit (MTU)

The largest allowable IP packet size (in bytes) that can transit a network interface without being fragmented.

Jumbo Frames

Ethernet frames modified to handle data payloads exceeding $1500\,\text{bytes}$, typically configured up to $9000$ or $9216\,\text{bytes}$.

Rapid Spanning Tree Protocol (RSTP / 802.1w)

An updated standard of IEEE 802.1D STP that speeds network loop convergence times down from $50\,\text{seconds}$ to $6\,\text{seconds}$.

Basic Service Set Identifier (BSSID)

The unique hardware MAC address of a wireless access point's radio interface used to identify it on a wireless network.

Extended Service Set Identifier (ESSID)

A common wireless network name shared across multiple access points to facilitate seamless client roaming throughout a facility.

Captive Portal

A web page intercepting client network access that requires authentication or policy acceptance before granting access to external networks.

CCMP

The encryption and message integrity protocol used in WPA2 that implements 128-bit AES encryption alongside CBC-MAC.

GCMP

The advanced block cipher mode introduced in WPA3 that uses AES encryption paired with Galois Message Authentication Code (GMAC).

Main Distribution Frame (MDF)

The primary central equipment room in a facility that houses core network switches and acts as the central termination point for WAN links.

Intermediate Distribution Frame (IDF)

A secondary wiring closet that extends network access from the central MDF to floor-level workgroups and end stations.

Rack Unit (U)

A standard unit of measure for equipment height in server racks, where $1\text{U}$ equals $1.75\,\text{inches}$.