PT.1 Networking D.1

1.1] OSI model

Open Systems Interconnection: a seven-layer model for describing network communication and locating problems.

[1.1] OSI layers from 1 to 7

Physical / Data Link / Network / Transport / Session / Presentation / Application.

[1.1] Layer 1: Physical

Carries bits as electrical / optical / or radio signals. includes cables / connectors / and signaling.

[1.1] Layer 2: Data Link

Transfers frames on a local link using MAC addresses. Ethernet switching operates here.

[1.1] Layer 3: Network

Uses logical addresses such as IP addresses to route packets between networks.

[1.1] Layer 4: Transport

Provides process-to-process delivery using ports. TCP and UDP operate here.

[1.1] Layer 5: Session

Establishes / manages / and ends communication sessions.

[1.1] Layer 6: Presentation

Handles data formatting / translation / compression / and encryption in the OSI model.

[1.1] Layer 7: Application

Provides network services to applications. examples include HTTP / DNS / and SMTP.

[1.1] Encapsulation

Adds protocol headers and sometimes trailers as data moves down the network stack.

[1.1] Decapsulation

Removes protocol information as received data moves up the network stack.

[1.1] Common protocol data units

Layer 1: bits. Layer 2: frames. Layer 3: packets. Layer 4: TCP segments or UDP datagrams.

[1.1] MAC address

Media Access Control address: typically a 48-bit Ethernet interface identifier written as six hexadecimal pairs.

[1.1] MAC vs. IP address

MAC identifies an interface on a local link. IP provides logical addressing for communication across networks.

[1.2] Router

A Layer 3 device that forwards packets between IP networks using a routing table.

[1.2] Layer 2 switch

Learns source MAC addresses and forwards frames using its MAC address table.

[1.2] Multilayer switch

Combines Layer 2 switching with Layer 3 routing / including routing between VLANs.

[1.2] Firewall

Allows or blocks traffic according to security rules.

[1.2] IDS vs. IPS

An Intrusion Detection System alerts on suspicious activity. an Intrusion Prevention System can block it inline.

[1.2] Load balancer

Distributes requests among servers to improve availability and spread workload.

[1.2] Forward proxy

Acts for clients when they request external resources. can filter or cache content.

[1.2] Reverse proxy

Receives requests on behalf of servers. can provide filtering / caching / and load balancing.

[1.2] NAS

Network-Attached Storage: shared file-level storage accessed through protocols such as SMB or NFS.

[1.2] SAN

Storage Area Network: provides block-level storage that appears like a disk to a server.

[1.2] Access point (AP)

Bridges wireless clients to a wired network / usually at Layer 2.

[1.2] WLC

Wireless LAN Controller: centrally manages access points and wireless policies.

[1.2] Physical vs. virtual appliance

A physical appliance uses dedicated hardware. a virtual appliance runs as software on a virtualization platform.

[1.2] CDN

Content Delivery Network: caches content at distributed locations to serve users from nearby systems.

[1.2] VPN

Virtual Private Network: creates a protected logical connection across another network / often using encryption.

[1.2] QoS

Quality of Service: prioritizes traffic to protect important applications such as voice and video.

[1.2] IP TTL

Time to Live: a hop-limit field reduced by routers to prevent packets from circulating indefinitely.

[1.3] NFV

Network Functions Virtualization: implements functions such as routing and firewalls in software rather than dedicated appliances.

[1.3] VPC

Virtual Private Cloud: a logically isolated virtual network within a public cloud.

[1.3] Cloud security group

A rule set commonly applied to cloud interfaces or instances. usually provides stateful traffic filtering.

[1.3] Cloud network ACL

Rules applied at a cloud subnet or network boundary. exact behavior depends on the provider.

[1.3] Internet gateway

Connects a cloud virtual network to the internet / subject to routes and security controls.

[1.3] NAT gateway

Commonly lets private cloud resources initiate internet connections without assigning each a public IPv4 address.

[1.3] Cloud VPN connection

Connects a local network to cloud resources through a protected tunnel over shared connectivity.

[1.3] Dedicated cloud connection

A private provider connection between an organization's network and a cloud service.

[1.3] Public cloud

Provider infrastructure shared among customers with logical separation.

[1.3] Private cloud

Cloud infrastructure dedicated to one organization.

[1.3] Hybrid cloud

Combines private or on-premises resources with public cloud services.

[1.3] IaaS

Infrastructure as a Service: the provider supplies infrastructure while the customer manages operating systems and applications.

[1.3] PaaS

Platform as a Service: the provider manages the platform while the customer develops or deploys applications.

[1.3] SaaS

Software as a Service: users access a provider-managed application.

[1.3] Scalability vs. elasticity

Scalability changes capacity to handle growth. elasticity adjusts capacity with changing demand / often automatically.

[1.3] Multitenancy

Multiple customers share a platform while their resources and data remain logically separated.

[1.4] TCP

Transmission Control Protocol: connection-oriented transport with sequencing / acknowledgments / and retransmission.

[1.4] UDP

User Datagram Protocol: connectionless transport without built-in delivery guarantees or retransmission.

[1.4] TCP three-way handshake

SYN / SYN-ACK / ACK: establishes a TCP connection.

[1.4] Well-known ports

Ports 0-1023. commonly assigned to widely used services.

[1.4] FTP ports

File Transfer Protocol: TCP 21 for control. TCP 20 for server data in active mode. Passive mode uses other negotiated data ports.

[1.4] SSH port

Secure Shell: TCP 22. encrypted remote command-line access.

[1.4] SFTP port

SSH File Transfer Protocol: TCP 22. transfers files over SSH.

[1.4] Telnet port

TCP 23. remote command-line access without encryption.

[1.4] SMTP port

Simple Mail Transfer Protocol: TCP 25. commonly used for mail transfer between servers.

[1.4] SMTP submission with STARTTLS

TCP 587. commonly used by clients to submit mail with encryption upgraded through STARTTLS.

[1.4] DNS port

Domain Name System: UDP and TCP 53. resolves names and other DNS information.

[1.4] DHCPv4 ports

Dynamic Host Configuration Protocol: UDP 67 for servers and UDP 68 for clients.

[1.4] TFTP port

Trivial File Transfer Protocol: UDP 69. simple file transfer without built-in authentication or encryption.

[1.4] HTTP port

Hypertext Transfer Protocol: TCP 80. unencrypted web communication.

[1.4] HTTPS port

TCP 443 for conventional HTTPS. HTTP/3 uses QUIC over UDP 443.

[1.4] NTP port

Network Time Protocol: UDP 123. synchronizes clocks.

[1.4] SNMP ports

Simple Network Management Protocol: UDP 161 for queries and UDP 162 for notifications such as traps.

[1.4] LDAP port

Lightweight Directory Access Protocol: commonly TCP 389 for directory access.

[1.4] LDAPS port

LDAP over TLS: TCP 636. encrypted directory access.

[1.4] SMB port

Server Message Block: TCP 445. shared files and printers.

[1.4] Syslog port

UDP 514 for traditional syslog. transports log messages.

[1.4] SQL Server port

TCP 1433. common default port for Microsoft SQL Server database connections.

[1.4] RDP port

Remote Desktop Protocol: TCP and UDP 3389. remote graphical access.

[1.4] SIP ports

Session Initiation Protocol: commonly TCP/UDP 5060. TLS-protected signaling commonly uses TCP 5061.

[1.4] POP3 ports

Post Office Protocol version 3: TCP 110. implicit TLS commonly uses TCP 995.

[1.4] IMAP ports

Internet Message Access Protocol: TCP 143. implicit TLS commonly uses TCP 993.

[1.4] SMTP implicit TLS port

TCP 465. encrypted mail submission / often called SMTPS.

[1.4] ICMP

Internet Control Message Protocol: carries control and error messages. ping uses echo messages. It does not use TCP/UDP ports.

[1.4] ARP

Address Resolution Protocol: discovers the MAC address for an IPv4 address on the local link.

[1.4] GRE

Generic Routing Encapsulation: encapsulates traffic in an IP tunnel. does not provide encryption by itself.

[1.4] IPsec

Internet Protocol Security: protects IP traffic using authentication / integrity / and optionally encryption.

[1.4] IPsec AH vs. ESP

Authentication Header provides integrity/authentication. Encapsulating Security Payload can also encrypt data.

[1.4] IKE

Internet Key Exchange: negotiates security associations and keys for IPsec. commonly uses UDP 500.

[1.4] Unicast

One sender communicates with one receiver.

[1.4] Broadcast

One sender reaches all devices in an IPv4 broadcast domain. routers normally do not forward it.

[1.4] Multicast

One sender delivers traffic to members of a selected receiver group.

[1.4] Anycast

Multiple systems share an address. routing delivers traffic to one preferred or nearest instance.

[1.5] IEEE 802.3 vs. 802.11

802.3 defines Ethernet. 802.11 defines Wi-Fi.

[1.5] 802.11a

Uses 5 GHz. maximum legacy data rate is 54 Mbps.

[1.5] 802.11b

Uses 2.4 GHz. maximum legacy data rate is 11 Mbps.

[1.5] 802.11g

Uses 2.4 GHz. maximum legacy data rate is 54 Mbps.

[1.5] 802.11n / Wi-Fi 4

Uses 2.4 or 5 GHz and supports MIMO. theoretical maximum is 600 Mbps.

[1.5] 802.11ac / Wi-Fi 5

Uses 5 GHz and supports wider channels and multiuser MIMO.

[1.5] 802.11ax / Wi-Fi 6 and 6E

Wi-Fi 6 uses 2.4/5 GHz. Wi-Fi 6E adds 6 GHz. OFDMA improves efficiency with many clients.

[1.5] Cellular connectivity

Uses a carrier's radio network. useful for mobile access or backup WAN connectivity