Glossary A to Z

The four EAPOL-Key messages between AP and client that turn the pairwise master key (from the PSK or 802.1X) into fresh session keys using two random nonces, and deliver the group key. It runs after every association in WPA2 and WPA3, and in WPA2-Personal it is what attackers capture to try cracking a weak passphrase offline.

WirelessWPA2WPA3PSKKRACK

Fifth-generation cellular, now a common primary or backup WAN link for branches and temporary sites alongside 4G LTE. Carriers often put mobile links behind CGNAT, so inbound access usually needs an overlay such as SD-WAN or a VPN started from the site.

WAN, MPLS and QoSSD-WANCGNAT

Static tunnel that carries IPv6 packets directly inside IPv4 using IP protocol number 41, with no UDP header. Simple and low overhead, but it does not pass through most NAT devices. Tunnel brokers used it to give IPv4-only sites IPv6.

IPv6Dual stackNAT64GRE

The IEEE VLAN tagging standard. It inserts a 4-byte tag after the source MAC with TPID 0x8100, a 3-bit priority (PCP, used for CoS), a DEI bit and a 12-bit VLAN ID, giving 4094 usable VLANs. A tagged frame can be up to 1522 bytes.

Switching and VLANsTrunkNative VLANQ-in-QCoS

Port-based access control with three roles, the supplicant (client), the authenticator (switch or AP) and the authentication server (RADIUS). EAP runs as EAPOL on the LAN and inside RADIUS to the server, and the port passes nothing but EAPOL until the user or device is authenticated.

Network securityRADIUSMABAAAWPA2

The IEEE family of wireless LAN standards. 802.11b and g use 2.4 GHz, 802.11a uses 5 GHz, 802.11n is Wi-Fi 4, 802.11ac is Wi-Fi 5 (5 GHz only), 802.11ax is Wi-Fi 6 and Wi-Fi 6E on 6 GHz, and 802.11be is Wi-Fi 7 with 320 MHz channels.

WirelessChannel widthCSMA/CAMU-MIMORoaming

DNS record that maps a name to an IPv4 address. The AAAA record does the same for IPv6, and dual-stack clients usually ask for both.

IP servicesDNSCNAME recordPTR record

The framework for controlling access to devices and networks. Authentication checks who you are, authorization decides what you may do, accounting records what you did. On Cisco it starts with aaa new-model and uses method lists, typically a TACACS+ server group with local users as the fallback.

Network securityRADIUSTACACS+802.1X

OSPF router with interfaces in area 0 and at least one other area. It keeps a separate LSDB per area, turns routes from one area into Type 3 summary LSAs for the others, and is the only place inter-area summarization can be done, with area range.

OSPFArea 0ASBRLSAStub area

Switch port that belongs to one data VLAN (plus an optional voice VLAN) and sends and receives untagged frames. End hosts connect here. Set it with switchport mode access so it never negotiates a trunk.

Switching and VLANsTrunkVLANVoice VLANPortFast

Ordered list of permit and deny entries checked top-down, where the first match wins and an implicit deny sits at the end. Used to filter traffic, and also to select traffic for NAT, QoS, route maps and VPNs.

Network securityStandard ACLExtended ACLWildcard maskImplicit deny

CEF table holding the layer 2 rewrite information (outgoing interface and next-hop MAC) for each next hop, built from ARP and similar protocols. FIB entries point to it, so forwarding a packet never waits on an ARP lookup.

Routing fundamentalsCEFFIBARP

How much a Cisco router trusts a route source, used only to choose between routes to the same prefix and length, and lower wins. Connected 0, static 1, eBGP 20, EIGRP internal 90, OSPF 110, IS-IS 115, RIP 120, EIGRP external 170, iBGP 200, and 255 means never install.

Routing fundamentalsLongest prefix matchFloating static routeRouting table

Symmetric block cipher with 128-bit blocks and 128, 192 or 256-bit keys. It is the standard cipher in IPsec, TLS, WPA2 and WPA3. In GCM mode it also provides integrity, so no separate hash is needed.

VPNs and tunnelsESPIPsecTLSMACsec

DiffServ per-hop behavior with 4 classes and 3 drop precedences each, written AF11 to AF43. The DSCP value is 8 times the class plus 2 times the drop precedence, so AF41 is 34. Under congestion, packets with higher drop precedence are dropped first.

WAN, MPLS and QoSDSCPEFDiffServWRED

IPsec protocol 51. It gives integrity and origin authentication for the whole packet, including the outer IP header, but no encryption. Because NAT changes that header, AH breaks behind NAT, which is one reason ESP is used almost everywhere.

VPNs and tunnelsESPIPsecNAT-T

AWS layer 7 load balancer for HTTP, HTTPS and gRPC. It routes by host, path and headers, terminates TLS and can authenticate users. Use an NLB instead when you need layer 4, static IPs or non-HTTP protocols.

Cloud networkingNLBLoad balancerTLS

Agentless automation tool that runs YAML playbooks over SSH or device APIs (the network_cli, netconf and httpapi connections). Network modules compare the wanted state with the device and only push what differs, reporting changed or ok.

Automation and SDNIdempotencyYAMLJinja2NAPALM

The same IP address announced from several places, so routing delivers each packet to the nearest one by routing metric. Used by DNS root servers, CDNs and DDoS scrubbing networks. IPv6 defines it as an address type.

Models and mediaUnicastMulticastAnycast gateway

The same default gateway IP and MAC configured on every leaf switch, so each host's gateway is always its local leaf and a VM can move between racks without relearning anything. Standard in VXLAN BGP EVPN fabrics, where it replaces HSRP.

Data centerEVPNVXLANSpine-leafFHRP

Device that connects wireless clients to the wired LAN. It can be autonomous (configured on its own), lightweight (run by a WLC over CAPWAP) or cloud managed. Each radio and SSID pair has its own BSSID.

WirelessWLCCAPWAPBSSIDSSID

When DHCP gets no answer, Windows and most other systems give themselves an address in 169.254.0.0/16. Seeing a 169.254 address is the quick sign that DHCP failed. These link-local addresses are never routed.

IPv4 and subnettingDHCPDORALink-local address

The OSPF backbone area. Every other area must attach to it, directly or through a virtual link, and all inter-area traffic passes through it. This two-level design is how OSPF prevents loops between areas.

OSPFABRVirtual linkOSPF

Maps an IPv4 address to a MAC address on the local segment with a broadcast request and a unicast reply. Hosts cache the answer (4 hours by default on Cisco IOS) and trust replies without checking them, which is why ARP spoofing works.

IPv4 and subnettingGratuitous ARPProxy ARPDynamic ARP inspectionARP spoofing

An attacker sends forged ARP replies so victims map the gateway IP to the attacker's MAC, putting the attacker in the middle of the traffic. On switches, Dynamic ARP inspection stops it by checking ARP against the DHCP snooping bindings.

Network securityARPDynamic ARP inspectionDHCP snooping

A network under one administration with one routing policy, identified by an AS number. 2-byte ASNs run to 65535 and 4-byte ASNs to about 4.29 billion. Private ranges are 64512 to 65534 and 4200000000 to 4294967294.

BGPBGPeBGPiBGPAS path

BGP attribute listing every AS a route has crossed. A router rejects any route that already contains its own ASN, which prevents loops between ASes, and a shorter AS path wins in best path selection.

BGPAS path prependingBGP best path selectioneBGP

Adding your own ASN several extra times to routes you advertise on one link, so that path looks longer and other networks prefer your other entry point. The classic tool for steering inbound traffic, but a provider's local preference beats it.

BGPAS pathMEDLocal preferenceMultihoming

OSPF router that redistributes routes from outside OSPF, such as static routes, BGP or another IGP. It creates Type 5 external LSAs, or Type 7 inside an NSSA.

OSPFABRLSANSSARoute redistribution

Return traffic takes a different path than the outgoing traffic. Routing itself does not care, but stateful firewalls and NAT that see only half the flow drop it, and strict uRPF can drop it too.

TroubleshootingStateful firewalluRPFECMPUnknown unicast flooding

DNS server that holds a zone and gives the final answer for names in it, with the AA flag set. Recursive resolvers reach it by following NS referrals down from the root and TLD servers.

IP servicesDNSRecursive resolverSOA recordZone transfer

Port feature that detects whether the cable is straight-through or crossover and swaps the transmit and receive pairs itself, so either cable works. On Cisco it needs speed and duplex left on auto.

Models and mediaUTPAutonegotiation

Copper Ethernet ports advertise their speeds and duplex modes to each other and pick the best common one. It is mandatory for 1000BASE-T. If one side is hard-coded, the other can still sense the speed but falls back to half duplex, causing a duplex mismatch.

Models and mediaDuplex mismatchAuto-MDIX

One or more physically separate data centers inside a cloud region, with independent power, cooling and networking. In AWS a subnet lives in exactly one AZ, so high availability means spreading subnets, NAT gateways and instances across at least two.

Cloud networkingVPCNAT gatewayEgress charges

AP feature that pushes dual-band clients toward 5 GHz (or 6 GHz) by delaying or skipping its replies to their 2.4 GHz probes. The client still makes the final choice.

Wireless802.11Channel widthRoaming

The capacity of a link in bits per second, such as 1 Gbps. Throughput is what you actually get after protocol overhead, loss, latency and window limits, and it is always lower.

Models and mediaLatencyJitterWindow scaling

Congestion control from Google that estimates the path's bottleneck rate and minimum RTT and paces sending to match, instead of backing off on every loss. It works much better than CUBIC on long, slightly lossy links.

TCP, UDP and applicationsCUBICCongestion windowSlow start

Lightweight hello protocol (UDP 3784 for single hop) that detects a broken forwarding path in milliseconds, for example 3 missed packets at 50 ms intervals. OSPF, EIGRP, BGP, HSRP and static routes register with it and fail over fast without aggressive protocol timers.

Gateway redundancyHold timerGraceful restartOSPFBGP

The path vector routing protocol of the internet, running between peers over TCP 179. It picks paths by policy through attributes, not by link speed, and carries far more routes than any IGP. Also used inside data centers and to carry MPLS VPN and EVPN routes.

BGPeBGPiBGPBGP best path selectionAS

Cisco checks in order highest weight, highest local preference, locally originated, shortest AS path, lowest origin (IGP, then EGP, then incomplete), lowest MED, eBGP over iBGP, lowest IGP metric to the next hop, oldest eBGP path, lowest router ID, lowest neighbor address. The next hop must be reachable first.

BGPWeightLocal preferenceAS pathMED

Optional transitive 32-bit tag added to routes, written as ASN and value like 64500:100, that tells other routers which policy to apply. Well-known ones include no-export, no-advertise and local-AS. Cisco only sends them to a neighbor configured with send-community.

BGPBGPRoute mapLocal preferenceMultihoming

An AS announces prefixes it does not hold, by mistake or on purpose, and pulls in traffic for them. A more specific announcement wins everywhere, so a hijacked /24 beats the real /22. Prefix filters, RPKI origin validation and route monitoring are the defenses.

BGPRPKIRoute leakPrefix listLongest prefix match

Idle, Connect, Active, OpenSent, OpenConfirm, Established. Active means the router keeps failing to open the TCP session, so it is a bad sign. Only Established exchanges routes. A session stuck between Idle and Active usually points to reachability, an ACL on TCP 179, a wrong AS number or the wrong update source.

BGPBGPHold timereBGP multihop

Linux combines several NICs into one logical interface. Common modes are 0 balance-rr, 1 active-backup (no switch config needed) and 4 802.3ad, which uses LACP and needs a matching port channel on the switch.

Linux networkingLACPEtherChannelMLAG

The STP message, sent every 2 seconds (hello time) to the multicast MAC 01:80:C2:00:00:00, or 01:00:0C:CC:CC:CD for Cisco PVST+. It carries the root bridge ID, root path cost, sender bridge ID, port ID and timers.

Spanning treeSTPRoot bridgeBridge IDTCN

Stops a port from sending BPDUs. Enabled globally it only applies to PortFast ports and turns itself off as soon as a BPDU arrives. Enabled on an interface it ignores BPDUs in both directions, which disables STP on that port and can allow a loop.

Spanning treeBPDU GuardPortFastSTP

Err-disables a port the moment it receives a BPDU. Used on PortFast access ports so a user who plugs in a switch cannot change the topology. Recover with shutdown and no shutdown, or with errdisable recovery.

Spanning treePortFastBPDU FilterRoot Guard

The 8-byte STP identifier made of a 2-byte priority (default 32768) and the switch MAC address. The lowest bridge ID becomes root. With the system ID extension, the priority moves in steps of 4096.

Spanning treeRoot bridgeSystem ID extensionSTP

A frame sent to every host on the segment, to MAC ff:ff:ff:ff:ff:ff, or an IPv4 packet to 255.255.255.255 or to the subnet broadcast address. Routers do not forward broadcasts. IPv6 has none and uses multicast instead.

Models and mediaBroadcast domainUnicastMulticast

All devices that receive each other's broadcasts. One VLAN is one broadcast domain, and router or layer 3 interfaces separate them. Smaller domains mean less flooding and a smaller blast radius when something goes wrong.

Models and mediaCollision domainVLANBroadcast

Broadcasts circling a layer 2 loop and multiplying, because Ethernet frames have no TTL, until links and switch CPUs saturate. Preventing it is the reason STP exists, and storm control can cap the damage.

Spanning treeSTPMAC flappingBroadcast

The MAC address of one AP radio for one SSID. Clients roam between BSSIDs that share an SSID, and that group of basic service sets forms an ESS (extended service set).

WirelessSSIDAPRoaming

The traffic a layer 2 network has to flood. In VXLAN it is sent either with underlay multicast or by ingress replication, where the source VTEP sends a copy to every other VTEP in the VNI.

Data centerVXLANFlood and learnUnknown unicast floodingVTEP

Web page a guest network shows before granting access, by catching the first HTTP request and redirecting it. Phones and laptops detect it by probing a known URL, because HTTPS requests cannot be redirected cleanly.

WirelessSSIDWLC

Tunnel between a lightweight AP and its WLC, UDP 5246 for DTLS-encrypted control and UDP 5247 for data. It implements split MAC, where the AP does real-time radio work and the controller does authentication, roaming and policy.

WirelessWLCAPRoaming

Cisco queuing that guarantees each traffic class a minimum share of bandwidth during congestion, configured with class maps and a policy map. Adding a strict priority queue turns it into LLQ.

WAN, MPLS and QoSLLQQoSShapingWRED

Cisco layer 2 discovery, sent every 60 seconds with a 180-second holdtime to 01:00:0C:CC:CC:CC. It shows the neighbor's name, model, software, port and IP. Turn it off on untrusted edge ports because it leaks that information.

Switching and VLANsLLDPVoice VLANNative VLAN

The customer's router at an MPLS VPN site. It peers with the provider's PE using static routes, OSPF, EIGRP or BGP and knows nothing about MPLS.

WAN, MPLS and QoSPE routerP routerMPLS L3VPN

The default Cisco forwarding method. It precomputes a FIB from the routing table and an adjacency table for layer 2 rewrites, so packets are forwarded by table lookup, in hardware on most platforms, instead of by the CPU.

Routing fundamentalsFIBAdjacency tableRIB

Trusted party that signs certificates. Clients trust a small set of root CAs, and a server sends its own certificate plus any intermediates so the client can build a chain up to one of those roots.

TCP, UDP and applicationsX.509TLS

NAT run by an ISP that puts many customers behind a few public IPv4 addresses, using 100.64.0.0/10 between the customer and the carrier. Customers behind it lose inbound connections and port forwarding.

IPv4 and subnettingNATPATRFC 1918

How wide a Wi-Fi channel is, 20, 40, 80, 160 or (Wi-Fi 7) 320 MHz. Wider channels give more speed per client but leave fewer non-overlapping channels. On 2.4 GHz stay at 20 MHz with channels 1, 6 and 11.

Wireless802.11Band steering

Replaced classful A, B and C addressing with any prefix length, written as /n. It allows right-sized allocations and aggregation of routes, which slowed both IPv4 exhaustion and routing table growth.

IPv4 and subnettingSubnet maskVLSMRoute summarization

DNS alias that points one name at another canonical name, which is then resolved. A CNAME cannot share its name with other records, so it cannot be used at the zone apex.

IP servicesA recordDNSRoute 53

Plugin standard Kubernetes uses to give pods interfaces and IPs and to connect them across nodes. Calico (routed, can use BGP), Cilium (eBPF) and Flannel (VXLAN overlay) are common choices.

Cloud networkingKubernetesPodOverlay

Two-tier campus design where the core and distribution layers merge into one pair of switches. Cheaper and simpler, and a good fit for a single building or a small site.

Network designHierarchical network designThree-tier design

The set of devices whose frames can collide on a shared medium. A hub is one collision domain, every switch port is its own, and full duplex removes collisions completely.

Models and mediaBroadcast domainHubCSMA/CD

Splits one BGP AS into private sub-ASes that run eBGP-style sessions between them, which reduces the iBGP full mesh. The outside world still sees one AS. Less common than route reflectors.

BGPRoute reflectoriBGP

The sender's own limit (cwnd) on unacknowledged data, set by congestion control. A TCP sender can have in flight at most the smaller of cwnd and the receiver's advertised window.

TCP, UDP and applicationsSlow startSliding windowCUBIC

Linux netfilter connection tracking. It records every flow and its state (NEW, ESTABLISHED, RELATED, INVALID) so iptables and nftables can filter statefully and NAT works. When the table reaches nf_conntrack_max, new connections are dropped.

Linux networkingiptablesnftablesStateful firewall

The part of a device that builds forwarding state, such as routing protocols, STP and ARP. It runs on the CPU. SDN moves it into a central controller.

Automation and SDNData planeManagement planeCoPPSDN

QoS policy on traffic headed to the device CPU that rate-limits each class (routing protocols, management, ICMP, everything else), so a flood cannot starve the control plane.

Network securityControl planePolicingDDoS

The 3-bit priority (PCP) in the 802.1Q tag, values 0 to 7, with voice usually at 5. It only exists in tagged layer 2 frames, so it is lost at the first routed hop unless mapped to DSCP.

WAN, MPLS and QoSDSCP802.1QTrust boundary

The checksum in the frame check sequence. Rising CRC errors on an interface mean frames arrive damaged, from a bad cable, dirty or failing optics, interference or a duplex mismatch. They are counted on the receiving side, so the cause is often the cable or the transmitter at the far end.

TroubleshootingFCSDuplex mismatchRuntGiant

Legacy Cisco way to configure IPsec, where an ACL selects interesting traffic and the map is applied to the outside interface. It is policy based with no tunnel interface, so no routing protocols run over it. VTIs replace it in most new designs.

VPNs and tunnelsVTIIPsecIKE

The Wi-Fi access method. Radios cannot detect collisions while sending, so a station listens, waits a random backoff, and expects an ACK for every frame. Optional RTS/CTS helps with hidden nodes.

WirelessCSMA/CD802.11

The half-duplex Ethernet access method. Listen, transmit, and if a collision is detected send a jam signal and retry after a random backoff. Full-duplex links do not use it.

Models and mediaCSMA/CACollision domainDuplex mismatch

Default TCP congestion control on Linux and recent Windows. After a loss it grows cwnd as a cubic function of time, ramping quickly back toward the old peak, which suits fast long-distance links. It is loss based, unlike BBR.

TCP, UDP and applicationsBBRCongestion windowSlow start

The switch starts forwarding a frame as soon as it has read the destination MAC, before the rest arrives. Lowest latency, but frames with a bad FCS get forwarded too. Common in low-latency data center switches.

Switching and VLANsStore-and-forwardFCS

Before using an IPv6 address, a host sends a Neighbor Solicitation for it from the unspecified address (::) to the matching solicited-node group. Any Neighbor Advertisement in reply means the address is already taken and the host must not use it.

IPv6NDPSLAACSolicited-node multicast

The forwarding path that moves packets using tables the control plane built, such as the FIB, MAC table and ACLs in TCAM. On most switches and routers it runs in hardware, so it keeps forwarding even when the CPU is busy.

Automation and SDNControl planeManagement planeFIBTCAM

Power relative to 1 milliwatt on a log scale. 0 dBm is 1 mW, 20 dBm is 100 mW, and every 3 dB doubles or halves the power. Received Wi-Fi signals are negative numbers, and -67 dBm is a common target for voice.

WirelessRSSISNR

Links between data centers for replication and for extending layer 2 or layer 3 between them, over dark fiber, DWDM, MPLS or VXLAN EVPN. Stretching layer 2 across sites is possible but joins their failure domains, so keep it to what really needs it.

Data centerEVPNVXLANVPLS

Many sources flood a target with volumetric traffic, protocol abuse such as SYN floods, or application requests. A link-filling flood cannot be stopped at your own firewall, so defense needs upstream help such as scrubbing services, remote triggered black hole routing, anycast and rate limits.

Network securitySYN floodCoPPAnycastNull0 route

The route 0.0.0.0/0 (or ::/0 in IPv6) that matches every destination, used when nothing more specific exists. Cisco shows it as the gateway of last resort. It is usually a static route at the edge, learned from the ISP, or injected into an IGP with default-information originate.

Routing fundamentalsStatic routeLongest prefix matchFloating static route

Layering several independent controls, such as an edge firewall, internal segmentation, host firewalls, MFA and logging, so that one failed control does not expose everything.

Network securityZero trustDMZMicrosegmentation

In STP, the port on each segment with the best path to the root, which forwards frames onto that segment. Ties break on lowest sender bridge ID, then lowest port ID. Every active port on the root bridge is designated.

Spanning treeRoot portRoot bridgeSTP

Hands out an IP address, mask, default gateway, DNS servers and other options for a limited lease. The server listens on UDP 67 and the client on UDP 68. Clients try to renew at half the lease time.

IP servicesDORADHCP relayDHCP optionsDHCP snooping

Extra settings carried in DHCP messages. The ones interviewers ask about are 3 (router), 6 (DNS servers), 15 (domain name), 43 (vendor specific, often WLC addresses for APs), 51 (lease time), 66 (TFTP server name), 82 (relay agent information) and 150 (Cisco TFTP server list for IP phones).

IP servicesDHCPDHCP relayTFTPZTP

A router or layer 3 switch forwards client DHCP broadcasts as unicast to a server on another subnet and fills in the giaddr field so the server picks the right pool. On Cisco it is ip helper-address on the client-facing interface, which also forwards a few other UDP broadcasts by default.

IP servicesDHCPDORADHCP options

Switch feature that accepts DHCP server replies only on trusted ports (uplinks), blocking rogue DHCP servers, and builds a binding table of MAC, IP, VLAN and port. Dynamic ARP inspection and IP source guard both rely on that table.

Network securityDynamic ARP inspectionIP source guardDHCP starvation

Attack that floods DHCP Discover messages with fake MAC addresses until the pool is empty, often as the first step before running a rogue DHCP server. Port security and DHCP snooping rate limits stop it.

Network securityDHCP snoopingPort securityDHCP

DHCP for IPv6, with clients on UDP 546 and servers on UDP 547. Stateful mode assigns addresses, while stateless mode only gives options like DNS and leaves addressing to SLAAC. It never hands out a default gateway, which always comes from router advertisements.

IPv6SLAACRouter advertisementNDP

Key exchange that lets two sides build a shared secret over an open channel without ever sending it. Used by IKE and TLS. The group sets the strength, for example group 14 is 2048-bit MODP and groups 19 and 20 are elliptic curve. Using fresh keys each time gives forward secrecy.

VPNs and tunnelsIKEPFSTLS

The scalable QoS model. Packets are classified and marked with a DSCP value near the edge, and every hop applies a per-hop behavior based on that marking. There is no per-flow signaling, unlike IntServ.

WAN, MPLS and QoSDSCPIntServEFAF

AWS dedicated private connection from your network into AWS at a colocation facility, as a dedicated port or a hosted connection from a partner. It runs BGP over 802.1Q virtual interfaces (private, public or transit) and is not encrypted by default.

Cloud networkingExpressRouteTransit gatewayBGP

Routing protocols that send their routes (distance and direction) to neighbors and trust what they hear, without a full map of the network. RIP is the classic example and EIGRP is an advanced one. Loops are prevented with split horizon, poison reverse and hold-down timers.

Routing fundamentalsLink stateRIPSplit horizonEIGRP

Hub and spoke VPN built from mGRE, NHRP and IPsec, where spokes can build tunnels to each other on demand. Phase 1 is hub only, Phase 2 adds spoke to spoke but the hub cannot summarize, and Phase 3 uses NHRP redirects and shortcuts so spokes go direct while the hub summarizes.

VPNs and tunnelsNHRPGREIPsecHub and spoke

A separate segment for public-facing servers, between the internet and the internal network. Firewall rules let outside users reach only the DMZ, and strictly limit what DMZ hosts can open toward the inside.

Network securityStateful firewallDefense in depthZone-based firewall

Resolves names to records such as addresses and mail servers. Queries use UDP 53 and fall back to TCP 53 for large answers and zone transfers, and DNS over TLS uses TCP 853. Answers are cached for their TTL.

IP servicesRecursive resolverAuthoritative name serverA recordDNSSEC

DNS server that makes up AAAA records from A records, using a prefix such as 64:ff9b::/96, for IPv6-only clients. Their traffic then goes to a NAT64 gateway that translates it to IPv4.

IPv6NAT64Dual stackA record

Signs DNS data (RRSIG records) with keys published as DNSKEY records, linked to the parent zone with DS records all the way up to the root. It proves an answer is authentic and unchanged, but does not encrypt it.

IP servicesDNSAuthoritative name serverRecursive resolver

The four messages of a DHCP lease. The client broadcasts Discover from 0.0.0.0, servers answer with an Offer, the client broadcasts a Request naming the offer it took so other servers can release theirs, and the server confirms with an Ack.

IP servicesDHCPDHCP relayAPIPA

On OSPF broadcast and NBMA segments, one router (with a BDR as backup) becomes Full with everyone, receives updates on 224.0.0.6 and floods them on 224.0.0.5, cutting the number of adjacencies. Highest priority wins, then highest router ID, priority 0 never wins, and the election is not preemptive.

OSPFOSPF neighbor statesRouter IDNBMA

The top 6 bits of the IPv4 ToS byte or IPv6 Traffic Class, giving 64 values. EF (46) is voice, AF classes are for data, CS values mirror old IP precedence, and 0 is best effort. It survives routed hops, unlike CoS.

WAN, MPLS and QoSEFAFCoSDiffServ

Cisco protocol that negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access, and nonegotiate turns DTP off. Auto with auto stays an access link. Disable it on edge ports because it allows switch spoofing.

Switching and VLANsTrunkVLAN hoppingAccess port

EIGRP's loop-free path algorithm. It keeps a successor plus backups (feasible successors) that pass the feasibility condition. If the successor fails and no feasible successor exists, the route goes active and EIGRP queries its neighbors for a new path.

EIGRP, RIP and IS-ISSuccessorFeasible successorFeasibility conditionStuck in active

Running IPv4 and IPv6 side by side on the same interfaces and hosts. The most common migration path. Applications pick the protocol, and most try IPv6 first and fall back quickly (Happy Eyeballs).

IPv66in4NAT64IPv6

One end runs full duplex and the other half, usually because one side is hard-coded and the other autonegotiates. The link stays up but is slow, the half-duplex side counts late collisions, and the full-duplex side counts CRC errors and runts.

Models and mediaAutonegotiationCRCCSMA/CDRunt

The switch checks ARP packets on untrusted ports against the DHCP snooping binding table (or ARP ACLs for static hosts) and drops those with a wrong IP to MAC mapping, stopping ARP spoofing. Cisco rate limits ARP on untrusted ports to 15 packets per second by default.

Network securityDHCP snoopingARP spoofingIP source guard

Traffic between servers inside the data center, as opposed to north-south traffic entering and leaving it. It is now most of the traffic, which is why spine-leaf replaced three-tier designs and why internal firewalling matters.

Data centerSpine-leafMicrosegmentationThree-tier design

BGP between routers in different autonomous systems. AD 20. Packets go out with TTL 1 by default, so peers must be directly connected unless multihop is set, and the sender sets itself as the next hop.

BGPiBGPeBGP multihopAS path

Raises the TTL on eBGP packets so peers that are not directly connected, for example peering between loopbacks, can form a session. Needs a route to the peer and update-source on the loopback. The ttl-security option is a safer alternative that also rejects spoofed packets from far away.

BGPeBGPBGP neighbor states

Installs several best routes with the same cost and spreads traffic across them by hashing each flow, usually on the 5-tuple. Per-flow hashing keeps one flow's packets in order, but one large flow can still fill one link.

Routing fundamentalsSpine-leafAsymmetric routingVariance

The DSCP 46 per-hop behavior for low-loss, low-latency, low-jitter traffic, normally voice. It goes into the strict priority queue of LLQ.

WAN, MPLS and QoSDSCPLLQAF

Cloud providers charge for data leaving their network, and often for traffic between zones and regions, while incoming data is usually free. It drives design choices like caching, private links and keeping chatty services in one zone.

Cloud networkingAvailability zoneNAT gatewayDirect Connect

Cisco advanced distance vector protocol on IP protocol 88, multicast 224.0.0.10. DUAL and feasible successors give very fast convergence, and it can load balance over unequal-cost paths. AD 90 internal and 170 external.

EIGRP, RIP and IS-ISDUALK valuesVarianceFeasible successor

A router that tells its neighbors it is a stub, so they never send it queries. This limits the query scope in hub and spoke designs and helps prevent stuck in active. By default a stub advertises its connected and summary routes.

EIGRP, RIP and IS-ISStuck in activeDUALHub and spoke

Each layer wraps the data from the layer above with its own header (and at layer 2 a trailer), turning data into segments, packets, frames and finally bits. The receiver removes them in reverse order.

Models and mediaPDUOSI model

Short-lived source port the OS picks for an outgoing connection. The IANA range is 49152 to 65535, and Linux uses 32768 to 60999 by default. A connection is identified by its 5-tuple of protocol, source IP and port, and destination IP and port.

TCP, UDP and applicationsWell-known portsTIME_WAITPAT

Copies mirrored traffic into GRE so it can be routed across a layer 3 network to an analyzer anywhere. Useful when the capture tool is not in the same layer 2 domain.

TroubleshootingSPANRSPANWireshark

IPsec protocol 50, giving encryption, integrity and anti-replay. It does not protect the outer IP header, which lets it work through NAT when wrapped in UDP 4500 by NAT-T.

VPNs and tunnelsAHIPsecNAT-TSPI

Bundles up to 8 active physical links into one logical port channel, so STP sees one link and traffic is shared by a hash. Members must match speed, duplex, VLANs and trunk mode. Negotiated by LACP or PAgP, or forced on. One flow always uses one member link.

Switching and VLANsLACPPAgPMLAGBonding

Preamble, then destination MAC, source MAC, an optional 802.1Q tag, the EtherType (0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP), a payload of 46 to 1500 bytes and a 4-byte FCS. Frames are 64 to 1518 bytes untagged.

Switching and VLANs802.1QFCSMAC addressJumbo frame

Builds a 64-bit IPv6 interface ID from a 48-bit MAC by splitting it, inserting FFFE in the middle and flipping the seventh bit (universal or local). It exposes the MAC address, which is why privacy addresses exist.

IPv6SLAACPrivacy addressesMAC address

Uses MP-BGP as the control plane for MAC and IP reachability, most often with VXLAN in data centers. It replaces flood and learn, supports all-active multihoming and anycast gateway, and suppresses ARP flooding.

Data centerVXLANEVPN route type 2EVPN route type 5MP-BGP

The MAC/IP advertisement route. It tells all VTEPs that a host's MAC, and optionally its IP, sits behind a given VTEP and VNI. It drives layer 2 forwarding and ARP suppression.

Data centerEVPNEVPN route type 5VTEP

The IP prefix route. It advertises subnets and external prefixes in a layer 3 VNI, so the fabric can route to them without a host route for every address.

Data centerEVPNEVPN route type 2VRF

Azure private connection from your network to Microsoft through a connectivity provider, with BGP over two links for redundancy. Private peering reaches your VNets and Microsoft peering reaches Microsoft 365 and public services. Not encrypted by default.

Cloud networkingDirect ConnectBGPTransit gateway

Cisco ACL numbered 100 to 199 or 2000 to 2699, or named, that matches source and destination address, protocol and ports. Place it close to the source so unwanted traffic is dropped early.

Network securityStandard ACLACLWildcard mask

Optional IPv6 headers chained by the Next Header field between the fixed header and the payload, such as Hop-by-Hop Options, Routing, Fragment, Destination Options, AH and ESP. Some firewalls drop packets that carry them, which can break fragmented traffic.

IPv6IPv6 headerFragmentation

TCP resends a segment after 3 duplicate ACKs instead of waiting for the retransmission timer, then fast recovery reduces cwnd (Reno halves it) instead of dropping back to one segment.

TCP, UDP and applicationsRTOCongestion windowSliding window

The 4-byte CRC at the end of every Ethernet frame. The receiver recomputes it and drops any frame that does not match, counting it as a CRC error.

Switching and VLANsCRCEthernet frameCut-through switching

The EIGRP loop-free rule. A neighbor can be a feasible successor only if its reported distance is lower than this router's current feasible distance, which proves its path does not loop back through us.

EIGRP, RIP and IS-ISFeasible successorReported distanceFeasible distance

EIGRP's best total metric to a destination from this router, which is the neighbor's reported distance plus the cost to reach that neighbor. The neighbor with the lowest one is the successor.

EIGRP, RIP and IS-ISReported distanceSuccessorFeasibility condition

EIGRP backup next hop that already meets the feasibility condition. It is kept in the topology table and used the moment the successor fails, with no queries and no recomputation.

EIGRP, RIP and IS-ISSuccessorFeasibility conditionDUAL

Gives hosts one virtual gateway IP and MAC shared by two or more routers, so the default gateway survives a router failure without touching the hosts. HSRP, VRRP and GLBP are the main ones.

Gateway redundancyHSRPVRRPGLBPObject tracking

The forwarding table built from the best routes in the RIB with next hops already resolved. It is what each packet is looked up in, and it is pushed into hardware on switches and most routers.

Routing fundamentalsRIBCEFAdjacency table

Lossless storage networking protocol for SANs, with its own switches, WWN addresses and zoning, at speeds like 16, 32 and 64 Gbps. FCoE carries it over lossless data center Ethernet.

Data centeriSCSI

99.999 percent availability, about 5.26 minutes of downtime a year (four nines is about 52.6 minutes, three nines about 8.8 hours). Parts in series multiply their availabilities, while redundant parts in parallel cut downtime, which is why redundancy is how you get there.

Network designFHRPHierarchical network design

A static route given an administrative distance higher than the primary route, so it is only installed when the primary disappears. The usual way to add a backup link without a routing protocol.

Routing fundamentalsAdministrative distanceStatic routeIP SLA

VXLAN without a control plane. BUM traffic is flooded with underlay multicast or ingress replication, and VTEPs learn remote MACs from the data plane like a normal switch. Simple but it scales poorly, and EVPN replaces it.

Data centerVXLANEVPNBUM traffic

STP timer, 15 seconds by default, that a port spends in listening and again in learning before forwarding. It is why classic STP takes 30 to 50 seconds to bring a port up or reconverge.

Spanning treeMax ageSTPRSTPPortFast

Splitting an IPv4 packet that is larger than the next link's MTU, using the identification, flags (DF and MF) and fragment offset fields. Fragments are reassembled only at the destination. With DF set the router drops the packet and returns ICMP type 3 code 4 instead. IPv6 routers never fragment.

IPv4 and subnettingMTUPMTUDIPv4 header

Cleartext file transfer with a control connection on TCP 21 and, in active mode, data from the server's TCP 20. In passive mode the client opens the data connection too, which works better through firewalls and NAT. Replace it with SFTP or SCP.

IP servicesSCPTFTP

A received frame larger than the interface allows, more than 1518 bytes on a standard untagged port. Usually a jumbo frame or extra tagging arriving on a port not configured for it.

TroubleshootingRuntJumbo frameMTU

Version control for configs, templates and scripts. Branches, pull requests and reviews give network changes the same history and peer review as code, and CI pipelines can test them before they are merged and deployed.

Automation and SDNInfrastructure as codeAnsibleTerraform

Cisco FHRP that load balances. The AVG (active virtual gateway) answers ARP for the one virtual IP with different virtual MACs that belong to up to 4 AVFs (active virtual forwarders), so hosts spread across several routers.

Gateway redundancyHSRPVRRPFHRP

Public, routable IPv6 address, currently allocated from 2000::/3. A site typically gets a /48 and each subnet is a /64.

IPv6Link-local addressULASLAAC

OpenConfig management protocol over gRPC (HTTP/2 with TLS) with four calls, Capabilities, Get, Set and Subscribe. Subscribe streams telemetry. The data follows YANG models.

Automation and SDNModel-driven telemetryYANGNETCONF

Lets a router restart its control plane or switch to a standby supervisor while neighbors keep forwarding to it with the old routes, so traffic keeps flowing during the restart. Cisco calls it NSF and pairs it with SSO.

Gateway redundancySSOBFD

An ARP announcement of a host's own IP to MAC mapping that nobody asked for. Sent at boot to detect duplicate addresses and update caches, and by FHRP routers and clusters after a failover so traffic moves to the new owner.

IPv4 and subnettingARPHSRPARP spoofing

IP protocol 47. A simple tunnel that carries almost any protocol, including multicast and routing protocol traffic, with 24 bytes of overhead (new IP header plus GRE header). It has no encryption of its own.

VPNs and tunnelsGRE over IPsecDMVPNVTI

Wrapping GRE inside IPsec, so GRE brings multicast and routing protocol support and IPsec brings encryption. The classic way to run OSPF or EIGRP over an encrypted WAN. A VTI does the same job with less overhead.

VPNs and tunnelsGREIPsecVTITransport mode

One lost or slow item at the front of a queue holds up everything behind it. HTTP/2 removed it at the request level, but one lost TCP packet still stalls every stream on the connection. QUIC fixes that by making streams independent.

TCP, UDP and applicationsHTTP/2HTTP/3QUIC

OSPF discovery and keepalive packet sent to 224.0.0.5, by default every 10 seconds with a 40-second dead interval on broadcast and point-to-point links, and 30 and 120 seconds on NBMA. Hello and dead timers, area, subnet, authentication and stub flags must match for two routers to become neighbors.

OSPFOSPF neighbor statesOSPFDR

Splitting a campus into access (end devices and edge security), distribution (policy, inter-VLAN routing and aggregation) and core (fast transport between distribution blocks). Each layer has one job, which makes the network easier to scale and troubleshoot.

Network designCollapsed coreThree-tier designSpine-leaf

BGP drops a session if no keepalive or update arrives within the hold time. Cisco defaults are keepalives every 60 seconds and a 180-second hold time, and the two peers use the lower of their configured values. BFD gives much faster failure detection.

BGPBGP neighbor statesBFDKeepalive

Cisco FHRP with one active and one standby router per group. Defaults are priority 100, hello 3 seconds, hold 10 seconds and preempt off. Version 1 uses 224.0.0.2, groups 0 to 255 and virtual MAC 0000.0c07.acXX, and version 2 uses 224.0.0.102, groups 0 to 4095 and 0000.0c9f.fXXX.

Gateway redundancyVRRPGLBPObject trackingFHRP

Request and response protocol for the web on TCP 80, or 443 with TLS for HTTPS. HTTP/1.1 keeps connections open, but responses on one connection come back strictly in order, so browsers open about six connections per site.

TCP, UDP and applicationsHTTP/2HTTP/3TLS

Binary framing with many multiplexed streams over one TCP connection, plus header compression (HPACK). It removes head-of-line blocking at the HTTP level but not at the TCP level. Browsers only use it over TLS.

TCP, UDP and applicationsHTTPHTTP/3Head-of-line blocking

HTTP over QUIC on UDP 443 instead of TCP. It gives faster setup (one round trip, or zero on resumption), independent streams, and connections that survive a change of client IP address.

TCP, UDP and applicationsQUICHTTP/2TLS

Layer 1 device that repeats every bit out of every other port. All ports share one collision domain and run half duplex, and there is no MAC learning. Mostly history now.

Models and mediaCollision domainCSMA/CD

Topology where branch sites (spokes) connect only to a central hub. Easy to secure and manage, but spoke to spoke traffic hairpins through the hub unless something like DMVPN or SD-WAN builds direct paths.

Network designDMVPNSD-WANTransit gateway

BGP between routers in the same AS. AD 200. It does not change the next hop by default, and a route learned from one iBGP peer is never passed to another, so iBGP needs a full mesh, route reflectors or confederations.

BGPeBGPRoute reflectorNext-hop-selfConfederation

IP protocol 1, used for errors and diagnostics. Echo request is type 8 and echo reply type 0 (ping), type 3 is destination unreachable (code 4 means fragmentation needed), type 11 is time exceeded (traceroute) and type 5 is redirect.

IPv4 and subnettingPingTraceroutePMTUDTTL

The IPv6 control protocol, next header 58. Besides ping and errors it carries Neighbor Discovery and MLD, so blocking all of it breaks IPv6. Packet Too Big (type 2) is what path MTU discovery depends on.

IPv6NDPPMTUDRouter advertisement

Running the same automation twice gives the same end state, and the second run changes nothing. It lets you rerun playbooks safely and use them to detect configuration drift.

Automation and SDNAnsibleInfrastructure as codeTerraform

Watches a copy of the traffic, from a SPAN port or a tap, and alerts on signatures or anomalies. It sits out of the path, so it adds no latency but cannot block anything on its own.

Network securityIPSSPANNGFW

How IPv4 hosts tell their local router which multicast groups they want to receive. Version 2 added leave messages and version 3 added source filtering for source-specific multicast. IPv6 uses MLD for the same job.

Models and mediaMulticastIGMP snooping

The switch listens to IGMP joins and leaves and forwards multicast only to ports that asked for it, instead of flooding the whole VLAN. It needs an IGMP querier in the VLAN, or memberships time out.

Switching and VLANsIGMPMulticastUnknown unicast flooding

Negotiates IPsec security associations over UDP 500, or UDP 4500 when NAT-T is in use. In IKEv1, phase 1 builds a protected channel with main mode (6 messages) or aggressive mode (3), and phase 2 quick mode builds the IPsec SAs that carry data.

VPNs and tunnelsIKEv2Main modeSADiffie-Hellman

The newer IKE. Four messages set up the IKE SA and the first child SA, and NAT traversal, dead peer detection, EAP for remote users and MOBIKE are built in. Simpler and more reliable than IKEv1 and the default choice today.

VPNs and tunnelsIKEIPsecNAT-T

The invisible last line of every ACL that denies anything not matched above it. An ACL with only deny lines therefore blocks everything. Add an explicit deny any with logging at the end if you want the hits counted.

Network securityACLStandard ACLExtended ACL

Defining network and cloud infrastructure in versioned text files that a tool applies, instead of making changes by hand. It gives peer review, repeatable builds and drift detection.

Automation and SDNTerraformGitIdempotencyAnsible

Kubernetes object that routes outside HTTP and HTTPS traffic to Services by host name and path, through an ingress controller such as NGINX, often terminating TLS. One entry point for many services. The Gateway API is its successor.

Cloud networkingKubernetesLoad balancerPod

Operators state the desired outcome, such as which groups may talk or what SLA an app needs, and the system turns it into device config and keeps checking that the network still meets it. Cisco Catalyst Center (formerly DNA Center) is the usual example.

Automation and SDNSDNModel-driven telemetryNorthbound API

AWS VPC component that gives subnets a path to and from the internet. A subnet is public when its route table sends 0.0.0.0/0 to an internet gateway, and its instances also need public IPs to be reachable.

Cloud networkingNAT gatewayVPCRouting table

Per-flow QoS model where applications reserve bandwidth along the whole path with RSVP. It gives hard guarantees, but every router keeps state for every flow, so it does not scale the way DiffServ does.

WAN, MPLS and QoSDiffServQoS

Cisco feature that sends synthetic probes (ICMP echo, UDP jitter, HTTP and others) and measures reachability, delay, jitter and loss. Tied to object tracking it can remove a static route or lower an HSRP priority when a path fails.

IP servicesObject trackingFloating static routeHSRP

Switch filter that only allows traffic from the IP address (and optionally the MAC) bound to that port in the DHCP snooping table, which blocks IP spoofing from access ports.

Network securityDHCP snoopingDynamic ARP inspectionuRPF

The system of record for subnets, addresses and VLANs, so allocations never overlap and everyone can see what is used. Often tied to DHCP and DNS, or kept in a tool like NetBox.

Network designNetBoxVLSMRFC 1918

Sits inline, so it can drop matching traffic in real time instead of only alerting. It adds latency and a false positive blocks real traffic. Usually a feature of an NGFW today.

Network securityIDSNGFWZero trust

Framework for securing IP traffic with ESP or AH, keyed by IKE, in transport or tunnel mode. The basis of most site-to-site VPNs and many remote access VPNs.

VPNs and tunnelsESPIKETunnel modeSA

The classic Linux netfilter firewall tool. Tables (filter, nat, mangle, raw) hold chains (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING) of rules checked in order. It is being replaced by nftables.

Linux networkingnftablesConntrackNAT

20 bytes without options. It carries version, header length, DSCP and ECN, total length, identification, flags, fragment offset, TTL, protocol (1 ICMP, 6 TCP, 17 UDP), header checksum, and source and destination addresses.

IPv4 and subnettingTTLFragmentationDSCPIPv6 header

128-bit addressing written as eight groups of four hex digits, where leading zeros can be dropped and one run of zero groups can be written as a double colon. No broadcast, no fragmentation by routers, built-in autoconfiguration and a simpler fixed header.

IPv6IPv6 headerSLAACNDPDual stack

A fixed 40 bytes with version, traffic class, flow label, payload length, next header, hop limit, and source and destination addresses. There is no header checksum and no fragmentation fields, and options move into extension headers.

IPv6Extension headerIPv4 headerIPv6

Link-state IGP that runs directly over layer 2 rather than IP, so it carries IPv4 and IPv6 easily. Level 1 routes inside an area, level 2 between areas, and L1/L2 routers do both. Routers are named by a NET such as 49.0001.0000.0000.0001.00. Favored by service providers for stability at scale.

EIGRP, RIP and IS-ISOSPFLink stateLSP

SCSI storage commands carried over TCP port 3260, so block storage runs on ordinary Ethernet. Usually kept on its own VLAN or network, often with jumbo frames.

Data centerFibre ChannelJumbo frame

Python template language used to generate device configs from variables, with loops and conditions. Ansible's template module and many Python scripts use it.

Automation and SDNAnsibleYAMLNetBox

Variation in packet delay. Voice and video need it low, about 30 ms or less, and endpoints use jitter buffers to smooth it out.

Models and mediaLatencyQoSLLQ

Data format made of objects and arrays, used by REST APIs and RESTCONF. Stricter than YAML and has no comments.

Automation and SDNYAMLXMLREST API

Ethernet frame with a payload above 1500 bytes, usually an MTU of 9000 or 9216. It cuts overhead for storage and data center traffic, but every device in the path must support it or the large frames are dropped.

Switching and VLANsMTUGiantiSCSI

EIGRP metric weights K1 to K5. By default only K1 (bandwidth) and K3 (delay) are 1, so the metric is 256 times the sum of 10^7 divided by the lowest bandwidth in kbps and the total delay in tens of microseconds. K values must match for neighbors to form.

EIGRP, RIP and IS-ISEIGRPFeasible distanceVariance

A small periodic message that proves a peer or path is still alive. TCP keepalives start after 2 hours idle by default on Linux, BGP sends them every 60 seconds, and interfaces and tunnels use them to detect a dead far end.

TCP, UDP and applicationsHold timerBFDTCP

Published in 2017. By replaying message 3 of the WPA2 4-way handshake, an attacker made clients reinstall a key already in use, resetting nonces so traffic could be decrypted or forged. It was fixed by patching clients and APs, not by a new protocol.

Wireless4-way handshakeWPA2WPA3

Container orchestrator with a simple network model. Every pod gets its own IP and can reach every other pod without NAT, and a Service gives a set of pods one stable virtual IP and DNS name, implemented by kube-proxy rules or by eBPF in some CNIs.

Cloud networkingPodCNIIngress

The IEEE negotiation protocol for EtherChannel (802.3ad, now 802.1AX). Modes are active and passive, and at least one side must be active. It detects miswiring and removes failed members.

Switching and VLANsEtherChannelPAgPBondingMLAG

The time data takes to cross the network, one way or round trip. It adds up from propagation (about 5 microseconds per km of fiber), serialization, queuing and processing delays.

Models and mediaJitterBandwidthRTO

Switch that also routes between VLANs in hardware, using SVIs or routed ports. Faster and cheaper per port than a router, but usually with fewer WAN interfaces, less NAT and VPN support and smaller tables.

Switching and VLANsSVIRouter-on-a-stickVLAN

MPLS protocol that assigns labels to IGP prefixes and shares them with neighbors. Discovery hellos use UDP 646 and sessions use TCP 646.

WAN, MPLS and QoSMPLSMPLS labelSegment routing

Routing protocols where every router floods its links to all others, builds the same full map (the LSDB) and runs SPF to compute its own best paths. OSPF and IS-IS work this way. Fast and loop-free by design, at the cost of more memory and CPU.

Routing fundamentalsDistance vectorSPFOSPFIS-IS

IPv6 address in fe80::/10 that every IPv6 interface creates for itself and that is only valid on that link. Used as the next hop in routing and by Neighbor Discovery. The IPv4 equivalent is 169.254.0.0/16.

IPv6Global unicast addressNDPAPIPA

Vendor-neutral IEEE 802.1AB discovery, sent every 30 seconds with a 120-second hold by default on Cisco. LLDP-MED adds voice VLAN and PoE details for IP phones.

Switching and VLANsCDPVoice VLANPoE

CBWFQ plus a strict priority queue for voice. The priority queue is always served first, but during congestion it is policed to its configured rate so it cannot starve the other classes.

WAN, MPLS and QoSCBWFQEFQoS

Spreads client connections across a pool of servers and health-checks them. Layer 4 balancers work on IP and port, while layer 7 balancers read HTTP and can route by URL, terminate TLS and add headers. Common algorithms are round robin, least connections and source hash.

Data centerSNATALBNLB

BGP attribute shared with all iBGP peers in the AS, where highest wins and the default is 100. The standard tool for choosing which exit your AS uses for outbound traffic.

BGPWeightBGP best path selectionMED

When several routes match a destination, the one with the longest prefix (the most specific) wins, before administrative distance or metric are even considered.

Routing fundamentalsAdministrative distanceRouting tableDefault route

STP feature that moves a root or alternate port into a loop-inconsistent blocking state when it stops receiving BPDUs, instead of letting it move to forwarding. Protects against unidirectional links.

Spanning treeUDLDRoot GuardBPDU Guard

127.0.0.1 in IPv4 (the whole 127.0.0.0/8) and ::1 in IPv6, addresses whose traffic never leaves the host. Not the same as a router loopback interface, which is a virtual, always-up interface used for router IDs and peering.

IPv4 and subnettingRouter IDAPIPA

The OSPF unit of topology. Type 1 router, Type 2 network (from the DR), Type 3 summary (from ABRs), Type 4 ASBR summary, Type 5 external (from ASBRs) and Type 7 NSSA external. Each LSA is refreshed every 30 minutes and expires at 60.

OSPFABRASBRNSSASPF

The one-way path a labeled packet follows through an MPLS network, from the ingress router to the egress router. In IS-IS the same letters mean link state PDU, so check the context.

WAN, MPLS and QoSMPLSLDPMPLS labelIS-IS

The switch sends a device's MAC address to RADIUS as its identity when the device cannot do 802.1X, such as printers and cameras. MACs are easy to spoof, so pair it with profiling and limited access.

Network security802.1XRADIUSPort security

48-bit layer 2 address written in hex. The first 24 bits are the vendor's OUI. The lowest bit of the first byte marks a multicast address and the next bit marks a locally administered one.

Models and mediaEthernet frameMAC address tableEUI-64

The switch table of MAC, VLAN and port, learned from source addresses and often called the CAM table. Frames to unknown destinations are flooded, and entries age out after 300 seconds by default on Cisco.

Switching and VLANsUnknown unicast floodingMAC floodingMAC flapping

The same MAC is learned on two ports in turn. The classic sign of a layer 2 loop, or of a server bond misconfigured as active/active. Cisco logs it as a MACFLAP notification.

Spanning treeBroadcast stormSTPBonding

Attack that fills the MAC table with fake source addresses so the switch floods all traffic like a hub and the attacker can capture it. Port security with a MAC limit stops it.

Network securityPort securityMAC address table

IEEE 802.1AE hop-by-hop encryption of Ethernet frames at line rate, keyed by MKA and often tied to 802.1X. Protects links between switches, or across leased fiber you do not control.

Network security802.1XAES

IKEv1 phase 1 exchange of 6 messages that protects the peers' identities. Aggressive mode does it in 3 messages but sends identities in the clear and exposes a hash of the pre-shared key to offline cracking.

VPNs and tunnelsIKEIKEv2Diffie-Hellman

Traffic and functions used to manage the device itself, such as SSH, SNMP, NETCONF, syslog and AAA. Best kept on an out-of-band network and protected with ACLs.

Automation and SDNControl planeData planeOut-of-band management

STP timer, 20 seconds by default, for how long a switch keeps the last BPDU information on a port after BPDUs stop arriving. When it expires the switch reconverges.

Spanning treeForward delaySTPBPDU

BGP attribute you send to a neighboring AS to suggest which of your links it should use to reach you, where lower wins. By default it is only compared between routes from the same neighboring AS, and that AS's local preference overrides it.

BGPAS path prependingLocal preferenceBGP best path selection

Carrier Ethernet service across a city, handed off as a normal Ethernet port. Services are E-Line (point to point), E-LAN (multipoint, often built on VPLS) and E-Tree (rooted multipoint).

WAN, MPLS and QoSVPLSQ-in-QMPLS

The tree of objects an SNMP agent exposes, each named by an OID. For example 1.3.6.1.2.1.1.5.0 is sysName.

IP servicesSNMPModel-driven telemetry

Applying security policy per workload or application rather than per subnet, so servers in the same VLAN cannot talk unless a rule allows it. Enforced by host agents, the hypervisor or the fabric.

Data centerZero trustEast-west trafficSecurity group

Two switches act as one LACP partner, so a server or switch can bundle links to both and get redundancy without STP blocking anything. Cisco Nexus calls it vPC and Arista calls it MLAG. It needs a peer link and a keepalive between the pair.

Data centerVirtual port channelLACPVSS

Devices push operational data shaped by YANG models, over gNMI, gRPC or NETCONF, either on a timer or when something changes, instead of waiting to be polled by SNMP. Faster, structured and easier to scale.

Automation and SDNgNMIYANGSNMP

Extends BGP to carry many address families (IPv6, VPNv4, EVPN and others) identified by AFI and SAFI. It carries customer VPN routes between PEs in MPLS L3VPN and MAC and IP routes in EVPN.

WAN, MPLS and QoSMPLS L3VPNEVPNRoute distinguisher

Forwards packets by short labels instead of full IP lookups. The ingress PE pushes labels, P routers swap them, and the router before the egress usually pops the top label (penultimate hop popping). It enables VPNs and traffic engineering over one shared core.

WAN, MPLS and QoSMPLS labelLDPMPLS L3VPNP router

Provider-run layer 3 VPN. Each customer gets a VRF on the PE, routes are made unique with a route distinguisher, shared between PEs by MP-BGP, filtered by route targets, and forwarded with two labels, an outer transport label and an inner VPN label.

WAN, MPLS and QoSVRFRoute distinguisherRoute targetMP-BGP

A 4-byte shim between the layer 2 header and the IP header holding a 20-bit label, a 3-bit traffic class (formerly EXP), a bottom-of-stack bit and an 8-bit TTL. Labels can be stacked.

WAN, MPLS and QoSMPLSLDPLSP

The largest TCP payload a host will accept, announced in its SYN. Normally the MTU minus 40, so 1460 bytes over Ethernet for IPv4 and 1440 for IPv6.

TCP, UDP and applicationsMTUMSS clampingPMTUD

A router lowers the MSS value in SYN packets passing through, so TCP segments fit inside a tunnel or PPPoE link without fragmentation. On Cisco ip tcp adjust-mss 1360 is common for IPsec and 1452 for PPPoE.

TCP, UDP and applicationsMSSMTUPMTUD black hole

IEEE 802.1s spanning tree that maps many VLANs to a few instances, cutting CPU load and BPDUs compared to one instance per VLAN. Switches are in the same region only if region name, revision number and VLAN to instance mapping all match.

Spanning treePVST+Rapid PVST+RSTP

The largest layer 3 packet a link carries without fragmenting, 1500 bytes on standard Ethernet. Tunnels and PPPoE lower the usable MTU, and mismatches cause drops that are hard to spot because small packets still work.

TCP, UDP and applicationsMSSPMTUDJumbo frameFragmentation

An AP transmits to several clients at once on separate spatial streams, and with Wi-Fi 6 also receives from several at once. Downlink came with 802.11ac Wave 2 and uplink with 802.11ax.

Wireless802.11Channel width

One-to-many delivery to a group address, 224.0.0.0/4 in IPv4 and ff00::/8 in IPv6. Receivers join with IGMP or MLD and routers build distribution trees with PIM. 224.0.0.0/24 is link-local and never routed.

Models and mediaIGMPIGMP snoopingUnicastBroadcast

Connecting to two or more ISPs for redundancy, usually with your own ASN and prefixes announced over BGP to both. Outbound traffic is steered with local preference and inbound with AS path prepending, MED or provider communities.

BGPLocal preferenceAS path prependingBGP community

Fiber with a wide core (50 or 62.5 microns) that carries many light paths, used with cheaper 850 nm optics. Modal dispersion limits its reach to a few hundred meters, for example about 300 m on OM3 and 400 m on OM4 at 10 Gbps.

Models and mediaSingle-mode fiberSFP

DNS record naming the mail servers for a domain, each with a preference number where lower is tried first. It must point to a host name, never an IP address or a CNAME.

IP servicesDNSA record

Python library that gives one API across vendors such as IOS, Junos, EOS and NX-OS. Getters return structured data, and config can be merged or fully replaced with a diff shown first and a rollback if needed.

Automation and SDNNetmikoAnsibleNetBox

Rewrites IP addresses, and with PAT also ports, as packets cross a router or firewall. Static NAT maps one to one, dynamic NAT draws from a pool, and PAT puts many hosts behind one address.

IP servicesPATNAT inside and outsideCGNAT

Managed cloud service that lets instances in private subnets open outbound connections to the internet while blocking connections from outside. In AWS each one lives in a single AZ and is billed per hour and per GB, so plan one per AZ.

Cloud networkingInternet gatewayEgress chargesAvailability zone

Cisco NAT terms. Inside local is the host's real private address and inside global is how it appears to the outside. Outside global is the remote host's real address and outside local is how it appears to the inside, usually the same.

IP servicesNATPAT

IPsec peers detect a NAT device in the path during IKE and then wrap ESP inside UDP 4500, because NAT cannot handle ESP, which has no ports.

VPNs and tunnelsESPIKEIPsec

Translates between IPv6-only clients and IPv4 servers, using an IPv6 prefix such as 64:ff9b::/96 that embeds the IPv4 address in its last 32 bits. Used with DNS64 so the clients get synthesized AAAA records.

IPv6DNS64Dual stackNAT

The one VLAN whose frames cross an 802.1Q trunk untagged, VLAN 1 by default. Both ends must agree, and it should be set to an unused VLAN to stop double-tagging attacks.

Switching and VLANs802.1QTrunkVLAN hopping

A network such as Frame Relay or a DMVPN cloud where many routers share a subnet but broadcast and multicast do not reach everyone. OSPF there needs static neighbors or a different network type, and the DR must be the hub.

OSPFDRDMVPNOSPF

IPv6 replacement for ARP and more, using ICMPv6 types 133 (router solicitation), 134 (router advertisement), 135 (neighbor solicitation), 136 (neighbor advertisement) and 137 (redirect). It handles address resolution, DAD, router discovery and SLAAC.

IPv6Router advertisementDADSolicited-node multicastICMPv6

Open source source of truth for networks, holding sites, racks, devices, cables, IP addresses, VLANs and circuits. Automation reads it through its REST and GraphQL APIs to build configs.

Automation and SDNIPAMJinja2NAPALM

Network configuration protocol over SSH on port 830, with XML-encoded RPCs and YANG data models. It supports a candidate config, validate, commit and locking, so changes are transactional.

Automation and SDNRESTCONFYANGgNMIXML

Cisco flow export. The device groups packets into flows by fields like the 5-tuple and sends records to a collector. Version 5 is fixed format, version 9 is template based, and IPFIX is the IETF standard built on it. It answers who talked to whom, when and how much.

IP servicessFlowSNMP

Python library built on Paramiko that handles SSH CLI sessions to many network vendors, dealing with login, prompts, paging, enable mode and config mode. It sends commands and returns text, so parsing is up to you.

Automation and SDNNAPALMAnsible

Stateless subnet-level filter in an AWS VPC with numbered allow and deny rules checked in order. Because it is stateless, return traffic must be allowed explicitly, usually ephemeral ports 1024 to 65535.

Cloud networkingSecurity groupVPCEphemeral port

Linux isolation of the network stack, where each namespace has its own interfaces, routes, neighbor table and firewall rules. Containers are built on them, and ip netns manages them by hand.

Linux networkingveth pairPodiptables

BGP setting that makes a router advertise routes to its iBGP peers with itself as the next hop, instead of the external eBGP peer's address that internal routers may not be able to reach.

BGPiBGPeBGPRoute reflector

The successor to iptables in Linux. One tool (nft) and one syntax cover IPv4, IPv6, ARP and bridging, with sets and maps for fast matching and atomic rule updates.

Linux networkingiptablesConntrack

Stateful firewall that also identifies applications regardless of port, knows users, and adds IPS, URL filtering and TLS decryption.

Network securityStateful firewallIPSZone-based firewall

In DMVPN, spokes register their tunnel address and public address with the hub, which acts as the NHRP server. Spokes then ask it for each other's public address to build direct tunnels.

VPNs and tunnelsDMVPNGRENBMA

AWS layer 4 load balancer for TCP, UDP and TLS, with very high throughput, a static IP per AZ, and the client's source IP preserved.

Cloud networkingALBLoad balancer

The interface a controller offers to applications and orchestration above it, usually REST. Southbound interfaces go from the controller down to devices, such as OpenFlow, NETCONF, gNMI or plain CLI.

Automation and SDNSDNREST APIOpenFlowNETCONF

OSPF stub area that still allows an ASBR inside it. External routes enter as Type 7 LSAs, which the ABR translates into Type 5 LSAs for the rest of the domain.

OSPFStub areaTotally stubby areaLSAASBR

Syncs clocks over UDP 123 through a hierarchy of strata. Stratum 1 servers attach to a reference clock, each hop adds one, and 16 means unsynchronized. Accurate time matters for log correlation, certificates and authentication.

IP servicesSyslogX.509

Static route to a discard interface that silently drops matching traffic. Used with summaries to stop loops, since more specific routes still win, and to black-hole attack traffic.

Routing fundamentalsRoute summarizationLongest prefix matchDDoS

Cisco watches an object, such as an interface's line protocol, a route or an IP SLA result, and other features react when it goes down. HSRP lowers its priority and static routes are removed.

Gateway redundancyIP SLAHSRPFloating static route

Early SDN southbound protocol where a central controller programs match-action flow tables directly in switches. Very influential, but rare in enterprise networks today.

Automation and SDNSDNNorthbound APIControl plane

Seven-layer reference model with physical, data link, network, transport, session, presentation and application layers. The TCP/IP model folds it into four layers (link, internet, transport, application). Engineers use it to say where a device works or where a fault sits.

Models and mediaEncapsulationPDU

Link-state IGP on IP protocol 89 that uses areas, LSAs and Dijkstra's SPF algorithm. It uses multicast 224.0.0.5 and 224.0.0.6, AD 110, and cost as its metric. OSPFv2 is for IPv4 and OSPFv3 for IPv6.

OSPFLSASPFArea 0OSPF neighbor states

The OSPF metric, reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so every link of 100 Mbps or faster costs 1. Raise it on every router with auto-cost reference-bandwidth so 1, 10 and 100 Gbps links differ.

OSPFOSPFSPF

Down, Attempt (NBMA only), Init, 2-Way, ExStart, Exchange, Loading, Full. Stuck in ExStart or Exchange usually means an MTU mismatch. Staying in 2-Way is normal between two routers that are both DROTHER.

OSPFHello packetDRMTU

OSPF for IPv6, and for IPv4 through address families. It runs per link over link-local addresses, uses multicast ff02::5 and ff02::6, relies on IPsec or an authentication trailer for security, and still uses a 32-bit router ID.

IPv6OSPFLink-local addressRouter ID

A separate management network, with dedicated management ports, console servers and sometimes a cellular link, that still works when the production network is down.

Network designManagement planeHierarchical network design

A virtual network built on top of another network by tunneling, as with VXLAN, GRE or SD-WAN. The tunnel endpoints only need IP reachability across the underlay.

Data centerUnderlayVXLANSD-WAN

The ratio of downstream port bandwidth to uplink bandwidth. 48 ports of 10 Gbps with 4 uplinks of 40 Gbps is 480 to 160, so 3 to 1. Acceptable because not everyone sends at once, with ratios around 20 to 1 common at campus access and 3 to 1 or better at a data center leaf.

Data centerSpine-leafHierarchical network design

Router in the MPLS core that only swaps labels and runs the IGP and LDP. It knows nothing about customer VPN routes.

WAN, MPLS and QoSPE routerCE routerMPLS

Cisco proprietary EtherChannel negotiation with modes desirable and auto. Desirable with auto or desirable forms a bundle, while auto with auto never does.

Switching and VLANsLACPEtherChannel

The routing protocol still advertises the interface's network but sends no hellos on it, so no neighbors can form there. Use it on user-facing and loopback interfaces.

OSPFOSPFHello packetEIGRP

Also called NAT overload. Many inside hosts share one public IP and are told apart by their translated source ports, giving roughly 64,000 sessions per protocol per public IP.

IP servicesNATCGNATEphemeral port

Routes packets by rules other than the destination, such as source address or application, using a route map applied inbound on an interface. Matching traffic ignores the routing table.

Routing fundamentalsRoute mapRouting table

The name for a unit of data at each layer, so bits at layer 1, frames at layer 2, packets at layer 3, and segments (TCP) or datagrams (UDP) at layer 4.

Models and mediaEncapsulationOSI model

The provider router that faces customers at the edge of an MPLS network. It holds a VRF per customer, peers with CE routers, and runs MP-BGP with other PEs to exchange VPN routes.

WAN, MPLS and QoSCE routerP routerMPLS L3VPNVRF

A fresh Diffie-Hellman exchange for each IPsec phase 2 rekey, so a stolen key cannot decrypt past or future sessions. Both peers must agree on the PFS group or phase 2 fails.

VPNs and tunnelsDiffie-HellmanIKE

Sends ICMP echo requests and waits for echo replies to test reachability and round trip time. Cisco prints ! for a reply, . for a timeout and U for unreachable. Extended ping sets the source, size, DF bit and count, which is how you test MTU and return routes.

TroubleshootingICMPTraceroutePMTUD

Hosts send packets with DF set and shrink them when a router replies with ICMP fragmentation needed (IPv4) or Packet Too Big (IPv6). It only works if those ICMP messages make it back to the sender.

TCP, UDP and applicationsMTUPMTUD black holeICMP

A router or firewall drops the ICMP messages PMTUD relies on, so large packets vanish without any error. Ping and SSH work but web pages or file transfers hang. Fix it by allowing ICMP type 3 code 4 or by clamping the MSS.

TroubleshootingPMTUDMSS clampingMTU

The smallest Kubernetes unit, one or more containers that share a network namespace and one IP address. Pod IPs change when pods are replaced, which is why Services exist.

Cloud networkingKubernetesCNINetwork namespace

The switch supplies DC power over the data cable. 802.3af gives up to 15.4 W per port, 802.3at (PoE+) 30 W, and 802.3bt 60 W (type 3) or 90 W (type 4). Check the switch's total power budget, not just the per-port limit.

Models and mediaUTPVoice VLANLLDP

Distance vector loop prevention that advertises a route back out the interface it was learned on with an infinite metric (16 in RIP) instead of staying silent. Route poisoning is the same idea for a failed route, sent to all neighbors.

EIGRP, RIP and IS-ISSplit horizonRIPDistance vector

Drops or re-marks traffic above a set rate straight away, with no buffering. It causes TCP retransmits and is usually applied inbound or by providers at the edge of a contract.

WAN, MPLS and QoSShapingQoSCoPP

Limits which and how many MAC addresses can use a switch port. Violation modes are protect (drop silently), restrict (drop and log) and shutdown (err-disable, the default). Sticky learning saves learned MACs into the config.

Network securityMAC floodingDHCP starvationMAB

Lets an access port go straight to forwarding instead of spending 30 seconds in listening and learning. Only for ports facing end hosts, and always paired with BPDU Guard.

Spanning treeBPDU GuardForward delayAccess port

Layer 2 protocol for serial and DSL links, with LCP to bring up the link, an NCP such as IPCP per layer 3 protocol, and PAP or CHAP authentication. PPPoE carries it over Ethernet for broadband and adds 8 bytes, so the MTU drops to 1492.

WAN, MPLS and QoSMSS clampingMTU

Matches routes by prefix and prefix length, with ge and le for ranges. Clearer and faster than ACLs for route filtering. Entries are checked by sequence number and end with an implicit deny.

Routing fundamentalsRoute mapACLRoute redistribution

Temporary, random IPv6 interface IDs that change over time, so a device cannot be tracked by a stable EUI-64 address built from its MAC. Most desktop and mobile systems use them for outbound connections by default.

IPv6EUI-64SLAAC

Splits one VLAN into isolated and community secondary VLANs under a primary VLAN. Isolated ports can only reach promiscuous ports such as the gateway, so hosts in one subnet cannot talk to each other.

Switching and VLANsVLANMicrosegmentation

AWS service that exposes a service from another VPC, or an AWS service, as an interface endpoint with a private IP in your own subnet. No peering, no route changes, and overlapping CIDRs do not matter. Azure Private Endpoint is the same idea.

Cloud networkingVPC peeringTransit gatewayVPC

A router answers ARP requests for addresses on other networks with its own MAC, so hosts with a wrong mask or no gateway can still reach them. On by default on Cisco interfaces, and it can hide misconfigurations.

IPv4 and subnettingARPGratuitous ARPSubnet mask

One shared secret for all users of a Wi-Fi network (WPA2-Personal) or between two IPsec peers. Simple, but anyone with the key gets in, and a WPA2 handshake capture lets attackers try to crack a weak passphrase offline.

WirelessWPA2WPA34-way handshake

Reverse DNS record that maps an IP address to a name, stored under in-addr.arpa for IPv4 and ip6.arpa for IPv6. Mail servers and logs depend on it.

IP servicesDNSA record

Cisco classic spanning tree with one 802.1D instance per VLAN, so different VLANs can have different root bridges and use different links.

Spanning treeRapid PVST+MSTSTP

IEEE 802.1ad double tagging. A provider adds an outer service tag (TPID 0x88A8) over the customer's 802.1Q tag, so customer VLANs cross the provider network untouched. Each tag adds 4 bytes, so check the MTU.

Switching and VLANs802.1QMetro EthernetJumbo frame

The tools that treat traffic classes differently when links are congested, namely classification, marking, queuing, policing, shaping and congestion avoidance. QoS does not add bandwidth, it decides who suffers.

WAN, MPLS and QoSDiffServDSCPLLQTrust boundary

Four-lane transceiver form factor. QSFP+ is 40 Gbps and QSFP28 is 100 Gbps, while QSFP-DD reaches 400 and 800 Gbps.

Models and mediaSFPXFP

Transport protocol over UDP with TLS 1.3 built in, independent streams, connection IDs that survive address changes, and 0-RTT resumption. HTTP/3 runs on it.

TCP, UDP and applicationsHTTP/3TLSUDPHead-of-line blocking

Switch feature that blocks IPv6 router advertisements on ports where no router should be, stopping rogue or accidental RAs from making hosts use the wrong default gateway.

IPv6Router advertisementNDPDHCP snooping

AAA protocol over UDP 1812 for authentication and 1813 for accounting (1645 and 1646 on older gear). It combines authentication and authorization and encrypts only the password. The standard for 802.1X and VPN users.

Network securityTACACS+AAA802.1X

Cisco per-VLAN version of RSTP (802.1w), one rapid instance per VLAN. It converges in about a second using the proposal and agreement handshake.

Spanning treeRSTPPVST+MST

When a route's next hop is not directly connected, the router looks up the next hop in the routing table too, repeating until it finds an exit interface. Normal for BGP and for static routes pointing at a remote next hop.

Routing fundamentalsRouting tableCEFStatic route

DNS server that answers clients by doing the whole lookup itself, asking a root server, then the TLD servers, then the authoritative server (each an iterative query), and caching the answer for its TTL.

IP servicesDNSAuthoritative name server

An EIGRP neighbor's own metric to a destination, as it advertised it, also called the advertised distance. Compared with your feasible distance to test the feasibility condition.

EIGRP, RIP and IS-ISFeasible distanceFeasibility condition

HTTP-based API that works on resources with GET (read), POST (create), PUT (replace), PATCH (modify) and DELETE. Common status codes are 200 OK, 201 created, 204 no content, 400 bad request, 401 not authenticated, 403 forbidden, 404 not found and 500 server error.

Automation and SDNRESTCONFJSONNorthbound API

REST-style access to YANG-modeled data over HTTPS, with JSON or XML bodies. Simpler to use than NETCONF, but without its candidate config and locking.

Automation and SDNNETCONFYANGREST API

The standard that defines private IPv4 ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not routed on the internet, so hosts using them need NAT to get out.

IPv4 and subnettingNATCGNATAPIPA

The routing table, holding the best route per prefix from all sources after administrative distance is compared. The FIB is built from it.

Routing fundamentalsFIBRouting tableAdministrative distance

Distance vector protocol with hop count as its metric, a maximum of 15 hops (16 means unreachable) and full updates every 30 seconds on UDP 520. RIPv2 is classless and multicasts to 224.0.0.9. AD 120. Too slow and too small for most networks today.

EIGRP, RIP and IS-ISDistance vectorSplit horizonPoison reverse

A client moving from one AP to another with the same SSID. The client decides when to move. 802.11k gives it neighbor lists, 802.11v lets the network suggest a better AP, and 802.11r (fast BSS transition) cuts the key exchange so roams take milliseconds, which voice needs.

WirelessBSSIDWLC4-way handshake

The STP switch with the lowest bridge ID, and every path is calculated toward it. Choose it on purpose with a low priority on a core or distribution switch, ideally the HSRP active router for those VLANs, rather than leaving it to the oldest MAC.

Spanning treeBridge IDRoot portRoot Guard

Stops a port from ever becoming a root port. If a superior BPDU arrives, the port goes root-inconsistent and blocks until those BPDUs stop. Put it on designated ports facing switches that must never become root.

Spanning treeRoot bridgeBPDU GuardLoop Guard

On each non-root switch, the one port with the lowest cost path to the root bridge. Ties break on the lowest sender bridge ID, then the lowest sender port ID.

Spanning treeDesignated portRoot bridgeSTP

AWS DNS service with public and private hosted zones, health checks, and routing policies such as weighted, latency, failover and geolocation. Alias records can point the zone apex at AWS resources, which a CNAME cannot do.

Cloud networkingDNSCNAME record

A 64-bit value added in front of a customer prefix to make it a unique VPNv4 route in MP-BGP, so customers with overlapping addresses can share the core. It does not decide which VRFs import the route, route targets do.

WAN, MPLS and QoSRoute targetMPLS L3VPNVRF

Routes passed on beyond their intended scope, typically a customer re-announcing one provider's routes to another and becoming accidental transit. It can black-hole large parts of the internet. Prevented with strict prefix and AS path filters.

BGPBGP hijackPrefix listRPKI

Cisco if-then policy tool made of sequenced permit and deny clauses with match conditions and set actions. Used for redistribution, BGP policy and PBR, and it ends with an implicit deny.

Routing fundamentalsPrefix listPBRRoute redistribution

Injecting routes from one routing source into another, such as OSPF into BGP. It needs a seed metric, and mutual redistribution at more than one point can cause loops and bad paths, which you stop with route tags and filters.

Routing fundamentalsRoute mapAdministrative distanceASBR

iBGP router allowed to pass iBGP routes on to its clients, which removes the need for a full mesh. It adds originator ID and cluster list attributes to prevent loops.

BGPiBGPConfederationNext-hop-self

Advertising one shorter prefix that covers many longer ones. It shrinks routing tables and hides flaps from the rest of the network, at the cost of less precise routing and possible black holes. Summarizing past a classful boundary is called supernetting.

Routing fundamentalsCIDRNull0 routeABR

BGP extended community that controls which VRFs import a VPN route. The export target is attached when a route is sent, and a VRF imports it only if one of its import targets matches. Used to build hub and spoke or shared services VPNs.

WAN, MPLS and QoSRoute distinguisherMPLS L3VPNVRF

ICMPv6 type 134, sent by routers periodically and in reply to router solicitations. It carries prefixes for SLAAC, the router's link-local address as default gateway, the MTU, and the M and O flags that tell hosts to use DHCPv6 for addresses or other settings.

IPv6SLAACDHCPv6RA GuardNDP

32-bit ID written like an IPv4 address that names a router in OSPF, BGP and EIGRP. Chosen from manual config first, then the highest loopback IP, then the highest active interface IP. Set it by hand so it never changes.

OSPFOSPFDRLoopback address

Inter-VLAN routing with one router interface on an 802.1Q trunk and one subinterface per VLAN as that VLAN's gateway. Cheap, but all routed traffic shares one link.

Switching and VLANsSVILayer 3 switch802.1Q

List of known prefixes with next hop, outgoing interface, administrative distance and metric, where the longest match wins. Cisco marks sources with codes such as C connected, L local, S static, O OSPF, D EIGRP and B BGP. In the cloud, route tables are attached to subnets.

Routing fundamentalsRIBLongest prefix matchAdministrative distance

Linux reverse path filter sysctl. Value 1 (strict) drops packets whose source would not route back out the receiving interface, 2 (loose) only needs any route to the source, and 0 turns it off. Strict mode breaks asymmetric routing and multihomed hosts.

Linux networkinguRPFAsymmetric routing

Holders of IP space publish signed ROAs saying which AS may originate their prefixes, up to what maximum length. Routers get validated data from a validator, mark routes valid, invalid or not found, and drop invalids. It stops origin hijacks but not forged AS paths.

BGPBGP hijackRoute leak

Carries mirrored traffic across switches in a dedicated RSPAN VLAN to an analyzer on another switch. It stays inside layer 2.

TroubleshootingSPANERSPAN

How strong the received Wi-Fi signal is, usually shown in dBm. -67 dBm or better is a common target for voice and video, and below about -80 dBm the link is poor.

WirelessSNRdBm

IEEE 802.1w spanning tree that converges in about a second using proposal and agreement handshakes on point-to-point links. Port roles are root, designated, alternate and backup, and port states are discarding, learning and forwarding.

Spanning treeSTPRapid PVST+MST

How long TCP waits for an ACK before resending, calculated from measured RTT and its variation. The standard suggests a minimum of 1 second, while Linux uses a 200 ms minimum. It doubles after each timeout in a row.

TCP, UDP and applicationsFast retransmitCongestion window

A frame shorter than the 64-byte Ethernet minimum, usually from collisions or a duplex mismatch.

TroubleshootingGiantCRCDuplex mismatch

A one-way agreement on keys and algorithms between IPsec peers, so every tunnel has at least a pair, each identified by its SPI. IKE builds its own SA first to protect the negotiation.

VPNs and tunnelsSPIIKEIPsec

File copy over SSH on TCP 22, used to move images and configs to and from devices. SFTP is the other SSH-based option with more features. Both replace TFTP and FTP for anything sensitive.

IP servicesTFTPFTP

A controller builds encrypted overlay tunnels across any transport (MPLS, broadband, LTE or 5G) and steers each application over the path that currently meets its SLA, based on live loss, delay and jitter measurements. Policy is central and branches come up with zero touch.

WAN, MPLS and QoSOverlayZTPHub and spoke

Separates the control plane from the data plane and centralizes it in a controller that applications program through APIs.

Automation and SDNControl planeNorthbound APIOpenFlow

Stateful virtual firewall attached to cloud instances and interfaces, with allow rules only. Return traffic is allowed automatically, and rules can reference other security groups instead of IP ranges.

Cloud networkingNetwork ACLStateful firewallMicrosegmentation

Source routing where the ingress router puts an ordered list of segments on the packet, as MPLS labels (SR-MPLS) or IPv6 addresses (SRv6). Segments are advertised by the IGP, so the core needs no LDP or RSVP state.

WAN, MPLS and QoSMPLSLDP

Sampled flow export. The switch sends the headers of 1 in N packets plus interface counters to a collector. Cheap enough to run at line rate in hardware, and statistically accurate rather than complete.

IP servicesNetFlowSNMP

Hot-swappable transceiver for 1 Gbps, with SFP+ for 10 Gbps and SFP28 for 25 Gbps. Choose by fiber type and reach, for example SR for short-range multimode and LR for 10 km single-mode.

Models and mediaQSFPSingle-mode fiberMultimode fiber

Buffers traffic above a configured rate and sends it later, smoothing bursts instead of dropping them. It adds delay, and is used outbound to match a provider's committed rate.

WAN, MPLS and QoSPolicingQoSCBWFQ

Fiber with a thin core of about 9 microns and a single light path, used with 1310 or 1550 nm lasers to reach from a few to tens of kilometers. Usually has a yellow jacket.

Models and mediaMultimode fiberSFP

A host builds its own IPv6 address from the /64 prefix in a router advertisement plus an interface ID (EUI-64 or random), then runs DAD before using it.

IPv6Router advertisementEUI-64DADDHCPv6

TCP flow control. The receiver advertises how many bytes it can buffer, and the sender keeps no more than that unacknowledged. Window size divided by RTT is the most one connection can achieve.

TCP, UDP and applicationsWindow scalingCongestion window

TCP phase where cwnd grows by one MSS per ACK, roughly doubling every RTT, until it reaches ssthresh or sees loss. After that, congestion avoidance grows it about one MSS per RTT.

TCP, UDP and applicationsCongestion windowCUBICFast retransmit

A load balancer replaces the client's source IP with its own, so server replies come back through it. It fixes return path problems but hides the client IP unless it is passed on in X-Forwarded-For or the proxy protocol.

Data centerLoad balancerNATAsymmetric routing

Managers poll agents on UDP 161 and agents send traps or informs to UDP 162. v2c uses cleartext community strings, while v3 adds users, authentication and encryption. Informs are acknowledged and traps are not.

IP servicesMIBModel-driven telemetrySyslog

Received signal minus the noise floor, in dB. About 25 dB or more is wanted for voice and high data rates, and low SNR forces clients down to slower rates.

WirelessRSSIdBm

The first record of a DNS zone, naming the primary server and admin contact and holding the serial number plus the refresh, retry, expire and negative caching timers. Secondaries compare the serial to decide whether to transfer the zone.

IP servicesZone transferAuthoritative name serverDNS

IPv6 multicast address ff02::1:ffXX:XXXX built from the last 24 bits of a unicast address. Neighbor solicitations go there instead of to all nodes, so only the target and very few others have to process them.

IPv6NDPDADMulticast

Copies traffic from source ports or VLANs to a destination port where a capture tool is connected. The copies can be dropped when the switch is busy, so it is not a perfect record.

TroubleshootingRSPANERSPANWireshark

Dijkstra's algorithm, which link-state protocols run over the LSDB to build a shortest path tree with the router itself at the root.

OSPFLink stateOSPFLSA

A 32-bit value in every ESP or AH header that tells the receiver which SA to use. Invalid SPI errors usually mean one peer rekeyed or rebooted and the other still holds old SAs.

VPNs and tunnelsSAESP

Two-layer Clos fabric where every leaf connects to every spine and spines never connect to each other. Any two leaves are always two hops apart, all uplinks are used with ECMP, and you scale by adding spines for bandwidth or leaves for ports.

Data centerECMPEast-west trafficThree-tier designOversubscription

Distance vector rule that never advertises a route back out the interface it was learned on, which stops simple loops between two routers. Often turned off on hub interfaces in hub and spoke networks so spokes can learn each other's routes.

EIGRP, RIP and IS-ISPoison reverseDistance vectorDMVPN

Linux socket statistics tool that replaces netstat. ss -tulpn lists listening TCP and UDP sockets with their processes, and ss -ti shows TCP internals such as cwnd and RTT.

Linux networkingEphemeral portTIME_WAIT

The Wi-Fi network name, up to 32 bytes. One AP radio can broadcast several SSIDs, each with its own BSSID, but every extra SSID adds beacon overhead and eats airtime.

WirelessBSSIDAP

Remote access VPN over TLS on TCP 443, or DTLS over UDP, through a browser portal or a client app. It passes through almost any firewall or hotel network, where IPsec often gets blocked.

VPNs and tunnelsTLSIPsecWireGuard

The standby supervisor or stack member keeps a synchronized copy of the active one's state, so it takes over without dropping links. Paired with NSF so neighbors keep forwarding while routing protocols recover.

Gateway redundancyGraceful restartVSSSwitch stacking

Cisco ACL that matches only the source IP, numbered 1 to 99 or 1300 to 1999, or named. Place it close to the destination, because it cannot tell where the traffic is going.

Network securityExtended ACLACLWildcard mask

Tracks every connection in a state table and lets the return traffic through automatically. A stateless filter, such as a plain ACL or a cloud network ACL, checks each packet on its own and needs explicit rules for replies.

Network securityNGFWZone-based firewallConntrack

A manually configured route with AD 1. Simple and predictable, but it does not react to failures unless tracked. Pointing it only at an Ethernet exit interface, with no next hop, makes the router ARP for every destination.

Routing fundamentalsFloating static routeDefault routeObject tracking

The switch receives the whole frame and checks the FCS before forwarding it, so bad frames are dropped. Latency grows with frame size. The default on most campus switches.

Switching and VLANsCut-through switchingFCS

IEEE 802.1D protocol that blocks redundant layer 2 paths to prevent loops, by electing a root bridge and keeping one active path to it from every switch. Ports move through blocking, listening, learning and forwarding, and it takes 30 to 50 seconds to converge.

Spanning treeRSTPRoot bridgeBPDUBroadcast storm

OSPF area that blocks Type 5 external LSAs, and the ABR sends in a default route instead. It cannot contain an ASBR or carry a virtual link.

OSPFTotally stubby areaNSSAABR

An EIGRP route stays active too long because a query got no reply within the active timer (3 minutes by default), so the neighbor that did not answer is reset. Prevented by limiting how far queries travel, with summarization and stub routers.

EIGRP, RIP and IS-ISEIGRP stubDUALRoute summarization

32-bit mask that marks which part of an IPv4 address is network and which is host, written dotted (255.255.255.0) or as a prefix length (/24). A /n subnet holds 2 to the power of (32 - n) addresses, with two fewer usable hosts, except /31 for point-to-point links and /32 for host routes.

IPv4 and subnettingCIDRVLSMWildcard mask

EIGRP's best next hop to a destination, the neighbor giving the lowest feasible distance. It is the route installed in the routing table.

EIGRP, RIP and IS-ISFeasible successorFeasible distanceDUAL

A layer 3 interface for a VLAN on a switch (interface vlan 10), used as that VLAN's gateway. It is up only when the VLAN exists and at least one port in that VLAN is up and forwarding.

Switching and VLANsLayer 3 switchRouter-on-a-stickVLAN

Several physical switches joined by stack cables that act as one logical switch with one control plane and one config. Easier to manage, and EtherChannels can span members for redundancy.

Switching and VLANsVSSSSOMLAG

The attacker sends many SYNs, often from spoofed addresses, and never completes the handshake, filling the server's queue of half-open connections. SYN cookies, rate limits and firewall SYN proxies defend against it.

Network securityThree-way handshakeDDoSTCP flags

Standard for sending log messages, on UDP 514 by default. Severities run 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational and 7 debug, and setting a level logs that level and everything more severe.

IP servicesNTPSNMP

In PVST+ and Rapid PVST+ the low 12 bits of the bridge priority carry the VLAN ID. That is why priority must be a multiple of 4096, and why VLAN 10 at the default priority shows as 32778.

Spanning treeBridge IDRoot bridgePVST+

Cisco-developed AAA protocol on TCP 49 that encrypts the whole payload and keeps authentication, authorization and accounting separate, which allows per-command authorization. The usual choice for device administration.

Network securityRADIUSAAA

Hardware memory that compares a value against every entry in one lookup, with each bit able to be 0, 1 or don't care. Switches keep ACLs, QoS rules and FIB entries in it, and its size limits how many fit.

Switching and VLANsFIBACLData plane

BPDU sent toward the root when a port changes state. The root then tells every switch to age out MAC entries quickly, using forward delay (15 seconds). Host ports flapping without PortFast cause a constant stream of them.

Spanning treeSTPPortFastMAC address table

Reliable, ordered, connection-oriented byte stream with flow control and congestion control. IP protocol 6, with a 20-byte header before options.

TCP, UDP and applicationsThree-way handshakeTCP flagsSliding windowUDP

Control bits in the TCP header. SYN opens a connection, ACK acknowledges, FIN closes gracefully, RST aborts at once, PSH pushes data to the application, URG marks urgent data, and ECE and CWR carry ECN congestion signals.

TCP, UDP and applicationsThree-way handshakeTCPSYN flood

Linux command-line packet capture using BPF filters, for example tcpdump -ni eth0 host 10.0.0.5 and port 443. Write the capture to a file with -w to open it later in Wireshark.

Linux networkingWiresharkSPAN

HashiCorp infrastructure as code tool. You declare resources in HCL, plan shows what will change, apply makes it so, and a state file tracks what really exists. Widely used for cloud networks and less for device config.

Automation and SDNInfrastructure as codeGitIdempotency

File transfer on UDP 69 with no authentication and no encryption. Still used for PXE boot, IP phone configs and loading images in labs.

IP servicesDHCP optionsSCPFTP

Data center model of access, aggregation and core layers built for north-south traffic, with STP and the gateways at aggregation. Server to server traffic crosses several hops and many links sit blocked, which is why spine-leaf replaced it.

Data centerSpine-leafHierarchical network designEast-west traffic

TCP connection setup with SYN, SYN-ACK and ACK. Both sides choose initial sequence numbers and exchange options such as MSS, window scale and SACK permitted.

TCP, UDP and applicationsTCP flagsTCPSYN floodMSS

State kept by the side that closes first, for twice the maximum segment lifetime (60 seconds on Linux), so late packets are discarded and the last ACK can be resent. Thousands of them on a busy client or proxy can use up its ephemeral ports.

TCP, UDP and applicationsEphemeral portTCP flagsss

Encryption and authentication for TCP applications such as HTTPS. TLS 1.3 needs one round trip, allows only forward-secret key exchange and AEAD ciphers, and encrypts the server certificate.

TCP, UDP and applicationsX.509Certificate authorityQUICHTTP

Cisco OSPF option that blocks both Type 3 summary and Type 5 external LSAs, leaving only a default route from the ABR. Configured on the ABR with area N stub no-summary, where N is the area number.

OSPFStub areaNSSAABR

Sends probes with TTL 1, 2, 3 and so on, and each router where the TTL runs out returns ICMP time exceeded, which reveals the path. Cisco and Linux send UDP to high ports by default, while Windows tracert sends ICMP echo. A star means no reply, not necessarily a drop.

TroubleshootingTTLICMPPing

AWS regional hub that connects many VPCs, VPNs and Direct Connect links, with its own route tables for segmentation. It solves the non-transitive limit of VPC peering. Azure Virtual WAN is the nearest equivalent.

Cloud networkingVPC peeringDirect ConnectHub and spoke

IPsec mode that protects only the payload and keeps the original IP header. Used host to host or with GRE over IPsec, where it saves the 20 bytes of a second IP header.

VPNs and tunnelsTunnel modeGRE over IPsecESP

A link that carries many VLANs using 802.1Q tags, usually between switches or to routers, firewalls and hypervisors. Limit the allowed VLAN list to what is needed.

Switching and VLANs802.1QNative VLANDTPAccess port

The point where the network starts trusting QoS markings, ideally the IP phone or the access port. Markings from anything outside it are reset or re-marked.

WAN, MPLS and QoSDSCPCoSVoice VLAN

8-bit IPv4 field that every router lowers by one. At zero the packet is dropped and ICMP time exceeded goes back to the sender, so looping packets cannot circle forever. IPv6 calls it hop limit. Linux starts at 64 and Windows at 128.

IPv4 and subnettingTracerouteIPv4 headerICMP

IPsec mode that encrypts the whole original packet and adds a new outer IP header. The default for site-to-site VPNs between gateways.

VPNs and tunnelsTransport modeESPIPsec

Cisco layer 2 protocol that detects a link passing traffic in only one direction, common with fiber, which would otherwise let STP open a loop. In aggressive mode it err-disables the port when it loses contact with the neighbor.

Spanning treeLoop GuardSTP

Connectionless transport with an 8-byte header and no retransmission, ordering or congestion control. IP protocol 17. Used for DNS, DHCP, voice, streaming and QUIC, where speed matters or the application handles reliability.

TCP, UDP and applicationsTCPQUIC

IPv6 private range fc00::/7, in practice fd00::/8 followed by a random 40-bit global ID so merged networks are unlikely to collide. Not routed on the internet.

IPv6Global unicast addressLink-local addressRFC 1918

The physical IP network that carries an overlay's tunnels. In a VXLAN fabric it is usually OSPF, IS-IS or eBGP between leaves and spines, built for ECMP and fast convergence.

Data centerOverlaySpine-leafECMP

One-to-one delivery from a single source to a single destination address. Almost all traffic is unicast.

Models and mediaMulticastBroadcastAnycast

When a switch has no MAC table entry for a destination, it floods the frame out every port in the VLAN. Heavy flooding often comes from asymmetric routing, where the ARP entry (4 hours on Cisco) outlives the MAC entry (5 minutes), or from a full MAC table.

Switching and VLANsMAC address tableBUM trafficMAC flooding

The router drops packets whose source address would not route back out the interface they arrived on (strict mode), or has no route at all (loose mode). It stops spoofed sources at the network edge.

Network securityrp_filterAsymmetric routingDDoS

Copper Ethernet cable. Cat5e handles 1 Gbps, Cat6 handles 10 Gbps up to about 55 m, and Cat6a handles 10 Gbps at the full 100 m channel length.

Models and mediaAuto-MDIXPoE

EIGRP unequal-cost load balancing. Routes with a metric up to the variance multiplier times the best metric are used too, but only if they are feasible successors. Variance 2 allows paths up to twice the best metric.

EIGRP, RIP and IS-ISFeasible successorECMPK values

Two linked Linux virtual Ethernet interfaces, where whatever goes into one comes out of the other. Used to connect a network namespace or container to a bridge on the host.

Linux networkingNetwork namespacePod

OSPF logical link through a non-backbone transit area that connects a distant area, or a split area 0, to the backbone. Meant as a temporary fix, and it cannot cross a stub area.

OSPFArea 0ABR

Cisco Nexus form of MLAG, known as vPC. Two switches appear as one LACP partner, with a peer link to sync state and a peer keepalive link to avoid split brain, while each keeps its own control plane.

Data centerMLAGLACPVSS

A separate layer 2 broadcast domain on shared switches, with IDs 1 to 4094 (Cisco reserves 1002 to 1005). Each VLAN is normally its own IP subnet.

Switching and VLANs802.1QTrunkAccess portSVI

Reaching another VLAN without going through a router, either by switch spoofing (negotiating a trunk through DTP) or by double tagging (abusing the native VLAN, which works one way only). Disable DTP, hard-set access ports and use an unused native VLAN.

Network securityDTPNative VLAN802.1Q

Using different prefix lengths inside one address block, sizing each subnet to its need, such as /31 or /30 for links and /24 for users. It needs a classless routing protocol.

IPv4 and subnettingCIDRSubnet maskRoute summarization

The 24-bit segment ID in the VXLAN header, which allows about 16 million segments instead of 4094 VLANs.

Data centerVXLANVTEPEVPN

A separate VLAN for IP phones on the same access port as a PC. The switch tells the phone the VLAN through CDP or LLDP-MED, the phone tags its voice traffic, and the PC stays untagged in the data VLAN.

Switching and VLANsAccess portCDPLLDPTrust boundary

Your isolated network in a cloud region, with your own CIDR, subnets, route tables and gateways. Azure calls it a VNet. In AWS each subnet lives in one availability zone.

Cloud networkingVPC peeringInternet gatewaySecurity groupAvailability zone

Private connection between two VPCs. It is not transitive, so A to B and B to C does not give A to C, and the CIDRs must not overlap. Larger setups move to a transit gateway.

Cloud networkingTransit gatewayPrivateLinkVPC

Multipoint layer 2 VPN over MPLS that makes remote sites look like they share one Ethernet switch. EVPN is its modern replacement.

WAN, MPLS and QoSMetro EthernetMPLSEVPN

Private traffic carried securely over a shared network such as the internet. Site-to-site VPNs join networks and remote access VPNs join individual users.

VPNs and tunnelsIPsecSSL VPNWireGuardMPLS L3VPN

Separate routing tables on one router, so overlapping addresses and isolated customers or departments can share hardware. VRF-lite means VRFs without MPLS, carried hop by hop with subinterfaces.

Routing fundamentalsMPLS L3VPNRoute distinguisherEVPN route type 5

Open standard FHRP on IP protocol 112 and multicast 224.0.0.18, with one master and one or more backups. Default priority is 100, preemption is on by default, the virtual MAC is 0000.5e00.01XX, and the virtual IP can be the master's real address.

Gateway redundancyHSRPGLBPFHRP

Cisco feature that joins two Catalyst chassis into one logical switch over a virtual switch link, so downstream switches use one EtherChannel to both. StackWise Virtual is its successor on Catalyst 9000.

Gateway redundancySwitch stackingMLAGSSO

The leaf switch or hypervisor that encapsulates and decapsulates VXLAN traffic, usually sourced from a loopback address.

Data centerVXLANVNIEVPN

IPsec on a routable tunnel interface, so routing protocols and route-based policies work over it. Static VTIs are used site to site and dynamic VTIs for many remote peers. It replaces crypto maps.

VPNs and tunnelsCrypto mapGRE over IPsecIPsec

Cisco protocol that copies VLAN definitions from a server to clients over trunks. A switch added with a higher revision number in the same domain can wipe the VLANs across the network, so many sites use transparent mode or VTPv3.

Switching and VLANsVLANTrunkDTP

Carries layer 2 frames inside UDP (port 4789) over an IP network, with a 24-bit VNI. It adds 50 bytes, so the underlay MTU must be at least 1550 for 1500-byte frames.

Data centerVNIVTEPEVPNOverlay

Cisco-only BGP attribute that is local to the router and never advertised. Highest wins and it is checked first. Default 0, or 32768 for routes the router originates itself.

BGPLocal preferenceBGP best path selection

Ports 0 to 1023, assigned by IANA. FTP 20 and 21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67 and 68, TFTP 69, HTTP 80, NTP 123, SNMP 161 and 162, BGP 179, LDAP 389, HTTPS 443, syslog 514. Registered ports run from 1024 to 49151.

TCP, UDP and applicationsEphemeral portTCPUDP

Inverse mask used in ACLs and OSPF network statements, where 0 bits must match and 1 bits are ignored. 0.0.0.255 matches a /24, and host and any are shortcuts for 0.0.0.0 and 255.255.255.255.

Network securityACLSubnet mask

TCP option sent in the SYN that multiplies the 16-bit window by up to 2 to the 14th power, allowing windows of about 1 GB. Without it the 64 KB limit caps throughput on long, fast paths.

TCP, UDP and applicationsSliding windowBandwidthThree-way handshake

Modern VPN protocol over UDP, built into the Linux kernel, with fixed modern cryptography (Curve25519 and ChaCha20-Poly1305) and peers identified by public keys. Small codebase, simple config, and no cipher negotiation.

VPNs and tunnelsIPsecSSL VPNVPN

Graphical packet analyzer. Display filters such as tcp.analysis.retransmission or ip.addr == 10.0.0.5, Follow TCP Stream and Expert Information help you find the problem in a capture quickly.

TroubleshootingtcpdumpSPAN

Central manager for lightweight APs over CAPWAP. It handles AP configuration, RF management, client authentication and roaming across the whole wireless network.

WirelessCAPWAPAPRoaming

Wi-Fi security using AES-CCMP. Personal mode uses a PSK and Enterprise mode uses 802.1X. Both derive session keys in the 4-way handshake.

WirelessWPA3PSK802.1X4-way handshake

Replaces the PSK exchange with SAE, which resists offline dictionary attacks and gives forward secrecy. Protected management frames are mandatory, Enterprise adds an optional 192-bit mode, and OWE (Enhanced Open) encrypts open guest networks.

WirelessWPA2PSKKRACK

Drops a few packets early as a queue fills, starting sooner for lower-priority markings, so TCP flows back off at different times instead of all at once as with tail drop (global synchronization).

WAN, MPLS and QoSAFQoSCBWFQ

The standard format for public key certificates. A certificate holds the subject, issuer, validity dates, public key and extensions such as subject alternative names and key usage, all signed by the issuing CA.

TCP, UDP and applicationsCertificate authorityTLS

Older and larger 10 Gbps optic module, replaced by the smaller SFP+.

Models and mediaSFPQSFP

Tag-based data format used by NETCONF and by Junos. Verbose but strictly structured, with namespaces and schemas.

Automation and SDNNETCONFJSONYAML

Human-friendly data format based on indentation, used for Ansible playbooks and inventories and for Kubernetes manifests. Wrong indentation and unquoted values that change type are the usual traps.

Automation and SDNJSONAnsibleXML

Data modeling language that defines a device's config and state as containers, lists and typed leaves. NETCONF, RESTCONF and gNMI all carry data shaped by YANG models from vendors, the IETF and OpenConfig.

Automation and SDNNETCONFRESTCONFgNMI

No user or device is trusted just for being on the inside network. Every access is authenticated, authorized for least privilege and checked continuously, based on identity and device posture.

Network securityMicrosegmentationDefense in depth802.1X

Copying a DNS zone from a primary to a secondary server over TCP 53, either a full AXFR or an incremental IXFR. Triggered by a higher SOA serial or a NOTIFY. Restrict it to known secondaries, because it hands out the whole zone.

IP servicesSOA recordAuthoritative name serverDNS

Cisco IOS firewall where interfaces join security zones, and class maps and policy maps decide inspect, pass or drop for each zone pair. Traffic between zones is denied without a policy, while traffic inside one zone is allowed.

Network securityStateful firewallDMZNGFW

A new device boots, gets an address and the location of a script or config through DHCP, downloads its config and software, and joins the network with no hands-on setup.

Automation and SDNDHCP optionsAnsibleSD-WAN