Models and media

Layer by layer

How I say it in the room

I describe each layer by what problem it solves, not by memorized names. Layer 2 answers "how do I get this frame to the next box on this wire". Layer 3 answers "how do I get this packet to the right network anywhere". Layer 4 answers "which program gets it, and does it arrive complete and in order".

A common mnemonic from the bottom is "Please Do Not Throw Sausage Pizza Away". Use it to recall the order, then talk about function.

Side by side

Why the difference matters

• OSI was designed first as a model, then protocols were written to fit it. TCP/IP grew from working protocols, and the model describes what was built.
• In TCP/IP the application handles what OSI calls session and presentation. TLS, for example, is a library the application calls.
• When engineers say "layer 2", "layer 3", "layer 4" or "layer 7" they borrow OSI numbers even though they run TCP/IP. Nobody says "layer 5 problem" in practice.

What layering buys you

• Independence. Each layer offers a service to the one above through a defined interface. IP runs over Ethernet, Wi-Fi, LTE or an MPLS label switched path without changes.
• Interoperability. Vendors build to one layer's standard. A Cisco switch and a Linux host agree on Ethernet without agreeing on anything above it.
• Troubleshooting. "Link is up, I can ARP for the gateway, but I cannot ping past it" puts the fault at layer 3 in a few seconds.
• Encapsulation. Each layer adds its own header, so devices only look as deep as they need. A switch reads the Ethernet header; a router reads the IP header.

The cost

Every layer adds header overhead and some processing. Strict layering also hides useful information, which is why real systems cross layers on purpose: TCP MSS is set from the interface MTU, and QoS marks at layer 3 (DSCP) are mapped to layer 2 (CoS).

A web request on Ethernet

How the receiver knows what is inside

Each header has a field that names the next protocol. This is multiplexing on the way down and demultiplexing on the way up.

• Ethernet EtherType: 0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP, 0x8100 802.1Q tag.
• IPv4 Protocol (IPv6 Next Header): 1 ICMP, 6 TCP, 17 UDP, 47 GRE, 50 ESP, 89 OSPF.
• TCP or UDP destination port: 443 HTTPS, 53 DNS, 22 SSH.

Overhead in numbers

A full 1500-byte IP packet carrying TCP leaves 1460 bytes of application data (1500 minus 20 IP minus 20 TCP). On the wire it costs 1538 bytes: 1500 + 18 Ethernet + 20 preamble and gap.

Comparison

Details worth adding

• A switch floods three things inside the VLAN: broadcasts, unknown unicast and multicast without IGMP snooping.
• A router rewrites the layer 2 header and decrements TTL. A switch forwards the frame unchanged (apart from VLAN tagging).
• A layer 3 switch does both jobs in hardware. Routers usually win on WAN interfaces, deep buffers, large routing tables and features like NAT, VPN and full BGP tables.

Formats you will see

• Cisco: 0050.56a1.2b3c
• Linux and most others: 00:50:56:a1:2b:3c
• Windows: 00-50-56-A1-2B-3C

Special addresses

Locally administered addresses

Phones and laptops now randomize their MAC per Wi-Fi network for privacy. Those addresses have the U/L bit set, so the second hex digit is 2, 6, A or E. This breaks MAC-based tracking, some MAB setups and DHCP reservations.

Worked example

R1 has two LAN interfaces. Gi0/0 connects to switch SW1 with four PCs. Gi0/1 connects to a hub with three PCs. All on one VLAN each.

• Broadcast domains: 2. One per router interface. R1 does not forward broadcasts.
• Collision domains: 6. SW1 has five ports in use (four PCs and the uplink to R1), each its own collision domain. The hub, its three PCs and R1 Gi0/1 share one.

Rules of thumb

Why it matters now

Collision domains are history on a full-duplex switched network. Broadcast domains still matter: every host in one must process every ARP and broadcast, and a loop in one becomes a broadcast storm. That is why we keep VLANs to a few hundred hosts.

Addresses

Details interviewers like

• Directed broadcast to a remote subnet is not forwarded by Cisco routers by default (no ip directed-broadcast has been the default since IOS 12.0) because of smurf attacks.
• Switches flood multicast like broadcast unless IGMP snooping tells them which ports have receivers.
• Anycast in IPv4 is purely a routing trick: the same prefix is announced by BGP from many sites. DNS root servers, public resolvers like 8.8.8.8 and CDNs use it. It suits short transactions; a route change mid-session can move a TCP flow to another instance.

Comparison

What actually changes with scope

Cost per bit, latency and who you call when it breaks. LAN bandwidth is cheap, so you overprovision. WAN bandwidth is expensive and slower to upgrade, so you use QoS, compression and caching. A SAN is a separate idea: a storage network (Fibre Channel or iSCSI), not a size class.

Topologies

Mesh math

10 sites in full mesh need 10 x 9 / 2 = 45 links. 20 sites need 190. That growth is why hub and spoke plus dynamic spoke-to-spoke tunnels (DMVPN, SD-WAN) took over.

Physical versus logical

The cabling shape and the forwarding shape can differ. A hub was a physical star but a logical bus. Token Ring was a physical star with a logical ring inside the MAU.

Definitions with units

Common targets for voice

The usual guidance is one-way delay under 150 ms (ITU-T G.114), jitter under about 30 ms, and loss under 1%. Jitter buffers trade extra delay for smooth playout.

Why throughput falls short of bandwidth

• Header overhead (about 5% for full-size TCP over Ethernet).
• A single TCP flow is capped at window size divided by RTT.
• Loss makes TCP cut its sending rate.
• The bottleneck link anywhere on the path sets the ceiling.

Categories

Choices that matter on a real job

• Multigigabit (802.3bz): 2.5GBASE-T and 5GBASE-T were designed to run on installed Cat5e and Cat6 so Wi-Fi 6 and 7 APs can exceed 1 Gbps without recabling.
• Jacket rating: plenum (CMP) for air-handling spaces, riser (CMR) between floors. Local fire code decides.
• Solid versus stranded: solid core for permanent runs, stranded for patch cords.
• Shielding: shielded cable (F/UTP, S/FTP) helps in high-noise areas but must be grounded correctly.
• Between buildings: use fiber. Copper between buildings invites ground potential differences and lightning damage.

Pinouts

• Straight-through: the same standard on both ends (usually T568B to T568B).
• Crossover: T568A on one end, T568B on the other. That swaps pairs 1-2 and 3-6. A full gigabit crossover also swaps 4-5 with 7-8.
• Rollover (console): pin 1 to 8, 2 to 7 and so on, for RJ-45 console ports.

Auto-MDIX on Cisco

interface GigabitEthernet1/0/10
 speed auto
 duplex auto
 mdix auto

mdix auto is the default. On older Catalyst platforms it only works when speed and duplex are left on auto, so hard-coding speed could silently disable it and bring the link down with the wrong cable.

Fiber types

Typical optics

How I choose

Multimode for short runs inside a building or row when optics cost dominates. Single-mode for anything between buildings, for long runs, and increasingly everywhere, because one plant then supports every future speed.

Useful IEEE amendments to know

Reading a few

• 1000BASE-T: 1 Gbps over four pairs of Cat5e or better, 100 m.
• 10GBASE-SR: 10 Gbps, 850 nm, multimode, 300 m on OM3.
• 25GBASE-CR: 25 Gbps over a twinax DAC, a few meters.
• 100GBASE-LR4: 100 Gbps as four 25 Gbps wavelengths on one single-mode pair, 10 km.

Reading the result on Cisco

SW1# show interfaces status
Port         Name               Status       Vlan       Duplex  Speed Type
Gi1/0/1      PC-101             connected    10         a-full a-1000 10/100/1000BaseTX
Gi1/0/2      OLD-PRINTER        connected    10           half    100 10/100/1000BaseTX

The a- prefix means the value was negotiated. No prefix means it was hard-coded.

Configuring

interface GigabitEthernet1/0/2
 speed 100
 duplex full

If you do this, configure the far end the same way.

Why auto is the modern default

Hard-coding was common in the 1990s when early autonegotiation was buggy. Today autonegotiation is reliable, required for 1000BASE-T, and hard-coding one side is the main way people create duplex mismatches.

Classes

Power-up sequence

1. Detection: the switch applies a low voltage and looks for a signature resistance of about 25 kilohms. A normal NIC does not present it, so it never gets power.
2. Classification: the device draws a set current that tells the switch its class.
3. Power on: the switch applies roughly 44 to 57 V and keeps monitoring the load.
4. Optional refinement: CDP or LLDP-MED lets the device ask for an exact wattage, so the switch can reserve less than the class maximum.

Cisco names

UPOE is Cisco's 60 W four-pair PoE that came before 802.3bt. UPOE+ is Cisco's 90 W offering aligned with 802.3bt Type 4.

Per hop, on each router

1. Check the FCS of the incoming frame. Drop it if it is bad.
2. Strip the Ethernet header and trailer.
3. Check the IPv4 header checksum, decrement TTL. If TTL reaches 0, drop the packet and send ICMP Time Exceeded (type 11, code 0) to the source.
4. Look up the destination in the routing table (longest prefix match) to get the next hop and outgoing interface.
5. Resolve the next hop's MAC address (ARP cache, or ARP request).
6. Recalculate the IPv4 header checksum (TTL changed), build a new frame, compute a new FCS, send it.

What else can change

• NAT at the edge rewrites source IP and often source port.
• Fragmentation: if the outgoing MTU is smaller and DF is clear, IPv4 routers split the packet.
• DSCP may be re-marked by QoS policy.
• VLAN tags are added, removed or changed per link.

What stays the same

Source and destination IP (without NAT), the TCP or UDP header and the payload.

The evidence for each side

• Layer 2 argument. ARP messages are never routed. They have no TTL and no IP header. A router does not forward an ARP request to another network.
• Layer 3 argument. ARP exists only because IP needs a MAC to build a frame. Its fields carry IPv4 addresses, and the ARP cache is consulted by the IP stack.

The ARP packet (IPv4 over Ethernet)

The 28-byte ARP payload is padded to the 46-byte Ethernet minimum.

Reference table

The point behind the question

The interviewer is checking whether you understand encapsulation. BGP is the classic trap: it is a routing protocol, yet it rides on TCP and needs IP reachability to the neighbor before it can even start.

Two different questions hide here

1. Where does it sit in the path? Routed firewall: it is the next hop, has IPs on each side, routes. Transparent firewall: it bridges between two VLANs on the same subnet and is invisible to traceroute.
2. How deep does it look? Packet filter (stateless ACL): layers 3 and 4, each packet on its own. Stateful firewall: layers 3 and 4 plus a connection table, so return traffic is allowed automatically. NGFW: application identification, URL filtering, IPS, TLS inspection, user identity. That is layer 7.

Other devices

1. Before any packet leaves

The browser parses https://www.example.com/, checks HSTS and its own caches. The OS checks its DNS cache and the hosts file.

2. Getting off the local network

The host compares the resolver's IP with its own address and mask. If the resolver is on another subnet, the frame goes to the default gateway. If the gateway MAC is not in the ARP cache, the host broadcasts an ARP request (destination ff:ff:ff:ff:ff:ff) and the gateway replies with its MAC by unicast.

3. DNS

The host sends a query, usually UDP port 53, to its recursive resolver. On a cache miss the resolver walks the hierarchy: a root server, the .com TLD servers, then the authoritative servers for example.com. It returns A and AAAA records with TTLs, and both the resolver and the host cache them.

4. TCP

SYN, SYN-ACK, ACK to port 443 from an ephemeral source port. Each side announces its MSS and window options. With HTTP/3 the browser uses QUIC over UDP 443 instead, which merges transport and TLS setup.

5. TLS 1.3

ClientHello with SNI (the server name), supported ciphers and a key share. The server answers with ServerHello, its certificate chain and Finished. The browser validates the chain up to a trusted root CA and checks the name. One round trip, then the session keys are in place.

6. HTTP

GET / with a Host header. The server answers 200 OK with HTML. The browser parses it and fetches CSS, scripts and images, reusing connections (HTTP/2 multiplexes many requests on one connection).

7. What the network does underneath

• Access switches forward by destination MAC and VLAN.
• Every router hop rewrites source and destination MAC, decrements TTL, and picks the next hop by longest prefix match.
• The edge firewall or router translates the private source address and port to a public one (PAT) and keeps state so the reply comes back in.
• Replies may take a different path back (asymmetric routing), which stateful devices must tolerate.

Proof per layer

Picking the approach

• Bottom up is thorough but slow. Good after cabling work or for a single port.
• Top down starts where the user is. Good when many users are fine and one app fails.
• Divide and conquer starts in the middle. A successful ping clears layers 1 to 3 at once.
• Follow the path hop by hop, using the routing table and ARP at each device.

Form factors

Things that bite

• Speed support: an SFP+ port often accepts a 1G SFP, but an SFP port never runs an SFP+ at 10G. Confirm per platform.
• Breakout: a 40G or 100G port can split into four 10G or 25G ports with a breakout cable, if the platform supports it and you configure it.
• Vendor coding: switches read the module's EEPROM. Cisco IOS rejects unsupported modules and can err-disable the port with reason gbic-invalid.
• Both ends must match: SR to SR, LR to LR. Different reach classes do not interoperate reliably.
• DOM: digital optical monitoring reports temperature, voltage, laser bias, Tx and Rx power. show interfaces transceiver reads it.

Field rules

• Inspect before you connect. Contamination is the most common cause of optical errors and loss. Use a fiber scope, clean with a proper cleaner, inspect again.
• Polarity. Transmit on one end must meet receive on the other. Duplex patch cords are A to B. If a link stays down with both optics healthy, swapping the two strands at one end is a quick test.
• MPO polarity follows TIA methods A, B and C. Mixing cassette and trunk types from different methods is a classic cause of dark links in new data center builds.
• Bend radius. Tight bends leak light, especially at 1550 nm.

Why APC and UPC must not mix

The angled face of an APC does not sit flush against a flat UPC face. You get an air gap, high loss and possible damage to the end faces.

Mechanism

• The full-duplex side transmits whenever it has data. It never listens for collisions.
• The half-duplex side runs CSMA/CD. If it is sending and a frame arrives, it calls that a collision, sends a jam signal and stops. If that happens after the first 512 bits (64 bytes), it is a late collision, and the MAC does not retry the frame. Loss is left to TCP.
• The full-duplex side receives the truncated frame plus jam, which fails the FCS: CRC errors and runts.

On the counters

Full-duplex side:

SW1# show interfaces GigabitEthernet1/0/2 | include CRC|runts
     112 runts, 0 giants, 0 throttles
     845 input errors, 733 CRC, 0 frame, 0 overrun, 0 ignored

Half-duplex side:

SW2# show interfaces FastEthernet0/1 | include collision
     0 output errors, 2290 collisions, 3 interface resets
     0 babbles, 418 late collision, 1022 deferred

And the CDP hint on SW1:

%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/2 (not half duplex), with SW2 FastEthernet0/1 (half duplex).

Why ping hides it

Small, occasional packets rarely overlap with traffic in the other direction. A file copy keeps both directions busy (data one way, ACKs the other), so collisions explode.

Fix

Make both sides the same: both auto (preferred) or both hard-coded to the same speed and duplex. Then clear counters and confirm CRC and late collisions stop increasing.

Backoff

After the nth collision the sender waits a random number of slot times from 0 to 2^k - 1, where k is the smaller of n and 10. After 16 failed attempts it drops the frame and counts an excessive collision. At 10 Mbps a slot time is 51.2 microseconds; at 100 Mbps it is 5.12 microseconds.

Normal versus late collisions

A normal collision happens within the first 64 bytes, while the frame could still be colliding with a sender at the far end of a legal network. A late collision happens after that point. On a correctly built half-duplex network it never happens, so it signals a duplex mismatch or a segment that is too long.

Wireless is different

A radio cannot hear a collision while it transmits, so 802.11 uses collision avoidance: listen, random backoff before sending, and an ACK for every unicast frame.

A Catalyst interface with a physical problem

SW1# show interfaces GigabitEthernet1/0/24
GigabitEthernet1/0/24 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is 7c21.0e44.1a18 (bia 7c21.0e44.1a18)
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
     5 minute input rate 412000 bits/sec, 61 packets/sec
     5 minute output rate 389000 bits/sec, 58 packets/sec
     1840122 packets input, 1306214450 bytes, 0 no buffer
     0 runts, 0 giants, 0 throttles
     4471 input errors, 4471 CRC, 0 frame, 0 overrun, 0 ignored
     0 output errors, 0 collisions, 2 interface resets

CRC equals input errors, no runts, full duplex: a cabling or port problem, not a mismatch.

What each counter points to

Method

clear counters GigabitEthernet1/0/24, then watch for a few minutes. Old totals since boot tell you nothing about now. On Catalyst, show interfaces counters errors gives a compact table per port.

Look at the switch

SW1# show power inline
Module   Available     Used     Remaining
          (Watts)     (Watts)    (Watts)
------   ---------   --------   ---------
1           437.0      431.8         5.2
Interface Admin  Oper       Power   Device              Class Max
                            (Watts)
--------- ------ ---------- ------- ------------------- ----- ----
Gi1/0/1   auto   on         6.3     IP Phone 8845       2     30.0
Gi1/0/2   auto   on         25.5    AP-2F-EAST          4     30.0
Gi1/0/3   auto   off        0.0     n/a                 n/a   30.0

Only 5.2 W remain. A new PoE+ AP plugged into Gi1/0/3 cannot be powered.

Fixes, in order

• Add or upgrade the power supply, or move devices to a switch with budget.
• Set priorities so critical devices win when the budget runs short (platform feature, often power inline priority or a stack power policy).
• Make sure the port is not capped:

  interface GigabitEthernet1/0/3
   power inline auto max 30000

  The value is in milliwatts.
• Check the AP side: many APs drop to a reduced mode (fewer spatial streams, USB off, one radio off) when they get PoE instead of PoE+.
• Inspect the cable. Long or poor runs and old injector setups cause voltage drop and flapping.

Planning rule

Sum the class maximum of every device you expect, not the typical draw, unless you use CDP or LLDP negotiation and have measured. Leave headroom for a power supply failure if the switch has two.

Worked numbers

What you can and cannot change

• Propagation only changes with a shorter path (better routing, a closer region).
• Serialization matters on slow links. It is why voice over low-speed WAN needed fragmentation and interleaving.
• Queuing is where QoS, buffer tuning and avoiding congestion help. Deep buffers that stay full cause bufferbloat: high latency without loss.

Examples that do not fit neatly

• MPLS: a label stack inserted between the Ethernet header and IP. Usually called layer 2.5.
• Tunnels: GRE puts IP inside IP. VXLAN puts an Ethernet frame inside UDP port 4789. IPsec ESP is an IP protocol that carries an entire IP packet. The layer count repeats inside the tunnel.
• QUIC: transport features (streams, loss recovery, congestion control) live in the application over UDP. TLS 1.3 is built into its handshake.
• Layers 5 and 6: in practice they live inside applications and libraries. Few engineers ever name a "session layer" problem.
• Devices: a layer 3 switch, an NGFW reading layer 7 and a load balancer rewriting HTTP headers all span several layers.

Why the model still earns its place

It gives a shared language ("is this a layer 1 or layer 3 problem?"), it orders troubleshooting, and it explains why a device can or cannot see a field: a switch never looks at the TCP port unless a feature tells it to.

Conversions to know

Worked example

A single-mode optic's datasheet gives minimum Tx power -6 dBm and Rx sensitivity -14 dBm, so the power budget is 8 dB. The link is 12 km with 4 connector pairs and 2 fusion splices.

Margin is 8 - 6.4 = 1.6 dB. It will probably link up today, but it is below a 3 dB design margin. I would reduce connector count or choose an optic with a larger budget.

Reading it on a switch

show interfaces transceiver lists Tx and Rx power per port with alarm and warning thresholds. Compare the Tx of one end with the Rx of the other: the difference is the real link loss.

Too much light

A long-reach optic on a short patch can overload the receiver. Use an inline attenuator (for example 5 or 10 dB) or a shorter-reach optic.

Diagnosing it

SW1# show interfaces GigabitEthernet1/0/14 status
Port         Name               Status       Vlan       Duplex  Speed Type
Gi1/0/14     Printer-2F         connected    20         a-full  a-100 10/100/1000BaseTX

The device supports gigabit, yet negotiation settled at a-100. Run the built-in cable test (it may bounce the link on some platforms, so do it in a window):

SW1# test cable-diagnostics tdr interface GigabitEthernet1/0/14
SW1# show cable-diagnostics tdr interface GigabitEthernet1/0/14

The TDR result shows each pair's status (Normal, Open, Short) and approximate distance to a fault.

Other causes

• A patch cord or wall plate wired with only two pairs.
• The far device only advertises 100 Mbps, or someone set speed 100 on one end.
• An old Cat5 cable with poor crosstalk performance at gigabit.

Checklist

Checking FEC on other platforms

SW1(config)# interface Ethernet1
SW1(config-if-Et1)# error-correction encoding reed-solomon

ethtool --show-fec ens1f0
ethtool --set-fec ens1f0 encoding rs

Server NICs and switches often pick different FEC defaults, which is why switch-to-server 25G links are the classic case.

The math

• BDP = bandwidth x RTT = 10^9 bit/s x 0.1 s = 10^8 bits = 12.5 MB.
• Max throughput of one flow = window / RTT. With 65,535 bytes: 65,535 x 8 / 0.1 = about 5.2 Mbps.
• TCP window scaling (RFC 7323) shifts the 16-bit window by up to 14 bits, allowing windows up to about 1 GB.

What else limits a long fat network

• Loss. One loss halves (Reno) or cuts (CUBIC) the congestion window, and regrowth takes many RTTs on a long path.
• Socket buffers. Operating systems autotune, but a host with small fixed buffers stays slow.
• Middleboxes that strip the window scale option during the handshake.

What to say when users complain

Measure RTT and loss before buying bandwidth. Parallel streams, tuned buffers, a modern congestion control such as BBR, or a server closer to the users fix more of these cases than a bigger circuit.

Per-frame cost on the wire

Small versus large frames at 1 Gbps

Efficiency

• IP efficiency with full frames: 1500 / 1538 = 97.5%.
• TCP payload efficiency: 1460 / 1538 = 94.9%, or about 94.1% with the 12 bytes of TCP timestamps.
• So a 1 Gbps link moves about 949 Mbps of TCP payload at best.

Why it matters

Forwarding engines are limited in packets per second as well as bits per second. A box rated "10 Gbps" may only reach that with large packets. Firewalls and software routers are the usual suspects.