One Track from Zero to Professional

Start from zero and build networks you can explain, configure, and troubleshoot. This single track takes you from networking fundamentals all the way to professional-level routing, switching, and services. Every session lists its sources — the textbook and the official certification guides — and the Learning Resources section gathers the whole study stack.

What Is a Network?

Sources: Kurose & Ross §1.1–1.3 · Odom Vol 1, Part I

Theory

A network connects devices so they can exchange data using agreed rules called protocols. Your laptop, a printer, and a file server can share a local area network (LAN). A wide area network (WAN) connects networks over a larger area. The internet is a collection of interconnected networks.

• Endpoint: a device that sends or receives data, such as a laptop or phone. A server provides a service to clients.
• Layer 2 switch: connects devices in a LAN and forwards Ethernet frames using MAC addresses.
• Router: forwards IP packets between networks using a routing table. A Layer 3 switch can also route.
• Access point: connects wireless clients to a network. An AP and a router perform different jobs, even when one home device combines them.
• Firewall: permits or blocks traffic according to a security policy.

Think of an office: the switch connects desks inside the office; the router provides a path to other networks. Wi-Fi is one way to reach that network, not another name for the internet.

Demonstration

Trace an example request from left to right. The intermediate network may contain many more devices than this simplified drawing.

Here is the same picture as a topology diagram — draw this in your lab notebook:

Endpoints talk through the switch; the router is only needed to leave the LAN.

Now unplug only the internet uplink. Two correctly configured computers on the same LAN can still communicate. Their local traffic does not need to travel through the ISP.

Practice

1. Draw two PCs and a printer connected to a switch.
2. Add a router connecting that LAN to an ISP.
3. Add an access point and a wireless laptop.
4. Mark the path for PC-to-printer traffic and laptop-to-internet traffic.

Wrap Up

Name the job each device performs before trying to configure it.

Packets, Layers, and Ethernet

Sources: Kurose & Ross §1.5 · Odom Vol 1, Part I

Theory

Layers divide communication into smaller jobs. In the OSI model, Layers 7–5 cover application, presentation, and session functions; Layer 4 is transport; Layer 3 is network; Layer 2 is data link; and Layer 1 is physical. The TCP/IP model groups these into application, transport, internet, and link layers.

• Transport port: identifies a service or conversation at a host. TCP port 443 is commonly used for HTTPS; HTTP/3 uses QUIC over UDP, commonly on port 443.
• IP address: identifies an interface at the network layer and helps routers select a path.
• MAC address: is used for delivery on an Ethernet link. A routed packet is placed into a new link-layer frame at each routed hop.

Each layer adds its own header around the data from above — that is encapsulation.

TCP establishes a connection and provides ordered delivery, acknowledgments, and retransmission. UDP sends datagrams without those transport-level guarantees; an application can add its own reliability. Ping uses ICMP, not a TCP or UDP port.

A switch learns a frame’s source MAC address on the incoming port. It looks up the destination MAC to choose the outgoing port. Unknown unicast frames are flooded to other forwarding ports in the same VLAN; broadcast frames are also flooded within that VLAN.

Demonstration

For a remote destination, a host normally sends the frame to its gateway’s MAC address while keeping the remote server as the packet’s destination IP. In IPv4 Ethernet networks, ARP discovers the local next-hop MAC address. NAT, when used, can change IP addresses; ordinary routing by itself does not.

PC sends to a server on a different subnet
Destination IP:  remote server
Destination MAC: local default gateway

PC sends to another PC on the same subnet
Destination IP:  other PC
Destination MAC: other PC

Practice

1. Write the OSI layers in order from physical to application.
2. For a remote web server, name the destination of the first Ethernet frame and of the IP packet.
3. Explain what a switch does with a destination MAC it has not learned.

Wrap Up

Ports describe transport conversations, IP addresses support routing, and MAC addresses support delivery on the local link.

Delay, Loss, and Throughput

Sources: Kurose & Ross §1.4 · Odom Vol 1, Part I

Theory

Every router adds delay to a packet in four ways. Processing delay covers header inspection and error checks (microseconds). Queuing delay is time spent waiting in the output buffer — it is the only delay that varies with congestion. Transmission delay is pushing the bits onto the link, and Propagation delay is the time the signal takes to travel the medium.

d_trans = L / R            packet length / link rate
d_prop  = d / s            distance / propagation speed
d_nodal = d_proc + d_queue + d_trans + d_prop

Traffic intensity = La / R   (a = average arrival rate)
Throughput = min(R1, R2, ..., RN)

d_nodal = process + queue + transmit + propagate. Only the queue part grows with congestion.

Keep the traffic intensity below 1. As La/R approaches 1, queuing delay grows sharply; above 1 the queue never drains, delay grows without bound, and when the buffer is full new packets are dropped.

Over N uncongested links, end-to-end delay is roughly N × (d_proc + d_trans + d_prop). Round-trip time (RTT) is the time for a packet to go out and its reply to return.

Caravan analogy: ten cars drive at 100 km/h; a tollbooth takes 12 seconds per car. The cars spread out, but the last car still arrives 120 seconds + 1 hour later. The tollbooth is the transmission delay, the road is propagation.

Demonstration

Send a 1,500-byte packet over a 10 Mbps link, then across 2,500 km of fiber:

Packet: 1500 bytes = 12,000 bits on a 10 Mbps link
d_trans = 12,000 / 10,000,000 = 1.2 ms
d_prop  = 2,500,000 m / 200,000,000 m/s = 12.5 ms

The propagation delay is ten times the transmission delay.
Typical ping RTT ≈ 2 × (d_prop + d_trans) + queuing.

Throughput = min(100, 10, 50) = 10 Mbps — the slowest pipe wins.

Run a traceroute to any public site. Each hop prints three RTTs. Find the hop where the time jumps most — that is usually the long-haul or transoceanic link, and the jump is propagation delay, not a fault.

Practice

1. Calculate d_trans for a 64-byte frame on a 1 Gbps link.
2. Calculate d_prop for 500 km of fiber at 2 × 10⁸ m/s.
3. A path has three links at 100 Mbps, 10 Mbps, and 50 Mbps. What is the throughput?
4. A queue's traffic intensity is 1.3. What happens to delay and loss?

d_trans = 64 × 8 / 1,000,000,000 = 512 ns
d_prop  = 500,000 m / 200,000,000 m/s = 2.5 ms
Throughput = min(100, 10, 50) = 10 Mbps
Intensity > 1 → the queue grows without bound →
delay rises and packets are eventually dropped

Wrap Up

Find the bottleneck before blaming the application — throughput is set by the slowest link, and long-haul delay by the longest path.

IPv4 Addresses and Default Gateways

Sources: Kurose & Ross §4.3.2 · Odom Vol 1, Part IV

Theory

An IPv4 address has 32 bits written as four decimal octets, each from 0 to 255. A prefix length tells you how many bits describe the network. With 192.168.10.20/24, the first 24 bits form the network portion and the remaining 8 bits form the host portion.

Host:            192.168.10.20/24
Subnet mask:     255.255.255.0
Network:         192.168.10.0
Usable hosts:    192.168.10.1 through 192.168.10.254
Broadcast:       192.168.10.255
Example gateway: 192.168.10.1

192.168.10.20/24 — the /24 marks where the network part ends.

The host uses its mask to decide whether a destination is local. For a remote destination without a more specific route, it sends toward the default gateway. The gateway must be reachable on the local link. Its address does not have to end in .1.

The private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12 (172.16–172.31), and 192.168.0.0/16. These are not globally routed on the public internet. Private addresses do not provide security by themselves.

DHCP can supply an address, mask, gateway, and DNS server automatically. DNS translates names into records such as IP addresses; it does not forward your packets.

Demonstration

PC-A is 192.168.10.20/24. PC-B is 192.168.10.30/24, so PC-A can send directly after resolving PC-B’s MAC. A destination of 192.168.20.30 is outside PC-A’s /24 and needs routing.

On Windows, inspect your current settings without changing them:

ipconfig /all
route print
arp -a

Find the active adapter, IPv4 address, subnet mask, default gateway, and DNS servers. On Linux, use ip address and ip route. A disconnected adapter may have no useful configuration.

Practice

1. For 192.168.50.25/24, write the network, broadcast, and usable host range.
2. Decide whether 192.168.50.100 and 192.168.51.100 are local destinations.
3. Choose an unused usable address for a router interface in this subnet.

Wrap Up

Check the address and mask together. A similar-looking address is not enough to decide whether two hosts share a subnet.

Subnetting Without Guessing

Sources: Kurose & Ross §4.3.2 · Odom Vol 1, Part IV

Theory

Subnetting uses additional network bits to divide an address block into smaller networks. Moving from /24 to /26 borrows two bits and creates four equal subnets. Six host bits remain, giving 64 addresses per subnet.

Last-octet bit values: 128 64 32 16 8 4 2 1
/26 mask last octet:     1  1  0  0 0 0 0 0 = 192
Mask:                 255.255.255.192
Block size:           256 - 192 = 64
Addresses per subnet: 2^(32 - 26) = 64
Usable hosts:         64 - 2 = 62

Four equal /26 blocks — the two borrowed bits split the /24 four ways.

For ordinary IPv4 LAN subnets, reserve the network address and broadcast address. The usual host-count formula is 2 to the power of the host bits, minus 2. /31 point-to-point links and /32 host routes are special cases, so do not apply that formula blindly.

Demonstration

Split 192.168.10.0/24 into /26 blocks. The last-octet boundaries increase by 64:

Network             Usable last octets   Broadcast
192.168.10.0/26      .1   through .62     192.168.10.63
192.168.10.64/26     .65  through .126    192.168.10.127
192.168.10.128/26    .129 through .190    192.168.10.191
192.168.10.192/26    .193 through .254    192.168.10.255

192.168.10.77/26 falls between .64 and .127. Its network is .64, its broadcast is .127, and it is a usable host address. Two hosts with last octets .62 and .65 now belong to different subnets.

Practice

1. Calculate the mask and usable host count for /27.
2. Find the network, first host, last host, and broadcast for 192.168.20.70/27.
3. Choose the smallest ordinary subnet that can hold 50 hosts.

/27: mask 255.255.255.224; block size 32; 30 usable hosts
192.168.20.70/27:
  Network:    192.168.20.64
  First host: 192.168.20.65
  Last host:  192.168.20.94
  Broadcast:  192.168.20.95
50 hosts: /26 (62 usable); /27 has only 30 usable

Wrap Up

Find the block boundary first, then derive the broadcast and usable range. Always check that the host fits inside that range.

IPv6 Addressing and Subnetting

Sources: Kurose & Ross §4.3.4 · Odom Vol 1, Part VII

Theory

IPv6 uses 128-bit addresses written as eight groups of four hexadecimal digits. Two shorthand rules apply: drop the leading zeros inside each group, and replace the longest run of all-zero groups with :: (usable only once per address).

2001:0db8:0000:0000:0000:0000:0000:0001
→ 2001:db8::1

fe80:0000:0000:0000:0a00:27ff:fe3e:9c1a
→ fe80::a00:27ff:fe3e:9c1a

Eight 16-bit hextets — compress the zero run once to get 2001:db8::1.

• Link-local (fe80::/10): every interface has one automatically. It never leaves the local link and is used by neighbor discovery.
• Global unicast (2000::/3): public, routable addresses — the IPv6 equivalent of public IPv4.
• Unique local (fc00::/7): private addressing for internal use, like RFC 1918 in IPv4.
• Multicast (ff00::/8): ff02::1 reaches all nodes, ff02::2 all routers. IPv6 has no broadcast.

The standard subnet size is /64, and sites typically receive a /48 — leaving 2^16 = 65,536 possible /64 subnets. Hosts can use SLAAC (router advertisement + interface ID), DHCPv6, or static addressing. Neighbor Discovery Protocol (NDP) replaces ARP: a neighbor solicitation asks "who has this IPv6 address?", and a neighbor advertisement answers with the MAC address.

Demonstration

Enable IPv6 routing and assign an address on a Packet Tracer router:

enable
configure terminal
ipv6 unicast-routing
interface gigabitethernet0/0/0
 ipv6 address 2001:db8:1::1/64
 no shutdown
end
show ipv6 interface brief

Each interface also self-assigns a link-local address the moment IPv6 is enabled — show ipv6 interface brief lists both. Set a PC's IPv6 configuration to Automatic and it receives a global address through SLAAC; then ping the router's global address 2001:db8:1::1.

Practice

1. Compress 2001:0db8:0000:0000:0000:0000:1428:57ab.
2. How many /64 subnets are available from one /48 block?
3. Configure IPv6 on a router interface in Packet Tracer and ping it from a PC using auto-configuration.
4. Explain why IPv6 does not need ARP.

2001:0db8:0000:0000:0000:0000:1428:57ab
→ 2001:db8::1428:57ab

One /48 contains 2^(64-48) = 2^16 = 65,536 /64 subnets

NDP (neighbor solicitation + neighbor advertisement)
replaces ARP for IPv6 address resolution

Wrap Up

IPv6 has no broadcast and every interface has a link-local address — learn to read both before you ping.

Your First Cisco Switch Configuration

Sources: Odom Vol 1, Part II

Theory

Cisco IOS uses modes. The prompt ending in > indicates user EXEC. Use enable to enter privileged EXEC, shown as #. Configuration mode changes settings; interface configuration mode changes a particular interface.

exit moves up one level; end returns straight to privileged EXEC.

Use a fresh simulated 2960 switch in Cisco Packet Tracer for this lesson. Open its CLI tab, decline the initial setup dialog if it appears, then press Enter. These exercises assume default settings and interface names such as FastEthernet0/1; other models may use different names.

Get Packet Tracer through Cisco Networking Academy. A Cisco account may be required. The course contains lab instructions; the simulator runs separately on your computer.

Demonstration

Enter these commands one line at a time. If no endpoint is connected yet, the port can remain down even after no shutdown.

enable
configure terminal
hostname SW1
interface fastethernet0/1
 description Link to PC-A
 no shutdown
exit
end
show interfaces status
show running-config
copy running-config startup-config

At the destination filename prompt, press Enter to accept startup-config. Running-config is the current configuration in RAM; startup-config is the saved configuration loaded at boot. The copy command saves the current configuration; it is not a factory reset.

CLI helpers: use ? for context-sensitive help, Tab to complete a unique command, exit to move up one configuration level, and end to return to privileged EXEC. Press Space for another page of long output.

Practice

1. Rename the switch to LAB-SW1.
2. Describe FastEthernet0/2 as Link to PC-B.
3. Use show running-config to confirm both changes.
4. Save, then use show startup-config to check the saved hostname and description.

enable
configure terminal
hostname LAB-SW1
interface fastethernet0/2
 description Link to PC-B
exit
end
show running-config
copy running-config startup-config
show startup-config

Wrap Up

Read the prompt, make a small change, verify the result, and save deliberately.

Build and Troubleshoot Your First LAN

Sources: Kurose & Ross §6.4 · Odom Vol 1, Part II

Theory

We will build a single subnet with one switch and two PCs. Both switch ports remain in the default VLAN. A switch does not need a management IP address to forward Ethernet frames between these PCs. No router, default gateway, or DNS server is needed for this local IP test.

The first ping may time out while ARP resolves — retry and it replies.

Ping sends ICMP Echo Requests and listens for replies. A successful ping is evidence of IP reachability at that moment; it does not prove that a website, DNS, or every application is working.

Demonstration

1. Add two PC-PT endpoints and one 2960 switch to a new Packet Tracer workspace.
2. Use copper straight-through cables: PC-A FastEthernet0 to SW1 FastEthernet0/1; PC-B FastEthernet0 to SW1 FastEthernet0/2.
3. Wait for the links to turn green. Switch ports may take time to begin forwarding.
4. Open Desktop → IP Configuration on each PC. Choose Static, set the addresses above, and use 255.255.255.0 as both masks. Leave gateway and DNS blank.
5. Open PC-A’s Desktop → Command Prompt and run the commands below.

ipconfig
ping 192.168.10.20
arp -a

Expect replies from 192.168.10.20. An initial attempt may time out while ARP or link convergence completes; retry once the links are ready. Persistent timeouts need investigation. Check the switch CLI:

enable
show interfaces status
show mac address-table dynamic

Expect the two connected ports to show connected status and learned PC MAC addresses in VLAN 1 after traffic passes. The exact addresses and output formatting vary.

In Simulation mode, filter for ARP and ICMP and send another ping. If ARP is already cached, you may only see ICMP; use a fresh lab state to observe the initial ARP request and reply. Save your topology as first-lan.pkt.

Practice

1. Ping PC-A from PC-B and record the result.
2. Change PC-B to 192.168.20.20/24, then ping that new address from PC-A. Explain the failure.
3. Restore PC-B to 192.168.10.20/24 and confirm replies return.
4. Add PC-C as 192.168.10.30/24 on Fa0/3. Verify all three pairs.
5. Record the symptom, cause, fix, and verification for the fault you introduced.

Wrap Up

A working lab includes evidence: correct addressing, connected ports, learned MAC addresses, and successful tests in both directions.

Ethernet, ARP, and Switch Forwarding

Sources: Kurose & Ross §6.4 · Odom Vol 1, Part II

Theory

Ethernet frames carry the IP packet across one link. The frame has a fixed structure, and every field has a job:

Preamble   Dest MAC    Src MAC    Type        Data           FCS
8 bytes    6 bytes     6 bytes    2 bytes     46–1500 bytes  4 bytes
                                      0x0800 = IPv4
                                      0x0806 = ARP

• MAC address: 48 bits written in hex — the first 24 bits are the vendor (OUI), the rest the device. The broadcast MAC is FF-FF-FF-FF-FF-FF.
• Type: tells the receiver which protocol is inside. MTU is 1,500 bytes, so larger packets are fragmented upstream.
• FCS: a CRC the receiver checks; damaged frames are silently dropped.

ARP answers one question: "which MAC address owns this IP address?" — and only on the same subnet. A host broadcasts an ARP request ("who has 192.168.10.20? tell 192.168.10.10"); the owner replies with a unicast ARP reply, and both sides cache the mapping for a few minutes.

A switch learns the source MAC of every frame it receives, then decides using the destination MAC: known on another port → forward; known on the same port → filter; unknown → flood to all other ports in the VLAN.

Demonstration

After this exchange, ping works without ARP until the cache expires.

In Packet Tracer, ping PC-B from PC-A, then check both tables:

! On the switch
enable
show mac address-table dynamic

! On PC-A
arp -a

The MAC table should map each PC's MAC to its switch port. arp -a should show 192.168.10.20 next to PC-B's MAC address.

Practice

1. Draw the Ethernet frame and label every field with its size.
2. Which destination MAC does an ARP request use, and why?
3. A switch receives a frame whose destination MAC it has not learned. What happens?
4. Ping two PCs in Packet Tracer, then verify the MAC table and the ARP cache.

Wrap Up

The switch forwards by MAC, ARP finds the MAC, and off-subnet traffic just needs the gateway's MAC.

VLANs and Access Ports

Sources: Kurose & Ross §6.4.4 · Odom Vol 1, Part III

Theory

A VLAN is a logical Layer 2 network. It lets one physical switch carry several separate broadcast domains. Devices in different VLANs cannot communicate through Layer 2 switching alone; they need a Layer 3 routing function.

• Access port: carries traffic for one data VLAN. An end host normally connects to an access port.
• Voice VLAN: lets a phone use a separate VLAN while a PC connected through the phone uses the data VLAN.
• Default VLAN: VLAN 1 exists on many Cisco switches by default. Plan management and user VLANs deliberately instead of treating VLAN 1 as a security boundary.
• Broadcast domain: broadcasts stay inside a VLAN unless a router or Layer 3 switch forwards them.

VLAN numbers are local to the switching domain. Giving two ports the same VLAN number on one switch does not extend that VLAN to another switch; the inter-switch link must carry it.

Demonstration

Use a 2960 switch and create VLAN 10 for students and VLAN 20 for staff. Configure endpoint ports as access ports:

enable
configure terminal
vlan 10
 name STUDENTS
vlan 20
 name STAFF
interface fastethernet0/1
 description Student PC
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
interface fastethernet0/2
 description Staff PC
 switchport mode access
 switchport access vlan 20
end
show vlan brief

show vlan brief should list VLANs 10 and 20 and place the configured ports in the expected VLAN. PortFast is for an edge port connected to an endpoint; do not enable it on a switch-to-switch link.

Give two student PCs addresses such as 192.168.10.10/24 and 192.168.10.20/24. They should communicate through the switch. A staff PC in VLAN 20 belongs to a different broadcast domain, even when it is plugged into the same physical switch.

Practice

1. Create VLAN 10 named STUDENTS and VLAN 20 named STAFF.
2. Place Fa0/1 and Fa0/2 in VLAN 10, then place Fa0/3 in VLAN 20.
3. Verify membership with show vlan brief.
4. Connect two PCs in VLAN 10 and test them with ping.
5. Explain why a PC in VLAN 20 cannot ping them yet.

show vlan brief
show interfaces fastethernet0/1 switchport
!
! Fa0/1 should report access VLAN 10
! Fa0/3 should report access VLAN 20

Wrap Up

VLAN membership determines the local Layer 2 boundary. Verify port mode and access VLAN before troubleshooting IP addresses.

Trunks, 802.1Q, and Discovery

Sources: Kurose & Ross §6.4.4 · Odom Vol 1, Part III

Theory

A trunk carries traffic for multiple VLANs over one link between network devices. Ethernet frames are identified with an IEEE 802.1Q VLAN tag while they cross the trunk. The receiving switch removes or interprets the tag before forwarding the frame inside the VLAN.

• Native VLAN: the VLAN sent untagged on an 802.1Q trunk. Both ends must agree on it.
• Allowed VLANs: the list of VLANs permitted on a trunk. Restricting the list reduces unnecessary broadcasts and limits mistakes.
• CDP: Cisco Discovery Protocol shares information with directly connected Cisco neighbors.
• LLDP: an open IEEE discovery protocol useful when devices come from different vendors.

A trunk preserves VLAN identity across a device-to-device link. It is not simply a faster access port.

Demonstration

Connect SW1 Fa0/24 to SW2 Fa0/24. Create VLANs 10 and 20 on both switches, then configure both ends the same way:

enable
configure terminal
vlan 10
 name STUDENTS
vlan 20
 name STAFF
vlan 99
 name NATIVE
interface fastethernet0/24
 description Trunk to SW2
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99
 no shutdown
end
show interfaces trunk
show interfaces fastethernet0/24 switchport

If your simulator asks for an encapsulation command, choose 802.1Q where the platform supports it. Many modern switches use 802.1Q automatically.

Verify the neighbor relationship:

show cdp neighbors detail
show lldp neighbors detail

Discovery output can show the remote device, local and remote ports, platform, and capabilities. Discovery reveals a directly connected neighbor; it does not replace a topology diagram or a security policy.

Practice

1. Create VLANs 10, 20, and 99 on both switches.
2. Configure Fa0/24 as a trunk on both ends.
3. Use native VLAN 99 and allow only VLANs 10, 20, and 99.
4. Verify the trunk and correct any native VLAN or allowed-list mismatch.
5. Use CDP or LLDP to record the remote switch and port.

show interfaces trunk
! Status should identify Fa0/24 as trunking
! Allowed VLANs should include 10,20,99
! Native VLAN should be 99

show cdp neighbors
show lldp neighbors

Wrap Up

A trunk carries several VLANs, and both ends must agree on tagging, native VLAN, and the allowed VLAN list.

Rapid STP and EtherChannel

Sources: Kurose & Ross §6.3–6.4 · Odom Vol 1, Part III

Theory

Redundant switch links improve availability but create Layer 2 loops. Broadcast frames have no TTL at Layer 2, so a loop can multiply traffic. Spanning Tree Protocol elects a root bridge and places some redundant paths into a non-forwarding role.

• Root bridge: the switch with the lowest bridge ID, based on priority and MAC address.
• Root port: the best path from a non-root switch toward the root.
• Designated port: the forwarding port selected for a segment.
• Rapid PVST+: Cisco’s per-VLAN rapid spanning tree mode.
• PortFast and BPDU Guard: PortFast quickly forwards a trusted endpoint port; BPDU Guard shuts it down if a BPDU appears.

EtherChannel bundles multiple physical links into one logical Port-Channel. LACP negotiates the bundle. All member interfaces need compatible speed, duplex, VLAN, and trunk settings. STP sees the bundle as one logical path.

Demonstration

Inspect spanning-tree state and select a predictable root in a lab:

show spanning-tree vlan 10
show spanning-tree root
configure terminal
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
end
show spanning-tree vlan 10

On an endpoint port, use PortFast with BPDU Guard. Never copy this to a switch uplink:

configure terminal
interface range fastethernet0/1 - 2
 spanning-tree portfast
 spanning-tree bpduguard enable
end

Connect SW1 Fa0/23–24 to SW2 Fa0/23–24 and form an LACP bundle:

configure terminal
interface range fastethernet0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
 channel-group 1 mode active
exit
interface port-channel 1
 description LACP trunk to SW2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
end
show etherchannel summary
show interfaces port-channel 1

A healthy bundle should show a Port-Channel in use and member ports bundled. If a member is suspended, compare both ends line by line.

Practice

1. Use show spanning-tree vlan 10 to identify the root bridge and port roles.
2. Set SW1 as the primary root and SW2 as the secondary.
3. Enable Rapid PVST+ and BPDU Guard only on endpoint ports.
4. Build an LACP trunk with Fa0/23 and Fa0/24 on both switches.
5. Verify the bundle and explain why STP treats it as one logical link.

show etherchannel summary
! Po1 should be up
! Member ports should be bundled, not suspended

show spanning-tree vlan 10
! Root ID identifies the root bridge
! Root port is the best path toward that bridge

Wrap Up

Use STP to prevent loops, EtherChannel to bundle compatible redundancy, and verification commands to confirm the control plane agrees with your design.

Error Detection and Cabling

Sources: Kurose & Ross §6.2 · Odom Vol 1, Part I

Theory

Bits flip in transit — noise, interference, and damaged cables all corrupt frames. The link layer must detect this cheaply and quickly:

• Parity: one extra bit makes the count of 1s even. It catches any odd number of bit errors, but misses even numbers and is weak against bursts.
• Internet checksum: the data is summed as 16-bit words and the 1s complement stored. Cheap in software, used by TCP and UDP.
• CRC: sender and receiver agree on a generator G; the sender appends the remainder of the polynomial division so the whole frame divides evenly. Strong against bursts — used in Ethernet (FCS) in hardware.

Data D = 101110, generator G = 1001 (r = 3)

Append 3 zeros:        101110000
Divide by G (mod-2: XOR, no borrow)
Remainder R =          011
Transmitted frame:     101110011

Receiver divides by G again:
remainder 0 = frame OK · any other value = error

Cabling: straight-through cables connect different device types (PC ↔ switch, router ↔ switch); crossover cables connect like devices (PC ↔ PC, switch ↔ switch). Most modern ports use auto-MDIX, which detects and fixes the pairing for you.

Demonstration

CRC turns any burst of bit errors into a nonzero remainder at the receiver.

In Packet Tracer, check the physical layer first when a link misbehaves:

show interfaces fastethernet0/1
! watch these counters:
! runts      — frames smaller than 64 bytes
! giants     — frames larger than allowed
! CRC errors — damaged frames (cable/interference)
! late collisions — cabling too long or duplex mismatch

Practice

1. Will single-bit parity detect a burst of two bit errors? Why?
2. Verify the CRC: divide 101110011 by 1001 (modulo-2). What remainder do you get?
3. Which cable connects a PC directly to a switch?
4. Name two show interfaces counters that indicate a physical problem.

Wrap Up

If a link accumulates CRC errors, the problem is usually physical — cable, interference, or duplex. Fix the medium before blaming the protocol.

Wireless LANs and Device Management

Sources: Kurose & Ross §7.3 · Odom Vol 2, Part I

Theory

An access point bridges wireless clients into a wired network. In an autonomous design, the AP carries much of its own configuration. In a controller-based design, a wireless LAN controller (WLC) centralizes WLAN policy, client access, and AP management.

• SSID: the name clients see. It maps to a WLAN policy and often a VLAN.
• AP mode: a lightweight AP may serve clients, scan for interference, monitor security, or support special deployment roles.
• Access link: can carry one AP management or client VLAN.
• Trunk/LAG: carries several WLAN VLANs from an AP or WLC connection. A LAG bundles links for redundancy and capacity.

Use the console during initial setup, then prefer encrypted SSH or HTTPS for normal administration. Telnet is plaintext. TACACS+ and RADIUS centralize authentication; local accounts provide a fallback. Cloud-managed devices use a vendor service, so account, reachability, and policy boundaries matter.

Demonstration

Map a small controller-based WLAN:

An AP uplink may be an access port for a simple single-VLAN deployment or a trunk when several VLANs are needed. A WLC connection commonly uses a trunk, and two physical links can form an LACP LAG when supported. Match management, client, native, and allowed VLAN settings on both sides.

For a device-management baseline:

configure terminal
hostname SW1
ip domain name lab.example
username admin privilege 15 secret Use-A-Unique-Lab-Password
crypto key generate rsa modulus 2048
line vty 0 15
 login local
 transport input ssh
end
show ip ssh
show users

The exact RSA command varies by IOS release. Never use a real password in a shared lab file. In production, centralize identity with TACACS+ or RADIUS, apply least privilege, and log administrative access.

Practice

1. Draw an AP, switch, WLC, router, and two client VLANs.
2. Label each link as access, trunk, or LAG and explain why.
3. Configure SSH on a lab switch using a local user and domain name.
4. Use show ip ssh and show users to verify the management baseline.
5. List two reasons a client may see an SSID but fail to receive an IP address.

Wrap Up

Wireless access still depends on wired VLANs, trunks, gateways, and identity. Trace the whole path when a client connects but cannot use the network.

WiFi Deep Dive

Sources: Kurose & Ross §7.3 · Odom Vol 2, Part I

Theory

WiFi stations cannot use collision detection: a radio cannot reliably transmit and receive at the same time, and hidden terminals would miss collisions anyway. So 802.11 uses CSMA/CA — collision avoidance:

Every frame gets a link-layer ACK — Ethernet does not need one, WiFi does.

Hidden terminal: two stations A and C cannot hear each other, yet both can hit the access point B. Their frames collide at B and neither knows why. RTS/CTS reserves the channel: A sends a Request-To-Send carrying a duration; B broadcasts Clear-To-Send; everyone who hears the CTS stays quiet for that duration.

An 802.11 frame carries four addresses: Addr1 is the immediate receiver, Addr2 the transmitter, Addr3 the final destination (usually the router's MAC — needed to convert the frame back to Ethernet at the AP), and Addr4 is only used in ad hoc AP-to-AP mode.

In the 2.4 GHz band only channels 1, 6, and 11 do not overlap. Place neighboring APs on different ones; the 5 GHz band offers many more.

Demonstration

In Packet Tracer, build a small wireless lab:

! 1. Add a wireless router / access point
! 2. Set SSID: LAB-NET and channel: 6
! 3. On the laptop, open the PC Wireless app
!    and connect to LAB-NET
! 4. Let DHCP hand out an address, then:

ipconfig
ping 192.168.10.1

Now add a second AP on channel 6 with the same SSID. Clients see one network but the APs interfere with each other — this is why channel planning matters before adding hardware. In Simulation mode you can watch the frames and their ACKs.

Practice

1. Why cannot 802.11 stations detect collisions while they transmit?
2. Draw the RTS/CTS exchange for a hidden-terminal scenario.
3. Which 2.4 GHz channels can share a building without overlapping?
4. In an 802.11 frame, which address is the immediate receiver and which is the final destination?

Wrap Up

WiFi trades collision detection for caution — listen, back off, acknowledge every frame, and reserve the channel when hidden nodes exist.

Routers and the Data Plane

Sources: Kurose & Ross §4.1–4.2 · ENCOR Part I

Theory

Forwarding is the data plane: moving each packet from an input port to an output port, in hardware, in nanoseconds. Routing is the control plane: computing the paths, in software, over seconds. A traditional router does both; in an SDN design the controller computes and the switch only forwards.

The forwarding table uses longest-prefix matching: when several routes could match a destination, the most specific one wins.

show ip route (abridged)
C    192.168.10.0/24  is directly connected
S    10.0.0.0/8       via 192.168.10.1
S    10.1.1.0/24      via 192.168.10.2

! Packet to 10.1.1.5 → the /24 wins (longest prefix)
! Packet to 10.2.2.2 → the /8 matches

Inside the router: input ports terminate the link, the switching fabric moves packets across, and output ports queue them. Fabrics range from shared memory, to a shared bus (one packet at a time), to a crossbar (many packets in parallel). Head-of-line blocking happens when a packet waits behind another packet whose output port is busy — its own output may be free. Output queues can be FIFO, priority, or weighted fair queuing, which guarantees each class its weight of the bandwidth.

Demonstration

The lookup happens once, in hardware, before the packet crosses the fabric.

On a router, inspect the control-plane table and the data-plane cache:

show ip route          ! control plane: routes + next hops
show ip cef            ! data plane: optimized forwarding entries
show interfaces        ! output drops → queuing pressure

Practice

1. A router has routes 10.0.0.0/8 and 10.1.1.0/24. Which one is used for 10.1.1.5?
2. Why is a crossbar fabric better than a shared bus?
3. What is head-of-line blocking?
4. Which queuing method gives each traffic class a guaranteed share of bandwidth?

Wrap Up

Forwarding is hardware, routing is software — and the longest prefix always wins.

Static and Default Routing

Sources: Odom Vol 1, Part V · ENCOR Ch 6

Theory

Connected routes appear automatically the moment an interface has an IP address. Static routes are typed by hand. A default route (0.0.0.0/0) catches every destination that nothing else matches — every branch router normally has one pointing at the internet.

ip route 10.2.2.0 255.255.255.0 10.1.1.2
ip route 0.0.0.0 0.0.0.0 203.0.113.1
ip route 10.2.2.0 255.255.255.0 10.1.1.2 200   ! floating static

When two sources know the same route, administrative distance picks the winner: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120. A floating static is a static with a higher AD — it sits in the table only when the preferred route disappears.

Demonstration

The branch needs a route toward HQ and a default for the rest of the world.

show ip route
! Codes: C connected, S static, S* default
!
! S*   0.0.0.0/0  via 203.0.113.1
! S    10.2.2.0/24  via 10.1.1.2

Watch a recursive lookup: the router finds the next hop 10.1.1.2, then looks up which interface reaches 10.1.1.2 — that two-step lookup is why the next hop should always be reachable.

Practice

1. Add a static route for 10.3.3.0/24 via next hop 10.1.1.3.
2. Add a default route via 203.0.113.1.
3. Make a backup static to 10.3.3.0/24 via 10.1.1.4 with AD 200.
4. Verify with show ip route and explain which route wins and why.

ip route 10.3.3.0 255.255.255.0 10.1.1.3
ip route 0.0.0.0 0.0.0.0 203.0.113.1
ip route 10.3.3.0 255.255.255.0 10.1.1.4 200
! The primary static (AD 1) is installed;
! the AD 200 one appears only if the primary is lost

Wrap Up

Statics are predictable and always in the table — until a better administrative distance comes along.

Routing Algorithms

Sources: Kurose & Ross §5.2 · ENCOR Ch 6

Theory

Link-state protocols flood the full topology: every router announces its links, then each runs Dijkstra locally on the same map. Distance-vector protocols share only vectors of distances: each router applies the Bellman-Ford equation d(x,y) = min over neighbors v of c(x,v) + d(v,y) and re-advertises the result.

Dijkstra from source u (graph from K&R Figure 5.3):
Step  N'        D(v),p  D(w),p   D(x),p  D(y),p  D(z),p
0     u         2,u     5,u      1,u     -       -
1     ux        2,u     4,x      1,u     2,x     -
2     uxy       2,u     3,y      1,u     2,x     4,y
3     uxyv      2,u     3,y      1,u     2,x     4,y
4     uxyvw     2,u     3,y      1,u     2,x     4,y
5     uxyvwz    2,u     3,y      1,u     2,x     4,y

Bellman-Ford for u→z:
min { c(u,v)+d(v,z), c(u,w)+d(w,z), c(u,x)+d(x,z) }
= min { 2+5, 5+3, 1+3 } = 4

Distance-vector has a famous weakness: count-to-infinity. When a link cost jumps (good news travels fast, bad news slowly), two routers keep passing an outdated distance back and forth, counting up loop by loop. Poisoned reverse slows this: a router advertises an infinite distance to the neighbor it actually routes through.

Demonstration

Link-state: identical map everywhere, so convergence is fast and consistent.

Distance-vector only talks to neighbors — watch a bad-news update: x's link to y goes from 4 to 60, y now claims it can reach x via z with cost 6, z claims 7 via y, and the two count up toward 60 in dozens of rounds. Poisoned reverse (y advertises ∞ to z for routes learned from z) breaks this two-node loop.

Practice

1. Run the first two steps of Dijkstra for the table above.
2. Using Bellman-Ford, why does u choose cost 4 for z instead of 5?
3. What causes count-to-infinity?
4. How does poisoned reverse help?

Wrap Up

Dijkstra needs the whole map; Bellman-Ford only needs rumors — and rumors die slowly.

OSPF

Sources: Kurose & Ross §5.3 · Odom Vol 1, Part VI · ENCOR Ch 8–9

Theory

OSPF is a link-state protocol (IP protocol 89) that builds a complete topology map and runs Dijkstra on it. Routers identify themselves with a router ID — the highest loopback IP, else the highest up interface IP. Neighbors exchange Hello packets, then flood link-state advertisements (LSAs).

router ospf 1
 network 10.0.0.0 0.255.255.255 area 0

! or interface style:
interface gigabitethernet0/0
 ip ospf 1 area 0

On a multiaccess segment, a designated router (DR) and backup (BDR) are elected — highest priority wins, then highest router ID. Other routers stay 2-way with each other and only form full adjacencies with DR/BDR, cutting the mesh of adjacencies.

Large networks split into areas; area 0 is the backbone and ABRs (area border routers) connect the others. LSA types: type 1 router LSA, type 2 network LSA, type 3 summary (between areas), type 5 external (from outside OSPF).

Demonstration

Areas keep the map small; the backbone carries summaries between them.

show ip ospf neighbor    ! adjacencies, state, router IDs
show ip ospf interface  ! DR/BDR, area, costs
show ip route           ! O = OSPF routes, O IA = inter-area

Two routers in area 0 with addresses 10.1.1.1 and 10.1.1.2 should reach FULL state. If they stay in 2-WAY, check whether one side is on a different area, a mismatched network type, or a duplicate router ID.

Practice

1. Configure OSPF area 0 between two routers.
2. Verify neighbors with show ip ospf neighbor.
3. Add a loopback on each router and restart OSPF — which router ID wins, and why?
4. Explain what a type 3 LSA carries and where it comes from.

Wrap Up

OSPF builds a map and runs Dijkstra on it — areas keep the map small, and the backbone ties them together.

BGP

Sources: Kurose & Ross §5.4 · ENCOR Ch 11–12

Theory

BGP is the inter-AS protocol that glues the internet together — a path-vector protocol over TCP port 179. eBGP runs between different autonomous systems; iBGP runs between routers inside one AS. Routes are advertised as prefixes plus attributes.

router bgp 65001
 neighbor 203.0.113.2 remote-as 65002
 network 198.51.100.0 mask 255.255.255.0

show ip bgp
! Network          Next Hop     Metric Path
! 198.51.100.0/24  203.0.113.2  0      65002 i

• AS-PATH: the list of ASes traversed. Each AS prepends its own number — and drops any advertisement containing itself, which is how BGP detects loops.
• NEXT-HOP: the router interface where the path begins — the hand-off between inter-AS and intra-AS routing.

Best-path selection runs in order: highest weight (Cisco), highest local preference, shortest AS-PATH, lowest origin, lowest MED, eBGP over iBGP, lowest IGP cost to the next hop, oldest route, lowest router ID. Policy usually dominates: local preference is set by the operator, and hot-potato routing exits through the closest NEXT-HOP.

Demonstration

Each AS adds its number to the path as the advertisement travels.

Two routers in different ASes (Packet Tracer supports basic BGP; for attribute labs use CML/GNS3). After configuring the neighbors, check the table and the received paths:

show ip bgp summary    ! neighbor state (idle = not configured right)
show ip bgp            ! best path marked with >
show ip bgp 198.51.100.0/24  ! all received paths + attributes

Practice

1. Configure eBGP between two ASes and verify the neighbor state.
2. Read show ip bgp and identify which path is marked best.
3. Change local preference to prefer one path over another.
4. Explain what happens when an AS receives a route whose AS-PATH already contains its own number.

Wrap Up

BGP routes between organizations on policy, not speed — the shortest AS-PATH wins unless policy overrides.

Route Redistribution and Route Maps

Sources: ENCOR Ch 12

Theory

Redistribution injects routes from one routing protocol into another — for example, OSPF routes into BGP at the network edge. Without controls it is dangerous: metrics do not translate between protocols, and mutual redistribution at two routers can loop routes endlessly. The fix is a route map: a sequence of match/set rules with an implicit deny at the end.

route-map OSPF-INTO-BGP permit 10
 match ip address prefix-list INTERNAL
 set metric 100

router bgp 65001
 redistribute ospf 1 route-map OSPF-INTO-BGP

ip prefix-list INTERNAL permit 10.0.0.0/8

Prefix-lists filter which networks are allowed; tags mark routes so the other side can refuse to re-inject them — the standard guard against feedback loops.

Demonstration

Match decides what crosses the boundary; set decides what it looks like on the other side.

On the receiving router, use a route map to reject anything already tagged, then redistribute the rest back into OSPF. Verify with show ip route (routes appear with the new protocol's code) and show route-map (hit counts prove the map is matching).

Practice

1. Write a route map that permits only 192.168.0.0/16 and sets a tag of 77.
2. Redistribute OSPF into BGP using that route map.
3. What happens to a route that matches no sequence in the map?
4. Why tag routes during mutual redistribution?

Wrap Up

Redistribution is like merging two rivers — without route maps and tags you get a flood.

Gateway Redundancy

Sources: ENCOR Ch 15

Theory

Endpoints usually point to a single gateway address. If that router dies, every host loses connectivity. First-hop redundancy protocols let two routers share one virtual IP (and a virtual MAC): one is active and answers; the other is standby and takes over within seconds if the active fails.

interface gigabitethernet0/0
 standby 1 ip 192.168.10.1
 standby 1 priority 110
 standby 1 preempt

show standby
! GigabitEthernet0/0 - Group 1
!   State is Active (priority 110)
!   Virtual IP address is 192.168.10.1

• HSRP — Cisco proprietary; priority 100 default, higher wins, preempt must be enabled explicitly.
• VRRP — open standard; the router owning the virtual IP is the master; preemption is on by default.
• GLBP — Cisco; load-balances across up to four active forwarders instead of leaving the standby idle.

Demonstration

The hosts never change their gateway — the routers swap who answers it.

In Packet Tracer or CML, configure the same HSRP group on two routers in the same subnet, then shut down the active router's LAN interface. Watch show standby on the second router flip from Standby to Active, and ping the virtual IP throughout — only one or two pings drop during the failover.

Practice

1. Configure HSRP group 1 with virtual IP 192.168.10.1 on two routers.
2. Make R1 the active router using priority and preempt.
3. Verify state and virtual MAC with show standby.
4. Fail the active router and confirm the standby takes over, then explain how GLBP differs.

Wrap Up

Endpoints keep one gateway IP forever — the routers sort out which one actually answers.

ICMP and Connectivity Troubleshooting

Sources: Kurose & Ross §5.6 · Odom Vol 1, Part V

Theory

ICMP is carried as IP payload (protocol 1). Ping sends an Echo Request (type 8) and waits for an Echo Reply (type 0). Every router decrements the TTL; when it hits 0, the router drops the packet and returns Time Exceeded (type 11). Traceroute exploits this: it sends probes with TTL 1, 2, 3… and each expired probe identifies one hop.

Each star or response in the traceroute output is one hop of the path.

Type 3 Destination Unreachable has useful codes: 1 host unreachable (router has no route), 3 port unreachable (traceroute's finishing signal), 4 fragmentation needed and DF set (MTU problem).

Demonstration

ping 8.8.8.8            ! reachability + RTT
! Reply from 8.8.8.8: time=24ms

traceroute 8.8.8.8      ! the per-hop path

! When ping fails, work top-down:
show ip route 8.8.8.8   ! is there a route? which next hop?
show ip arp              ! is the next hop resolved to a MAC?
show ip interface brief  ! are the interfaces up?

Classic reading: "Destination host unreachable" means a router answered but has no route — a routing problem. "Request timed out" means nobody answered at all — usually filtering, a dead next hop, or a silent drop.

Practice

1. Explain what each traceroute hop represents.
2. What is the difference between 'host unreachable' and 'request timed out'?
3. A ping to a remote site fails but the default route exists. What do you check next?
4. Why does traceroute show a star for some hops?

Wrap Up

Ping proves reachability, traceroute proves the path — and the routing table explains both.

DNS Deep Dive

Sources: Kurose & Ross §2.4 · Odom Vol 2, Part IV

Theory

DNS is a distributed database and an application-layer protocol (UDP port 53). It translates names like www.example.com into IP addresses. One central server would fail on four counts: a single point of failure, enormous query volume, distance, and maintenance — so the database is a hierarchy:

Iterative queries walk the tree step by step; recursive queries ask the resolver to do the walking.

• A / AAAA: hostname → IPv4 / IPv6 address.
• NS: the authoritative server for a domain.
• CNAME: an alias pointing at a canonical hostname.
• MX: the mail server for a domain.

Every answer carries a TTL, and every resolver caches along the way — that is why the root servers only see a tiny fraction of queries.

Demonstration

nslookup www.example.com
! Server:  dns.local
! Address: 192.168.10.1
! Non-authoritative answer: 93.184.216.34

nslookup -type=MX example.com
nslookup -type=NS example.com
ipconfig /displaydns   ! your local cache

"Non-authoritative" means the answer came from a cache, not the domain's own server. Add a hosts-file entry or an internal DNS A record and watch the same name resolve differently — local DNS decides where a name goes before any external query happens.

Practice

1. Query the A, MX, and NS records for a public domain and record the answers.
2. Explain the order in which the servers are contacted for an uncached name.
3. Why does DNS cache answers, and what is the TTL for?
4. What is the difference between a recursive and an iterative query?

Wrap Up

DNS is the internet's phone book — distributed, cached, and consulted before the first packet is sent.

DHCP in Depth

Sources: Kurose & Ross §4.3.2 · Odom Vol 2, Part IV

Theory

DHCP gives an endpoint four settings automatically: address, mask, gateway, and DNS. The exchange is four messages — DORA: Discover, Offer, Request, Acknowledgment. The client broadcasts because it has no address yet; UDP ports 67 (server) and 68 (client).

DORA completes in four packets — a few milliseconds on a LAN.

A router can be the server:

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp pool LAN
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8

! relay on the client-side router interface:
interface gigabitethernet0/1
 ip helper-address 10.1.1.100

Routers do not forward broadcasts between subnets, so a client without a local server needs a relay agent: ip helper-address converts the broadcast into a unicast toward the real server.

Demonstration

In Packet Tracer, set a PC to DHCP and configure the pool on a router:

show ip dhcp binding   ! MAC → IP → lease time
show ip dhcp pool      ! usage counters
! On the PC:
ipconfig /renew

Watch the PC receive an address from the pool, then reserve one address for a printer by excluding everything else around it — fixed hosts get predictability, everything else gets plug-and-play.

Practice

1. List the four DORA messages in order and what each carries.
2. Configure a DHCP pool for 192.168.10.0/24 with gateway .1 and DNS 8.8.8.8.
3. Why is a relay agent needed when the server is on another subnet?
4. Which command installs the relay function on an interface?

Wrap Up

DHCP is plug-and-play addressing — four messages give every endpoint its four settings.

NAT and Port Forwarding

Sources: Kurose & Ross §4.3.3 · Odom Vol 2, Ch 14

Theory

NAT rewrites source IP addresses at the network edge so many private hosts can share one public address. Three flavors: static NAT (fixed one-to-one), dynamic NAT (from a pool), and PAT (many-to-one, tracking each session by its port — the standard for homes and small offices).

interface gigabitethernet0/0
 ip nat inside
interface gigabitethernet0/1
 ip nat outside

access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface gigabitethernet0/1 overload

! port forwarding: public 203.0.113.10:8080 → internal web server
ip nat inside source static tcp 192.168.10.5 80 203.0.113.10 8080

Inside and outside matter: inside traffic gets translated on the way out, and replies are mapped back through the translation table. NAT buys address space — it is not a firewall, and it breaks end-to-end reachability for inbound connections unless a port forwarding rule exists.

Demonstration

PAT distinguishes the two PCs by their source ports, not by address.

show ip nat translations
! Pro  Inside global      Inside local
! tcp  203.0.113.10:5001  192.168.10.5:54321
! tcp  203.0.113.10:5002  192.168.10.6:54321

From an inside PC, ping a public address and watch the table grow. The inside-global column always shows the router's public IP — that is overload at work.

Practice

1. What is the difference between static NAT and PAT?
2. Configure PAT using interface gigabitethernet0/1 with overload.
3. Add a port forward from 203.0.113.10:8080 to 192.168.10.5:80.
4. Explain why two inside hosts can use the same public IP at the same time.

Wrap Up

NAT buys address space, not security — and port forwarding is how servers live behind it.

NTP, Syslog, and Device Maintenance

Sources: Odom Vol 2, Ch 13

Theory

Every network device keeps a clock, and accurate time is what makes logs, certificates, and troubleshooting trustworthy. NTP is a hierarchy of strata: stratum 0 atomic clocks feed stratum 1 primary servers, which feed stratum 2, and so on — devices at the edge sync to a nearby server.

Syslog ships log messages to a central collector, with severity levels from 0 (emergency) to 7 (debug): emergency, alert, critical, error, warning, notice, informational, debug.

ntp server 10.1.1.10
logging host 10.1.1.20
logging trap notifications      ! levels 0–5 only

show ntp status                 ! synced? which stratum?
show logging                    ! buffer + destinations
show flash:                     ! image files on the device
copy running-config tftp://10.1.1.30/backup.cfg

Maintenance basics: back up the config, keep a known-good image in flash, verify licenses before upgrades, and always schedule changes in a maintenance window.

Demonstration

One time source upstream, one log destination downstream — now every event has a clock behind it.

In the lab, point two devices at the same NTP server and compare show clock — then deliberately log an interface down/up and find it on the syslog server with a matching timestamp.

Practice

1. Configure an NTP server on a router and verify with show ntp status.
2. What severity range does 'logging trap notifications' send?
3. Back up the running config to a TFTP server.
4. Why does accurate time matter on network devices?

Wrap Up

Every device tells the same time and the same story — clocks and logs are your first forensic evidence.

SNMP and NETCONF/YANG

Sources: Kurose & Ross §5.7 · Odom Vol 2, Part V

Theory

SNMP is the classic monitoring protocol: a manager polls agents with Get requests, changes values with Set, and agents push asynchronous Traps. Managed objects live in a MIB, structured by SMI, and are addressed by OIDs such as 1.3.6.1.2.1.1.5 (the system name). SNMPv3 adds authentication and encryption; v2c only has community strings.

snmp-server community READONLY ro
snmp-server host 10.1.1.25 version 2c READONLY

! from a Linux host:
snmpwalk -v2c -c READONLY 10.1.1.1 system

NETCONF is the configuration counterpart — XML-encoded RPC over SSH/TLS (port 830):

<rpc message-id="101">
  <get-config><source><running/></source></get-config>
</rpc>

<rpc-reply message-id="101">
  <data>…running configuration tree…</data>
</rpc-reply>

YANG is the data-modeling language that describes the config tree — both the device and the automation script read the same model, which is what makes programmatic configuration predictable.

Demonstration

SNMP watches, NETCONF changes, YANG describes.

Configure a read-only SNMP community on a lab router and walk the system OIDs from a Linux host — you will see the hostname, uptime, and description come back as numbered objects. Then read a NETCONF get-config reply and notice how every element matches the YANG model of the interface.

Practice

1. Configure an SNMP community and trap host on a router.
2. What is an OID?
3. Write the RPC that fetches the running configuration with NETCONF.
4. Why does SNMPv3 matter?

Wrap Up

SNMP watches, NETCONF changes — and YANG is the contract both sides read.

QoS Fundamentals

Sources: ENCOR Ch 14

Theory

Quality of service is triage: when links are busy, some traffic must wait and some must not. The toolkit is classification (match traffic), marking (set a DSCP value), queuing (decide the order), policing (drop excess), and shaping (buffer excess).

class-map match-any VOICE
 match dscp ef

policy-map WAN-EDGE
 class VOICE
  priority 100
 class class-default
  fair-queue

interface gigabitethernet0/1
 service-policy output WAN-EDGE

EF (DSCP 46, expedited forwarding) is reserved for voice — it gets a strict-priority queue. Data classes use AF values with different drop priorities. A policer drops traffic that exceeds a rate; a shaper delays it in a buffer instead — shaping smooths, policing enforces.

Demonstration

The queue is where the policy actually happens — every packet waits in exactly one queue.

In CML or Packet Tracer, apply the policy above to a link and watch show policy-map interface count packets per class. Even with a saturated link, a call marked EF keeps working while bulk transfers wait.

Practice

1. Which DSCP value marks expedited forwarding, and what uses it?
2. Build a policy-map that gives EF traffic strict priority.
3. What is the difference between policing and shaping?
4. Why does voice get strict priority instead of fair queuing?

Wrap Up

QoS is triage: decide what matters, mark it, and let the queue do the talking.

Multicast Concepts

Sources: ENCOR Ch 13

Theory

Multicast sends one stream to many receivers — one copy traverses each link, so a thousand viewers do not mean a thousand copies from the server. Group addresses come from 224.0.0.0/4; there is no multicast broadcast, hosts opt in.

• IGMP: how hosts tell their router which groups they want to receive (join/leave on the last hop).
• PIM: how routers build the distribution tree toward receivers.
• PIM-SM and the RP: sources and receivers first meet at a rendezvous point, then the receivers switch to the shortest-path tree toward the source.

Demonstration

PIM-SM rendezvous first, then direct — the RP is the introduction, not the highway.

ip pim rp-address 10.1.1.1
show ip igmp groups      ! who joined what
show ip mroute           ! the multicast routing table
! (S, G) entries: source + group pairs

In CML you can enable PIM on a few routers and join a group with a test receiver — show ip mroute then shows the (S, G) tree build out from the RP.

Practice

1. Which address range is reserved for multicast groups?
2. Which protocol do hosts use to join a group?
3. What is the RP's job in PIM-SM?
4. Why is multicast more efficient than unicast for a live stream to many viewers?

Wrap Up

Unicast sends N copies, multicast sends one — IGMP joins, PIM builds the tree.

NetFlow and Telemetry

Sources: ENCOR Ch 24

Theory

A flow is a unidirectional conversation identified by its 5-tuple: source IP, destination IP, source port, destination port, and protocol. NetFlow exports aggregated flow records to a collector so you can see who talks to whom and how much — the foundation of capacity planning and security forensics.

flow record FLOW-REC
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 match transport source-port
 match transport destination-port
 collect counter bytes

flow exporter NETFLOW-EXP
 destination 10.1.1.50
 transport udp 2055

flow monitor NETFLOW-MON
 record FLOW-REC
 exporter NETFLOW-EXP

interface gigabitethernet0/0
 ip flow monitor NETFLOW-MON input

SPAN mirrors traffic from a source port or VLAN to an analyzer port for deep inspection. Modern streaming telemetry goes further than polling: the device pushes state continuously (model-driven, often gRPC) instead of waiting to be asked.

Demonstration

Record decides what is measured, exporter decides where it goes, monitor binds them to an interface.

show flow monitor NETFLOW-MON cache
! IPV4 SOURCE ADDR  IPV4 DEST ADDR  PROT  SRC PORT  DST PORT  BYTES
! 192.168.10.5      93.184.216.34   6     54321     443       12844

Practice

1. What five fields identify a flow?
2. Build a flow record, exporter, and monitor and apply it to an interface.
3. What is SPAN used for?
4. How does streaming telemetry differ from SNMP polling?

Wrap Up

You can't fix what you can't see — flows tell you who talks to whom and how much.

Threats and Security Principles

Sources: Kurose & Ross §8.1 · Odom Vol 2, Part III

Theory

Network security has four goals: confidentiality (only the intended parties can read the message), message integrity (tampering is detected), end-point authentication (the other side is who it claims to be), and availability (the network itself keeps working — the job of firewalls and intrusion detection).

• Malware: viruses and worms that infect hosts; infected machines become botnets — remote-controlled armies used for spam and attacks.
• DoS / DDoS: vulnerability attacks, bandwidth flooding, and connection flooding. A DDoS spreads the flood across thousands of zombie hosts so it is hard to filter by source.
• Packet sniffing: a passive receiver records copies of frames — trivially easy on wireless and shared media. Encryption is the main defense.
• IP spoofing: injecting packets with a forged source address, which defeats source-based trust and enables reflection attacks.

DDoS works because the aggregate traffic looks like ordinary packets from everywhere.

The internet was designed for mutually trusting users — access control was never built into the core. Every security control since is a retrofit on that assumption.

Demonstration

In Packet Tracer or Wireshark, watch what a broadcast medium reveals: capture traffic on a shared segment and read the payloads of unencrypted protocols like Telnet and HTTP. Then switch the same flows to SSH and HTTPS and see only ciphertext.

! What an attacker on the segment sees:
! Telnet:   username/password in plaintext
! HTTP:     every page in plaintext
! SSH/HTTPS: only encrypted bytes

! Your countermeasures checklist:
!  1. Encrypt management (SSH, HTTPS)
!  2. Authenticate peers (certificates, VPN)
!  3. Filter at the edge (firewall)
!  4. Monitor for anomalies (IDS)

Practice

1. Define the four security goals and name the control that supports each.
2. What is the difference between DoS and DDoS?
3. Why is packet sniffing especially easy on wireless?
4. What makes IP spoofing dangerous?

Wrap Up

Security is defense in depth: assume every link is watched and every packet can be forged.

Cryptography Foundations

Sources: Kurose & Ross §8.2–8.3

Theory

Symmetric key cryptography uses one shared secret key (AES is the modern standard — fast, block-based). Public key cryptography uses a key pair: anything encrypted with the public key is decrypted only with the private key, and vice versa. RSA is the classic example.

RSA, small numbers (K&R §8.2):
p = 5, q = 7 → n = 35, z = (p-1)(q-1) = 24
e = 5  (coprime to 24)
d = 29 (5 × 29 mod 24 = 1)

Public:  (n=35, e=5)   Private: (n=35, d=29)

Encrypt 'l' (12):  12^5 mod 35 = 17
Decrypt 17:        17^29 mod 35 = 12   ✓

RSA is slow, so real systems use it only to protect a session key, then encrypt the bulk data with fast symmetric crypto. Integrity is separate: a hash (SHA) fingerprints the message; a MAC (H(m + s)) adds a shared secret so only the key holder can create a valid fingerprint; a digital signature (K⁻(H(m))) lets anyone verify with the public key. A certificate authority then binds a public key to an identity — that is the trust anchor of TLS and VPNs.

Demonstration

Confidentiality with public key — and the same pair, applied in reverse, signs a message.

Compute one more RSA step by hand: encrypt 15 with (35, 5), then decrypt it with (35, 29). The round trip must return 15. This is the entire trick behind HTTPS, SSH, and IPsec.

Practice

1. In the example above, why is d = 29 a valid private exponent?
2. Encrypt m = 15 with the public key (35, 5).
3. Why do real systems sign a hash instead of the whole message?
4. What does a certificate authority add to a public key?

Wrap Up

Symmetric is fast, public key is safe to share, hashes prove integrity — production systems combine all three.

Authentication and AAA

Sources: Kurose & Ross §8.4 · ENCOR Ch 26

Theory

Build authentication up step by step and watch each version fail: ap1.0 "I am Alice" — anyone can say it. ap2.0 check the source IP — spoofed in one packet. ap3.0 a password — sniffed off the wire. ap3.1 an encrypted password — recorded and replayed. The fix is ap4.0: Bob sends a fresh nonce R; Alice returns the nonce encrypted with the shared key; Bob decrypts and matches. A correct reply proves Alice knows the key and is live — a replay of an old reply fails.

The nonce makes every authentication attempt unique — old answers are worthless.

Network devices centralize this with AAA: Authentication (who you are), Authorization (what you may do), Accounting (what you did). RADIUS (UDP) encrypts only the password; TACACS+ (TCP) encrypts the entire exchange and separates the three A's per-command.

aaa new-model
aaa authentication login DEFAULT group tacacs+ local
tacacs server TAC1
 address ipv4 10.1.1.50
 key SecretKey123

Demonstration

Configure the device to try TACACS+ first and fall back to the local database:

! Verify who you are talking to:
show tacacs

! Simulate the failure: shut the TACACS server
! and confirm local login still works (fallback)
! Then check accounting:
show aaa sessions

The fallback order matters: if the AAA server dies, administrators must still be able to reach the device — that is why local comes last.

Practice

1. Why does an encrypted password still fail against replay?
2. What does the nonce prove that the password alone cannot?
3. Configure AAA login to use TACACS+ with local fallback.
4. Compare RADIUS and TACACS+.

Wrap Up

Passwords prove knowledge once; nonces prove presence every time — and AAA turns that into policy.

Access Control Lists

Sources: Odom Vol 2, Part II

Theory

An ACL is an ordered list of rules; the first match decides, and there is an implicit deny at the end. Standard ACLs match source addresses only and are placed near the destination. Extended ACLs match source, destination, protocol, and ports, and belong near the source to drop bad traffic early.

! Standard: only the source matters
access-list 10 deny 192.168.20.0 0.0.0.255
access-list 10 permit any

! Extended: source → destination + port
access-list 101 deny tcp 192.168.10.0 0.0.0.255 host 10.2.2.10 eq 22
access-list 101 permit ip any any

interface gigabitethernet0/1
 ip access-group 101 in

Wildcard masks are the inverse of subnet masks: 0 means "must match", 255 means "ignore". host 10.2.2.10 is a wildcard of 0.0.0.0; any is 255.255.255.255.

Demonstration

Placement is policy: block early what should never travel; allow precisely what must.

show access-lists
! Extended IP access list 101
!   deny tcp 192.168.10.0 0.0.0.255 host 10.2.2.10 eq 22 (17 matches)
!   permit ip any any

Test both directions: the SSH deny should stop 192.168.10.x from reaching the server, while everything else still flows. Move the ACL to the wrong interface and watch the symptom change — direction is part of the rule.

Practice

1. Write a standard ACL that blocks 192.168.20.0/24 but allows everyone else.
2. Write an extended ACL that permits web traffic to 10.2.2.10 and denies all other IP.
3. What is the wildcard mask for a single host?
4. What happens to traffic that matches no rule?

Wrap Up

ACLs are if-then lists with a silent 'else drop' — order, direction, and interface decide everything.

Switch Security

Sources: Odom Vol 2, Part III

Theory

The switch port is the front door of the LAN, and three controls defend it:

• Port security: limit how many MACs may appear on a port. A second device trips the violation — protect (drop extras), restrict (drop + log), or shutdown (disable the port).
• DHCP snooping: only trusted ports (uplinks) may answer DHCP; untrusted ports may only request. The switch builds a binding table of MAC → IP → port.
• Dynamic ARP inspection (DAI): uses that binding table to drop ARP replies that pair a MAC with a stolen IP — the classic man-in-the-middle setup.

interface fastethernet0/1
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown

ip dhcp snooping
ip dhcp snooping vlan 10
interface gigabitethernet0/1
 ip dhcp snooping trust

Demonstration

One binding table, two defenses: DHCP snooping builds it, DAI enforces it.

In Packet Tracer, add a second PC to a port-secured switchport and watch it err-disable. Then clear it with shutdown / no shutdown and check show port-security interface for the counters.

Practice

1. Configure port security with a maximum of 1 MAC and shutdown violation.
2. Which ports should be DHCP snooping trusted ports?
3. What attack does DAI stop?
4. How do you recover a port that was shut down by port security?

Wrap Up

The switch is the LAN's firewall — limit who may connect, who may serve, and whose MAC speaks for which IP.

TLS and Secure Management

Sources: Kurose & Ross §8.6 · Odom Vol 2, Part III

Theory

TLS upgrades TCP with confidentiality, integrity, and authentication. The handshake exchanges nonces and a certificate, then both sides derive a master secret and split it into four keys (two encryption, two MAC). Data flows in records: message + HMAC + sequence number, then encrypted. Nonces stop connection replay; sequence numbers stop packet reordering and truncation.

HTTPS is HTTP inside TLS records — same web, sealed envelope.

Device management needs the same discipline: SSH instead of Telnet, HTTPS instead of HTTP.

ip domain name lab.example
crypto key generate rsa modulus 2048
username admin secret StrongPass
line vty 0 15
 login local
 transport input ssh

show ip ssh     ! version + key state
show ssh        ! active sessions

Demonstration

Connect to the router with SSH in Packet Tracer, then try Telnet — it should be refused once transport input ssh is set. Capture both sessions with Wireshark: Telnet shows the password in plaintext, SSH shows only encrypted bytes.

Practice

1. What do the two TLS nonces protect against?
2. Generate an RSA key pair and restrict vty lines to SSH.
3. Why does each TLS record carry a sequence number?
4. Which command verifies the SSH service state?

Wrap Up

Encrypt the management plane first — an attacker who owns the console owns the network.

IPsec and Site-to-Site VPNs

Sources: Kurose & Ross §8.7 · ENCOR Ch 16

Theory

A VPN connects sites over the public internet with network-layer encryption. AH authenticates but does not encrypt; ESP adds confidentiality, so it dominates. A security association (SA) is a simplex agreement — algorithms, keys, and a 32-bit SPI — stored in the SAD; the SPD decides which traffic to protect.

Tunnel mode encapsulation:

[ new IP header | ESP header | encrypted:
    original IP header + payload + ESP trailer ]
  └─────────────── MAC over ESP header + ciphertext ───────┘

Outer protocol number: 50 (ESP)

IKE automates SA setup: phase 1 authenticates the peers and builds a secure channel (Diffie-Hellman + signed identities), phase 2 derives the bulk IPsec keys — so the expensive public-key math runs once, not per SA.

Demonstration

The internet sees only the outer headers — the inner packets are ciphertext.

crypto isakmp policy 10
 encryption aes
 hash sha256
 authentication pre-share
 group 14
crypto isakmp key VPN-KEY address 203.0.113.2
crypto ipsec transform-set TSET esp-aes esp-sha256-hmac
crypto map VPN-MAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set TSET
 match address 101
interface gigabitethernet0/1
 crypto map VPN-MAP

Practice

1. Which protocol provides confidentiality — AH or ESP?
2. What does the SPI identify?
3. Why does IKE use two phases?
4. What does 'match address 101' do in the crypto map?

Wrap Up

IPsec makes the public internet behave like a private WAN — ESP encrypts, SAs negotiate, IKE automates.

Wireless Security

Sources: Kurose & Ross §8.8 · Odom Vol 2, Part I

Theory

Wireless changes everything: the medium is shared, so eavesdropping needs no physical access. WEP failed because it reused short IVs with RC4, letting attackers recover the key from captured frames in minutes. WPA2 (802.11i) mandated AES-CCMP with the four-way handshake: the authentication server sends a nonce, the device replies with its own, and both derive the session key K_M-AP from the master key, the two nonces, and the MAC addresses. WPA3 adds SAE — a password-based handshake with forward secrecy that also fixes a WPA2 nonce-reuse weakness.

EAP messages ride end-to-end; the AP only ferries them and receives the derived key.

Cellular networks use the same pattern at scale: AKA — the SIM and the home network share a secret key; the network challenges, the device proves it, and session keys are derived for encryption. 5G goes further and encrypts the IMSI itself so the subscriber identity never travels in cleartext.

Demonstration

! WLAN security comparison:
! WEP   — RC4 + short IV reuse        → broken
! WPA1  — TKIP integrity              → legacy
! WPA2  — AES-CCMP + 4-way handshake  → standard
! WPA3  — SAE + forward secrecy       → current

! Check what your AP actually offers:
! security mode, cipher, and PSK length
! — an AP still offering WEP is a liability

Practice

1. What made WEP recoverable from captured traffic?
2. Which two nonces feed the WPA2 four-way handshake?
3. What does the four-way handshake derive?
4. What does 5G change about the IMSI?

Wrap Up

Wireless security is key management — WPA3 earns trust per session, WEP lost it once and forever.

Firewalls and IDS/IPS

Sources: Kurose & Ross §8.9 · ENCOR Ch 25–26

Theory

A firewall sits between trust zones and enforces policy on every packet. Stateless filters judge each packet alone (ACL-style). Stateful filters track connections in a table — replies are admitted only if a session exists, which defeats spoofed ACK tricks. Zone-based firewalls (ZFW) group interfaces into zones and apply inspection policies between zone pairs.

zone security INSIDE
zone security OUTSIDE

class-map type inspect match-any INTERNET
 match protocol tcp
 match protocol udp

policy-map type inspect INSIDE-TO-OUT
 class type inspect INTERNET
  inspect

zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
 service-policy type inspect INSIDE-TO-OUT

interface gigabitethernet0/0
 zone-member security INSIDE
interface gigabitethernet0/1
 zone-member security OUTSIDE

Firewalls block; IDS/IPS detect. Signature-based systems match known attack patterns (like Snort rules) — precise but blind to new attacks. Anomaly-based systems profile normal traffic and flag deviations — they catch the novel but suffer false alarms. Servers facing the internet belong in a DMZ, behind the firewall but isolated from the LAN.

Demonstration

Three zones, two policies: inside may start sessions out; outside may only answer them.

show policy-map type inspect zone-pair sessions
show zone security
! verify: outbound sessions tracked, inbound-only attempts dropped

Practice

1. What is the key advantage of stateful over stateless filtering?
2. Which zones would a public web server live in?
3. Write the zone-pair that allows INSIDE to initiate toward OUTSIDE.
4. What is the main weakness of signature-based detection?

Wrap Up

Firewalls draw the lines, stateful tables remember the conversations, and IDS watches for what slips through.

SDN and the Control/Data Plane Split

Sources: Kurose & Ross §4.4, 5.1 · ENCOR Ch 27

Theory

A traditional router couples two jobs: forwarding (data plane — move packets) and routing (control plane — decide paths). SDN separates them. Switches become simple match-action forwarders, and a logically centralized controller computes the forwarding tables and pushes them down.

One brain, many hands — the controller computes, the switches execute.

The controller acts as a network operating system: a communication layer to devices, a state layer holding topology and flows, and an interface layer for applications. Production examples: Google's B4 WAN (near 70% utilization with OpenFlow), Microsoft SWAN, and Cisco SD-Access for campus fabric.

Demonstration

Walk a link failure the SDN way:

1. The switch notices the port down and sends a Port-status message to the controller.
2. The controller updates its topology map.
3. The routing application is notified, recomputes paths, and the controller installs new flow entries into the affected switches.

In a traditional network every router would independently recompute and gossip — SDN does it once, centrally, in milliseconds.

Practice

1. What problem does the control/data plane split solve?
2. Name the two APIs a controller exposes and what each talks to.
3. Give one real-world SDN deployment.
4. What happens in the data plane when the controller is unreachable?

Wrap Up

SDN moves the brains out of the box and into software — the network becomes programmable.

OpenFlow and Match-Action Forwarding

Sources: Kurose & Ross §5.5 · ENCOR Ch 28

Theory

Generalized forwarding replaces "match destination IP" with match-plus-action: a flow entry matches many header fields at once and applies actions — forward, drop, rewrite fields, or send to the controller. OpenFlow 1.0 defines the match fields:

Match fields: ingress port, source/destination MAC,
Ethernet type, VLAN ID, VLAN priority, source/destination IP,
IP protocol, IP ToS, TCP/UDP source and destination ports

Actions: forward to port(s), drop, modify header fields,
send to controller

s1: IngressPort=1, IPSrc=10.3.*.*, IPDst=10.2.*.* → Forward(4)

s2: IngressPort=3, IPDst=10.1.*.* → Forward(2)   ! load balance path A
s2: IngressPort=4, IPDst=10.1.*.* → Forward(1)   ! load balance path B

s2: IPSrc=10.3.*.*                → (drop)        ! a firewall rule as a flow

Entries support wildcards and priorities — the highest-priority match wins. Packets matching nothing trigger a packet-in to the controller, which decides and can install a new entry.

Demonstration

One table replaces a dozen per-protocol decisions — the same entry can be a route, a load-balancer rule, or a firewall rule.

Re-read the s2 entries above: the same switch does destination-based forwarding, load balancing, and firewalling at once — impossible with a classic forwarding table.

Practice

1. Which fields does OpenFlow 1.0 match on?
2. What action turns a flow entry into a firewall rule?
3. What happens to a packet that matches no entry?
4. Why do flow entries need priorities?

Wrap Up

One flow table, many jobs — matching fields and actions turn switches into programmable policy engines.

Data Formats

Sources: ENCOR Ch 28

Theory

Automation speaks in structured text. The three formats you will meet: JSON (REST APIs and device data — compact, strict), XML (NETCONF and document-centric protocols — verbose, schema-driven), and YAML (Ansible and human-written configs — indentation-sensitive, readable).

The same interface in three formats:

JSON
{ "interface": "GigabitEthernet0/0",
  "description": "Uplink to HQ",
  "enabled": true }

XML
<interface>
  <name>GigabitEthernet0/0</name>
  <description>Uplink to HQ</description>
  <enabled>true</enabled>
</interface>

YAML
interface: GigabitEthernet0/0
description: Uplink to HQ
enabled: true

• JSON: no comments, double quotes required, ends with brackets/braces — the lingua franca of REST.
• XML: opening and closing tags, attributes, namespaces — the language of NETCONF.
• YAML: indentation defines structure — no tabs, and a wrong indent changes the whole document. Ansible playbooks are YAML.

Demonstration

Parse one value in each format mentally:

JSON: data["interface"]                    → GigabitEthernet0/0
XML:  root.find("interface/name").text    → GigabitEthernet0/0
YAML: parsed["interface"]                  → GigabitEthernet0/0

The rule of thumb: machines exchanging data prefer JSON; NETCONF and enterprise documents use XML; humans writing automation prefer YAML.

Practice

1. Write the interface example in JSON.
2. Write it again in YAML.
3. Which format does NETCONF use, and which does Ansible use?
4. Why must YAML never mix tabs and spaces?

Wrap Up

JSON for APIs, XML for NETCONF, YAML for people — read all three fluently.

REST APIs for Network Devices

Sources: ENCOR Ch 28

Theory

REST treats everything as a resource addressed by a URL. The verbs: GET read, POST create, PUT replace, PATCH partial update, DELETE remove. Status codes tell the story: 200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 404 Not Found.

RESTCONF is REST over the device's YANG datastores (HTTPS, /restconf/data/…); NETCONF is XML-RPC over SSH (port 830). Same YANG models, two transport styles.

! Read all interfaces
GET https://r1/restconf/data/ietf-interfaces:interfaces
→ 200 OK + JSON body

! Disable one interface
PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0%2F0
Content-Type: application/yang-data+json
{ "ietf-interfaces:interface": { "enabled": false } }
→ 204 No Content

Notice the URL-encoding: the slash inside the interface name becomes %2F. The YANG model defines exactly which paths exist — the API and the data model are the same tree.

Demonstration

! With curl:
curl -k -u admin:pass \
  https://r1/restconf/data/ietf-interfaces:interfaces | python -m json.tool

! The response mirrors the YANG tree:
{ "ietf-interfaces:interfaces": {
    "interface": [
      { "name": "GigabitEthernet0/0", "enabled": true, ... }
    ] } }

Change enabled to false, re-run the GET, and watch the running configuration change — the same operation a human would type at the CLI, done as data.

Practice

1. Which verb reads a resource, and which partially updates it?
2. What does a 204 status mean?
3. How do RESTCONF and NETCONF differ in transport?
4. Why does the interface name need %2F in the URL?

Wrap Up

The device is a data store with an HTTP front door — GET reads it, PATCH changes it.

Python for Network Automation

Sources: ENCOR Ch 28

Theory

Python is the default language of network automation. The pattern is always the same: authenticate, request data, parse JSON, act on it.

import requests

url = "https://r1/restconf/data/ietf-interfaces:interfaces"
response = requests.get(url, auth=("admin", "pass"), verify=False)
response.raise_for_status()      # fail loudly on HTTP errors

interfaces = response.json()["ietf-interfaces:interfaces"]["interface"]

for intf in interfaces:
    name = intf["name"]
    state = intf.get("enabled", "unknown")
    print(f"{name}: enabled={state}")

Output:
GigabitEthernet0/0: enabled=True
GigabitEthernet0/1: enabled=False
GigabitEthernet0/2: enabled=True

• raise_for_status() — never let a 401 or 404 pass silently.
• .json() — the body becomes nested dicts and lists.
• Secrets: keep them in environment variables or a vault, never hard-coded in scripts.

Demonstration

Extend the script to collect just the disabled interfaces and print a one-line report. Then make it configurable:

import os
USER = os.environ["DEVICE_USER"]
PASS = os.environ["DEVICE_PASS"]
DEVICE = os.environ.get("DEVICE", "r1")
# ...same logic, no secrets in the file

This is the seed of every automation job you will ever write: read state, decide, change state, verify.

Practice

1. What does raise_for_status() protect against?
2. How do you access a nested value in a parsed JSON response?
3. Write the loop that prints every interface name.
4. Where should credentials live?

Wrap Up

One request, one .json() call, one loop — most network automation is that close.

Ansible and Configuration Management

Sources: ENCOR Ch 29

Theory

Ansible manages many devices from one control node — no agents needed, just SSH. Two files do the work: the inventory (which devices) and the playbook (what to do, as YAML tasks using modules like cisco.ios.ios_config).

# inventory.yml
all:
  hosts:
    sw1: { ansible_host: 10.1.1.11 }
    sw2: { ansible_host: 10.1.1.12 }

# playbook.yml
- name: Baseline NTP and SSH
  hosts: all
  tasks:
    - name: Configure NTP server
      cisco.ios.ios_config:
        lines:
          - ntp server 10.1.1.10
    - name: Enable SSH
      cisco.ios.ios_config:
        lines:
          - ip domain name lab.example
          - crypto key generate rsa modulus 2048

Idempotence is the superpower: run the playbook twice, and the second run changes nothing. Each task reports changed: false when the device already matches the intent — that is how you know state, not just commands, is being managed.

Demonstration

$ ansible-playbook -i inventory.yml playbook.yml

TASK [Configure NTP server] ***
changed: [sw1]
changed: [sw2]

TASK [Enable SSH] ***
changed: [sw1]
changed: [sw2]

$ ansible-playbook -i inventory.yml playbook.yml   ! again

TASK [Configure NTP server] ***
ok: [sw1]        ! changed: false
ok: [sw2]

The first run configures; the second proves the config sticks. That ok/changed difference is the whole philosophy of configuration management.

Practice

1. Which two files does an Ansible project start with?
2. Write a task that configures a banner on all switches.
3. What does 'changed: false' mean on a re-run?
4. Why does Ansible need no agent on the device?

Wrap Up

Describe the end state, not the keystrokes — Ansible makes every device converge on intent.

Troubleshooting Methodology

Sources: Odom Vol 2, Ch 20

Theory

A method beats guessing. Start with the symptom, not with a theory: what works, what does not, and since when? Then pick a direction — top-down for application problems, bottom-up for cabling problems, and divide-and-conquer for routing problems. Test exactly one hypothesis at a time, and always verify.

1. Define the problem   — what works, what doesn't, since when?
2. Gather evidence      — show ip route, show interfaces, ping,
                          traceroute, logs
3. Form ONE hypothesis  — one likely cause, not a list
4. Test it              — change ONE thing
5. Verify + record      — symptom gone? write down cause + fix

If the verification fails, the loop starts again — with better evidence this time.

Production changes need change control: back up the config, work in a maintenance window, have a rollback plan, and log the change. The fix log you keep becomes your personal debugging reference for the next incident.

Demonstration

Work a real example: a branch PC cannot reach a server at HQ.

ping 10.2.2.10          ! fails
show ip route 10.2.2.10 ! no route → hypothesis: routing
show ip route           ! default present? static missing?
ip route 10.2.2.0 255.255.255.0 10.1.1.2
ping 10.2.2.10          ! works → verified
! Log: missing static route on branch router. Fixed + saved.

Notice what was not done: no reboots, no guessing at cables, no changing five things at once. One hypothesis, one change, one verification.

Practice

1. What is the first step in any troubleshooting session?
2. When would you troubleshoot bottom-up instead of top-down?
3. Why test only one hypothesis at a time?
4. What belongs in a change record?

Wrap Up

Slow is smooth: define, gather, hypothesize once, change once, verify — then write it down.

A Day in the Life of a Web Request

Sources: Kurose & Ross §6.7

Theory

Every module of this course fires in the first seconds of opening a web page. Before the browser even starts, DHCP hands out the four settings (DORA over broadcast). Then ARP finds the gateway's MAC. DNS resolves the name (UDP 53). TCP opens the connection (SYN → SYNACK → ACK), and HTTP (inside TLS for HTTPS) requests the page. At every hop the frame is rewrapped — destination MAC changes per link while the IP addresses stay constant end to end.

One URL, five protocols, dozens of frames — and each one follows the rules from this course.

Demonstration

DHCP: 0.0.0.0 → 255.255.255.255  (discover, offer, request, ack)
      now: 192.168.10.10/24 · gw .1 · dns 8.8.8.8

ARP:  who has 192.168.10.1?  → gateway replies with its MAC
DNS:  192.168.10.10 → 8.8.8.8 :53   (A record answer)
TCP:  SYN → SYNACK → ACK      (dest 93.184.216.34 :443)
HTTP: GET /   →   200 OK       (TLS records around it)

Frame at each hop:
PC→SW:   dst MAC = gateway  (learning on the switch)
SW→R:    same frame, next port
R→ISP:   new frame, dst MAC = ISP router — IP never changes

Open a browser with the F12 Network tab while pinging — or use Packet Tracer Simulation mode to step through the exact frames. You should be able to name every protocol in the capture now.

Practice

1. What does DHCP provide before anything else can happen?
2. Why does the first ping sometimes time out?
3. Which protocol resolves the server name, and over which port?
4. Which addresses change at each hop, and which stay constant?

Wrap Up

One page load is the whole course in action — if you can narrate it, you understand the network.

Final Lab: Multi-Site Enterprise Network

Sources: Odom Vol 2, Ch 20 · ENCOR Ch 30

Theory

The capstone ties every module together. Build a small enterprise: an HQ site with redundant routers and switches, a branch site, and an internet edge. Everything you have practiced appears in one topology.

HQ:
  SW-HQ   — VLANs 10 (users) + 20 (servers), trunk + EtherChannel
            Rapid PVST+, SW-HQ as primary root
  R-HQ1 / R-HQ2 — OSPF area 0, HSRP group 1 (virtual 192.168.10.1)
Branch:
  SW-BR   — VLAN 10, PortFast + BPDU Guard
  R-BR    — OSPF + default route + PAT to the internet
WAN link: 10.255.255.0/30 between R-HQ1 and R-BR
Internet: R-HQ1 egress with PAT + extended ACL 101
Security: SSH on all devices, ACLs on the edge, port security on access ports

Plan before you configure: draw the topology, choose the addressing scheme (one subnet per VLAN, /30 for the WAN), and write the verification list first — that list is your rubric.

Demonstration

Build order and the evidence for each step:

1. VLANs + access ports     → show vlan brief
2. Trunk + EtherChannel      → show interfaces trunk, show etherchannel summary
3. STP                       → show spanning-tree root
4. OSPF                      → show ip ospf neighbor (FULL), show ip route
5. HSRP                      → show standby (Active + Standby)
6. PAT                       → show ip nat translations
7. ACLs                      → show access-lists (matches counting up)
8. SSH                       → ssh from one device to another
9. End-to-end pings          → PC-HQ ↔ PC-BR, both sites ↔ internet

Then the real exercise: break it. Disable the trunk, change a VLAN, kill HSRP priority, remove the default route — one fault at a time, each fixed with the methodology from Session 47 and recorded with the evidence commands.

Practice

1. Draw the topology with every subnet and VLAN labeled.
2. Configure the full HQ site and verify each of the nine evidence points.
3. From the branch, fail the WAN link and restore it — record your fix.
4. Pass the rubric: explain which module each configuration belongs to and why.

Wrap Up

Every module in one topology — if you can build it, break it, and defend your fixes, you own the fundamentals.

Study Plan

Do not book the exam until the practice scores say you are ready. Follow this sequence, and schedule the test only when you pass the final gate.

1. Read the exam topics first — the official topic list is the contract the exam follows. Print it and check items off as you complete them.
2. Theory pass — work through the sessions in order. Each session lists its sources: read the Kurose & Ross chapter for the concepts and the official guide chapters for exam depth.
3. Daily labs — rebuild every topology in Packet Tracer without the answer key. Break it, fix it, verify it.
4. Make subnetting automatic — /24 through /30 masks, block sizes, and usable ranges in seconds, no calculator.
5. CLI muscle memory — config modes, show commands, and saving the configuration should need no thinking.
6. Flashcards — ports, cable types, administrative distances, and timers (Anki works well).
7. Practice exams — only after the content is done. Review every wrong answer against its source chapter.
8. Book the exam — when you score 85% or higher on three practice exams in a row, pick a date three to four weeks out and book it. Final weeks: weak areas only, plus full timed runs.

Rule of thumb: the deadline keeps you honest, but never book before the practice scores justify it. A retake costs more than waiting.

Learning Resources

The complete study stack for this track — the official certification guides, the textbook this course builds on, labs, videos, practice exams, and study tools.