One Track from Zero to Professional

Start from zero and build networks you can explain, configure, and troubleshoot. This single track takes you from networking fundamentals all the way to professional-level routing, switching, and services — ten sessions are ready to work through right now. Every session lists its sources, the complete curriculum maps each module to the textbook and the official certification guides, and the Learning Resources section gathers the whole study stack.

What Is a Network?

Sources: Kurose & Ross §1.1–1.3 · Odom Vol 1, Part I

Theory

A network connects devices so they can exchange data using agreed rules called protocols. Your laptop, a printer, and a file server can share a local area network (LAN). A wide area network (WAN) connects networks over a larger area. The internet is a collection of interconnected networks.

• Endpoint: a device that sends or receives data, such as a laptop or phone. A server provides a service to clients.
• Layer 2 switch: connects devices in a LAN and forwards Ethernet frames using MAC addresses.
• Router: forwards IP packets between networks using a routing table. A Layer 3 switch can also route.
• Access point: connects wireless clients to a network. An AP and a router perform different jobs, even when one home device combines them.
• Firewall: permits or blocks traffic according to a security policy.

Think of an office: the switch connects desks inside the office; the router provides a path to other networks. Wi-Fi is one way to reach that network, not another name for the internet.

Demonstration

Trace an example request from left to right. The intermediate network may contain many more devices than this simplified drawing.

Now unplug only the internet uplink. Two correctly configured computers on the same LAN can still communicate. Their local traffic does not need to travel through the ISP.

Practice

1. Draw two PCs and a printer connected to a switch.
2. Add a router connecting that LAN to an ISP.
3. Add an access point and a wireless laptop.
4. Mark the path for PC-to-printer traffic and laptop-to-internet traffic.

Wrap Up

Name the job each device performs before trying to configure it.

Packets, Layers, and Ethernet

Sources: Kurose & Ross §1.5 · Odom Vol 1, Part I

Theory

Layers divide communication into smaller jobs. In the OSI model, Layers 7–5 cover application, presentation, and session functions; Layer 4 is transport; Layer 3 is network; Layer 2 is data link; and Layer 1 is physical. The TCP/IP model groups these into application, transport, internet, and link layers.

• Transport port: identifies a service or conversation at a host. TCP port 443 is commonly used for HTTPS; HTTP/3 uses QUIC over UDP, commonly on port 443.
• IP address: identifies an interface at the network layer and helps routers select a path.
• MAC address: is used for delivery on an Ethernet link. A routed packet is placed into a new link-layer frame at each routed hop.

TCP establishes a connection and provides ordered delivery, acknowledgments, and retransmission. UDP sends datagrams without those transport-level guarantees; an application can add its own reliability. Ping uses ICMP, not a TCP or UDP port.

A switch learns a frame’s source MAC address on the incoming port. It looks up the destination MAC to choose the outgoing port. Unknown unicast frames are flooded to other forwarding ports in the same VLAN; broadcast frames are also flooded within that VLAN.

Demonstration

For a remote destination, a host normally sends the frame to its gateway’s MAC address while keeping the remote server as the packet’s destination IP. In IPv4 Ethernet networks, ARP discovers the local next-hop MAC address. NAT, when used, can change IP addresses; ordinary routing by itself does not.

PC sends to a server on a different subnet
Destination IP:  remote server
Destination MAC: local default gateway

PC sends to another PC on the same subnet
Destination IP:  other PC
Destination MAC: other PC

Practice

1. Write the OSI layers in order from physical to application.
2. For a remote web server, name the destination of the first Ethernet frame and of the IP packet.
3. Explain what a switch does with a destination MAC it has not learned.

Wrap Up

Ports describe transport conversations, IP addresses support routing, and MAC addresses support delivery on the local link.

IPv4 Addresses and Default Gateways

Sources: Kurose & Ross §4.3.2 · Odom Vol 1, Part IV

Theory

An IPv4 address has 32 bits written as four decimal octets, each from 0 to 255. A prefix length tells you how many bits describe the network. With 192.168.10.20/24, the first 24 bits form the network portion and the remaining 8 bits form the host portion.

Host:            192.168.10.20/24
Subnet mask:     255.255.255.0
Network:         192.168.10.0
Usable hosts:    192.168.10.1 through 192.168.10.254
Broadcast:       192.168.10.255
Example gateway: 192.168.10.1

The host uses its mask to decide whether a destination is local. For a remote destination without a more specific route, it sends toward the default gateway. The gateway must be reachable on the local link. Its address does not have to end in .1.

The private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12 (172.16–172.31), and 192.168.0.0/16. These are not globally routed on the public internet. Private addresses do not provide security by themselves.

DHCP can supply an address, mask, gateway, and DNS server automatically. DNS translates names into records such as IP addresses; it does not forward your packets.

Demonstration

PC-A is 192.168.10.20/24. PC-B is 192.168.10.30/24, so PC-A can send directly after resolving PC-B’s MAC. A destination of 192.168.20.30 is outside PC-A’s /24 and needs routing.

On Windows, inspect your current settings without changing them:

ipconfig /all
route print
arp -a

Find the active adapter, IPv4 address, subnet mask, default gateway, and DNS servers. On Linux, use ip address and ip route. A disconnected adapter may have no useful configuration.

Practice

1. For 192.168.50.25/24, write the network, broadcast, and usable host range.
2. Decide whether 192.168.50.100 and 192.168.51.100 are local destinations.
3. Choose an unused usable address for a router interface in this subnet.

Wrap Up

Check the address and mask together. A similar-looking address is not enough to decide whether two hosts share a subnet.

Subnetting Without Guessing

Sources: Kurose & Ross §4.3.2 · Odom Vol 1, Part IV

Theory

Subnetting uses additional network bits to divide an address block into smaller networks. Moving from /24 to /26 borrows two bits and creates four equal subnets. Six host bits remain, giving 64 addresses per subnet.

Last-octet bit values: 128 64 32 16 8 4 2 1
/26 mask last octet:     1  1  0  0 0 0 0 0 = 192
Mask:                 255.255.255.192
Block size:           256 - 192 = 64
Addresses per subnet: 2^(32 - 26) = 64
Usable hosts:         64 - 2 = 62

For ordinary IPv4 LAN subnets, reserve the network address and broadcast address. The usual host-count formula is 2 to the power of the host bits, minus 2. /31 point-to-point links and /32 host routes are special cases, so do not apply that formula blindly.

Demonstration

Split 192.168.10.0/24 into /26 blocks. The last-octet boundaries increase by 64:

Network             Usable last octets   Broadcast
192.168.10.0/26      .1   through .62     192.168.10.63
192.168.10.64/26     .65  through .126    192.168.10.127
192.168.10.128/26    .129 through .190    192.168.10.191
192.168.10.192/26    .193 through .254    192.168.10.255

192.168.10.77/26 falls between .64 and .127. Its network is .64, its broadcast is .127, and it is a usable host address. Two hosts with last octets .62 and .65 now belong to different subnets.

Practice

1. Calculate the mask and usable host count for /27.
2. Find the network, first host, last host, and broadcast for 192.168.20.70/27.
3. Choose the smallest ordinary subnet that can hold 50 hosts.

/27: mask 255.255.255.224; block size 32; 30 usable hosts
192.168.20.70/27:
  Network:    192.168.20.64
  First host: 192.168.20.65
  Last host:  192.168.20.94
  Broadcast:  192.168.20.95
50 hosts: /26 (62 usable); /27 has only 30 usable

Wrap Up

Find the block boundary first, then derive the broadcast and usable range. Always check that the host fits inside that range.

Your First Cisco Switch Configuration

Sources: Odom Vol 1, Part II

Theory

Cisco IOS uses modes. The prompt ending in > indicates user EXEC. Use enable to enter privileged EXEC, shown as #. Configuration mode changes settings; interface configuration mode changes a particular interface.

Use a fresh simulated 2960 switch in Cisco Packet Tracer for this lesson. Open its CLI tab, decline the initial setup dialog if it appears, then press Enter. These exercises assume default settings and interface names such as FastEthernet0/1; other models may use different names.

Get Packet Tracer through Cisco Networking Academy. A Cisco account may be required. The course contains lab instructions; the simulator runs separately on your computer.

Demonstration

Enter these commands one line at a time. If no endpoint is connected yet, the port can remain down even after no shutdown.

enable
configure terminal
hostname SW1
interface fastethernet0/1
 description Link to PC-A
 no shutdown
exit
end
show interfaces status
show running-config
copy running-config startup-config

At the destination filename prompt, press Enter to accept startup-config. Running-config is the current configuration in RAM; startup-config is the saved configuration loaded at boot. The copy command saves the current configuration; it is not a factory reset.

CLI helpers: use ? for context-sensitive help, Tab to complete a unique command, exit to move up one configuration level, and end to return to privileged EXEC. Press Space for another page of long output.

Practice

1. Rename the switch to LAB-SW1.
2. Describe FastEthernet0/2 as Link to PC-B.
3. Use show running-config to confirm both changes.
4. Save, then use show startup-config to check the saved hostname and description.

enable
configure terminal
hostname LAB-SW1
interface fastethernet0/2
 description Link to PC-B
exit
end
show running-config
copy running-config startup-config
show startup-config

Wrap Up

Read the prompt, make a small change, verify the result, and save deliberately.

Build and Troubleshoot Your First LAN

Sources: Kurose & Ross §6.4 · Odom Vol 1, Part II

Theory

We will build a single subnet with one switch and two PCs. Both switch ports remain in the default VLAN. A switch does not need a management IP address to forward Ethernet frames between these PCs. No router, default gateway, or DNS server is needed for this local IP test.

Ping sends ICMP Echo Requests and listens for replies. A successful ping is evidence of IP reachability at that moment; it does not prove that a website, DNS, or every application is working.

Demonstration

1. Add two PC-PT endpoints and one 2960 switch to a new Packet Tracer workspace.
2. Use copper straight-through cables: PC-A FastEthernet0 to SW1 FastEthernet0/1; PC-B FastEthernet0 to SW1 FastEthernet0/2.
3. Wait for the links to turn green. Switch ports may take time to begin forwarding.
4. Open Desktop → IP Configuration on each PC. Choose Static, set the addresses above, and use 255.255.255.0 as both masks. Leave gateway and DNS blank.
5. Open PC-A’s Desktop → Command Prompt and run the commands below.

ipconfig
ping 192.168.10.20
arp -a

Expect replies from 192.168.10.20. An initial attempt may time out while ARP or link convergence completes; retry once the links are ready. Persistent timeouts need investigation. Check the switch CLI:

enable
show interfaces status
show mac address-table dynamic

Expect the two connected ports to show connected status and learned PC MAC addresses in VLAN 1 after traffic passes. The exact addresses and output formatting vary.

In Simulation mode, filter for ARP and ICMP and send another ping. If ARP is already cached, you may only see ICMP; use a fresh lab state to observe the initial ARP request and reply. Save your topology as first-lan.pkt.

Practice

1. Ping PC-A from PC-B and record the result.
2. Change PC-B to 192.168.20.20/24, then ping that new address from PC-A. Explain the failure.
3. Restore PC-B to 192.168.10.20/24 and confirm replies return.
4. Add PC-C as 192.168.10.30/24 on Fa0/3. Verify all three pairs.
5. Record the symptom, cause, fix, and verification for the fault you introduced.

Wrap Up

A working lab includes evidence: correct addressing, connected ports, learned MAC addresses, and successful tests in both directions.

VLANs and Access Ports

Sources: Kurose & Ross §6.4.4 · Odom Vol 1, Part III

Theory

A VLAN is a logical Layer 2 network. It lets one physical switch carry several separate broadcast domains. Devices in different VLANs cannot communicate through Layer 2 switching alone; they need a Layer 3 routing function.

• Access port: carries traffic for one data VLAN. An end host normally connects to an access port.
• Voice VLAN: lets a phone use a separate VLAN while a PC connected through the phone uses the data VLAN.
• Default VLAN: VLAN 1 exists on many Cisco switches by default. Plan management and user VLANs deliberately instead of treating VLAN 1 as a security boundary.
• Broadcast domain: broadcasts stay inside a VLAN unless a router or Layer 3 switch forwards them.

VLAN numbers are local to the switching domain. Giving two ports the same VLAN number on one switch does not extend that VLAN to another switch; the inter-switch link must carry it.

Demonstration

Use a 2960 switch and create VLAN 10 for students and VLAN 20 for staff. Configure endpoint ports as access ports:

enable
configure terminal
vlan 10
 name STUDENTS
vlan 20
 name STAFF
interface fastethernet0/1
 description Student PC
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
interface fastethernet0/2
 description Staff PC
 switchport mode access
 switchport access vlan 20
end
show vlan brief

show vlan brief should list VLANs 10 and 20 and place the configured ports in the expected VLAN. PortFast is for an edge port connected to an endpoint; do not enable it on a switch-to-switch link.

Give two student PCs addresses such as 192.168.10.10/24 and 192.168.10.20/24. They should communicate through the switch. A staff PC in VLAN 20 belongs to a different broadcast domain, even when it is plugged into the same physical switch.

Practice

1. Create VLAN 10 named STUDENTS and VLAN 20 named STAFF.
2. Place Fa0/1 and Fa0/2 in VLAN 10, then place Fa0/3 in VLAN 20.
3. Verify membership with show vlan brief.
4. Connect two PCs in VLAN 10 and test them with ping.
5. Explain why a PC in VLAN 20 cannot ping them yet.

show vlan brief
show interfaces fastethernet0/1 switchport
!
! Fa0/1 should report access VLAN 10
! Fa0/3 should report access VLAN 20

Wrap Up

VLAN membership determines the local Layer 2 boundary. Verify port mode and access VLAN before troubleshooting IP addresses.

Trunks, 802.1Q, and Discovery

Sources: Kurose & Ross §6.4.4 · Odom Vol 1, Part III

Theory

A trunk carries traffic for multiple VLANs over one link between network devices. Ethernet frames are identified with an IEEE 802.1Q VLAN tag while they cross the trunk. The receiving switch removes or interprets the tag before forwarding the frame inside the VLAN.

• Native VLAN: the VLAN sent untagged on an 802.1Q trunk. Both ends must agree on it.
• Allowed VLANs: the list of VLANs permitted on a trunk. Restricting the list reduces unnecessary broadcasts and limits mistakes.
• CDP: Cisco Discovery Protocol shares information with directly connected Cisco neighbors.
• LLDP: an open IEEE discovery protocol useful when devices come from different vendors.

A trunk preserves VLAN identity across a device-to-device link. It is not simply a faster access port.

Demonstration

Connect SW1 Fa0/24 to SW2 Fa0/24. Create VLANs 10 and 20 on both switches, then configure both ends the same way:

enable
configure terminal
vlan 10
 name STUDENTS
vlan 20
 name STAFF
vlan 99
 name NATIVE
interface fastethernet0/24
 description Trunk to SW2
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99
 no shutdown
end
show interfaces trunk
show interfaces fastethernet0/24 switchport

If your simulator asks for an encapsulation command, choose 802.1Q where the platform supports it. Many modern switches use 802.1Q automatically.

Verify the neighbor relationship:

show cdp neighbors detail
show lldp neighbors detail

Discovery output can show the remote device, local and remote ports, platform, and capabilities. Discovery reveals a directly connected neighbor; it does not replace a topology diagram or a security policy.

Practice

1. Create VLANs 10, 20, and 99 on both switches.
2. Configure Fa0/24 as a trunk on both ends.
3. Use native VLAN 99 and allow only VLANs 10, 20, and 99.
4. Verify the trunk and correct any native VLAN or allowed-list mismatch.
5. Use CDP or LLDP to record the remote switch and port.

show interfaces trunk
! Status should identify Fa0/24 as trunking
! Allowed VLANs should include 10,20,99
! Native VLAN should be 99

show cdp neighbors
show lldp neighbors

Wrap Up

A trunk carries several VLANs, and both ends must agree on tagging, native VLAN, and the allowed VLAN list.

Rapid STP and EtherChannel

Sources: Kurose & Ross §6.3–6.4 · Odom Vol 1, Part III

Theory

Redundant switch links improve availability but create Layer 2 loops. Broadcast frames have no TTL at Layer 2, so a loop can multiply traffic. Spanning Tree Protocol elects a root bridge and places some redundant paths into a non-forwarding role.

• Root bridge: the switch with the lowest bridge ID, based on priority and MAC address.
• Root port: the best path from a non-root switch toward the root.
• Designated port: the forwarding port selected for a segment.
• Rapid PVST+: Cisco’s per-VLAN rapid spanning tree mode.
• PortFast and BPDU Guard: PortFast quickly forwards a trusted endpoint port; BPDU Guard shuts it down if a BPDU appears.

EtherChannel bundles multiple physical links into one logical Port-Channel. LACP negotiates the bundle. All member interfaces need compatible speed, duplex, VLAN, and trunk settings. STP sees the bundle as one logical path.

Demonstration

Inspect spanning-tree state and select a predictable root in a lab:

show spanning-tree vlan 10
show spanning-tree root
configure terminal
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
end
show spanning-tree vlan 10

On an endpoint port, use PortFast with BPDU Guard. Never copy this to a switch uplink:

configure terminal
interface range fastethernet0/1 - 2
 spanning-tree portfast
 spanning-tree bpduguard enable
end

Connect SW1 Fa0/23–24 to SW2 Fa0/23–24 and form an LACP bundle:

configure terminal
interface range fastethernet0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
 channel-group 1 mode active
exit
interface port-channel 1
 description LACP trunk to SW2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
end
show etherchannel summary
show interfaces port-channel 1

A healthy bundle should show a Port-Channel in use and member ports bundled. If a member is suspended, compare both ends line by line.

Practice

1. Use show spanning-tree vlan 10 to identify the root bridge and port roles.
2. Set SW1 as the primary root and SW2 as the secondary.
3. Enable Rapid PVST+ and BPDU Guard only on endpoint ports.
4. Build an LACP trunk with Fa0/23 and Fa0/24 on both switches.
5. Verify the bundle and explain why STP treats it as one logical link.

show etherchannel summary
! Po1 should be up
! Member ports should be bundled, not suspended

show spanning-tree vlan 10
! Root ID identifies the root bridge
! Root port is the best path toward that bridge

Wrap Up

Use STP to prevent loops, EtherChannel to bundle compatible redundancy, and verification commands to confirm the control plane agrees with your design.

Wireless LANs and Device Management

Sources: Kurose & Ross §7.3 · Odom Vol 2, Part I

Theory

An access point bridges wireless clients into a wired network. In an autonomous design, the AP carries much of its own configuration. In a controller-based design, a wireless LAN controller (WLC) centralizes WLAN policy, client access, and AP management.

• SSID: the name clients see. It maps to a WLAN policy and often a VLAN.
• AP mode: a lightweight AP may serve clients, scan for interference, monitor security, or support special deployment roles.
• Access link: can carry one AP management or client VLAN.
• Trunk/LAG: carries several WLAN VLANs from an AP or WLC connection. A LAG bundles links for redundancy and capacity.

Use the console during initial setup, then prefer encrypted SSH or HTTPS for normal administration. Telnet is plaintext. TACACS+ and RADIUS centralize authentication; local accounts provide a fallback. Cloud-managed devices use a vendor service, so account, reachability, and policy boundaries matter.

Demonstration

Map a small controller-based WLAN:

An AP uplink may be an access port for a simple single-VLAN deployment or a trunk when several VLANs are needed. A WLC connection commonly uses a trunk, and two physical links can form an LACP LAG when supported. Match management, client, native, and allowed VLAN settings on both sides.

For a device-management baseline:

configure terminal
hostname SW1
ip domain name lab.example
username admin privilege 15 secret Use-A-Unique-Lab-Password
crypto key generate rsa modulus 2048
line vty 0 15
 login local
 transport input ssh
end
show ip ssh
show users

The exact RSA command varies by IOS release. Never use a real password in a shared lab file. In production, centralize identity with TACACS+ or RADIUS, apply least privilege, and log administrative access.

Practice

1. Draw an AP, switch, WLC, router, and two client VLANs.
2. Label each link as access, trunk, or LAG and explain why.
3. Configure SSH on a lab switch using a local user and domain name.
4. Use show ip ssh and show users to verify the management baseline.
5. List two reasons a client may see an SSID but fail to receive an IP address.

Wrap Up

Wireless access still depends on wired VLANs, trunks, gateways, and identity. Trace the whole path when a client connects but cannot use the network.

The Complete Curriculum

One track from the first cable to professional-level networking. Every session below is mapped to the book we build on — Kurose & Ross, Computer Networking: A Top-Down Approach. Ten sessions are ready today; the rest are planned.

Module 1 · Network Foundations

Book: Chapter 1 · Sections 4.3.1–4.3.2

Official Guide: Odom Vol 1, Parts I & IV · ENCOR Part I

• Ready · Session 1 · What Is a Network?
• Ready · Session 2 · Packets, Layers, and Ethernet
• Planned · Delay, Loss, and Throughput — queuing, packet loss, and bottlenecks (Book: Ch 1.4)
• Ready · Session 3 · IPv4 Addresses and Default Gateways
• Ready · Session 4 · Subnetting Without Guessing
• Planned · IPv6 Addressing and Subnetting — 128-bit addresses and prefix math (Book: Ch 4.3.4)
• Ready · Session 5 · Your First Cisco Switch Configuration
• Ready · Session 6 · Build and Troubleshoot Your First LAN

Module 2 · Network Access and Switching

Book: Chapter 6 · Chapter 7.3

Official Guide: Odom Vol 1, Parts II–III · Odom Vol 2, Part I · ENCOR Parts II & VI

• Planned · Ethernet, ARP, and Switch Forwarding — frames, MAC learning, and filtering (Book: Ch 6.4)
• Ready · Session 7 · VLANs and Access Ports
• Ready · Session 8 · Trunks, 802.1Q, and Discovery
• Ready · Session 9 · Rapid STP and EtherChannel
• Planned · Error Detection and Cabling — CRC, parity, and physical faults (Book: Ch 6.2)
• Ready · Session 10 · Wireless LANs and Device Management
• Planned · WiFi Deep Dive — CSMA/CA, RTS/CTS, and 802.11 frames (Book: Ch 7.3)

Module 3 · IP Connectivity and Routing

Book: Chapters 4–5

Official Guide: Odom Vol 1, Parts V–VII · ENCOR Parts I & III

• Planned · Routers and the Data Plane — forwarding, fabrics, and queuing (Book: Ch 4.1–4.2)
• Planned · Static and Default Routing — next hops, AD, and floating statics
• Planned · Routing Algorithms — link-state and distance-vector (Book: Ch 5.2)
• Planned · OSPF — areas, LSAs, and multi-area design (Book: Ch 5.3)
• Planned · BGP — eBGP/iBGP, AS-PATH, and policy (Book: Ch 5.4)
• Planned · Route Redistribution and Route Maps
• Planned · Gateway Redundancy — HSRP, VRRP, and GLBP
• Planned · ICMP and Connectivity Troubleshooting — ping, traceroute, TTL (Book: Ch 5.6)

Module 4 · IP Services

Book: Chapter 2.4 · Chapter 5.7

Official Guide: Odom Vol 2, Part IV · ENCOR Part IV & Ch 24

• Planned · DNS Deep Dive — hierarchy, records, and resolution (Book: Ch 2.4)
• Planned · DHCP in Depth — discover, offer, request, ack (Book: Ch 4.3.2)
• Planned · NAT and Port Forwarding — translation tables (Book: Ch 4.3.3)
• Planned · NTP, Syslog, and Device Maintenance
• Planned · SNMP and NETCONF/YANG — monitoring and programmatic config (Book: Ch 5.7)
• Planned · QoS Fundamentals — classification, marking, and queuing
• Planned · Multicast Concepts — IGMP and PIM
• Planned · NetFlow and Telemetry

Module 5 · Network Security

Book: Chapter 8

Official Guide: Odom Vol 2, Parts II–III · ENCOR Part VIII

• Planned · Threats and Security Principles — CIA, malware, attacks (Book: Ch 8.1)
• Planned · Cryptography Foundations — symmetric, asymmetric, hashes (Book: Ch 8.2–8.3)
• Planned · Authentication and AAA — RADIUS, TACACS+, 802.1X (Book: Ch 8.4)
• Planned · Access Control Lists — standard, extended, named
• Planned · Switch Security — port security, DHCP snooping, ARP inspection
• Planned · TLS and Secure Management — SSH, HTTPS, certificates (Book: Ch 8.6)
• Planned · IPsec and Site-to-Site VPNs — ESP, tunnels, IKE (Book: Ch 8.7)
• Planned · Wireless Security — WPA2, WPA3, four-way handshake (Book: Ch 8.8)
• Planned · Firewalls and IDS/IPS — stateful filtering and detection (Book: Ch 8.9)

Module 6 · Automation and Programmability

Book: Chapter 4.4 · Chapter 5.5

Official Guide: Odom Vol 2, Part V · ENCOR Part IX

• Planned · SDN and the Control/Data Plane Split (Book: Ch 4.4, 5.1)
• Planned · OpenFlow and Match-Action Forwarding (Book: Ch 5.5)
• Planned · Data Formats — JSON, XML, and YAML
• Planned · REST APIs for Network Devices
• Planned · Python for Network Automation
• Planned · Ansible and Configuration Management

Module 7 · Capstone and Troubleshooting

Book: Chapter 6.7

Official Guide: Odom Vol 2, Ch 20 · ENCOR Ch 24 & 30

• Planned · Troubleshooting Methodology — layered and evidence-based
• Planned · A Day in the Life of a Web Request — DHCP, ARP, DNS, TCP, HTTP end-to-end (Book: Ch 6.7)
• Planned · Final Lab: Multi-Site Enterprise Network — design, build, and defend

Study Plan

Do not book the exam until the practice scores say you are ready. Follow this sequence, and schedule the test only when you pass the final gate.

1. Read the exam topics first — the official topic list is the contract the exam follows. Print it and check items off as you complete them.
2. Theory pass — work through the sessions in order. Each session lists its sources: read the Kurose & Ross chapter for the concepts and the official guide chapters for exam depth.
3. Daily labs — rebuild every topology in Packet Tracer without the answer key. Break it, fix it, verify it.
4. Make subnetting automatic — /24 through /30 masks, block sizes, and usable ranges in seconds, no calculator.
5. CLI muscle memory — config modes, show commands, and saving the configuration should need no thinking.
6. Flashcards — ports, cable types, administrative distances, and timers (Anki works well).
7. Practice exams — only after the content is done. Review every wrong answer against its source chapter.
8. Book the exam — when you score 85% or higher on three practice exams in a row, pick a date three to four weeks out and book it. Final weeks: weak areas only, plus full timed runs.

Rule of thumb: the deadline keeps you honest, but never book before the practice scores justify it. A retake costs more than waiting.

Learning Resources

The complete study stack for this track — the official certification guides, the textbook this course builds on, labs, videos, practice exams, and study tools.