Network+ N10-009 Memorization Sheet

Encrypted pairs

• HTTP 80 to HTTPS 443
• Telnet 23 to SSH 22
• FTP 21 to SFTP 22
• LDAP 389 to LDAPS 636
• IMAP 143 to IMAPS 993
• POP3 110 to POP3S 995
• SMTP 25 to SMTPS 587
• DNS 53 to DoT 853 or DoH 443
• SNMP v1/v2c to SNMPv3 (same ports)
• SIP 5060 to SIP over TLS 5061

Port ranges and IP protocol numbers

• 0 to 1023: well-known
• 1024 to 49151: registered
• 49152 to 65535: dynamic (client) ports
• ICMP 1, TCP 6, UDP 17
• GRE 47, ESP 50, AH 51
• OSPF 89, EIGRP 88 (ride directly on IP)

• Bottom up: Please Do Not Throw Sausage Pizza Away
• Top down: All People Seem To Need Data Processing
• TCP/IP model: Application (OSI 5 to 7), Transport (4), Internet (3), Network Access or Link (1 and 2)
• Encapsulation: data, segment, packet, frame, bits. Capture order: Ethernet header (MACs), IP header (addresses, TTL), TCP or UDP header (ports), payload
• MAC address: 48 bits, 12 hex digits, first 24 bits are the OUI. Rewritten at every router hop; the IP address stays the same end to end
• MTU 1500 bytes standard; jumbo frames about 9000
• TCP handshake: SYN, SYN-ACK, ACK. Close: FIN and ACK. Abort: RST
• Traffic types: unicast one to one; broadcast one to all on the segment (routers stop it; IPv6 has none); multicast one to a group (224.0.0.0 to 239.255.255.255); anycast one address on many servers, nearest answers

• Mask octet values: 128, 192, 224, 240, 248, 252, 254, 255 = 1 to 8 network bits
• Binary place values: 128, 64, 32, 16, 8, 4, 2, 1
• Powers of two: 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096
• Usable hosts = 2 to the host bits, minus 2. Subnets created = 2 to the borrowed bits
• Hosts needed: add 2, round up to the next power of two, that many host bits
• A subnet must start on a multiple of its own block size (192.168.10.96/26 is invalid; 64 and 128 are valid starts)
• Summarization: 10.1.0.0/24 through 10.1.3.0/24 = 10.1.0.0/22

• 128 bits, eight groups of four hex digits. A standard LAN is a /64: 64 bits network, 64 bits interface ID
• Shortening: drop leading zeros in each group; replace one run of all-zero groups with :: (only once)
• SLAAC: the router advertisement supplies the /64 prefix and the host builds its own interface ID
• EUI-64: split the 48-bit MAC, insert ff:fe in the middle, flip the seventh bit
• DHCPv6: stateful hands out addresses; stateless hands out only options such as DNS
• NDP replaces ARP: neighbor solicitation and neighbor advertisement over ICMPv6 multicast
• Dual stack runs both. Tunneling (6to4, ISATAP, Teredo, GRE) carries v6 inside v4. NAT64 with DNS64 translates for v6-only clients

• All twisted pair Ethernet: 100 meters (328 feet) including patch cords
• RJ45 is 8P8C for Ethernet; RJ11 for telephone
• UTP default; STP for high-EMI areas (motors, fluorescent ballasts)
• T568B pins: 1 white-orange, 2 orange, 3 white-green, 4 blue, 5 white-blue, 6 green, 7 white-brown, 8 brown. T568A swaps the orange and green pairs
• Same standard both ends = straight-through (host to switch). Different = crossover (switch to switch without auto-MDIX)
• Plenum-rated for air-handling spaces above drop ceilings; riser-rated for vertical runs between floors
• CSMA/CD: listen, send, back off on collision. Full duplex has no collisions. Duplex mismatch = late collisions and CRC errors

• LC: small square snap-in, most common on transceivers. SC: larger square push-pull. ST: round bayonet twist, legacy. MPO/MTP: 12 or 24 fibers in one plug for 40 and 100 Gbps
• UPC blue flat polish; APC green angled polish (less reflection, long haul and PON). Never mate UPC to APC
• Media converter changes medium without changing data (fiber to copper, SMF to MMF)
• Transceivers: SFP 1 Gbps, SFP+ 10 Gbps, QSFP/QSFP+ 40 Gbps, QSFP28 100 Gbps, QSFP-DD and OSFP 400 Gbps. Both ends must match speed, wavelength, and fiber type

• 2.4 GHz: non-overlapping channels 1, 6, 11 (20 MHz). Longest range, most interference (microwaves, Bluetooth, neighbors)
• 5 GHz: many channels, 40/80/160 MHz bonding, DFS channels must yield to radar. 6 GHz: Wi-Fi 6E only, shortest range
• Wider channels = more speed, more overlap and noise. Use 20 MHz in dense 2.4 GHz deployments
• SSID = network name. BSSID = MAC of one radio on one AP. ESSID = same SSID across many APs for roaming
• Infrastructure (through an AP), ad hoc (IBSS, no AP), mesh (APs link wirelessly), point-to-point (directional antennas between buildings)
• Omnidirectional for general coverage; directional (Yagi, patch, parabolic) for long links and hallways
• Autonomous APs configured individually; lightweight APs managed by a wireless LAN controller
• Site survey produces a heat map. Overlap cells 15 to 20 percent for roaming. Band steering pushes clients to 5 GHz

• Switch jobs: learn source MACs into the MAC (CAM) table, forward known destinations, flood unknowns and broadcasts, block loops with STP
• Each switch port is one collision domain. Each VLAN is one broadcast domain. A hub is one collision domain. A router separates broadcast domains
• Unmanaged: no config. Managed: VLANs, STP, port security. Layer 3 switch: also routes between VLANs in hardware
• In-band management over the network (SSH, web). Out-of-band via console port or dedicated management network
• Access port: one VLAN, untagged. Trunk port: many VLANs tagged with 802.1Q (4-byte tag, IDs 1 to 4094)
• Native VLAN crosses the trunk untagged (default VLAN 1) and must match on both ends
• Voice VLAN lets a phone tag while the PC behind it stays untagged. Management VLAN holds switch interfaces
• Routing between VLANs: SVI on a Layer 3 switch, or router on a stick with one subinterface per VLAN
• LACP (802.3ad, 802.1AX) bundles links; every member needs matching speed, duplex, and VLANs. One flow still uses one link
• MTU 1500; jumbo about 9000; every device in the path must match. Symptom of mismatch: small pings work, large transfers fail
• Port mirroring (SPAN) copies traffic to an analyzer port. Port security limits MACs; violation puts the port in error-disabled
• Duplex mismatch: one side hard-coded, the other auto falls to half duplex. Late collisions, CRC errors, slow link

• Distance-vector knows what neighbors say; link-state knows the whole map (more CPU, faster, fewer loops)
• Static: predictable, no overhead, no adaptation. Dynamic: adapts to failures. Default route 0.0.0.0/0 is the way out
• Routers rewrap the frame (new MACs), keep the packet (same IPs), decrement TTL by one. TTL 0 = discard
• Static NAT: one to one, publish a server. Dynamic NAT: pool, many to many. PAT (overload): many to one by source port, every home router
• Port forwarding: public port to an inside host. Inside local = private address; inside global = its public translation
• FHRP: routers share a virtual IP and virtual MAC. HSRP Cisco (active/standby). VRRP open standard (master/backup). GLBP Cisco with load balancing
• Subinterfaces: one physical interface split per VLAN (router on a stick)
• Convergence: time for all routers to agree after a change

DHCP

• DORA: Discover (broadcast from 0.0.0.0 to 255.255.255.255), Offer, Request, Acknowledge. UDP 67 server, 68 client
• Scope = the pool. Exclusion = addresses never leased. Reservation = fixed address pinned to a MAC. Lease = how long
• Clients renew at 50 percent of the lease (T1) and rebind at 87.5 percent (T2)
• Options: 3 default gateway, 6 DNS servers, 15 domain name, 42 NTP, 66 TFTP server name, 150 Cisco phone TFTP
• Relay agent or IP helper address turns the broadcast into a unicast so one server can serve many subnets
• Scope exhaustion or unreachable server = client self-assigns 169.254.x.x (APIPA). Rogue DHCP = DHCP snooping

• Lookup path: recursive resolver, root, top-level domain, authoritative. Cached answers are non-authoritative and expire at the TTL
• Forward zone: names to addresses. Reverse zone: addresses to names. Primary holds the writable copy; secondaries pull by zone transfer on TCP 53
• DNSSEC signs records: integrity, not privacy. DoT (TCP 853) and DoH (443) encrypt queries: privacy
• The hosts file is checked before DNS
• NTP UDP 123, millisecond accuracy. Stratum 0 = reference clock (GPS, atomic); stratum 1 connects to it; stratum 2 syncs from 1
• PTP (IEEE 1588) = sub-microsecond with hardware timestamps. NTS = authenticated, encrypted NTP
• Clock skew over 5 minutes breaks Kerberos; wrong time breaks certificates, MFA codes, and log correlation

Cloud

• SaaS: use the application. PaaS: deploy your code, provider runs the OS and runtime. IaaS: rent VMs, you manage the OS
• Public (shared, pay as you go), private (dedicated), hybrid (mix)
• VPC: your isolated virtual network with its own subnets
• Network security group: stateful firewall per VM interface. Network security list or NACL: stateless rules per subnet
• Internet gateway: public addresses reach the internet. NAT gateway: private subnets reach out only
• NFV: routers, firewalls, load balancers as software instances
• Site-to-site VPN over the internet (cheap, variable) versus direct connect (private circuit, predictable, costly)
• Scalability grows capacity; elasticity grows and shrinks automatically; multitenancy shares hardware with logical isolation

SDN, SD-WAN, VXLAN, zero trust, IaC

• SDN separates the control plane (decisions) from the data plane (forwarding). Application plane on top, management plane for monitoring
• Northbound APIs: applications to controller. Southbound APIs: controller to devices
• SD-WAN: application aware, transport agnostic, zero-touch provisioning, central policy management
• VXLAN: Layer 2 frames inside UDP across Layer 3. 24-bit VNI = 16 million segments versus 4094 VLANs. Data center interconnect
• Zero trust: never trust, always verify. Every request authenticated and authorized by policy with least privilege
• SASE = SD-WAN plus cloud security (firewall, secure web gateway, ZTNA, CASB). SSE = the security half only
• IaC: playbooks and templates, source control, drift detection, dynamic inventories, automated upgrades

Physical installation

• MDF: main wiring room, core devices, demarcation point where the provider's responsibility ends
• IDF: closet per floor or wing with access switches, uplinked to the MDF
• 19-inch racks; 1U = 1.75 inches. Two-post for light gear, four-post or lockable cabinet for servers
• Front intake cold aisle, rear exhaust hot aisle. Match port-side intake or exhaust to the rack's airflow
• Patch panel terminates horizontal cabling; patch cords connect panel to switch. Label both ends
• UPS carries load through outages and conditions power; generator is long term. PDU is the rack power strip
• Temperature 18 to 27 C (64 to 80 F). Humidity 40 to 60 percent: too dry = static, too humid = condensation
• Clean-agent or gas fire suppression, not water. 120 V or 208/240 V; redundant supplies on separate circuits

Documentation and agreements

• Physical diagram: where devices sit and cables run. Logical diagram: subnets, VLANs, routing, traffic flow
• Layer 1 diagram cabling; Layer 2 switches, VLANs, trunks, STP; Layer 3 routers, subnets, routing protocols
• Rack diagram: front view by rack unit. Cable map: jack to patch panel port to switch port
• Asset inventory: model, serial, location, owner, warranty, licensing. IPAM: every subnet and address
• SLA: what the provider guarantees (uptime, repair time) and penalties. MOU: non-binding intent. NDA: confidentiality
• Update documentation as the last step of every change

Life cycle, change, and configuration

• EOL: vendor stops selling. EOS: no more patches or support; replace it
• Change process in order: request, assess impact and write a rollback plan, approve, schedule a maintenance window and notify, implement and test, document
• Emergency changes take a shorter path but are still recorded. Service request = routine pre-approved work
• Production config (running now), backup config (saved before and after changes), baseline or golden config (approved standard). Drift = deviation from golden

Metrics

• Bandwidth = capacity. Throughput = what you get. Utilization = the ratio; sustained above 70 to 80 percent means congestion
• Latency = delay in ms (distance, queueing, satellite adds 500 to 600 ms). Jitter = variation in delay; choppy voice
• Packet loss = missing packets: TCP retransmits, voice gaps. Interface errors: CRC, runts, giants, discards
• Device health: CPU, memory, temperature, fans. CPU pegged often means a broadcast storm or attack

Remote access and management

• Site-to-site VPN joins offices. Client-to-site joins remote users. Clientless = browser over TLS
• Split tunnel: only corporate traffic through the VPN. Full tunnel: everything, inspected and protected
• Manage by SSH (22), HTTPS GUI, API, or console cable. Jump box or bastion: one hardened host you reach everything through
• In-band uses the production network. Out-of-band (console server, management network, cellular) works when production is down

Concepts

• CIA: confidentiality (encryption, access control), integrity (hashing, signatures), availability (redundancy, DDoS protection)
• Vulnerability = weakness. Threat = what could exploit it. Exploit = the method. Risk = likelihood times impact
• Encryption in transit (TLS, IPsec, SSH) versus at rest (disk, database). PKI: a certificate authority binds a public key to an identity. Self-signed = browser warning
• AAA: authentication (who), authorization (what), accounting (record)
• MFA factors: something you know, have, are; plus location and time. Password plus phone app code = know plus have
• SSO: one login for many systems. SAML: web SSO between identity provider and applications
• RADIUS: UDP 1812/1813, network access (Wi-Fi, VPN, 802.1X), encrypts only the password
• TACACS+: TCP 49, device administration, encrypts the whole payload, separates authentication from authorization, per-command control
• Least privilege; role-based access control; geofencing
• Honeypot = decoy system; honeynet = decoy network. Physical: locks, badges, cameras, mantraps
• Data locality laws; PCI DSS for card data; GDPR for EU personal data. Segment IoT, IIoT, SCADA/ICS/OT, guest, and BYOD
• IPsec: AH = integrity and authentication only; ESP = encryption too. Transport mode encrypts the payload; tunnel mode wraps the packet (site-to-site). IKE on UDP 500

Hardening and defense

• First steps on any device: change default passwords, disable unused ports and services, patch firmware, SSH and HTTPS only, management on its own VLAN or out of band
• Rotate keys and certificates; revoke compromised ones
• NAC: 802.1X authentication plus posture assessment (antivirus, patches, disk encryption). Noncompliant devices go to a quarantine or remediation VLAN
• ACLs: processed top down, first match wins, implicit deny at the end
• URL filtering by address or category; content filtering inspects what is inside
• Firewall zones: trusted (inside), untrusted (internet), screened subnet (DMZ) for public-facing servers
• Segmentation with VLANs and firewall rules limits lateral movement