Networking essentials: 50 must-know concepts

All 50 cards

1. 1
   The seven OSI layers, from bottom to top
   1 Physical, 2 Data link, 3 Network, 4 Transport, 5 Session, 6 Presentation, 7 Application

   Mnemonic: Please Do Not Throw Sausage Pizza Away.
2. 2
   The four layers of the TCP/IP model
   Link (network access), Internet, Transport, Application

   OSI layers 5–7 all map to the TCP/IP application layer.
3. 3
   What is the unit of data called at layers 2, 3 and 4?
   Frame (data link), packet (network), segment for TCP or datagram for UDP (transport)
4. 4
   At which OSI layers do switches and routers work?
   Switches at layer 2, forwarding frames by MAC address; routers at layer 3, forwarding packets by IP address

   Layer 3 switches can also route.
5. 5
   What is a MAC address?
   A 48-bit hardware address written as six hex pairs, like 00:1a:2b:3c:4d:5e; the first 24 bits identify the vendor (OUI)
6. 6
   TCP vs UDP
   TCP is connection-oriented, with reliable, ordered delivery plus flow and congestion control; UDP is connectionless and best-effort, with less overhead

   UDP suits DNS queries, streaming, voice calls and games.
7. 7
   The TCP three-way handshake
   SYN → SYN-ACK → ACK
8. 8
   How is a TCP connection closed?
   Each side sends a FIN that the other acknowledges (FIN, ACK, FIN, ACK); an RST aborts the connection immediately
9. 9
   Well-known, registered and dynamic port ranges
   0–1023 well-known, 1024–49151 registered, 49152–65535 dynamic (ephemeral)

   Linux uses 32768–60999 for ephemeral ports by default.
10. 10
    Port 22
    SSH (also used by SFTP and SCP)
11. 11
    Port 53
    DNS: UDP for most queries, TCP for zone transfers and large responses
12. 12
    Ports 80 and 443
    HTTP and HTTPS

    HTTP/3 runs over QUIC on UDP port 443.
13. 13
    Ports 67 and 68
    DHCP over UDP: 67 for the server, 68 for the client
14. 14
    Ports 20 and 21
    FTP: 21 for control, 20 for data in active mode
15. 15
    Ports 25, 587 and 465
    SMTP: 25 between mail servers, 587 for client submission with STARTTLS, 465 for submission over implicit TLS
16. 16
    Ports 110, 143, 993 and 995
    POP3 (110), IMAP (143), IMAP over TLS (993), POP3 over TLS (995)
17. 17
    Port 123
    NTP (UDP)
18. 18
    Ports 161 and 162
    SNMP over UDP: 161 for queries to agents, 162 for traps sent to the manager
19. 19
    Port 3389
    RDP (Remote Desktop Protocol)
20. 20
    How many bits are in an IPv4 address?
    32, written as four decimal octets like 192.168.1.10

    $2^{32} \approx 4.3$ billion addresses.
21. 21
    What does /24 mean in 192.168.1.0/24?
    The first 24 bits are the network prefix: mask 255.255.255.0, 256 addresses, 254 usable hosts
22. 22
    Usable hosts in a subnet with $h$ host bits
    $2^{h} - 2$

    The network and broadcast addresses can’t be assigned. A /31 point-to-point link is the exception, with both usable.
23. 23
    Usable hosts in a /26
    $2^{32-26} - 2 = 62$
24. 24
    Subnet mask of a /27
    255.255.255.224: 32 addresses, 30 usable hosts
25. 25
    Network and broadcast address of 192.168.10.77/26
    Network 192.168.10.64, broadcast 192.168.10.127; hosts .65 to .126

    A /26 splits the last octet into blocks of 64: .0, .64, .128, .192.
26. 26
    The private IPv4 ranges (RFC 1918)
    10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16
27. 27
    What is 127.0.0.0/8?
    Loopback: traffic never leaves the host. 127.0.0.1 is localhost
28. 28
    What does an address in 169.254.0.0/16 tell you?
    It is link-local (APIPA): the host assigned itself an address, usually because DHCP failed
29. 29
    Default gateway
    The router a host sends packets to when the destination is outside its own subnet
30. 30
    NAT vs PAT
    NAT rewrites private source addresses to a public one; PAT (NAT overload) also rewrites ports, so many hosts share one public IP
31. 31
    CIDR
    Classless Inter-Domain Routing: prefixes of any length (/22, /27) instead of fixed class A, B and C networks, which also allows route summarization
32. 32
    What does ARP do?
    Resolves an IPv4 address to a MAC address on the local network, with a broadcast request and a unicast reply

    On Linux, ip neigh shows the ARP cache.
33. 33
    DNS A vs AAAA record
    A maps a name to an IPv4 address; AAAA maps it to an IPv6 address
34. 34
    DNS CNAME record
    An alias that points one name at another, canonical name

    A name with a CNAME can’t have other records, so the bare domain (zone apex) can’t be a CNAME.
35. 35
    DNS MX record
    The mail servers for a domain, each with a preference number; lower numbers are tried first
36. 36
    DNS PTR record
    Reverse DNS: maps an IP address back to a name, under in-addr.arpa for IPv4 or ip6.arpa for IPv6
37. 37
    Recursive vs iterative DNS resolution
    The client asks a recursive resolver to do the whole lookup; the resolver then queries iteratively: a root server, then the TLD server, then the authoritative server, each referring it onward
38. 38
    TTL on a DNS record
    How many seconds resolvers may cache the record before asking again
39. 39
    The four steps of getting a DHCP lease (DORA)
    Discover, Offer, Request, Acknowledge

    Discover is a broadcast, because the client has no address yet.
40. 40
    What is ICMP used for?
    Network-layer control and error messages: echo request and reply (ping), destination unreachable, time exceeded
41. 41
    How does traceroute work?
    It sends packets with TTL 1, 2, 3…; each router that drops one when its TTL runs out replies with ICMP Time Exceeded, revealing the path
42. 42
    VLAN
    A logical layer 2 network that splits a switch into separate broadcast domains; trunk links tag frames with an 802.1Q header carrying a 12-bit VLAN ID
43. 43
    How many bits are in an IPv6 address?
    128, written as eight groups of four hex digits separated by colons
44. 44
    Shorten 2001:0db8:0000:0000:0000:0000:0000:0001
    2001:db8::1

    Drop leading zeros in each group, and replace one run of all-zero groups with :: (only once per address).
45. 45
    IPv6 loopback address and link-local prefix
    Loopback ::1; link-local fe80::/10
46. 46
    What replaces ARP in IPv6?
    Neighbor Discovery Protocol (NDP), with ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages
47. 47
    SLAAC
    Stateless Address Autoconfiguration: a host builds its own address from the /64 prefix in a router advertisement plus an interface ID

    The interface ID is random (privacy addresses) or derived from the MAC address (EUI-64).
48. 48
    Does IPv6 have broadcast?
    No. It uses multicast instead; ff02::1 reaches all nodes on the local link
49. 49
    IPv6 unique local addresses
    fc00::/7 (in practice fd00::/8), the IPv6 counterpart of private IPv4 ranges
50. 50
    IPv6 global unicast range
    2000::/3

    2001:db8::/32 is reserved for documentation and examples.