CCNA Notes and current progress on my CCNA studies. Jeremy's IT Lab: CCNA 200-301 Course Index This index provides a comprehensive breakdown of the CCNA 200-301 complete course by Jeremy's IT Lab, including direct links to lectures, labs, and extra resources. Playlist Link: Jeremy's IT Lab CCNA Playlist Day Topic Content Type Duration Link Day 1 Network Devices Lecture 30:26 Watch Anki Flashcards Extra 14:56 Watch Packet Tracer Introduction Lab 15:18 Watch Day 2 Interfaces and Cables Lecture 35:52 Watch Connecting Devices Lab 5:33 Watch Day 3 How the TCP/IP Model Actually Works Lecture 42:42 Watch OSI Model Lab 8:05 Watch Day 4 Intro to the CLI Lecture 31:06 Watch Basic Device Security Lab 10:26 Watch Day 5 Ethernet LAN Switching (Part 1) Lecture 38:13 Watch Day 6 Ethernet LAN Switching (Part 2) Lecture 33:41 Watch Analyzing Ethernet Switching Lab 10:29 Watch Day 7 IPv4 Addressing (Part 1) Lecture 40:21 Watch Day 8 IPv4 Addressing (Part 2) Lecture 30:42 Watch Configuring IP Addresses Lab 10:06 Watch Day 9 Switch Interfaces Lecture 32:28 Watch Configuring Interfaces Lab 11:54 Watch Day 10 IPv4 Header Lecture 30:11 Watch Day 11 Routing Fundamentals (Part 1) Lecture 31:00 Watch Static Routing (Part 2) Lecture 37:44 Watch Configuring Static Routes Lab 1 12:29 Watch Troubleshooting Static Routes Lab 2 9:45 Watch Day 12 The Life of a Packet Lecture 20:13 Watch Life of a Packet Lab 15:36 Watch Day 13 Subnetting (Part 1) Lecture 28:54 Watch Day 14 Subnetting (Part 2) Lecture 24:47 Watch Day 15 Subnetting (Part 3 - VLSM) Lecture 23:53 Watch Subnetting (VLSM) Lab 14:59 Watch Day 16 VLANs (Part 1) Lecture 23:45 Watch VLANs (Part 1) Lab 11:02 Watch Day 17 VLANs (Part 2) Lecture 40:01 Watch VLANs (Part 2) Lab 23:23 Watch Day 18 VLANs (Part 3) Lecture 32:32 Watch VLANs (Part 3) Lab 25:19 Watch Day 19 DTP/VTP Lecture 37:34 Watch DTP/VTP Lab 18:47 Watch Day 20 Spanning Tree Protocol (Part 1) Lecture 38:39 Watch Analyzing STP Lab 18:55 Watch Day 21 Spanning Tree Protocol (Part 2) Lecture 42:18 Watch PortFast (STP Toolkit) Lecture 17:34 Watch BPDU Guard & BPDU Filter Lecture 24:24 Watch Root Guard Lecture 19:44 Watch Loop Guard Lecture 18:49 Watch Configuring STP (PVST+) Lab 17:09 Watch Day 22 Rapid Spanning Tree Protocol Lecture 43:01 Watch Rapid STP Lab 19:50 Watch Day 23 EtherChannel Lecture 41:33 Watch Configuring EtherChannel Lab 25:03 Watch Day 24 Dynamic Routing Lecture 44:38 Watch Floating Static Routes Lab 23:20 Watch Day 25 RIP & EIGRP Lecture 43:42 Watch Configuring EIGRP Lab 26:14 Watch Day 26 OSPF Part 1 Lecture 39:40 Watch Configuring OSPF (1) Lab 22:07 Watch Day 27 OSPF Part 2 Lecture 36:55 Watch Configuring OSPF (2) Lab 22:10 Watch Day 28 OSPF Part 3 Lecture 47:53 Watch Configuring OSPF (3) Lab 21:25 Watch Day 29 First Hop Redundancy Protocols (FHRP) Lecture 40:25 Watch Configuring HSRP Lab 22:01 Watch Day 30 TCP & UDP Lecture 33:59 Watch Wireshark Demo (TCP/UDP) Lab 11:15 Watch Day 31 IPv6 Part 1 Lecture 39:26 Watch Configuring IPv6 (Part 1) Lab 18:02 Watch Day 32 IPv6 Part 2 Lecture 39:33 Watch Configuring IPv6 (Part 2) Lab 21:02 Watch Day 33 IPv6 Part 3 Lecture 43:50 Watch Configuring IPv6 (Part 3) Lab 19:17 Watch Day 34 Standard ACLs Lecture 46:51 Watch Standard ACLs Lab 27:01 Watch Day 35 Extended ACLs Lecture 40:55 Watch Extended ACLs Lab 22:08 Watch Day 36 CDP & LLDP Lecture 39:23 Watch CDP & LLDP Lab 24:37 Watch Day 37 NTP Lecture 42:46 Watch NTP Lab 19:08 Watch Day 38 DNS Lecture 30:11 Watch DNS Lab 17:31 Watch Day 39 DHCP Lecture 37:02 Watch DHCP Lab 17:49 Watch Day 40 SNMP Lecture 29:21 Watch SNMP Lab 13:37 Watch Day 41 Syslog Lecture 27:58 Watch Syslog Lab 14:03 Watch Day 42 SSH Lecture 31:07 Watch SSH Lab 15:50 Watch Day 43 FTP & TFTP Lecture 30:55 Watch FTP & TFTP Lab 15:36 Watch Day 44 NAT (Part 1) Lecture 32:10 Watch Static NAT Lab 14:12 Watch Day 45 NAT (Part 2) Lecture 29:40 Watch Dynamic NAT Lab 15:01 Watch Day 46 QoS (Part 1) Lecture 32:33 Watch Voice VLANs Lab 20:18 Watch Day 47 QoS (Part 2) Lecture 41:46 Watch QoS Lab 15:41 Watch Day 48 Security Fundamentals Lecture 38:40 Watch Kali Linux Demo Lab 10:25 Watch Day 49 Port Security Lecture 34:28 Watch Port Security Lab 17:03 Watch Day 50 DHCP Snooping Lecture 28:23 Watch DHCP Snooping Lab 15:41 Watch Day 51 Dynamic ARP Inspection Lecture 32:50 Watch Dynamic ARP Inspection Lab 20:53 Watch Day 52 LAN Architectures Lecture 28:06 Watch STP & FHRP Synchronization Lab 19:11 Watch Day 53 WAN Architectures Lecture 37:34 Watch GRE Tunnels Lab 22:04 Watch Day 54 Virtualization & Cloud (Part 1) Lecture 38:41 Watch Containers (Part 2) Lecture 13:33 Watch VRF (Part 3) Lecture 18:03 Watch Oracle VirtualBox Lab 8:43 Watch Day 55 Wireless Fundamentals Lecture 35:57 Watch Day 56 Wireless Architectures Lecture 38:21 Watch Day 57 Wireless Security Lecture 33:53 Watch Day 58 Wireless Configuration Lecture 46:38 Watch Wireless LANs Lab 17:28 Watch Day 59 Intro to Network Automation (Part 1) Lecture 33:27 Watch AI & Machine Learning (Part 2) Lecture 41:49 Watch Day 60 JSON, XML, & YAML Lecture 28:56 Watch Day 61 REST APIs (Part 1) Lecture 31:45 Watch REST API Authentication (Part 2) Lecture 29:15 Watch Day 62 Software-Defined Networking Lecture 28:19 Watch Day 63 Ansible, Puppet, & Chef (Part 1) Lecture 21:33 Watch Terraform (Part 2) Lecture 22:29 Watch Final CCNA Mega Lab! Lab 2:38:50 Watch Day 1: Network Devices and Fundamentals Networking Fundamentals Core Concepts What is a Network? A network is a digital telecommunications system that allows nodes (devices) to share resources and communicate with each other. Device Roles Client A device that accesses services or resources provided by another device Initiates requests to servers Server A device that provides services, functions, or resources to client devices Responds to client requests Note: Devices are not inherently "client" or "server"—the same device can fulfill either role depending on the context. Example: In a peer-to-peer (P2P) network, all devices act as both clients and servers.     Network Devices by Function Switches (OSI Layer 2) Purpose: Connect devices within a single LAN Key Characteristics: Multiple network ports/interfaces for connecting end hosts Operate at Layer 2 (Data Link Layer) of the OSI model Enable device-to-device communication on the same local network Forward frames based on MAC addresses What they do NOT do: Provide connectivity between different LANs Route traffic over the Internet Connect networks to the wider world     Routers (OSI Layer 3) Purpose: Connect multiple networks and route traffic between them Key Characteristics: Fewer network interfaces than switches Operate at Layer 3 (Network Layer) of the OSI model Forward packets between LANs using IP addresses Enable communication across the Internet Can connect local networks to ISP networks     Firewalls (OSI Layers 3–7) Purpose: Control and monitor network traffic to enforce security policies Key Characteristics: Specialty network security devices that filter traffic entering and exiting a network Operate at multiple OSI layers depending on filtering sophistication Monitor and enforce rules based on traffic patterns, protocols, and applications Types: Network-based Firewalls Dedicated hardware devices placed at network perimeter (inside or outside) Protect entire networks Examples: Cisco ASA, Palo Alto Networks, Fortinet FortiGate Host-based Firewalls Software applications running on individual machines Protect only that specific device (e.g., Windows Defender Firewall, macOS firewall) Examples: Personal computers, servers Next-Generation Firewalls (NGFW) Enhanced firewalls with advanced filtering capabilities Include features like: Application-layer awareness Intrusion prevention Deep packet inspection User/identity-based policies     Summary Table Device OSI Layer Primary Function Scope Switch Layer 2 Connect hosts on same LAN Single LAN Router Layer 3 Connect different networks Multiple LANs/Internet Firewall Layers 3–7 Control traffic via rules Network or host level Day 2: Interfaces and Cables Interfaces and Cables Overview Switches provide multiple ports for device connectivity—typically 24 ports on a standard switch. These ports are RJ-45 (Registered Jack) connectors, the standard connection point for network devices.     Ethernet: The Standard What is Ethernet? Ethernet is a collection of standardized network protocols and hardware specifications that define how devices communicate over wired networks. Why Standards Matter Network protocols and standards serve two critical purposes: Communication standards — Enable devices from different manufacturers to communicate reliably Hardware standards — Ensure physical compatibility between devices and cables Speed and Measurement Connections between devices operate at specific speeds, measured in bits per second (bps). Bit = a single value: 0 or 1 Byte = 8 bits Speed Conversions: Unit Bits 1 kilobit (Kb) 1,000 1 megabit (Mb) 1,000,000 1 gigabit (Gb) 1,000,000,000 1 terabit (Tb) 1,000,000,000,000 Ethernet Standards Defined: IEEE 802.3 standard (established 1983) IEEE = Institute of Electrical and Electronics Engineers     Copper Ethernet Cables (UTP) Ethernet Standards by Speed Speed Common Name Standard Cable Type Max Distance 10 Mbps Ethernet 802.3i 10BASE-T 100m 100 Mbps Fast Ethernet 802.3u 100BASE-T 100m 1 Gbps Gigabit Ethernet 802.3ab 1000BASE-T 100m 10 Gbps 10 Gigabit Ethernet 802.3an 10GBASE-T 100m Notation: BASE = Baseband Signaling (digital signal, single information channel) T = Twisted Pair (copper cable type) UTP Cables (Unshielded Twisted Pair) What it is: Standard copper cabling for most Ethernet connections No metallic shield around the wires Contains twisted pairs of wires Why twist the wires? The twisting protects against EMI (Electromagnetic Interference) from external sources Helps maintain signal integrity over distance Wire Count by Speed: 10/100BASE-T: Uses 2 pairs (4 wires) 1000BASE-T / 10GBASE-T: Uses 4 pairs (8 wires) All 4 pairs are bidirectional (can transmit and receive simultaneously) This enables faster transmission than older standards     Cable Pinout and Device Communication RJ-45 Connector Pin Layout An RJ-45 plug has 8 pins numbered 1–8 at each end of the cable. Devices use specific pins to transmit (TX) and receive (RX) data: Device Type TX Pins RX Pins Router 1, 2 3, 6 Firewall 1, 2 3, 6 PC 1, 2 3, 6 Switch 3, 6 1, 2 Full-Duplex Transmission The pin arrangement enables full-duplex communication—devices can transmit and receive simultaneously because they use different pin pairs.     Cable Types: Straight-Through vs. Crossover Straight-Through Cables When to use: Connecting a PC or Router to a Switch Connecting a Firewall to a Switch Any device with TX on pins 1-2 to a device with RX on pins 1-2 Why it works: One end has pins arranged the same as the other end TX pins from one device connect to RX pins on the other device No pin swapping needed Crossover Cables When to use: Connecting two similar devices directly (Router to Router, Switch to Switch, PC to PC) These devices have the same TX/RX pin configuration, so they would conflict with a straight-through cable How it works: One end of the cable has pins swapped to create proper TX/RX alignment Pins are crossed: 1↔3, 2↔6, 3↔1, 6↔2 Crossover Pin Mapping: End A → End B PIN 1 → PIN 3 PIN 2 → PIN 6 PIN 3 → PIN 1 PIN 6 → PIN 2 Auto MDI-X Modern equipment simplifies this: Most switches, routers, and PCs now include Auto MDI-X capability Devices automatically detect the neighbor's transmit pins and adjust their receive pins accordingly Works with either straight-through or crossover cables Eliminates the need to manually choose cable type     Fiber-Optic Cables When to Use Fiber Fiber-optic cables are used for high-speed, long-distance connections between network devices. Standard: IEEE 802.3ae (and 802.3z for 1 Gbps) SFP Transceiver SFP (Small Form-Factor Pluggable): A module that allows fiber-optic cables to connect to switches and routers Separate TX and RX cables (unlike copper which uses the same cable for both directions) Removes the need for pin management—fiber uses dedicated paths for each direction Fiber Cable Structure A fiber-optic cable has 4 main components: Core (glass or plastic) Cladding (surrounds and protects core) Buffer (protective layer) Jacket (outer protective sheath) Two Types of Fiber Single-Mode Fiber Characteristics: Narrower core than multimode Light enters at a single angle (mode) using a laser-based transmitter Allows the longest cable distances of all Ethernet media More expensive (laser-based SFP transmitters are costly) Use case: Long-distance backbone connections between buildings or data centers Multimode Fiber Characteristics: Wider core than single-mode Light enters at multiple angles (modes) using an LED-based transmitter Allows longer distances than UTP, but shorter than single-mode Less expensive than single-mode (LED-based transmitters are cheaper) Use case: Medium-distance connections within a data center or building Fiber-Optic Standards Standard Speed Mode Max Distance 1000BASE-LX 1 Gbps Multimode / Single 550m (MM) / 5km (SM) 10GBASE-SR 10 Gbps Multimode 400m 10GBASE-LR 10 Gbps Single 10km 10GBASE-ER 10 Gbps Single 30km     UTP vs. Fiber-Optic: Comparison UTP (Unshielded Twisted Pair) Advantages: Lower cost RJ-45 ports are inexpensive Simple to install and terminate Disadvantages: Maximum distance: ~100m Vulnerable to EMI (Electromagnetic Interference) Security risk: Cables emit a faint signal that can be intercepted or copied Not suitable for long distances Fiber-Optic Advantages: Longer maximum distances (hundreds of meters to tens of kilometers) No vulnerability to EMI More secure: Signals cannot leak from the cable; no risk of interception Suitable for long-distance and high-security applications Disadvantages: Higher cost than UTP SFP ports are more expensive than RJ-45 ports Single-mode fiber is significantly more expensive than multimode Requires specialized installation and termination tools More fragile (fiber can break if bent too sharply)     Quick Reference: When to Use What Situation Media Reason PC to Switch (same building) UTP Cost-effective, sufficient distance Switch to Switch (same building) UTP or Fiber UTP for short runs; Fiber for long runs or security Router to Router (different buildings) Fiber Longer distances, EMI immunity Data center backbone Fiber Long distances, high throughput, security Home/office network UTP Cost, simplicity, Auto MDI-X Day 3: OSI Model and TCP/IP Suite OSI Model & TCP/IP Suite Networking Models: Overview A networking model categorizes and provides structure for networking protocols and standards. Protocol = A set of logical rules defining how network devices and software communicate and function. Networking models help engineers understand which layer is responsible for which functions, making troubleshooting and design much easier.     OSI Model What is the OSI Model? OSI = Open Systems Interconnection Model Conceptual model created by ISO (International Organization for Standardization) Standardizes different functions in a network across 7 layers Purpose: Provide a reference framework for understanding how networks operate These 7 layers work together hierarchically to enable end-to-end communication Key Concept: Data Movement As data moves through the layers, it follows two processes: Encapsulation (Top → Bottom, Layers 7 → 1) Data travels DOWN the OSI stack Each layer adds its own header/trailer to the data Headers contain layer-specific information needed for that layer's function Happens at the sender's device De-encapsulation (Bottom → Top, Layers 1 → 7) Data travels UP the OSI stack Each layer removes (strips) its header/trailer Extracts the information needed at that layer Happens at the receiver's device Key Concept: Layer Interactions Adjacent-Layer Interaction Communication between different layers on the same device Example: Layer 5 sends data to Layer 4, Layer 4 adds header and sends to Layer 3 Same-Layer Interaction Communication between the same layer on different devices Example: The HTTP layer (Layer 7) on your PC browser talks to HTTP layer on a web server You can analyze one layer's interaction in isolation, ignoring what other layers do     The 7 Layers of the OSI Model Layer 7 - APPLICATION What it does: Closest to the end user Interacts directly with user applications and software Provides services that enable network communication for applications Key Functions: Identifying and locating communication partners Synchronizing communication between applications Providing user-visible network services Common Layer 7 Protocols: HTTP / HTTPS (web browsing) FTP (file transfer) SMTP / POP3 (email) DNS (domain name resolution) Telnet / SSH (remote login) Who uses it: Application developers and end users     Layer 6 - PRESENTATION What it does: Translates data into an appropriate format for transmission Converts between application format and network transmission format Handles data encryption, compression, and translation Key Functions: Data formatting and conversion Encryption/Decryption of data Data compression Character encoding (ASCII, Unicode, etc.) Who uses it: Application developers     Layer 5 - SESSION What it does: Controls "dialogues" (sessions) between communicating applications Manages the connection lifecycle between local and remote applications Key Functions: Establishing connections Managing (maintaining) connections Terminating connections Dialog control and synchronization Common Session Layer Examples: Remote Desktop Protocol (RDP) X Window System Who uses it: Application developers     ⚠️ Important Note: Top 3 Layers Network engineers rarely work directly with Layers 5-7. These layers are the domain of application developers who design software to use networks. When troubleshooting network issues, most work happens at Layers 1-4.     Layer 4 - TRANSPORT What it does: Segments (breaks up) and reassembles data for communication between end hosts Provides HOST-TO-HOST (end-to-end) communication Why segmentation matters: Large pieces of data are broken into smaller segments Smaller segments are easier to send across the network If an error occurs, only the affected segment needs retransmission (not the entire message) Key Protocols: TCP (Transmission Control Protocol) — reliable, connection-oriented UDP (User Datagram Protocol) — fast, connectionless PDU (Protocol Data Unit) at Layer 4: When Layer 7-5 data arrives at Layer 4, Layer 4 adds a Layer 4 Header Result: SEGMENT Format: [DATA + L4 Header] Common Layer 4 Port Numbers (CCNA exam-relevant): TCP 80 (HTTP) TCP 443 (HTTPS) TCP 22 (SSH) UDP 53 (DNS)     Layer 3 - NETWORK What it does: Provides connectivity between different networks (outside the local LAN) Provides logical addressing using IP addresses (unlike Layer 2's MAC addresses) Performs path selection — determines the best route for data to travel from source to destination Works with routers to forward data between networks Key Functions: IP addressing and routing Path selection using routing protocols Logical addressing (not physical) Device operating at Layer 3: Routers — forward packets between networks based on IP addresses PDU (Protocol Data Unit) at Layer 3: When Layer 4 header arrives at Layer 3, Layer 3 adds a Layer 3 Header Result: PACKET Format: [DATA + L4 Header + L3 Header] Contains: Source/destination IP addresses Common Layer 3 Protocols: IP (IPv4, IPv6) ICMP (ping) IGMP     Layer 2 - DATA LINK What it does: Provides NODE-TO-NODE connectivity and data transfer Examples: PC to Switch, Switch to Router, Router to Router Defines how data is formatted for transmission over physical medium (e.g., UTP cables) Detects (and sometimes corrects) physical layer errors Uses Layer 2 addressing (MAC addresses) — separate from Layer 3 IP addresses Key Functions: Node-to-node delivery Physical addressing (MAC addresses) Framing and error detection Media access control (determining who uses the network when) Device operating at Layer 2: Switches — forward frames between ports based on MAC addresses PDU (Protocol Data Unit) at Layer 2: When Layer 3 packet arrives at Layer 2, Layer 2 adds both a Header AND a Trailer Result: FRAME Format: [L2 Header + DATA + L4 Header + L3 Header + L2 Trailer] Contains: Source/destination MAC addresses Common Layer 2 Protocols: Ethernet PPP (Point-to-Point Protocol) Frame Relay     Layer 1 - PHYSICAL What it does: Defines the physical characteristics of the network medium Converts digital bits into electrical or radio signals for transmission Receives signals and converts them back to digital bits Key Functions: Physical medium specifications (copper, fiber, wireless) Voltage levels and signal timing Maximum transmission distances Physical connectors and cable specifications Bit transmission (0s and 1s) Examples of Layer 1: RJ-45 connectors Ethernet cables (UTP, fiber-optic) Hub devices (simple repeaters) The actual wires and wireless frequencies Related Reference: All content from your Networking Devices and Interfaces & Cables notes is Layer 1 related     OSI Model: PDU Summary A PDU (Protocol Data Unit) is the formatted data at each layer of the OSI model. As data moves down the stack, each layer adds information to the PDU. Encapsulation Process (Sender, Top to Bottom): Layer 7-5:  [DATA]             ↓ Layer 4:    [DATA + L4 Header] = SEGMENT             ↓ Layer 3:    [DATA + L4 Header + L3 Header] = PACKET             ↓ Layer 2:    [L2 Header + DATA + L4 Header + L3 Header + L2 Trailer] = FRAME             ↓ Layer 1:    Convert Frame to bits (0s and 1s) = BITS De-encapsulation Process (Receiver, Bottom to Top): Layer 1 converts bits to frame Layer 2 strips L2 header/trailer, checks for errors Layer 3 strips L3 header, checks IP address Layer 4 strips L4 header, hands data to upper layers Layers 5-7 process the original data Quick Reference Table: OSI Layer PDU Name Headers/Trailers Added Key Information 7-5 DATA None (origination) User data 4 SEGMENT Layer 4 Header Port numbers (TCP/UDP) 3 PACKET Layer 3 Header IP addresses 2 FRAME L2 Header + L2 Trailer MAC addresses 1 BITS None (transmission) 0s and 1s     TCP/IP Suite (Modern Model) What is TCP/IP? TCP/IP Suite: Actual set of communications protocols used in the modern Internet and networks Named after two foundational protocols: TCP and IP Developed by U.S. Department of Defense through DARPA (Defense Advanced Research Projects Agency) This is the model actually deployed and in use today How is it Different from OSI? Similarities: Both are layered models Both help organize network functions Key Differences: Aspect OSI Model TCP/IP Model Layers 7 layers 4-5 layers (varies by source) Status Conceptual reference Practical, in-use model Development International standards body (ISO) U.S. Department of Defense (DARPA) Protocol specificity Generic, protocol-agnostic Built around TCP/IP protocols Use Teaching and troubleshooting framework Actual implementation TCP/IP Model Layers (Simplified) Most commonly shown as 4 layers: Application Layer (Layers 5-7 in OSI) Protocols: HTTP, HTTPS, FTP, SMTP, DNS, SSH Transport Layer (Layer 4 in OSI) Protocols: TCP, UDP Internet Layer (Layer 3 in OSI) Protocols: IP, ICMP Link Layer (Layers 1-2 in OSI) Protocols: Ethernet, PPP Physical medium and hardware OSI vs. TCP/IP: Why OSI Still Matters Although TCP/IP is the working model: OSI model still influences how network engineers think and talk about networks CCNA exam heavily emphasizes OSI model concepts OSI's 7-layer breakdown is clearer for teaching individual functions Both models coexist in professional environments     Quick Reference: Which Device Operates at Which Layer? Device OSI Layer Function Hub Layer 1 Repeats signals Switch Layer 2 Forwards frames by MAC address Router Layer 3 Forwards packets by IP address Firewall Layer 3-7 Filters traffic based on multiple criteria PC / Server Layers 1-7 All layers     Key Takeaways for CCNA ✅ Understand encapsulation/de-encapsulation — This is fundamental to how networks work ✅ Know what each layer does — Particularly Layers 1-4 for network engineers ✅ Understand PDU names — Segment, Packet, Frame, Bits (test questions often ask "what is this called?") ✅ Know device-to-layer mapping — Switches at Layer 2, Routers at Layer 3 ✅ Understand adjacent vs. same-layer interaction — Helps with troubleshooting concepts ✅ TCP/IP is the real model — OSI is the teaching model; they're used together in practice Day 4: Introduction to the CLI Introduction to the CLI (Command Line Interface) Overview The CLI (Command Line Interface) is the text-based interface used to configure Cisco network devices. Contrast: A GUI (Graphical User Interface) is a visual, point-and-click interface—less common in Cisco device administration.     Accessing the CLI: Physical Connection Console Port Connection When you first configure a Cisco device, you must physically connect via the Console Port. Cable Options: Rollover Cable (DB9 serial to RJ45) Connects serial port on your computer to the RJ45 console port on the device USB Adapter (DB9 serial to USB) For computers without a native serial port (most modern laptops) Terminal Emulator To actually access the CLI after connecting the console cable: Open a Terminal Emulator application on your PC Popular choices: PuTTY, Cisco Packet Tracer, SecureCRT, Tera Term Configure the connection as "Serial" with Cisco default settings (see below) Cisco Default Serial Settings These are the standard configuration settings for console access to Cisco devices: Setting Value Speed (Baud Rate) 9600 bits/second Data Bits 8 Stop Bits 1 Parity None Flow Control None     Cisco CLI Modes The CLI is organized into different modes, each with different capabilities and prompts. Mode 1: User EXEC Mode (User Mode) How to enter: This is the default mode when you first connect to the device. Prompt: Router> (greater-than symbol) Capabilities: Very limited access Can view some basic information about the device Cannot make ANY changes to the device configuration Read-only mode Common User EXEC Commands: enable — Switch to Privileged EXEC mode ? — Display available commands help — Get help Mode 2: Privileged EXEC Mode How to enter: Type enable from User EXEC mode (may require password) Prompt: Router# (hash/pound symbol) Capabilities: Full access to view device configuration Can restart the device Can save configuration files Can change the system clock/time Still cannot make configuration changes This mode is for "executing" commands, not entering configuration Common Privileged EXEC Commands: configure terminal (or conf t) — Enter Global Configuration Mode show running-config — View current active configuration show startup-config — View configuration that loads on reboot write or write memory — Save running config to startup config exit — Go back to User EXEC mode Mode 3: Global Configuration Mode How to enter: From Privileged EXEC mode, type configure terminal or conf t Prompt: Router(config)# (the word "config" appears in the prompt) Capabilities: Can make changes to the device configuration Enter commands that modify how the device operates Can set passwords, configure interfaces, enable services, etc. Changes made here affect the running configuration (active config) How to exit: Type exit to return to Privileged EXEC mode Important: Changes made in Global Configuration Mode are temporary—they affect the running configuration but are lost if the device restarts. You must save them (with write or copy running-config startup-config) to make them permanent.     CLI Navigation Helpers Question Mark (?) The ? key provides context-sensitive help at ANY time and in ANY mode. Uses: View all available commands in current mode: Router# ?  Lists every command available at this prompt level View commands that start with a specific letter or prefix: Router(config)# conf ?  Lists all commands starting with "conf" View required parameters for a command: Router# configure ?  Shows what parameters are needed to complete the configure command Pro tip: This is one of the most important tools in Cisco CLI—always use ? when you're unsure what to do. TAB Key (Command Completion) Press TAB to auto-complete a partially entered command. How it works: Type the first few letters of a command Press TAB If the command is unambiguous (only one match), it auto-completes If multiple matches exist, nothing happens—add more letters to narrow it down Example: Router# conf  → Router# configure Router# conf t → Router# configure terminal     Configuration Files Cisco devices maintain two separate configuration files at all times: Running Configuration (running-config) The current, active configuration on the device All commands you enter in the CLI edit this file in real-time If the device restarts, this configuration is lost (unless saved) Stored in RAM Startup Configuration (startup-config) The configuration file that loads when the device boots up Used to restore the device configuration after a restart Stored in NVRAM (non-volatile memory) Persists even if power is lost Viewing Configurations From Privileged EXEC mode: Router# show running-config    (view current active config) Router# show startup-config    (view config that will load on reboot) Saving Configuration (Making Changes Permanent) To copy the running-config to startup-config, use any of these equivalent commands from Privileged EXEC mode: Router# write Router# write memory Router# copy running-config startup-config Destination filename [startup-config]? All three commands accomplish the same thing—they save your changes so they survive a device restart.     Passwords and Security Enable Password (Weak Encryption) Purpose: Protects access to Privileged EXEC mode Command (in Global Configuration Mode): Router(config)# enable password (your-password) Encryption Level: Uses Type 7 encryption (Cisco proprietary) Weak encryption—easy to crack Passwords are visible as plaintext in the config file until encryption is enabled Important: Passwords are case-sensitive. Enable Secret (Strong Encryption) Purpose: Also protects access to Privileged EXEC mode (overrides enable password) Command (in Global Configuration Mode): Router(config)# enable secret (your-password) Encryption Level: Uses Type 5 encryption (MD5 hashing) Much stronger than Type 7 Should always be used over enable password Passwords are always encrypted (even without service password-encryption) Important Note: Once you set enable secret, it takes precedence over enable password. If both are configured, only enable secret is used. Service Password-Encryption Purpose: Automatically encrypts all passwords in the configuration file Command (in Global Configuration Mode): Router(config)# service password-encryption What it does: Converts plaintext passwords (like enable password) to Type 7 encrypted format Future passwords entered will also be encrypted automatically Does NOT affect enable secret (which is always encrypted anyway) What happens if you disable it: Router(config)# no service password-encryption Current encrypted passwords remain encrypted (won't be decrypted) Future passwords will not be encrypted enable secret is not affected Encryption Type Reference: Type Encryption Method Strength Notes 7 Cisco Proprietary Weak Used by service password-encryption 5 MD5 Hash Strong Used by enable secret     Modifying or Deleting Configuration Commands Using the "no" Keyword To remove or disable any configuration command, prefix it with no: Examples: Router(config)# no enable password (Removes the enable password entirely) Router(config)# no service password-encryption (Disables automatic encryption of passwords) Router(config)# no enable secret (Removes the enable secret) The no keyword is how you undo any configuration change in Cisco CLI.     Practical Workflow: Initial Device Configuration Here's a typical sequence for configuring a new device: Router> enable (Enter Privileged EXEC Mode) Router# configure terminal (Enter Global Configuration Mode) Router(config)# enable password mypassword (Set weak password protection for privileged mode) Router(config)# enable secret mysecretpassword (Set strong password protection for privileged mode) Router(config)# service password-encryption (Encrypt plaintext passwords in config) Router(config)# exit (Return to Privileged EXEC Mode) Router# write memory (Save configuration to startup-config) Router# show running-config (Verify your changes)     Key Takeaways for CCNA ✅ Know the three modes: User EXEC (>), Privileged EXEC (#), Global Configuration (config#) ✅ Understand the two config files: running-config (active, temporary) and startup-config (saved, permanent) ✅ Use ? and TAB constantly — They're your best friends in the CLI ✅ Password security: Use enable secret (Type 5), not enable password (Type 7) ✅ Always save your work — Use write or copy running-config startup-config ✅ Use no to undo — It's the standard way to remove any configuration ✅ Case-sensitive — All CLI input, especially passwords, is case-sensitive     Common Commands Quick Reference Task Command Mode Switch to Privileged mode enable User EXEC Enter config mode configure terminal Privileged EXEC Exit current mode exit Any mode View all commands ? Any mode View running config show running-config Privileged EXEC View startup config show startup-config Privileged EXEC Save config write or write memory Privileged EXEC Set weak password enable password (pass) Global Config Set strong password enable secret (pass) Global Config Enable auto-encryption service password-encryption Global Config Remove a command no (command) Global Config Days 5, 6: Ethernet LAN Switching Ethernet LAN Switching Overview LANs (Local Area Networks) A LAN is a network contained within a relatively small area (typically a single building or floor) Devices within the same LAN communicate directly using Ethernet (Layer 2) Routers are used to connect separate LANs together Switches provide connectivity to hosts within the same LAN     Ethernet Frames Frame Structure An Ethernet Frame is the Layer 2 Protocol Data Unit (PDU) that carries data across a LAN. Overall Frame Structure: [Ethernet Header] --- [DATA / Packet] --- [Ethernet Trailer] Ethernet Header Fields The Ethernet header contains 5 fields totaling 14 bytes (excluding Preamble and SFD): Field Size Purpose Preamble 7 bytes Synchronizes receiver clock (alternating 10101010 pattern) SFD 1 byte Start Frame Delimiter (10101011) - marks start of actual frame Destination MAC 6 bytes Layer 2 address of receiving device Source MAC 6 bytes Layer 2 address of sending device Type/Length 2 bytes Indicates protocol type OR data length Note: The Preamble and SFD are typically not counted as part of the Ethernet header in frame size calculations. Preamble (7 bytes) Pattern: 10101010 repeated 7 times (56 bits) Allows receiving devices to synchronize their clock with the sender Used for timing reference SFD (Start Frame Delimiter) (1 byte) Value: 10101011 (8 bits) Marks the end of the Preamble and the beginning of the actual frame data Signals that important information follows Destination and Source MAC Addresses (6 bytes each) MAC = Media Access Control Layer 2 physical address of the sending and receiving devices Burned-in address (BIA) assigned by manufacturer Globally unique (in theory) Written as 12 hexadecimal characters with colons or dots: E8:BA:70:11:28:74 MAC Address Structure: First 3 bytes (6 hex characters): OUI (Organizationally Unique Identifier) Assigned to the manufacturer by IEEE Identifies the company that made the device Example: E8:BA:70 (Cisco) Last 3 bytes (6 hex characters): Unique device identifier Assigned by the manufacturer to individual devices Ensures no two devices from the same manufacturer have the same MAC address Example: 11:28:74 Type/Length Field (2 bytes) Value of 1500 or less: Field indicates the LENGTH of the encapsulated data payload (in bytes) Value of 1536 or greater: Field indicates the TYPE of the encapsulated protocol Common Layer 3 Protocol Types: Protocol Hexadecimal Decimal IPv4 0x0800 2048 IPv6 0x86DD 34525 ARP 0x0806 2054 Ethernet Trailer The Ethernet trailer contains 1 field: FCS (Frame Check Sequence) - 4 bytes (32 bits) Detects corrupted data using a CRC (Cyclic Redundancy Check) algorithm Calculated over the entire received frame If calculated CRC doesn't match FCS, the frame is discarded as corrupted Receiver calculates CRC and compares it to the FCS value Frame Size Calculation Total Ethernet Header + Trailer Size: Header: 6 + 6 + 2 = 14 bytes Trailer (FCS): 4 bytes Total: 18 bytes (not including Preamble + SFD, which add 8 more bytes) Minimum Frame Size: Minimum Ethernet frame (including header + trailer): 64 bytes total Minimum data payload: 64 - 18 = 46 bytes If payload < 46 bytes: Padding bytes are added (series of 0x00 bytes) until the payload reaches 46 bytes Ensures the frame meets the 64-byte minimum Maximum Frame Size: Standard Ethernet: 1518 bytes (includes header + trailer, excludes Preamble + SFD) Payload (without header/trailer): 1500 bytes (called the MTU - Maximum Transmission Unit) Jumbo Frames (optional): Up to 9000 bytes     MAC Addressing Deep Dive Hexadecimal Numbering MAC addresses are written in hexadecimal (base 16) instead of binary or decimal. Hexadecimal: Uses digits 0-9 and letters A-F Each hexadecimal digit represents 4 bits Example: E8 in hex = 11101000 in binary = 232 in decimal MAC Address Example Breakdown: E8:BA:70:11:28:74 └─ OUI ─┘ └─ Device ID ─┘ E8 BA 70 (Manufacturer) | 11 28 74 (Unique Device) Dynamic vs. Static MAC Addresses Dynamic MAC Learning (on Switches): Switches learn MAC addresses by examining the source MAC address of frames they receive When a frame arrives on an interface, the switch records: MAC Address | Interface | VLAN If a frame arrives with a source MAC not in the table, the switch adds it Dynamic entries are removed after 5 minutes of inactivity (idle timeout) Static MAC Addresses: Manually configured by administrators for devices that shouldn't change ports Do not expire due to inactivity     Switch Frame Forwarding Switches make forwarding decisions based on the destination MAC address of received frames. Known Unicast Forwarding When the destination MAC is in the switch's MAC address table: Switch looks up the destination MAC address Finds the interface associated with that MAC Forwards the frame out only that specific interface Frame does NOT go to other interfaces Example: Frame arrives on port Fa0/1, destination MAC is in table pointing to Fa0/3 Switch forwards only out Fa0/3 Unknown Unicast Flooding When the destination MAC is NOT in the switch's MAC address table (unknown): Switch doesn't know where to send the frame Floods the frame to ALL interfaces except the incoming port Ensures the destination will receive the frame even if MAC isn't learned yet Example: Frame arrives on Fa0/1 for an unknown destination MAC Switch forwards out Fa0/2, Fa0/3, Fa0/4, etc. (all except Fa0/1) One of those ports will eventually send back a reply, teaching the switch the MAC's location Broadcast Forwarding Broadcast frames (destination MAC = FFFF.FFFF.FFFF): Always flooded to all interfaces except the incoming port Used for ARP, DHCP, and other network-wide communications MAC Address Table Maintenance Command View the MAC address table: Switch# show mac address-table Output shows: VLAN (Virtual LAN) MAC Address Type (DYNAMIC or STATIC) Port/Interface Clear the MAC address table: Switch# clear mac address-table dynamic Clear specific MAC entry: Switch# clear mac address-table dynamic address E8BA.7011.2874 Clear MAC entries for a specific interface: Switch# clear mac address-table dynamic interface FastEthernet 0/1     Interface Naming Conventions Cisco switch interfaces follow a naming convention: Format: [Type][Slot]/[Port] Interface Type Speed Example Fa Fast Ethernet 100 Mbps Gi Gigabit Ethernet 1 Gbps Et 10 Gigabit Ethernet 10 Gbps Example: Fa0/1 Fa = Fast Ethernet (100 Mbps) 0 = Slot/module number 1 = Port number on that slot     Address Resolution Protocol (ARP) What is ARP? ARP (Address Resolution Protocol) is a protocol used to map IP addresses (Layer 3) to MAC addresses (Layer 2). Problem it solves: A device knows the IP address of a destination but needs the MAC address to send an Ethernet frame ARP discovers the MAC address associated with a known IP address Layer: Layer 2/3 (operates at the boundary) How ARP Works When a PC wants to send a packet to a destination with a known IP address but unknown MAC address: PC sends an ARP REQUEST (broadcast) Destination PC receives the broadcast Destination responds with an ARP REPLY (unicast) Sender learns the destination's MAC address Sender can now send data frames ARP Request Sent by: Device that needs to learn a MAC address Destination: Broadcast (FFFF.FFFF.FFFF) — sent to all devices on the LAN Contains: Source IP Address (sender's IP) Destination IP Address (target's IP) Source MAC Address (sender's MAC) Destination MAC Address: FFFF.FFFF.FFFF (broadcast) Message: "Who has IP address X.X.X.X? Please tell me your MAC address!" ARP Reply Sent by: Device that recognizes its own IP address in the ARP request Destination: Unicast (only to the sender) — not broadcast Contains: Source IP Address (responder's IP) Destination IP Address (requester's IP) Source MAC Address (responder's MAC) Destination MAC Address (requester's MAC) Message: "I have IP address X.X.X.X. My MAC address is YYYY.YYYY.YYYY" ARP Caching ARP Table: Each device maintains an ARP table (cache) storing IP-to-MAC mappings Devices cache ARP replies so they don't have to send another ARP request for the same IP next time Cache entries typically expire after 240 seconds (4 minutes) View ARP table on a device: Device# show arp Shows: Protocol (usually IP) IP Address Age (seconds since learned) Hardware Address (MAC) Type (ARPA for Ethernet) ARP Example Scenario Scenario: PC1 wants to send data to PC2 PC1 (IP: 192.168.1.10)  → Needs MAC of PC2 (IP: 192.168.1.20) 1. PC1 sends ARP REQUEST (broadcast on Ethernet):    "Who has 192.168.1.20? Tell 192.168.1.10"     2. Switch floods the ARP REQUEST to all ports (unknown destination) 3. PC2 receives ARP REQUEST, recognizes its own IP     4. PC2 sends ARP REPLY (unicast back to PC1):    "I have 192.168.1.20. My MAC is AAAA.AAAA.AAAA"     5. Switch learns: MAC AAAA.AAAA.AAAA is on PC2's port    Switch forwards ARP REPLY out PC1's port (known unicast)     6. PC1 receives ARP REPLY, learns:    IP 192.168.1.20 = MAC AAAA.AAAA.AAAA     7. PC1 can now send Ethernet frames destined to AAAA.AAAA.AAAA     PING (Packet Internet Groper) What is PING? PING is a network utility that tests reachability to a remote host and measures round-trip time. How it works: Sends ICMP Echo REQUEST message to target Target responds with ICMP Echo REPLY message Sender measures time between request and reply Uses: Test if a host is reachable Measure network latency (round-trip time) Troubleshoot connectivity issues PING Command Syntax: Device# ping [IP_address] Example: Router# ping 192.168.1.20 PING Output By default, Cisco IOS sends 5 ICMP requests/replies (100 bytes each) Router# ping 192.168.1.20 Type escape sequence to abort. Sending 5, 100-byte ICMP Echoes to 192.168.1.20, timeout is 2 seconds: .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/5 ms Output Legend: Symbol Meaning ! Successful echo reply received . Echo request timed out (no reply) U Destination unreachable C Congestion experienced I User interrupted Statistics shown: Number of successful replies Success rate (percentage) Round-trip times: min/avg/max (in milliseconds) ICMP Messages PING uses ICMP (Internet Control Message Protocol) which operates at Layer 3 Two ICMP message types for ping: Echo Request (Type 8) — Sent by host asking for a reply Echo Reply (Type 0) — Response from target confirming it's reachable Other ICMP message types (used for troubleshooting): Destination Unreachable (Type 3) — Host/network unreachable Time Exceeded (Type 11) — TTL expired (used by traceroute) Redirect (Type 5) — Better route available     Troubleshooting Commands Reference View ARP Table Device# show arp Output shows: Protocol type (usually IP) IP address Hardware address (MAC address in HHHHH.HHHHH.HHHHHH format) Type (ARPA for Ethernet) Age in minutes (how long since learned) Example: Device# show arp Protocol  Address          Age (min)  Hardware Addr   Type Internet  192.168.1.10        0      AAAA.BBBB.CCCC  ARPA Internet  192.168.1.20        2      DDDD.EEEE.FFFF  ARPA View Switch MAC Address Table Switch# show mac address-table Output shows: VLAN number MAC address (HHHH.HHHH.HHHH format) Type (DYNAMIC or STATIC) Ports (interface where MAC is learned) Example: Switch# show mac address-table Vlan    Mac Address       Type        Ports ----    -----------       ----        -----  1      AAAA.BBBB.CCCC    DYNAMIC     Fa0/1  1      DDDD.EEEE.FFFF    DYNAMIC     Fa0/2  1      ffff.ffff.ffff    STATIC      CPU Clear MAC Address Table Switch# clear mac address-table dynamic Clears all dynamic MAC entries (not static ones) Useful when troubleshooting or deploying a new device Clear specific MAC address: Switch# clear mac address-table dynamic address AAAA.BBBB.CCCC Clear MAC entries on a specific interface: Switch# clear mac address-table dynamic interface FastEthernet 0/1     Summary: Frame Forwarding Decision Tree Switch receives frame on interface X Does frame have a broadcast destination (FFFF.FFFF.FFFF)? ├─ YES → FLOOD to all interfaces except X └─ NO  → Is destination MAC in MAC address table?          ├─ YES (KNOWN UNICAST) → Forward to specific interface          └─ NO  (UNKNOWN UNICAST) → FLOOD to all interfaces except X     Quick Reference Table Concept Size Purpose MAC Address 6 bytes (48 bits) Layer 2 physical address Ethernet Header 14 bytes Destination MAC, Source MAC, Type/Length Ethernet Trailer (FCS) 4 bytes Error detection via CRC Minimum Frame 64 bytes Ensures collision detection reliability Maximum Frame 1518 bytes Standard Ethernet MTU is 1500 bytes Preamble + SFD 8 bytes Not counted in frame size; for synchronization     Key Takeaways for CCNA ✅ MAC addresses are Layer 2 addresses; switches use them for forwarding ✅ Ethernet frames have header, data payload, and trailer with error detection ✅ Switches learn source MAC addresses from incoming frames and build a MAC address table ✅ Flooding vs. Forwarding: If destination MAC is known, forward to specific port; if unknown, flood to all except incoming ✅ ARP maps IP addresses to MAC addresses—used when sending data to a known IP but unknown MAC ✅ PING uses ICMP to test reachability and measure latency ✅ Frame sizing: Minimum 64 bytes, maximum 1518 bytes (standard), padding added if needed ✅ Hexadecimal used to represent MAC and FCS values in network notation ✅ Dynamic MAC entries are learned and age out after 5 minutes of inactivity; static entries are permanent ✅ Commands: show mac address-table, show arp, ping, clear mac address-table dynamic Days 7, 8: IPv4 IPv4 Addressing Overview IPv4 Fundamentals IPv4 (Internet Protocol Version 4) is the primary Layer 3 protocol used in modern networks. It provides: Logical addressing via 32-bit IP addresses Connectivity between different networks (requires routers) Path selection between source and destination hosts Key Distinction from Layer 2: Layer 2 (Switches) expands networks using MAC addressing within the same LAN Layer 3 (Routers) separates and connects different networks using IP addressing     IP Address Structure The IPv4 Address Format IPv4 addresses consist of 32 bits divided into 4 octets (8 bits each), written in Dotted Decimal Notation: 192.168.1.254 Each decimal number = 8-bit octet Each octet can range from 0 to 255 Binary Representation: 192        .    168        .    1          .    254 11000000   .    10101000   .    00000001   .    11111110 Network and Host Portions An IP address is split into two parts: Network Portion — Identifies the network itself Host Portion — Identifies the device within that network Notation: CIDR (Classless Inter-Domain Routing) The slash notation /X indicates how many bits are the network portion: 192.168.1.254/24 / 24 = The first 24 bits are the NETWORK portion The remaining 8 bits are the HOST portion NETWORK: 192.168.1   (first 3 octets) HOST:    .254        (last octet) All devices on the same network must have the same network portion but different host portions: 192.168.1.100   ← Same network (192.168.1) 192.168.1.105   ← Same network (192.168.1) 192.168.1.205   ← Same network (192.168.1) Network Boundaries Routers separate networks. When a router is placed between two networks: Network 1: 192.168.1.0/24 Router Interface 1 (G0/0): 192.168.1.254 Router Interface 2 (G0/1): 192.168.2.254 Network 2: 192.168.2.0/24 Each router interface gets a unique IP address on the network it connects to. Broadcasts do not cross routers: When a broadcast packet hits a router, it stops. Broadcasts stay within the local LAN.     Number Systems for IP Addressing Converting Binary to Decimal Each bit position represents a power of 2: Bit positions:  128  64  32  16  8  4  2  1 Example:        1    0   0   1   1  1  1  1  = 10011111 Calculation: 1 × 128 = 128 0 × 64  = 0 0 × 32  = 0 1 × 16  = 16 1 × 8   = 8 1 × 4   = 4 1 × 2   = 2 1 × 1   = 1 Sum: 128 + 16 + 8 + 4 + 2 + 1 = 159 Another Example: 01110110 64 + 32 + 16 + 4 + 2 = 118 Converting Decimal to Binary Method 1: Subtraction (Left to Right) Convert 221 to binary: 221 - 128 = 93  ✓ → write 1 in 128 position 93  - 64  = 29  ✓ → write 1 in 64 position 29  - 32  = X   ✗ → write 0 in 32 position 29  - 16  = 13  ✓ → write 1 in 16 position 13  - 8   = 5   ✓ → write 1 in 8 position 5   - 4   = 1   ✓ → write 1 in 4 position 1   - 2   = X   ✗ → write 0 in 2 position 1   - 1   = 0   ✓ → write 1 in 1 position Result: 11011101 Method 2: Subtraction from 255 Convert 207 to binary: 255 - 207 = 48 Now find where 48 appears in binary positions: 48 = 32 + 16 So the 0's are in positions 32 and 16 The 1's are everywhere else Result: 11001111 Convert Binary IP to Decimal Binary: 10011010.01001110.01101111.00100000 Octet 1: 128 + 16 + 8 + 2 = 154 Octet 2: 64 + 8 + 4 + 2 = 78 Octet 3: 64 + 32 + 8 + 4 + 2 + 1 = 111 Octet 4: 32 IPv4 Address: 154.78.111.32     IPv4 Address Classes IPv4 addresses are divided into 5 classes based on the first octet: Class First Bit Pattern First Octet Range Network Bits Host Bits CIDR A 0xxxxxxx 0–126 (127 = loopback) 8 24 /8 B 10xxxxxx 128–191 16 16 /16 C 110xxxxx 192–223 24 8 /24 D 1110xxxx 224–239 Multicast (reserved) — — E 1111xxxx 240–255 Experimental (reserved) — — For CCNA, focus on Classes A, B, and C. Class A (0–126) Example: 10.0.0.0/8 Range:   10.0.0.1 to 10.255.255.254 Hosts:   2^24 - 2 = 16,777,214 Network portion: First octet only Host portion: Last 3 octets Very large networks Rarely used in modern networks (reserved for special use) Class B (128–191) Example: 172.16.0.0/16 Range:   172.16.0.1 to 172.16.255.254 Hosts:   2^16 - 2 = 65,534 Network portion: First 2 octets Host portion: Last 2 octets Medium-sized networks Common in larger enterprises Class C (192–223) Example: 192.168.1.0/24 Range:   192.168.1.1 to 192.168.1.254 Hosts:   2^8 - 2 = 254 Network portion: First 3 octets Host portion: Last octet Smaller networks Most common in small to medium businesses Special Addresses: Loopback (Class A) 127.0.0.0 to 127.255.255.255 — Reserved for loopback testing 127.0.0.1 is the standard loopback address Used to test the network stack (OSI & TCP/IP model) on a local device Does not go to the network; stays on the local machine Useful for testing TCP/IP implementation without actual network traffic     Subnet Masks and Network Addresses Subnet Mask (Netmask) A subnet mask identifies which bits are the network portion and which are the host portion: 1's in the binary netmask = network bits 0's in the binary netmask = host bits Standard Class Netmasks: Class CIDR Dotted Decimal Binary A /8 255.0.0.0 11111111.00000000.00000000.00000000 B /16 255.255.0.0 11111111.11111111.00000000.00000000 C /24 255.255.255.0 11111111.11111111.11111111.00000000 Example: Identifying Network and Host with Mask IP Address:    192.168.1.100 Netmask (/24): 255.255.255.0 Match the 1's in the netmask: Network:       192.168.1.0 Host portion:  .100     Network Addresses and Broadcast Addresses Network Address (First Address) When the host portion is all 0's, it's the network address — the identifier of the network itself. 192.168.1.0/24 = NETWORK ADDRESS (not assigned to any host) Broadcast Address (Last Address) When the host portion is all 1's, it's the broadcast address — used to send data to all hosts on the network. 192.168.1.255/24 = BROADCAST ADDRESS (not assigned to any host) Destination IP:  192.168.1.255 Destination MAC: FFFF.FFFF.FFFF First and Last Usable Addresses Because network and broadcast addresses are reserved, the usable host range is: Network Address:       192.168.1.0   ← Not usable First Usable Address:  192.168.1.1   ← Usable ... Last Usable Address:   192.168.1.254 ← Usable Broadcast Address:     192.168.1.255 ← Not usable     Calculating Maximum Hosts per Network Formula: 2^N - 2 Where N = number of host bits (The "-2" accounts for the network address and broadcast address) Class A Example 10.0.0.0/8 Host bits: 24 (since /8 network bits) Maximum hosts: 2^24 - 2 = 16,777,216 - 2 = 16,777,214 Class B Example 172.16.0.0/16 Host bits: 16 Maximum hosts: 2^16 - 2 = 65,536 - 2 = 65,534 Class C Example 192.168.1.0/24 Host bits: 8 Maximum hosts: 2^8 - 2 = 256 - 2 = 254     IPv4 Header (Layer 3) Header Overview The IPv4 header contains many more fields than the Ethernet header: Minimum Header Length: 20 bytes Maximum Header Length: 60 bytes Key Header Fields Source IP Address (32 bits) IP address of the sender/originating device Destination IP Address (32 bits) IP address of the intended receiver/destination Total Length (16 bits) Indicates the total length of the packet (header + data) Measured in bytes (not 4-byte increments like IHL) Minimum: 20 bytes (header only, no data) Maximum: 65,535 bytes (2^16 - 1) Header Checksum (16 bits) Calculated checksum for error detection Routers calculate this and drop the packet if checksums don't match Only checks the IPv4 header, not the encapsulated data The encapsulated protocol (TCP/UDP) handles data error checking Time To Live (TTL) (8 bits) Prevents packets from circulating indefinitely Decremented by 1 at each router When TTL reaches 0, the packet is dropped Default value: typically 64 or 255 Version (4 bits) IP version: 4 for IPv4, 6 for IPv6     Cisco Router Interface Configuration Viewing Interface Status Router# show ip interface brief Output columns: Column Meaning Interface Physical port name (Gi0/0, Fa0/1, etc.) IP Address Assigned IP address (or unassigned) Method How the IP was assigned (manual, DHCP, etc.) Status (L1) Physical layer status (up/down/administratively down) Protocol (L2) Data link layer status (up/down) Status Meanings: up — Interface is operational down — Interface has a problem or no cable administratively down — Interface has been disabled with shutdown command Default Behavior: Router interfaces are administratively down by DEFAULT Switch interfaces are NOT administratively down by default Entering Interface Configuration Mode Router# configure terminal Router(config)# interface gigabitethernet 0/0 Shorthand can be used: g0/0, fa0/0, etc. Assigning an IP Address Router(config-if)# ip address 10.255.255.254 255.0.0.0 Format: ip address Enabling the Interface Router(config-if)# no shutdown This removes the "administratively down" status. Expected output: Interface GigabitEthernet0/0 changed state to up Line protocol on Interface GigabitEthernet0/0, changed state to up Verifying Configuration From interface configuration mode, use do to execute privileged commands: Router(config-if)# do show ip interface brief This confirms the interface is up and the IP address is assigned correctly. Detailed Interface Information Router# show interfaces gigabitethernet 0/0 Shows extensive Layer 1, Layer 2, and Layer 3 information: MAC address (BIA) IP address Interface encapsulation MTU size Error statistics And much more Router# show interfaces description Displays descriptions assigned to each interface (if any).     Summary: Common IPv4 Classes at a Glance Feature Class A Class B Class C First Octet 0–126 128–191 192–223 CIDR /8 /16 /24 Netmask 255.0.0.0 255.255.0.0 255.255.255.0 Networks 126 16,384 2,097,152 Hosts per Network 16,777,214 65,534 254 Example Network 10.0.0.0 172.16.0.0 192.168.1.0 First Usable Host 10.0.0.1 172.16.0.1 192.168.1.1 Last Usable Host 10.255.255.254 172.16.255.254 192.168.1.254 Broadcast Address 10.255.255.255 172.16.255.255 192.168.1.255     Quick Conversion Reference Common Decimal to Binary for Octets: Decimal Binary Decimal Binary 0 00000000 128 10000000 1 00000001 192 11000000 127 01111111 224 11100000 255 11111111 254 11111110     Key Takeaways for CCNA ✅ IPv4 addresses are 32-bit logical addresses, split into network and host portions ✅ The CIDR notation (/8, /16, /24) indicates the network portion length ✅ Routers separate networks; switches expand networks within the same LAN ✅ IPv4 Classes A, B, C differ in network size (more hosts = more network bits needed) ✅ Network addresses (all host bits = 0) and broadcast addresses (all host bits = 1) are reserved and not usable ✅ Usable host range = 2^(host bits) - 2 ✅ Router interfaces must be enabled with no shutdown (administratively down by default) ✅ Subnet masks use 1's for network bits and 0's for host bits ✅ Binary-to-decimal conversion is crucial for subnetting (coming next!) ✅ Broadcasts don't cross routers — they stay within the local LAN ✅ Verify interface configuration with show ip interface brief and show interfaces Day 9: Switch Interfaces Switch Interfaces Overview What are Switch Interfaces? Physical ports on a switch where devices (PCs, servers, routers, other switches) connect Each interface can be independently configured with different settings Configuration and status monitoring is done through the Cisco CLI Key Difference from Routers: Unlike routers (which default to administratively down), switch interfaces are active by default and don't require no shutdown to enable them.     Viewing Switch Interface Status show ip interface brief SW1# show ip interface brief This command displays a summary of all interfaces on the switch. Output Columns: Column What It Shows Details Interface Port name Fa0/1, Fa0/2, Gi0/1, etc. IP Address IP address assigned to interface Most switch interfaces don't have IPs assigned Method How IP was assigned manual, DHCP, etc. (rarely used on access ports) Status (L1) Physical layer status up = connected, down = not connected Protocol (L2) Data link layer status up = operational, down = problem detected Status Meanings on Switches: Status Protocol Meaning up up Interface is connected and operational down down Interface has no cable or no device connected administratively down down Interface has been disabled with shutdown Key Difference: Unlike routers, switch interfaces do NOT default to "administratively down" — they are active by default. show interfaces status SW1# show interfaces status This provides a more detailed view of all interfaces. Output Columns: Column Purpose Port Interface name (Fa0/1, Fa0/2, etc.) Name Description assigned to the interface (for organization) Status connected, notconnect, disabled, err-disabled VLAN VLAN assignment (default is VLAN 1) Duplex half, full, or auto Speed 10, 100, 1000 (Mbps) or auto Type 10/100BaseTX, 10/100/1000BaseTX, etc.     Interface Configuration Basics Entering Interface Configuration Mode SW1# configure terminal SW1(config)# interface fastethernet 0/1 SW1(config-if)# Or use shorthand: SW1(config)# interface fa0/1 SW1(config-if)# Adding a Description SW1(config-if)# description ## Connection to PC1 ## Descriptions are useful for documenting what each port is connected to. Disabling an Interface SW1(config-if)# shutdown Puts interface in "administratively down" status Useful for security (disabling unused ports) Can be re-enabled with no shutdown Enabling a Disabled Interface SW1(config-if)# no shutdown     Configuring Multiple Interfaces at Once Interface Range Command Manually configuring each unused interface would be tedious. Use the interface range command: SW1(config)# interface range fastethernet 0/5 - 12 SW1(config-if-range)# This selects interfaces Fa0/5 through Fa0/12 (inclusive). Apply configuration to all selected interfaces: SW1(config-if-range)# description ## Not in use ## SW1(config-if-range)# shutdown Both commands are applied to all 8 interfaces (0/5, 0/6, 0/7, ... 0/12) at once. Verify the changes: SW1# show interfaces status You should see all the selected interfaces now show "disabled" status. Other Range Syntax // Separate specific interfaces SW1(config)# interface range fa0/1, fa0/5, fa0/10 SW1(config-if-range)# shutdown // Combine multiple ranges SW1(config)# interface range fa0/1 - 5, fa0/10 - 15 SW1(config-if-range)# shutdown     Duplex and Collisions Half Duplex vs. Full Duplex Half Duplex: Device cannot send AND receive at the same time Must wait to receive before sending Must wait to send before receiving Like a walkie-talkie — only one person can talk at a time Full Duplex: Device can send AND receive simultaneously No waiting required Like a telephone — both parties can talk at the same time More efficient, uses available bandwidth fully Modern Switch Reality Most modern switches and devices support Full Duplex. Half duplex is virtually unused today, except in legacy or specialized scenarios. Historical Context: Hubs vs. Switches Hubs (Layer 1 Devices): Simple repeaters that flood frames to all ports All connected devices share the same collision domain When multiple devices send simultaneously, collisions occur (frames corrupt each other) All devices use Half Duplex (because collisions are common) Use CSMA/CD to detect and handle collisions Switches (Layer 2 Devices): Intelligent devices that forward frames based on MAC addresses Each port has its own collision domain Collisions rarely occur (only within the same port pair, very unlikely) All devices can use Full Duplex (no collision risk) CSMA/CD is almost never triggered CSMA/CD (Carrier Sense Multiple Access with Collision Detection) How it works (for historical context): Device listens to the network (carrier sense) Waits until no other devices are transmitting Begins transmitting data If collision detected (two devices send at once), jam signal is sent All devices stop transmitting Each device waits a random amount of time Retry transmission Process repeats until successful Why it's obsolete: Full Duplex switches make collisions impossible within normal operation.     Speed and Duplex Autonegotiation Default Settings Modern switch interfaces support automatic negotiation of speed and duplex: Interface Type | Default Speed | Default Duplex | 10/100 | Auto | Auto | 10/100/1000 | Auto | Auto | How autonegotiation works: Both devices advertise their capabilities (speeds and duplex modes they support) Devices negotiate the best mutually supported speed and duplex Both ends use the negotiated settings Example: Device A: Supports 10/100/1000 Full Duplex Device B: Supports 10/100 Full Duplex Result: Both use 100 Mbps Full Duplex (best common speed) What Happens When Autonegotiation Fails? If a device doesn't support autonegotiation (or it's disabled), the switch must guess: Speed Fallback: Switch tries to detect the speed the other device is using If detection fails, defaults to the slowest supported speed Example: On a 10/100/1000 interface, defaults to 10 Mbps Duplex Fallback: Speed Default Duplex 10 Mbps Half Duplex 100 Mbps Half Duplex 1000 Mbps Full Duplex Why this matters: Mismatched duplex causes performance problems and errors Speed mismatch causes data loss or slow throughput Always ensure both sides match or both use autonegotiation Manually Configuring Speed and Duplex If autonegotiation isn't working properly, manually set the interface: SW1(config-if)# speed 100 SW1(config-if)# duplex full Both sides must match manually (best practice: set both to auto if possible).     Interface Errors and Counters Viewing Interface Statistics SW1# show interfaces fastethernet 0/1 This displays detailed statistics including error counters at the bottom. Error Types and Meanings Frame Reception Statistics: Counter Meaning Normal? Runts Frames smaller than minimum 64 bytes Should be 0 Giants Frames larger than maximum 1518 bytes Should be 0 CRC Errors Frames that failed CRC check (FCS trailer) Should be 0 Frame Errors Frames with incorrect format due to errors Should be 0 Aggregated Counters: Counter Meaning Input Errors Total of various receive errors (runts, CRC, frame, etc.) Output Errors Count of frames switch tried to send but failed What These Errors Indicate Error Type Common Causes Runts Cable issues, duplex mismatch, electromagnetic interference (EMI) Giants Device doesn't properly enforce frame size limits, MTU mismatch CRC Errors Bad cable, duplex mismatch, EMI, faulty NIC Frame Errors Cable problems, duplex mismatch, hardware failure Output Errors Switch interface hardware problem, buffer overflow Troubleshooting with Error Counters High runt/CRC errors? Check cable quality and connections Verify duplex settings on both ends Check for electrical interference Replace faulty cable or NIC Increasing errors after configuration change? Verify speed/duplex settings match on both ends Check if autonegotiation is conflicting Look at interface utilization (might be saturated)     Complete Interface Configuration Example Scenario: Setting up a PC Connection Requirements: Connect PC to Fa0/1 Label the port Ensure it's enabled Verify speed/duplex is auto (default) Configuration: SW1# configure terminal SW1(config)# interface fastethernet 0/1 SW1(config-if)# description ## PC1 - Finance Department ## SW1(config-if)# speed auto SW1(config-if)# duplex auto SW1(config-if)# no shutdown SW1(config-if)# exit // Verify configuration SW1# show interfaces status Expected output: Port      Name                          Status    Vlan   Duplex  Speed Type Fa0/1     ## PC1 - Finance Dept ##      connected  1      auto   auto  10/100BaseTX     Disabling Unused Ports for Security The Problem Unused ports are a security risk — unauthorized devices can connect and access the network. The Solution: Disable Them SW1# configure terminal SW1(config)# interface range fastethernet 0/5 - 28 SW1(config-if-range)# description ## Unused - Security ## SW1(config-if-range)# shutdown SW1(config-if-range)# exit // Verify SW1# show interfaces status Result: All ports Fa0/5 through Fa0/28 now show "disabled" status and will not accept any connections.     Quick Reference: Common Interface Commands Configuration Mode Command Purpose interface fa0/1 Enter interface configuration mode interface range fa0/1 - 5 Configure multiple interfaces at once description Add description to interface no shutdown Enable interface shutdown Disable interface speed 10 | 100 | 1000 | auto Set interface speed duplex half | full | auto Set duplex mode Privileged EXEC Mode Command Purpose show ip interface brief Summary of all interfaces show interfaces status Detailed interface status show interfaces fa0/1 Detailed stats for one interface show interfaces description Show interface descriptions     Summary Table: Interface Status States Status Protocol Meaning Solution up up Operational None needed down down No cable or device Check cable, reconnect device down down Disabled Use no shutdown to enable up down Physical good, L2 problem Check configurations, VLAN issues     Key Takeaways for CCNA ✅ Switch interfaces are active by default — no shutdown needed to enable them (unlike routers) ✅ show ip interface brief shows summary status; show interfaces status shows detailed info ✅ Interface range command allows configuring multiple ports at once for efficiency ✅ Full Duplex is standard on modern switches; Half Duplex is legacy (used with hubs) ✅ CSMA/CD was used to detect collisions on hubs; obsolete with full-duplex switches ✅ Autonegotiation lets devices automatically negotiate speed and duplex (default and preferred) ✅ Mismatched speed/duplex causes performance problems and errors ✅ Error counters (runts, giants, CRC) indicate cable, duplex, or hardware issues ✅ Disable unused ports with shutdown command for security ✅ Descriptions on interfaces help with organization and troubleshooting ✅ Always verify interface status after making changes using show commands ✅ Typical default is Speed auto, Duplex auto — change only if autonegotiation fails Day 10: IPv4 Header The IPv4 Header Overview What is the IPv4 Header? The IPv4 header is the Layer 3 (Network Layer) Protocol Data Unit that enables: Routing — Sending data between devices on separate networks Global connectivity — Reaching devices across the Internet Protocol identification — Knowing what Layer 4 protocol is encapsulated Error checking — Detecting corruption in the header itself Position in the Stack: Application Data      ↓ (encapsulated in) TCP/UDP Segment (Layer 4)      ↓ (encapsulated in) IPv4 Packet (Layer 3) ← IPv4 Header      ↓ (encapsulated in) Ethernet Frame (Layer 2) Key Purpose: The IPv4 header tells routers where the packet came from (source IP) and where it's going (destination IP), allowing them to make forwarding decisions.     IPv4 Header Structure Overall Header Layout 32-bit boundaries (4-byte words) [VERSION][IHL][DSCP][ECN] [TOTAL LENGTH] [IDENTIFICATION] [FLAGS][FRAGMENT OFFSET] [TTL][PROTOCOL] [HEADER CHECKSUM] [SOURCE IP ADDRESS (32 bits)] [DESTINATION IP ADDRESS (32 bits)] [OPTIONS (Optional, Variable Length)] Header Size Minimum size: 20 bytes (no options) Maximum size: 60 bytes (with options) The minimum 20 bytes is the standard for most packets. Complete Field Reference Field Bits Purpose Version 4 IP version (4 for IPv4, 6 for IPv6) IHL 4 Header length in 4-byte increments DSCP 6 Quality of Service prioritization ECN 2 Congestion notification Total Length 16 Entire packet size (header + data) Identification 16 Fragmentation group identifier Flags 3 Fragmentation control (DF, MF bits) Fragment Offset 13 Position within fragmented packet TTL 8 Hop count (prevents infinite loops) Protocol 8 Encapsulated Layer 4 protocol Header Checksum 16 Error detection for header only Source IP 32 Sender's IP address Destination IP 32 Receiver's IP address Options 0–320 Optional features (rarely used)     Field Definitions Version (4 bits) Identifies the Internet Protocol version being used. Value Binary Version 4 0100 IPv4 (current standard) 6 0110 IPv6 (next generation) Note: The first field of every IP header is the version, so a device can immediately identify which IP version is being used.     IHL — Internet Header Length (4 bits) Specifies the total length of the IPv4 header in 4-byte increments. Why is this needed? The Options field (last part of header) is variable in length. The IHL field tells the device where the actual data payload begins. Calculation: IHL value × 4 bytes = Header length in bytes Example: IHL = 5 → 5 × 4 = 20 bytes (standard minimum) IHL = 15 → 15 × 4 = 60 bytes (maximum with options) Valid Range: IHL Value Bytes Meaning 5 20 No options present (most common) 6–14 24–56 Options present 15 60 Maximum size with options Default: IHL = 5 (20 bytes) for packets without options.     DSCP — Differentiated Services Code Point (6 bits) Used for Quality of Service (QoS) — prioritizing certain types of traffic. What it does: Marks packets with a priority/class level Routers use this to make forwarding decisions Can prioritize delay-sensitive traffic (VoIP, video streaming) Can deprioritize non-critical traffic (file transfers, email) Common Uses: Voice over IP (VoIP) — High priority (low latency needed) Video streaming — Medium-high priority Regular web traffic — Standard priority Backup/FTP transfers — Low priority Note: Only meaningful if routers are configured to respect QoS markings.     ECN — Explicit Congestion Notification (2 bits) Provides congestion feedback without dropping packets. Traditional Approach (old): Routers detect congestion → Drop packets Sender notices packet loss → Reduces sending rate Works, but wastes the dropped packets ECN Approach (modern, optional): Routers detect congestion → Mark packet with ECN bit (don't drop it) Packet reaches destination → Receiver knows congestion occurred Receiver notifies sender → Sender reduces rate All devices still receive their data (more efficient) Requirements: Both sender and receiver must support ECN Routers/network must be configured to use it Not always enabled (legacy network compatibility)     Total Length (16 bits) Specifies the total size of the entire IP packet — header + encapsulated data. Important Details: Measured in bytes (not 4-byte increments) Minimum value: 20 bytes (IPv4 header with no data) Maximum value: 65,535 bytes (2^16 - 1) Example: IPv4 Header: 20 bytes TCP Segment: 40 bytes Data: 400 bytes Total Length: 20 + 40 + 400 = 460 bytes MTU (Maximum Transmission Unit): Typical MTU for Ethernet: 1500 bytes If packet total length exceeds MTU, packet is fragmented     Identification (16 bits) Groups fragmented packets together so they can be reassembled. What it does: If a packet is too large (exceeds MTU), it's split into fragments Each fragment gets its own IPv4 header All fragments from the same packet have the same Identification value Receiving device uses this value to know which fragments belong together Example Scenario: Original packet: 4000 bytes (exceeds 1500 MTU) Fragment 1: Header (20 bytes) + Data (1480 bytes) = 1500 Fragment 2: Header (20 bytes) + Data (1480 bytes) = 1500 Fragment 3: Header (20 bytes) + Data (1020 bytes) = 1040 All three fragments have: Identification = 5000 (same value) Receiving host reassembles using this identifier     Flags (3 bits) Control packet fragmentation behavior. Bit # Name Purpose 0 Reserved Always set to 0 (unused) 1 DF (Don't Fragment) 0 = fragmentation allowed, 1 = don't fragment this packet 2 MF (More Fragments) 1 = more fragments coming, 0 = last fragment or no fragments Usage Examples: DF Bit = 1 (Don't Fragment): Used when fragmentation is undesirable Example: Some VPN or tunneling protocols If packet exceeds MTU and DF=1, router drops packet and sends ICMP error Sender receives error and resends with smaller size MF Bit = 1 (More Fragments): Set to 1 on all fragments except the last one Last fragment (or unfragmented packet) has MF = 0 Helps receiver know when it has received all fragments Example: Original: 3000 bytes, Identification = 100 Fragment 1: FLAGS = 001 (DF=0, MF=1 — more fragments coming) Fragment 2: FLAGS = 001 (DF=0, MF=1 — more fragments coming) Fragment 3: FLAGS = 000 (DF=0, MF=0 — last fragment, no more) Receiver sees MF=0 on third fragment and stops waiting     Fragment Offset (13 bits) Indicates the position of this fragment within the original unfragmented packet. Measured in: 8-byte increments Why it's needed: Fragments can arrive out of order Receiver uses offset to reassemble in correct order Offset allows fragments as small as 8 bytes (efficiency) Calculation: Actual byte position = Fragment Offset × 8 Example: Fragment Offset = 0 → Bytes 0–7 (first fragment) Fragment Offset = 185 → Bytes 1480–1487 (fragment 2, after 185×8) Fragment Offset = 370 → Bytes 2960–2967 (fragment 3)     TTL — Time To Live (8 bits) Prevents packets from circulating infinitely through the network. Original Purpose (historical): Meant to represent packet's maximum lifetime in seconds In practice, became a hop count mechanism Modern Usage (hop count): Each router decrements TTL by 1 When TTL reaches 0, router drops the packet Prevents infinite loops (routing loops) Common Default Values: OS/Device Default TTL Windows 128 Linux 64 macOS 64 Routers 64 or 255 Recommended 64 Example Journey: PC sends packet with TTL = 64 Router 1: TTL = 64 → Decrements to 63 → Forwards Router 2: TTL = 63 → Decrements to 62 → Forwards Router 3: TTL = 62 → Decrements to 61 → Forwards ... Router 64: TTL = 1 → Decrements to 0 → DROPS packet Prevents packet from traveling more than ~64 hops Traceroute Uses TTL: The traceroute command intentionally uses increasing TTL values to discover the path packets take: Send packet with TTL=1 → Router 1 drops it, sends ICMP error Send packet with TTL=2 → Router 2 drops it, sends ICMP error Send packet with TTL=3 → Router 3 drops it, sends ICMP error ... continues until destination reached     Protocol (8 bits) Identifies which Layer 4 protocol is encapsulated in the packet. Common Protocol Numbers: Protocol Number Purpose ICMP 1 Internet Control Message Protocol (ping, traceroute) IGMP 2 Internet Group Management Protocol (multicast) TCP 6 Transmission Control Protocol (reliable) UDP 17 User Datagram Protocol (unreliable, low latency) OSPF 89 Open Shortest Path First (routing protocol) Why routers need this: Router reads protocol number Knows what Layer 4 protocol to expect Can make forwarding decisions based on protocol (e.g., route all TCP port 80 via certain interface) Complete Protocol Numbers: Internet Assigned Numbers Authority (IANA) Protocol Numbers     Header Checksum (16 bits) Detects errors in the IPv4 header only. How it works: Sender calculates a checksum of all header fields Sender stores checksum in Header Checksum field Router receives packet Router recalculates checksum from header fields Router compares calculated checksum to Header Checksum field If they don't match → packet is corrupted → packet is dropped If they match → packet is valid → forward it Important: Only checks the IPv4 header, not the data payload Does NOT check TCP/UDP segment or application data TCP and UDP have their own checksum fields for data integrity If header corrupted, packet is discarded (not retransmitted by IP layer) Why separate checksums? IP header is critical (routing decisions depend on source/destination) Data errors are handled by Layer 4 protocols (TCP/UDP) Separating concerns improves efficiency     Source and Destination IP Addresses (32 bits each) Source IP Address: IP address of the device that originated the packet Set by the sender Does not change during transit (unless NAT is involved) Destination IP Address: IP address of the device the packet is destined for Set by the sender Routers use this to make forwarding decisions Routing Decision: Router receives packet ↓ Router looks at Destination IP ↓ Router checks routing table: "Where do I send packets destined for X.X.X.X?" ↓ Router forwards packet out appropriate interface ↓ Packet travels to next hop (another router or destination)     Options (0–320 bits, variable) Optional and rarely used — present only if IHL > 5. When Options exist: IHL field will be > 5 Example: IHL = 6 means 24 bytes (20 + 4 bytes of options) IHL = 7 means 28 bytes (20 + 8 bytes of options) Rare Options Examples: Strict Routing — Specify exact route packet must take Loose Routing — Specify certain routers packet must pass through Record Route — Track which routers packet passes through Timestamp — Record timestamps at each router Why rarely used? Add overhead (increased header size) Not supported by many routers (security/efficiency reasons) Can slow down routing decisions Modern protocols (IPv6) handle these features differently     Fragmentation Example Scenario: Packet Too Large for MTU Application sends 3000 bytes to network with 1500 MTU IPv4 Header created:   Source: 192.168.1.100   Destination: 192.168.1.200   Total Length: 3020 (20 header + 3000 data)    Router sees: 3020 > 1500 (MTU exceeded) Fragmentation occurs: Fragment 1:   IPv4 Header (20 bytes)   + Data (1480 bytes)   = 1500 bytes total   Identification: 5000   Flags: 001 (DF=0, MF=1)   Fragment Offset: 0 (starts at byte 0) Fragment 2:   IPv4 Header (20 bytes)   + Data (1480 bytes)   = 1500 bytes total   Identification: 5000 (SAME)   Flags: 001 (DF=0, MF=1)   Fragment Offset: 185 (starts at byte 1480 = 185×8) Fragment 3:   IPv4 Header (20 bytes)   + Data (40 bytes)   = 60 bytes total   Identification: 5000 (SAME)   Flags: 000 (DF=0, MF=0 — last fragment)   Fragment Offset: 370 (starts at byte 2960 = 370×8) Receiving host:   Gets Fragment 1 (offset 0)   Gets Fragment 3 (offset 370) — arrives first   Gets Fragment 2 (offset 185) — arrives last      Uses offsets to reassemble in correct order:   Bytes 0–1479 (Fragment 1)   Bytes 1480–2959 (Fragment 2)   Bytes 2960–2999 (Fragment 3)      Result: Complete 3000-byte data message     Summary Table: IPv4 Header Fields Quick Reference Field Bits Function Example Version 4 IP version 4 (IPv4) IHL 4 Header length in 4-byte units 5 (20 bytes) DSCP 6 Quality of Service 46 (VoIP) ECN 2 Congestion notification 00 (none) Total Length 16 Entire packet size 460 Identification 16 Fragment group ID 5000 Flags 3 Fragment control 010 (DF bit set) Fragment Offset 13 Position in original packet 0 (first) TTL 8 Hop limit 64 Protocol 8 Layer 4 protocol 6 (TCP) Header Checksum 16 Header error detection Calculated Source IP 32 Sender IP address 192.168.1.100 Destination IP 32 Receiver IP address 192.168.1.200 Options Variable Rarely used features (empty)     Key Concepts for Routing How Routers Use the IPv4 Header Router's processing: 1. Read Source IP → know where it came from 2. Read Destination IP → look up in routing table 3. Read TTL → decrement by 1 4. Recalculate Header Checksum → verify no corruption 5. Read Protocol → identify Layer 4 payload 6. Read Total Length → know packet size 7. Check if fragmentation needed (MTU comparison) 8. Forward out appropriate interface TTL as a Loop Prevention Mechanism Network with routing loop: PC1 sends to 10.0.0.5 with TTL=64   ↓ Router A: TTL 64→63, forwards to Router B   ↓ Router B: TTL 63→62, forwards to Router A (loop!)   ↓ Router A: TTL 62→61, forwards to Router B   ↓ [continues looping...]   ↓ Router: TTL=1, decrements to 0 → DROPS packet   ↓ Packet never reaches destination, but network not flooded Without TTL, the packet would loop infinitely, consuming bandwidth.     Practical Example: Complete IPv4 Header Scenario: PC1 sends HTTP request to web server PC1 (192.168.1.100) → Web Server (8.8.8.8) IPv4 Header created: Version: 4 (0100 in binary) IHL: 5 (20 bytes, no options) DSCP: 0 (normal priority) ECN: 0 (no congestion) Total Length: 546 (20 header + 40 TCP + 486 HTTP data) Identification: 34521 (random ID for this packet) Flags: 010 (DF bit set — don't fragment) Fragment Offset: 0 (not fragmented) TTL: 64 (default from Windows/Linux) Protocol: 6 (TCP) Header Checksum: 0xA2B4 (calculated checksum) Source IP: 192.168.1.100 Destination IP: 8.8.8.8 Options: (none) Routing decision: Router looks at destination 8.8.8.8 Checks routing table: "8.8.8.0/24 → send via ISP gateway" Forwards packet toward ISP gateway Decrements TTL from 64 to 63 Recalculates checksum (TTL changed) Forwards on WAN interface     Key Takeaways for CCNA ✅ IPv4 header minimum 20 bytes (no options), maximum 60 bytes (with options) ✅ IHL field indicates header length in 4-byte increments (5 = 20 bytes standard) ✅ Total Length = entire packet size (header + data), can be up to 65,535 bytes ✅ TTL prevents routing loops; decremented at each router; default ~64 ✅ Protocol field identifies Layer 4 protocol (6=TCP, 17=UDP, 1=ICMP) ✅ Fragmentation happens when packet exceeds MTU (usually 1500 bytes) ✅ Identification field groups fragments; all fragments of same packet have same ID ✅ Flags control fragmentation: DF (don't fragment), MF (more fragments) ✅ Fragment Offset in 8-byte increments allows out-of-order reassembly ✅ Header Checksum verifies header integrity only (not data) ✅ Source and Destination IP addresses never change in transit (IP layer perspective) ✅ DSCP used for QoS prioritization (optional) ✅ ECN enables congestion notification without packet drop (optional) ✅ Options field rarely used in modern networks ✅ Routers examine destination IP to make forwarding decisions based on routing table ✅ Traceroute works by sending packets with increasing TTL values to trace route to destination Day 11: Routing Fundamentals Routing Fundamentals & Static Routing Overview What is Routing? Routing is the process that routers use to determine the path that IP packets should take over a network to reach their destination. Core Concept: Routers forward packets between different networks (across network boundaries) Switches forward frames within the same LAN (within a network) A router reads the destination IP address and determines where to send the packet next Key Difference from Switching: Switches (Layer 2): - Examine destination MAC address - Forward within the same LAN - Fast forwarding to connected devices Routers (Layer 3): - Examine destination IP address - Forward between different networks - Use routing tables to determine best path     Routing Tables What is a Routing Table? A routing table is a database of routes that tells the router where to send packets destined for specific networks or IP addresses. Stored on: Every router in the network Content: Network destinations and how to reach them Route Components Each route entry contains: Destination Network → Next-Hop Router (or directly connected) Example: Destination: 192.168.2.0/24 → Send to next-hop router: 10.0.0.2 Destination: 10.1.1.0/24 → Send directly out interface G0/1 Destination: 172.16.0.0/16 → Send to next-hop router: 10.0.0.3 Route Types When a router receives a packet, it can take one of three actions: 1. Forward to Next-Hop Router Route: "To reach 192.168.1.0/24, send to router 10.0.0.2" Router receives packet destined for 192.168.1.50 ↓ Looks in routing table: "I have a route to 192.168.1.0/24" ↓ Action: Forward packet to 10.0.0.2 (next-hop IP) ↓ Router 10.0.0.2 receives and continues forwarding 2. Forward Directly to Destination (Directly Connected) Route: "192.168.1.0/24 is directly connected to my G0/1 interface" Router receives packet destined for 192.168.1.100 ↓ Looks in routing table: "192.168.1.0/24 is on my G0/1 interface" ↓ Action: Send packet directly out G0/1 to destination 3. Receive for Itself Route: "10.0.0.0/24 is my own interface" Router receives packet destined for 10.0.0.1 (its own IP) ↓ Looks in routing table: "This is MY IP address" ↓ Action: Don't forward, receive packet and process it Viewing the Routing Table Router# show ip route This displays all routes the router knows about. Output includes: Gateway of last resort is not set     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C       10.0.0.0/24 is directly connected, GigabitEthernet0/0 L       10.0.0.1/32 is directly connected, GigabitEthernet0/0     192.168.0.0/16 is variably subnetted, 2 subnets, 2 masks C       192.168.1.0/24 is directly connected, GigabitEthernet0/1 L       192.168.1.254/32 is directly connected, GigabitEthernet0/1 S       192.168.2.0/24 [1/0] via 10.0.0.2 Legend: C = Connected (directly connected) L = Local (router's own IP) S = Static (manually configured) D = Dynamic (learned from routing protocol) R = RIP, O = OSPF, B = BGP (dynamic protocols)     Routing Methods There are two main ways routers learn routes and populate their routing tables: 1. Static Routing What it is: Network engineer/administrator manually configures routes Routes do NOT change automatically Engineer must manually update routes if network changes Advantages: Simple to understand and implement No overhead (no routing protocol traffic) Secure (no routing information shared automatically) Good for small networks Disadvantages: Must manually configure every route Doesn't adapt if network fails or changes Not scalable for large networks Time-consuming to maintain When to use: Small networks (< 10 routers) Point-to-point links (few destinations) Labs and testing When security requires manual control 2. Dynamic Routing What it is: Routers automatically share routing information with each other Routers learn and update routes automatically Routes adapt when network conditions change Advantages: Automatic route discovery and updates Adapts to network failures Scalable for large networks Less manual configuration Load balancing across multiple paths Disadvantages: More complex to configure and understand Uses network bandwidth and CPU (routing protocol overhead) Slower initial convergence Security concerns (routing information shared) Common Dynamic Routing Protocols: Protocol Type Purpose RIP (Routing Information Protocol) Distance Vector Simple, outdated OSPF (Open Shortest Path First) Link State Industry standard, widely used EIGRP (Enhanced Interior Gateway Routing Protocol) Hybrid Cisco proprietary, powerful BGP (Border Gateway Protocol) Path Vector Internet routing When to use: Medium to large networks Complex topologies Multiple paths to destinations Networks with redundancy When automatic failover is needed     WANs (Wide Area Networks) What is a WAN? A Wide Area Network (WAN) is a network that extends over a large geographic area — typically connecting multiple locations (cities, countries, or across the Internet). Characteristics: Connects different LANs together Uses routers to connect Often uses leased lines or Internet as backbone Lower bandwidth and higher latency than LANs Can span great distances Example WAN Architecture:        [LAN A]          |       Router A ←→ Router B ← WAN Link (Internet or Leased Line)          |          |       [LAN B]    [LAN C] Routers A and B are connected via WAN Each router serves its local LAN Users in LAN A can reach LAN B/C through routers LAN vs WAN Feature LAN WAN Size Single building/floor Multiple locations Speed Fast (100 Mbps - 10 Gbps) Slower (1-100 Mbps) Devices Switches, local routers Routers, modems, firewalls Latency Low (< 1ms) Higher (10-100+ ms) Ownership Single organization Often shared/rented Cost Lower per Mbps Higher per Mbps     Static Routing Configuration Basic Static Route Syntax Router(config)# ip route Components: destination-network — The network you want to reach (e.g., 192.168.2.0) subnet-mask — Netmask of that network (e.g., 255.255.255.0) next-hop-ip — IP address of the next router (e.g., 10.0.0.2) Example 1: Basic Static Route Scenario: Router A at 10.0.0.1 needs to reach network 192.168.2.0/24 Router B (next-hop) is at 10.0.0.2 on a shared link with Router A Configuration: RouterA(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.2 Translation: "To reach 192.168.2.0/24, send packets to my neighbor at 10.0.0.2" Result in routing table: S       192.168.2.0/24 [1/0] via 10.0.0.2 Example 2: Multiple Static Routes Scenario: Router A needs to reach two different networks: RouterA(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.2 RouterA(config)# ip route 172.16.0.0 255.255.0.0 10.0.0.3 Result: Packets destined for 192.168.2.x go to 10.0.0.2 Packets destined for 172.16.x.x go to 10.0.0.3 Static Route Configuration with Exit Interface Alternative Syntax (for point-to-point links): Router(config)# ip route Example: RouterA(config)# ip route 192.168.2.0 255.255.255.0 Serial0/0/0 Translation: "To reach 192.168.2.0/24, send out my Serial0/0/0 interface" When to use: Point-to-point WAN links (Serial, PPP) When only one neighbor on the link More efficient on point-to-point connections Difference: Method Use Case Next-Hop IP Multi-access networks (Ethernet, Frame Relay with many neighbors) Exit Interface Point-to-point links (Serial, PPP) Example 3: Next-Hop vs Exit Interface Next-Hop (for Ethernet): RouterA(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.2                                                     ↑                                             specific neighbor IP Exit Interface (for Serial): RouterA(config)# ip route 192.168.2.0 255.255.255.0 Serial0/0/0                                                     ↑                                               output interface     Default Route What is a Default Route? A default route is a "catch-all" route that handles packets destined for networks the router doesn't have specific routes for. Use: Send unknown destinations to a central router or ISP gateway Default Route Configuration Syntax: Router(config)# ip route 0.0.0.0 0.0.0.0 Or in CIDR notation: Router(config)# ip route 0.0.0.0/0 Translation: "For any destination I don't have a more specific route for, send to this router" Common notation: The default route is often written as 0.0.0.0/0 (the "default route") Example: Setting a Default Route Scenario: Small office network with single ISP connection Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 Translation: "For any destination not in my routing table, send to the ISP gateway at 203.0.113.1" Result: S*   0.0.0.0/0 [1/0] via 203.0.113.1      *  indicates this is the default route Route Precedence (Most Specific Wins) When multiple routes match a destination, the router uses the most specific route: Routing table: 0.0.0.0/0 → 203.0.113.1 (default route) 192.168.2.0/24 → 10.0.0.2 (specific route) 192.168.2.0/25 → 10.0.0.3 (more specific) Packet destined for: 192.168.2.10 → Uses 192.168.2.0/25 (longest prefix match — /25 most specific) 192.168.3.10 → Uses 0.0.0.0/0 (default — no other match) 172.16.0.1 → Uses 0.0.0.0/0 (default — no other match)     Static Routing Configuration Example Complete Scenario Network setup:          [PC A]             |         [Switch]             |         Router A ────WAN Link──── Router B ────[Switch]──── [PC B]        10.0.0.1    (Serial)      10.0.0.2                192.168.1.0/24        Router A is in: 10.0.0.0/24 Router B is in: 10.0.0.0/24 and 192.168.1.0/24 Requirements: PC A (in 10.0.0.0 LAN) needs to reach PC B (in 192.168.1.0 LAN) Need static routes on both routers Configuration on Router A: RouterA(config)# ip route 192.168.1.0 255.255.255.0 10.0.0.2 RouterA(config)# end RouterA# show ip route S       192.168.1.0/24 [1/0] via 10.0.0.2 Configuration on Router B: RouterB(config)# ip route 10.0.0.0 255.255.255.0 10.0.0.1 RouterB(config)# end RouterB# show ip route S       10.0.0.0/24 [1/0] via 10.0.0.1 Result: Router A knows how to reach 192.168.1.0/24 (sends to Router B) Router B knows how to reach 10.0.0.0/24 (sends to Router A) PC A can now ping and communicate with PC B Verifying Routes Check routing table: Router# show ip route Test connectivity: Router# ping 192.168.1.100 Trace packet path: Router# traceroute 192.168.1.100     Comparison: Static vs Dynamic Routing When to Use Static Routing ✅ Good for: Small networks (< 10 routers) Simple, stable topologies Point-to-point links High security requirements Lab/testing environments When you want complete control ❌ Not good for: Large networks Complex topologies Frequent topology changes Networks requiring redundancy Automatic failover When to Use Dynamic Routing ✅ Good for: Large networks (> 10 routers) Complex topologies Multiple paths to destinations Automatic redundancy/failover Networks that change frequently Production enterprise networks ❌ Not good for: Very small networks (overhead not worth it) When bandwidth is extremely limited When security isolation is critical Simple point-to-point links     Static Route Commands Reference Configuration Command Purpose ip route Add static route ip route Add route via interface ip route 0.0.0.0 0.0.0.0 Configure default route no ip route Delete static route Verification Command Purpose show ip route Display entire routing table show ip route static Show only static routes show ip route 192.168.1.0 Show route for specific destination ping Test connectivity traceroute Trace path to destination Example Session Router# configure terminal Router(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.2 Router(config)# ip route 192.168.3.0 255.255.255.0 10.0.0.2 Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 Router(config)# exit Router# show ip route     10.0.0.0/24 is directly connected, GigabitEthernet0/0 S   192.168.2.0/24 [1/0] via 10.0.0.2 S   192.168.3.0/24 [1/0] via 10.0.0.2 S*  0.0.0.0/0 [1/0] via 203.0.113.1 Router# ping 192.168.2.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echoes to 192.168.2.100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/5 ms     Key Differences: Switches vs Routers in Network Feature Switch Router Layer Layer 2 (Data Link) Layer 3 (Network) Forwards within/between Within LANs Between LANs/Networks Uses MAC addresses IP addresses Table MAC address table Routing table Decision Destination MAC Destination IP Broadcasts Floods to all ports Blocks/filters Default behavior Active Interfaces down by default     Key Takeaways for CCNA ✅ Routing is how packets move between different networks using destination IP addresses ✅ Routing table stores all known routes; router uses it for forwarding decisions ✅ Static routing = manual configuration; good for small, stable networks ✅ Dynamic routing = automatic discovery; good for large, complex networks ✅ WAN connects separate LANs over large geographic distances ✅ Default route (0.0.0.0/0) catches packets with no other matching route ✅ Static route syntax: ip route ✅ Exit interface method used for point-to-point links; next-hop method for multi-access ✅ Routes point to next-hop IP or exit interface — tells router where to send packets ✅ Most specific route wins when multiple routes match a destination (longest prefix match) ✅ Router must have routes in both directions for bidirectional communication ✅ Directly connected routes appear as 'C' in routing table; don't need to be configured ✅ Local routes (L) are the router's own IP addresses; handled automatically ✅ show ip route displays routing table; includes source and metric information ✅ Routers separate broadcast domains — broadcasts don't cross router interfaces Day 12: Life of a Packet Life of a Packet Overview What is the "Life of a Packet"? The life of a packet traces the complete journey of a single packet as it travels from source to destination across multiple networks, through switches and routers, with different headers being applied and modified at each stage. Core Principle: A packet passes through many network devices and may traverse multiple networks. As it travels: IP addresses (Layer 3) NEVER change — they identify the source and destination hosts MAC addresses (Layer 2) CHANGE at every hop — they identify the current sender and next receiver This distinction is critical for understanding how networks actually work.     The Big Picture: Layer 3 vs Layer 2 IP Addresses (Layer 3) — End-to-End IP addresses remain CONSTANT throughout the packet's journey. SOURCE IP: 192.168.1.100 DESTINATION IP: 192.168.2.100 These never change, no matter how many routers the packet passes through. They identify the ultimate SOURCE and DESTINATION hosts. Purpose: Tell routers where the packet needs to go (the final destination) Used by: Routers to make forwarding decisions MAC Addresses (Layer 2) — Hop-by-Hop MAC addresses CHANGE at every hop — new source and destination at each step. Each interface on a network device (router, switch) has its OWN MAC address. As a packet travels, different interfaces add their own MAC addresses. Hop 1: Source MAC = PC's NIC, Destination MAC = Router's G0/0 interface Hop 2: Source MAC = Router's G0/1 interface, Destination MAC = Next Router's interface Hop 3: Source MAC = Next Router's interface, Destination MAC = Destination host's NIC Purpose: Tell the next device where to send the frame (the immediate next hop) Used by: Switches to forward within LANs, routers to forward between LANs Why This Matters Analogy: Sending a letter through the mail IP Address = Your home address + recipient's home address   (Written on the envelope, never changes)    MAC Address = Current postal worker + Next postal facility   (Changes at each facility — each worker adds/removes their stamp)     Packet Structure Review Layers of Encapsulation ┌─────────────────────────────────────┐ │      Application Data (HTTP, etc)   │ ├─────────────────────────────────────┤ │  TCP/UDP Header (Source Port,       │ │  Destination Port, Sequence, etc)   │ ← Layer 4 PDU ├─────────────────────────────────────┤ │  IPv4 Header (Source IP,            │ │  Destination IP, TTL, Protocol)     │ ← Layer 3 PDU / IP Packet ├─────────────────────────────────────┤ │  Ethernet Header (Dest MAC,         │ │  Source MAC, Type)                  │ ← Layer 2 PDU / Ethernet Frame │  Ethernet Trailer (FCS)             │ └─────────────────────────────────────┘ Field Order Matters! Critical observation: The fields appear in a specific order In TCP Header: [Source IP] [Destination IP] [Source Port] [Destination Port]   ↑            ↑   Source comes FIRST In Ethernet Header: [Destination MAC] [Source MAC] [Type]    ↑                ↑    Destination comes FIRST (opposite of Layer 3!) This is important because it shows the different perspectives: Layer 3 focuses on the ultimate destination (where are we going?) Layer 2 focuses on the immediate next hop (who am I sending to right now?)     Detailed Journey: Packet Travels Through Network Scenario Setup                    [Router B]                    10.0.0.2                         |                    WAN Link                         | PC A ─[Switch]─ [Router A] ─────────── [Switch] ─── PC B 192.168.1.100    10.0.0.1                          192.168.2.100                                                       10.0.0.2 Network A: - PC A: IP 192.168.1.100, MAC AAAA.AAAA.AAAA - Router A G0/0: IP 192.168.1.1, MAC 1111.1111.1111 - Router A G0/1: IP 10.0.0.1, MAC 2222.2222.2222 WAN Link: - Router B G0/0: IP 10.0.0.2, MAC 3333.3333.3333 Network B: - Router B G0/1: IP 192.168.2.1, MAC 4444.4444.4444 - PC B: IP 192.168.2.100, MAC BBBB.BBBB.BBBB Task: PC A sends HTTP packet to PC B     Step-by-Step Packet Journey Step 1: PC A Creates the Packet PC A (192.168.1.100) initiates an HTTP request to PC B (192.168.2.100) First, PC A checks if 192.168.2.100 is on the same network: PC A's IP: 192.168.1.100/24 Network: 192.168.1.0/24 (host 100 is in this network) Destination: 192.168.2.100/24 Network: 192.168.2.0/24 (different network!) Conclusion: 192.168.2.100 is NOT on my local network Action: Send to default gateway (router) PC A needs Router A's MAC address (192.168.1.1) PC A sends ARP REQUEST:   "Who has 192.168.1.1? Tell 192.168.1.100"    Router A responds with ARP REPLY:   "I have 192.168.1.1. My MAC is 1111.1111.1111"    PC A learns: Router A's MAC = 1111.1111.1111 PC A creates the packet: ┌─────────────────────────────────────────┐ │ Application Data (HTTP Request)         │ ├─────────────────────────────────────────┤ │ TCP Header                              │ │ Source Port: 50000                      │ │ Destination Port: 80                    │ ├─────────────────────────────────────────┤ │ IPv4 Header                             │ │ Source IP: 192.168.1.100        ← CONSTANT │ Destination IP: 192.168.2.100   ← CONSTANT │ TTL: 64                         ← Will decrement ├─────────────────────────────────────────┤ │ Ethernet Header                         │ │ Destination MAC: 1111.1111.1111 ← Router A │ Source MAC: AAAA.AAAA.AAAA      ← PC A │ Type: 0x0800 (IPv4)             │ ├─────────────────────────────────────────┤ │ Ethernet Trailer (FCS)                  │ └─────────────────────────────────────────┘ Key Point: IP addresses are already set — they will NOT change during transit!     Step 2: Packet Travels on Network A (Local LAN) PC A sends the frame out on the Ethernet to all devices on the switch Switch processing: Switch receives frame on port with PC A   ↓ Examines Destination MAC: 1111.1111.1111   ↓ Looks in MAC address table: "Where is 1111.1111.1111?"   ↓ MAC table shows: 1111.1111.1111 is on port connected to Router A   ↓ Action: Forward frame out that port only (known unicast) Router A receives the frame on interface G0/0 Router A receives frame on G0/0   ↓ Examines Ethernet Destination MAC: 1111.1111.1111   ↓ Checks local interfaces: "Is this MY MAC? Yes!"   ↓ Action: Strip Ethernet header/trailer, examine IPv4 header     Step 3: Router A Processes the Packet Router A examines the IPv4 header: Source IP: 192.168.1.100 Destination IP: 192.168.2.100 TTL: 64 Router A's routing table lookup:   "Destination 192.168.2.100... which network? 192.168.2.0/24"   "Where is 192.168.2.0/24? Via next-hop 10.0.0.2"   "That's Router B at 10.0.0.2"    Action: Forward out interface G0/1 toward Router B Router A decrements TTL: Original TTL: 64 Decremented: 64 - 1 = 63 New TTL: 63 Router A creates NEW Ethernet header: This is CRITICAL: The Ethernet header is REPLACED! Old Ethernet Header (from Network A):   Destination MAC: 1111.1111.1111 (Router A's G0/0)   Source MAC: AAAA.AAAA.AAAA (PC A's NIC) New Ethernet Header (for WAN Link):   Destination MAC: 3333.3333.3333 ← Router B's G0/0   Source MAC: 2222.2222.2222     ← Router A's G0/1   Type: 0x0800 (IPv4) IPv4 Header (UNCHANGED):   Source IP: 192.168.1.100        ← STILL THE SAME   Destination IP: 192.168.2.100   ← STILL THE SAME   TTL: 63                         ← Decremented Visualization of what happened: Before Router A processing: ┌─────────────────────────┐ │ Application Data (HTTP) │ ├─────────────────────────┤ │ TCP Header              │ ├─────────────────────────┤ │ IPv4 Header             │ │ Src: 192.168.1.100      │ │ Dst: 192.168.2.100      │ │ TTL: 64                 │ ├─────────────────────────┤ │ Eth Header (OLD)        │ │ Dst MAC: 1111.1111.1111 │ │ Src MAC: AAAA.AAAA.AAAA │ └─────────────────────────┘ After Router A processing: ┌─────────────────────────┐ │ Application Data (HTTP) │ ├─────────────────────────┤ │ TCP Header              │ ├─────────────────────────┤ │ IPv4 Header             │ │ Src: 192.168.1.100 ✓    │ │ Dst: 192.168.2.100 ✓    │ │ TTL: 63                 │ ├─────────────────────────┤ │ Eth Header (NEW)        │ │ Dst MAC: 3333.3333.3333 │ │ Src MAC: 2222.2222.2222 │ └─────────────────────────┘     Step 4: Packet Travels on WAN Link Router A sends the new frame toward Router B Router B receives the frame on interface G0/0 Router B receives frame on G0/0   ↓ Examines Ethernet Destination MAC: 3333.3333.3333   ↓ Checks local interfaces: "Is this MY MAC? Yes!"   ↓ Action: Strip Ethernet header/trailer, examine IPv4 header     Step 5: Router B Processes the Packet Router B examines the IPv4 header: Source IP: 192.168.1.100        ← Still PC A! Destination IP: 192.168.2.100   ← Still PC B! TTL: 63 Router B's routing table lookup:   "Destination 192.168.2.100... which network? 192.168.2.0/24"   "Is 192.168.2.0/24 directly connected to me? Yes! On G0/1"    Action: Forward directly out interface G0/1 Router B decrements TTL: Original TTL: 63 Decremented: 63 - 1 = 62 New TTL: 62 Router B creates NEW Ethernet header: This time, destination is directly connected: Old Ethernet Header (from WAN):   Destination MAC: 3333.3333.3333 (Router B's G0/0)   Source MAC: 2222.2222.2222 (Router A's G0/1) Router B needs PC B's MAC address:   Sends ARP REQUEST: "Who has 192.168.2.100? Tell me"   PC B responds: "I have 192.168.2.100. My MAC is BBBB.BBBB.BBBB"   Router B learns: PC B's MAC = BBBB.BBBB.BBBB New Ethernet Header (for Network B):   Destination MAC: BBBB.BBBB.BBBB ← PC B's NIC   Source MAC: 4444.4444.4444     ← Router B's G0/1   Type: 0x0800 (IPv4) IPv4 Header (UNCHANGED):   Source IP: 192.168.1.100        ← STILL THE SAME   Destination IP: 192.168.2.100   ← STILL THE SAME   TTL: 62                         ← Decremented again     Step 6: Packet Travels on Network B (Local LAN) Router B sends the frame out on the Ethernet to switch on Network B Switch processes: Switch receives frame on port with Router B   ↓ Examines Destination MAC: BBBB.BBBB.BBBB   ↓ Looks in MAC address table: "Where is BBBB.BBBB.BBBB?"   ↓ MAC table shows: BBBB.BBBB.BBBB is on port connected to PC B   ↓ Action: Forward frame out that port only PC B receives the frame PC B's NIC receives frame   ↓ Examines Ethernet Destination MAC: BBBB.BBBB.BBBB   ↓ Checks: "Is this MY MAC? Yes!"   ↓ Action: Accept frame, strip Ethernet header/trailer   ↓ Examine IPv4 header     Step 7: PC B Processes the Packet PC B examines the IPv4 header: Source IP: 192.168.1.100        ← Where did this come from Destination IP: 192.168.2.100   ← This is MY IP TTL: 62 Router processing: "Is this packet destined for ME? Yes!" Action: Don't forward, hand to Layer 4 (TCP) PC B examines the TCP header: Source Port: 50000 (from PC A) Destination Port: 80 (HTTP) TCP processing: "Is port 80 open? Yes, web server is listening" Action: Pass to HTTP application (web browser or server) PC B's HTTP application receives the data Application layer processes the HTTP request Web server generates HTTP response Response is sent back toward PC A (reverse journey)     Summary: MAC Addresses vs IP Addresses What Changed / What Stayed the Same                 PC A            Router A        Router B          PC B                   ↓                 ↓               ↓                ↓ Ethernet Header: Dest MAC    AAAA→1111        AAAA→3333       3333→BBBB Src MAC     AAAA←AAAA        2222←2222       4444←4444                 ↓↓              ↓↓              ↓↓               CHANGED          CHANGED        CHANGED at each hop IPv4 Header: Src IP      192.168.1.100 → 192.168.1.100 → 192.168.1.100 → 192.168.1.100             ↓↓                                                              NEVER CHANGES - Identifies ultimate source Dst IP      192.168.2.100 → 192.168.2.100 → 192.168.2.100 → 192.168.2.100             ↓↓             NEVER CHANGES - Identifies ultimate destination TTL         64 → 63 → 62 → 61             ↓↓  ↓↓             DECREMENTED at each router hop     Key Concepts: Why MAC Changes, IP Doesn't IP Addresses: End-to-End Navigation IP addresses define the final destination: "I am PC A (192.168.1.100) and I want to send this to PC B (192.168.2.100)" This information MUST be in every packet so that: 1. Routers know the ultimate destination 2. The destination knows it was for them 3. Response packets can find the way back Changing IP addresses would mean: - Routers wouldn't know where to send it - Destination wouldn't know who to respond to MAC Addresses: Local Hop Navigation MAC addresses define the CURRENT hop: "Right now, send this to the interface that's my next hop" At each hop: - Router A says: "Send to Router B at 10.0.0.2 (MAC: 3333.3333.3333)" - Router B says: "Send to PC B at 192.168.2.100 (MAC: BBBB.BBBB.BBBB)" Changing MAC addresses at each hop means: - Devices know which interface to send the frame to immediately - Each interface in a router gets its own MAC address - The destination MAC changes based on the next hop Analogy: Package Delivery Package Contents:    From: 123 Main St (IP address) ← Never changes   To: 456 Oak Ave (IP address) ← Never changes Delivery Process:   Postman A: "Take to Postal Hub B" (MAC address)   Hub B Postman: "Take to Postal Hub C" (MAC address)   Hub C Postman: "Take to 456 Oak Ave" (MAC address)    Each postman (router) has different address (MAC) for next hop But the package's original and final addresses never change     Packet Journey with Port Numbers Understanding Port Numbers (Layer 4) Port numbers also remain constant throughout the journey. Source Port: 50000 (from PC A - random ephemeral port) Destination Port: 80 (HTTP service on PC B) These identify the specific application/service: - Port 80 = HTTP web server - Port 443 = HTTPS web server   - Port 22 = SSH - Port 23 = Telnet - Ports 49152-65535 = Ephemeral (temporary, assigned by OS) Why Ports Don't Change Like IP addresses, port numbers identify the endpoint services. If routers changed port numbers, the destination wouldn't know which service the packet was meant for. Routers don't care about port numbers (they're Layer 4). Routers only care about: - Layer 3: Destination IP (where to forward) - Layer 2: Destination MAC (which interface to use)     TTL and the Journey TTL Decrements at Each Router PC A sends with TTL = 64 Router A:   Receives TTL = 64   Decrements: 64 - 1 = 63   Forwards with TTL = 63 Router B:   Receives TTL = 63   Decrements: 63 - 1 = 62   Forwards with TTL = 62 PC B:   Receives with TTL = 62   (Doesn't decrement - destination doesn't forward) Why TTL Matters Prevents infinite loops: If routing loop exists (Router A → Router B → Router A):   TTL = 64 at Router A   TTL = 63 after Router B     TTL = 62 at Router A again   TTL = 61 after Router B   ... continues ...   TTL = 1 at Router A   TTL = 0 after Router B → DROPPED Packet never circulates infinitely, consuming bandwidth     Complete Packet at Each Stage Stage 1: PC A Creates (Network A) Ethernet Header: ├─ Dest MAC: 1111.1111.1111 (Router A G0/0) ├─ Src MAC: AAAA.AAAA.AAAA (PC A) └─ Type: 0x0800 IPv4 Header: ├─ Src IP: 192.168.1.100 ├─ Dst IP: 192.168.2.100 ├─ TTL: 64 └─ Protocol: 6 (TCP) TCP Header: ├─ Src Port: 50000 ├─ Dst Port: 80 ├─ Sequence: [value] └─ Flags: [SYN] HTTP Data: "GET / HTTP/1.1..." Stage 2: Router A Forwards (WAN) Ethernet Header: ├─ Dest MAC: 3333.3333.3333 (Router B G0/0) ← CHANGED ├─ Src MAC: 2222.2222.2222 (Router A G0/1) ← CHANGED └─ Type: 0x0800 IPv4 Header: ├─ Src IP: 192.168.1.100 ← SAME ├─ Dst IP: 192.168.2.100 ← SAME ├─ TTL: 63 ← DECREMENTED └─ Protocol: 6 (TCP) ← SAME TCP Header: (UNCHANGED) ├─ Src Port: 50000 ├─ Dst Port: 80 ├─ Sequence: [value] └─ Flags: [SYN] HTTP Data: (UNCHANGED) "GET / HTTP/1.1..." Stage 3: Router B Forwards (Network B) Ethernet Header: ├─ Dest MAC: BBBB.BBBB.BBBB (PC B) ← CHANGED ├─ Src MAC: 4444.4444.4444 (Router B G0/1) ← CHANGED └─ Type: 0x0800 IPv4 Header: ├─ Src IP: 192.168.1.100 ← SAME ├─ Dst IP: 192.168.2.100 ← SAME ├─ TTL: 62 ← DECREMENTED └─ Protocol: 6 (TCP) ← SAME TCP Header: (UNCHANGED) ├─ Src Port: 50000 ├─ Dst Port: 80 ├─ Sequence: [value] └─ Flags: [SYN] HTTP Data: (UNCHANGED) "GET / HTTP/1.1..." Stage 4: PC B Receives Ethernet Header: (Stripped off) IPv4 Header: (Examined and passed to TCP) ├─ Src IP: 192.168.1.100 ← Identifies who sent it ├─ Dst IP: 192.168.2.100 ← "This is for me!" ├─ TTL: 62 └─ Protocol: 6 (TCP) ← "Pass to TCP handler" TCP Header: (Examined and passed to HTTP) ├─ Src Port: 50000 ← "From where?" ├─ Dst Port: 80 ← "To HTTP service" ├─ Sequence: [value] └─ Flags: [SYN] ← "Connection attempt" HTTP Application: (Processes request) "GET / HTTP/1.1 from PC A... Generate response"     Key Takeaways for CCNA ✅ IP addresses NEVER change during transit — they identify source and destination hosts ✅ MAC addresses CHANGE at every hop — they identify the current sender and next receiver ✅ Each router interface has a unique MAC address for its local network segment ✅ Routers decrement TTL by 1 at each hop to prevent infinite loops ✅ Ethernet destination MAC comes BEFORE source MAC in the header (opposite of Layer 3) ✅ Port numbers stay constant throughout the journey (identify services/applications) ✅ Routers use destination IP to determine where to forward packets ✅ Routers need destination MAC to know which interface to send the frame to ✅ If destination not directly connected, router uses next-hop IP (from routing table) to determine destination MAC ✅ Switches use destination MAC to forward frames within LANs; routers replace MAC at each hop ✅ Packet encapsulation remains as it travels — each layer's header is examined then passed down/up ✅ Return packets follow reverse path but go through same address transformations (MAC changes, IP stays same) ✅ ARP resolves IP addresses to MAC addresses when router needs to forward to next hop or final destination ✅ TTL reaching 0 causes packet to be dropped (prevents routing loop packet storms) ✅ Each device on path adds only its own MAC as source — never "hops" across multiple devices in one frame Days 13, 14, 15: IPv4 Subnetting Subnetting: Comprehensive Guide (FLSM & VLSM) Overview What is Subnetting? Subnetting is the process of dividing a large network into smaller subnetworks (subnets) to make more efficient use of IP address space and improve network organization. Why Subnetting Matters: Problem with Classful Addressing:   - Company needs 5,000 IPs → Assigned entire Class B   - Class B = 65,536 addresses   - Result: 60,000+ addresses wasted! Solution: CIDR (Classless Inter-Domain Routing)   - Remove class restrictions   - Split large networks into smaller, right-sized subnets   - Much more efficient IP address utilization     From Classful to CIDR The Class System (Old) Class A:  1.0.0.0 - 126.0.0.0     (Prefix: /8) Class B:  128.0.0.0 - 191.255.0.0 (Prefix: /16) Class C:  192.0.0.0 - 223.255.255.0 (Prefix: /24) Class D:  224.0.0.0 - 239.255.255.255 (Multicast) Class E:  240.0.0.0 - 255.255.255.255 (Reserved) Problem: Organization's network size had to fit exactly into one class (no middle ground) CIDR (New, Modern) CIDR (Classless Inter-Domain Routing) introduced in 1993 by the IETF removes the class requirement. Benefit: Any network can be split into smaller subnets of any size needed 10.0.0.0/8 → Can be split into:   10.0.0.0/16   10.0.0.0/24   10.0.0.0/25   10.0.0.0/26   (any prefix length)     The Math: Calculating Subnets Host Bits and Usable Addresses The Formula: Usable Hosts = 2^n - 2 n = number of HOST BITS (bits to the right of the subnet mask) -2 = subtract network address and broadcast address (reserved) Example 1: 203.0.113.0/25 /25 means first 25 bits are the NETWORK 32 - 25 = 7 bits remaining for HOSTS Usable Hosts = 2^7 - 2 = 128 - 2 = 126 hosts Binary: 203.0.113.0 = 1100 1011 . 0000 0000 . 0111 0001 . 0 | 000 0000                                                     ↑                                             25 bits | 7 bits Example 2: 203.0.113.0/28 /28 means first 28 bits are the NETWORK 32 - 28 = 4 bits remaining for HOSTS Usable Hosts = 2^4 - 2 = 16 - 2 = 14 hosts Binary: 203.0.113.0 = 1100 1011 . 0000 0000 . 0111 0001 . 0000 | 0000                                                         ↑                                             28 bits | 4 bits Subnet Mask = 1111 1111 . 1111 1111 . 1111 1111 . 1111 0000             = 255.255.255.240 Subnet Masks and CIDR Relationship Understanding the relationship between prefix length and dotted-decimal subnet mask is critical. CIDR Subnet Mask Host Bits Usable Hosts Group Size /24 255.255.255.0 8 254 256 /25 255.255.255.128 7 126 128 /26 255.255.255.192 6 62 64 /27 255.255.255.224 5 30 32 /28 255.255.255.240 4 14 16 /29 255.255.255.248 3 6 8 /30 255.255.255.252 2 2 4 /31 255.255.255.254 1 0 2 /32 255.255.255.255 0 1 1 Reading the Table: Smaller CIDR number = larger network (more addresses) Larger CIDR number = smaller network (fewer addresses) /30 is popular for WAN point-to-point links (2 usable IPs)     Method 1: Subnetting Cheatsheet The cheatsheet method is the fastest way to subnet for the CCNA exam. The Magic Cheatsheet Group Size:  | 128 | 64  | 32  | 16  | 8   | 4   | 2   | 1   | Subnet Mask: | 128 | 192 | 224 | 240 | 248 | 252 | 254 | 255 | Last Octet:  | /25 | /26 | /27 | /28 | /29 | /30 | /31 | /32 | 3rd Octet:   | /17 | /18 | /19 | /20 | /21 | /22 | /23 | /24 | 2nd Octet:   | /9  | /10 | /11 | /12 | /13 | /14 | /15 | /16 | 1st Octet:   | /1  | /2  | /3  | /4  | /5  | /6  | /7  | /8  | How It Works: Find the CIDR prefix → Look up which row (which octet is the "magic octet") Find Group Size from that row Step through by Group Size starting at 0 until you PASS your target IP Identify network boundaries: Number BEFORE target = Network Address Number AFTER target = Next Network IP before next network = Broadcast Address IP after network address = First Usable Host IP before broadcast = Last Usable Host Example 1: /25 in Last Octet Problem: Find network for 203.0.113.100/25 /25 is in the "Last Octet" row Look across: Group Size = 128 Step by 128s in last octet:   0, 128, 256 (exceeds 255, wrap to next octet) Since 100 falls between 0 and 128: Network Address:     203.0.113.0/25 Broadcast Address:   203.0.113.127/25 First Usable Host:   203.0.113.1/25 Last Usable Host:    203.0.113.126/25 Next Network:        203.0.113.128/25 Total Usable Hosts:  2^7 - 2 = 126 Example 2: /28 in Last Octet Problem: Find network for 192.168.1.100/28 /28 is in the "Last Octet" row Look across: Group Size = 16 Step by 16s in last octet:   0, 16, 32, 48, 64, 80, 96, 112, 128, ... Since 100 falls between 96 and 112: Network Address:     192.168.1.96/28 Broadcast Address:   192.168.1.111/28 First Usable Host:   192.168.1.97/28 Last Usable Host:    192.168.1.110/28 Next Network:        192.168.1.112/28 Total Usable Hosts:  2^4 - 2 = 14 Example 3: /19 in Third Octet Problem: Find network for 10.4.77.188/19 /19 is in the "3rd Octet" row Look across: Group Size = 32 Step by 32s in third octet (target = 77):   0, 32, 64, 96, 128, ... Since 77 falls between 64 and 96: Network Address:     10.4.64.0/19 Broadcast Address:   10.4.95.255/19 First Usable Host:   10.4.64.1/19 Last Usable Host:    10.4.95.254/19 Next Network:        10.4.96.0/19 Subnet Mask: Every octet left of 3rd = 255, every octet right = 0              = 255.255.224.0 Total Usable Hosts: 2^(32-19) - 2 = 2^13 - 2 = 8190 Example 4: /10 in Second Octet Problem: Find network for 84.75.21.6/10 /10 is in the "2nd Octet" row Look across: Group Size = 64 Step by 64s in second octet (target = 75):   0, 64, 128, 192, 256 (exceeds 255) Since 75 falls between 64 and 128: Network Address:     84.64.0.0/10 Broadcast Address:   84.127.255.255/10 First Usable Host:   84.64.0.1/10 Last Usable Host:    84.127.255.254/10 Next Network:        84.128.0.0/10 Subnet Mask: = 255.192.0.0 Total Usable Hosts: 2^(32-10) - 2 = 2^22 - 2 = 4,194,302     Method 2: Binary Method (Alternative) When the cheatsheet isn't available, use the binary method. The Process Convert IP to binary (only need to focus on the "magic octet") Identify network bits vs host bits based on prefix length Calculate group size from the number of host bits in the magic octet Find subnet mask = 256 - Group Size Divide and multiply to find network boundaries Example: 154.219.154.180/20 Step 1: Focus on the 3rd octet (where /20 lands)         154.219.154.180/20         The /20 means: /16 (all of 2nd octet) + /4 (4 bits of 3rd octet)         3rd octet is the "magic octet" Step 2: Convert 154 to binary         154 = 1001 1010 Step 3: Identify network vs host bits         /20 means 4 bits are NETWORK bits in this octet         1001 | 1010 (first 4 bits are network, last 4 are host)         ↑ network | host ↑ Step 4: Calculate Group Size         Host bits in magic octet = 4         Group Size = 2^4 = 16         Subnet Mask last part = 256 - 16 = 240         Full Subnet Mask = 255.255.240.0 Step 5: Find network boundaries         Divide: 154 ÷ 16 = 9 with remainder 10         Multiple remainder back: 9 × 16 = 144                  Network Address: 154.219.144.0/20         Broadcast Address: 154.219.159.255/20                  (144 + 16 - 1 = 159 is the broadcast 3rd octet) Step 6: Calculate usable hosts         Total host bits = 32 - 20 = 12         Usable hosts = 2^12 - 2 = 4,094     Subnetting Class A, B, C Networks The process is identical for all classes; only the prefix length changes based on the requirement. Class A Example: 10.0.0.0/8 Problem: Divide 10.0.0.0/8 into 2000 subnets. What prefix length? Current: 10.0.0.0/8 = 2^24 = 16.7 million hosts Need 2000 subnets:   2^10 = 1024 (not enough)   2^11 = 2048 (enough!)    Must borrow 11 bits from host space:   /8 + /11 = /19 Network bits: 1111 1111 . 1111 1111 . 1110 0000 . 0000 0000             = 255.255.224.0 Host bits remaining: 32 - 19 = 13 Usable hosts per subnet: 2^13 - 2 = 8,190 Number of subnets: 2^11 = 2,048 Class B Example: 172.16.0.0/16 Problem: Divide 172.16.0.0/16 into 50 subnets Need 50 subnets:   2^5 = 32 (not enough)   2^6 = 64 (enough!)    Must borrow 6 bits from host space:   /16 + /6 = /22 Network bits: 1111 1111 . 1111 1111 . 1111 1100 . 0000 0000             = 255.255.252.0 Host bits remaining: 32 - 22 = 10 Usable hosts per subnet: 2^10 - 2 = 1,022 Number of subnets: 2^6 = 64 Class C Example: 192.168.1.0/24 Problem: Divide 192.168.1.0/24 into 4 subnets Need 4 subnets:   2^2 = 4 (perfect!)    Must borrow 2 bits from host space:   /24 + /2 = /26 Network bits: 1111 1111 . 1111 1111 . 1111 1111 . 1100 0000             = 255.255.255.192 Host bits remaining: 32 - 26 = 6 Usable hosts per subnet: 2^6 - 2 = 62 Number of subnets: 2^2 = 4 The 4 subnets:   192.168.1.0/26   (0-63)   192.168.1.64/26  (64-127)   192.168.1.128/26 (128-191)   192.168.1.192/26 (192-255)     Variable-Length Subnet Masks (VLSM) Fixed-Length vs Variable-Length FLSM (Fixed-Length Subnet Masks): All subnets have the SAME prefix length Simple, but wasteful Example: Divide /24 into four /26 subnets (all 62 hosts each) Problem: One subnet needs 110 hosts, another needs 2 hosts Solution: Would waste 60 IPs in the small subnet with FLSM VLSM (Variable-Length Subnet Masks): Subnets can have DIFFERENT prefix lengths Right-size each subnet to its needs Much more efficient Solution: /25 for large subnet (126 hosts), /30 for small subnet (2 hosts) Result: No wasted IPs! VLSM Process Key Principle: Sort subnets by size (LARGEST first), then subnet sequentially Sort requirements by host count (largest first) Allocate the largest with appropriate prefix length Use the next available address range for the next subnet Repeat for all subnets VLSM Example: Multiple Sites Scenario: Split 192.168.1.0/24 for: Tokyo LAN A: 110 hosts Toronto LAN B: 45 hosts Toronto LAN A: 29 hosts Tokyo LAN B: 8 hosts Point-to-Point Link: 2 hosts Step 1: Sort by Size (Largest First) 1. Tokyo LAN A: 110 hosts → need /25 (126 usable) 2. Toronto LAN B: 45 hosts → need /26 (62 usable) 3. Toronto LAN A: 29 hosts → need /27 (30 usable) 4. Tokyo LAN B: 8 hosts → need /28 (14 usable) 5. Point-to-Point: 2 hosts → need /30 (2 usable) Step 2: Allocate Tokyo LAN A (/25) Need: 110 hosts Use: /25 (128 total addresses, 126 usable) Network:  192.168.1.0/25 Binary:   1000 0000 . 1010 1000 . 0000 0001 . 0 | 000 0000 Broadcast: 192.168.1.127/25 First Usable:  192.168.1.1/25 Last Usable:   192.168.1.126/25 Step 3: Allocate Toronto LAN B (/26) Need: 45 hosts Use: /26 (64 total addresses, 62 usable) Next available after 192.168.1.127 = 192.168.1.128 Network:  192.168.1.128/26 Binary:   1000 0000 . 1010 1000 . 0000 0001 . 10 | 00 0000 Broadcast: 192.168.1.191/26 First Usable:  192.168.1.129/26 Last Usable:   192.168.1.190/26 Step 4: Allocate Toronto LAN A (/27) Need: 29 hosts Use: /27 (32 total addresses, 30 usable) Next available after 192.168.1.191 = 192.168.1.192 Network:  192.168.1.192/27 Binary:   1000 0000 . 1010 1000 . 0000 0001 . 110 | 0 0000 Broadcast: 192.168.1.223/27 First Usable:  192.168.1.193/27 Last Usable:   192.168.1.222/27 Step 5: Allocate Tokyo LAN B (/28) Need: 8 hosts Use: /28 (16 total addresses, 14 usable) Next available after 192.168.1.223 = 192.168.1.224 Network:  192.168.1.224/28 Binary:   1000 0000 . 1010 1000 . 0000 0001 . 1110 | 0000 Broadcast: 192.168.1.239/28 First Usable:  192.168.1.225/28 Last Usable:   192.168.1.238/28 Step 6: Allocate Point-to-Point (/30) Need: 2 hosts Use: /30 (4 total addresses, 2 usable) Next available after 192.168.1.239 = 192.168.1.240 Network:  192.168.1.240/30 Binary:   1000 0000 . 1010 1000 . 0000 0001 . 1111 00 | 00 Broadcast: 192.168.1.243/30 First Usable:  192.168.1.241/30 (Router 1) Last Usable:   192.168.1.242/30 (Router 2) VLSM Summary Table ┌─────────────────┬──────────────────┬─────────────────┬──────────────┐ │ Location        │ Host Requirement │ CIDR/Mask       │ Usable Hosts │ ├─────────────────┼──────────────────┼─────────────────┼──────────────┤ │ Tokyo LAN A     │ 110              │ 192.168.1.0/25  │ 126          │ │ Toronto LAN B   │ 45               │ 192.168.1.128/26│ 62           │ │ Toronto LAN A   │ 29               │ 192.168.1.192/27│ 30           │ │ Tokyo LAN B     │ 8                │ 192.168.1.224/28│ 14           │ │ Point-to-Point  │ 2                │ 192.168.1.240/30│ 2            │ └─────────────────┴──────────────────┴─────────────────┴──────────────┘ Total 192.168.1.0/24 = 254 usable addresses After allocation = 126 + 62 + 30 + 14 + 2 = 234 used, 20 unused (vs FLSM would have wasted much more) Why VLSM Matters Without VLSM (FLSM with /26): 4 subnets of /26 = 62 hosts each = 248 total hosts Problem: Tokyo LAN B only needs 8 hosts → 54 wasted! With VLSM: Right-sized allocation = 234 used, 20 unused = efficient Tokyo LAN B gets /28 = 14 hosts = 6 wasted (much better)     Subnetting Checklist When given a subnet problem: ✅ Step 1: Identify the magic octet (which octet contains the CIDR boundary) ✅ Step 2: Extract Group Size from cheatsheet OR calculate from binary ✅ Step 3: Determine Subnet Mask (256 - Group Size for magic octet, other octets 255 or 0) ✅ Step 4: Step through by Group Size to find network boundaries ✅ Step 5: Identify: Network Address First Usable Host Last Usable Host Broadcast Address Next Network ✅ Step 6: Calculate total usable hosts: 2^(32 - CIDR) - 2 ✅ Step 7 (VLSM only): Sort by size, allocate largest first, allocate sequentially     Practice Problems Quick Practice Set 1 1) 10.1.1.100/28 Network Address? Broadcast? First/Last Usable? Number of Subnets from /8? 2) 172.16.50.200/22 Network Address? Broadcast? Total Usable Hosts? 3) 192.168.100.0/24 divided into /28 subnets How many /28 subnets can you create? List the first 3 subnet addresses Solutions 1) 10.1.1.100/28    - Network: 10.1.1.96/28    - Broadcast: 10.1.1.111/28    - First: 10.1.1.97, Last: 10.1.1.110    - Subnets from /8: 2^20 = 1,048,576 2) 172.16.50.200/22    - Network: 172.16.48.0/22 (256-64=192, 50÷4=12r2, 12×4=48)    - Broadcast: 172.16.51.255/22    - Total Hosts: 2^10 - 2 = 1,022 3) 192.168.100.0/24 into /28    - /28 group size = 16    - 256 ÷ 16 = 16 subnets    - Subnets: 192.168.100.0/28, 192.168.100.16/28, 192.168.100.32/28, ...     Practice Resources For extra practice and mastery: subnettingpractice.com ⭐ (recommended) subnettingquestions.com subnetting.org     Key Takeaways for CCNA ✅ CIDR replaced classful addressing to enable flexible subnet sizes ✅ Usable hosts formula: 2^n - 2 (n = number of host bits) ✅ Magic octet is where the prefix length boundary falls (1st, 2nd, 3rd, or 4th octet) ✅ Cheatsheet method is fastest for exam: step by group size, identify boundaries ✅ Subnet mask = 256 - Group Size for magic octet (other octets: 255 left, 0 right) ✅ Larger CIDR number = smaller network (fewer addresses) ✅ Smaller CIDR number = larger network (more addresses) ✅ FLSM = all subnets same size (simple, may waste IPs) ✅ VLSM = variable subnet sizes (efficient, complex) ✅ VLSM key rule: Sort by size (largest first), allocate sequentially ✅ /30 networks are standard for point-to-point WAN links (2 usable IPs) ✅ Network address has all host bits = 0 ✅ Broadcast address has all host bits = 1 ✅ Usable host range = Network + 1 to Broadcast - 1 ✅ Next network = Broadcast + 1 Days 16, 17, 18: VLANs VLANs: CCNA Reference Sheet Core Definitions VLAN (Virtual LAN): Logical grouping of network devices; segments a physical network into isolated broadcast domains at Layer 2 (Data Link Layer). LAN / Broadcast Domain: Single group of devices receiving broadcast frames (Dst MAC: FFFF.FFFF.FFFF) sent by any member. Access Port: Belongs to a single VLAN; connects to end hosts; does NOT tag frames. Trunk Port: Carries traffic from multiple VLANs over a single link using VLAN tagging; connects switches/routers. Native VLAN: Special VLAN on trunk port that does NOT get tagged when sent; default = VLAN 1. 802.1Q Tag: 4-byte VLAN tag inserted between Src MAC and Type/Length fields in Ethernet frame. Switch Virtual Interface (SVI): Virtual Layer 3 interface on multilayer switch representing a VLAN; acts as default gateway. Layer 3 Switch / Multilayer Switch: Device combining switch (L2) + router (L3) functionality; performs inter-VLAN routing internally.     VLAN Benefits vs. Drawbacks Issue Without VLAN With VLAN Performance Broadcast floods entire network Broadcasts isolated to VLAN Security No L2 segmentation; all devices reach each other directly Devices can't reach other VLANs without routing Access Control Router policies ineffective (same LAN) Router can filter between VLANs Scalability Single broadcast domain Multiple isolated domains     How VLANs Work Key Rule: Switches do NOT forward traffic between VLANs. Switch Logic: Receive frame on interface in VLAN X Check destination MAC If destination in VLAN X → forward normally If destination in different VLAN → DROP (do not forward) Inter-VLAN Routing Required: Traffic must pass through router or Layer 3 switch. Flow: Source VLAN → Router/L3 Switch (strips VLAN, routes IP, re-tags) → Destination VLAN     Access Port Configuration Switch(config)# vlan 10 Switch(config-vlan)# name Engineering Switch(config-vlan)# exit Switch(config)# interface Fa0/1 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 10 Switch(config-if)# exit Switch(config)# interface range Fa0/2-3 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# exit Default VLANs (cannot delete): VLAN 1: default (exists by default, cannot be removed) VLANs 1002-1005: reserved for legacy protocols Verification: show vlan brief                    → List all VLANs and assigned ports show interfaces Fa0/1 switchport   → Detailed switchport info show vlan id 10                    → Info for specific VLAN     Trunk Ports & 802.1Q Tagging Trunk Configuration Switch(config)# interface g0/0 Switch(config-if)# switchport trunk encapsulation dot1q Switch(config-if)# switchport mode trunk Switch(config-if)# switchport trunk native vlan 10 Switch(config-if)# switchport trunk allowed vlan 10,20,30 Switch(config-if)# exit Verification: show interfaces trunk              → Shows encapsulation, status, native VLAN, allowed VLANs 802.1Q Tag Structure 4-Byte Tag inserted between Src MAC and Type/Length: Field Bytes Size Purpose TPID 1–2 16 bits Always 0x8100; indicates 802.1Q tagged frame PCP 3 (bits 7–5) 3 bits Priority Code Point (CoS: 0–7, 7=highest) DEI 3 (bit 4) 1 bit Drop Eligible Indicator; marks droppable frames VID 3–4 (bits 11–0) 12 bits VLAN ID (0–4095; usable: 1–4094) VLAN Ranges: 0: Reserved (not used) 1–1005: Standard range 1: Default (always exists) 2–1005: User-defined 1002–1005: Legacy protocols (reserved) 1006–4094: Extended range (requires special switch mode; not common in CCNA) 4095: Reserved (not used) Total usable: 1–4094 (4,094 VLANs) Native VLAN Behavior: Frames on native VLAN are sent untagged (no 4-byte tag) Smaller frame size (4 bytes smaller); faster transmission Default native VLAN = VLAN 1 Critical Rule: Native VLAN must MATCH on both ends of trunk or frames go to wrong VLAN. Example Mismatch: SW1: Native VLAN = 10 SW2: Native VLAN = 1 Result:   SW1 sends VLAN 10 untagged   SW2 receives untagged frames on VLAN 1 (wrong!)   → VLAN mismatch Configuration: Switch(config-if)# switchport trunk native vlan 10     Router on a Stick (ROAS) Use Case: Route between VLANs when router has only one physical interface. Switch Configuration (Trunk): Switch(config)# interface g0/0 Switch(config-if)# switchport mode trunk Switch(config-if)# switchport trunk encapsulation dot1q Switch(config-if)# exit Router Configuration (Sub-Interfaces): Router(config)# interface g0/0 Router(config-if)# no shutdown Router(config-if)# exit Router(config)# interface g0/0.10 Router(config-subif)# encapsulation dot1q 10 Router(config-subif)# ip address 192.168.10.254 255.255.255.0 Router(config-subif)# exit Router(config)# interface g0/0.20 Router(config-subif)# encapsulation dot1q 20 Router(config-subif)# ip address 192.168.20.254 255.255.255.0 Router(config-subif)# exit Router(config)# interface g0/0.30 Router(config-subif)# encapsulation dot1q 30 Router(config-subif)# ip address 192.168.30.254 255.255.255.0 Router(config-subif)# exit Native VLAN Methods: Method 1: encapsulation dot1q 10 native (sub-interface) Method 2: IP address on physical interface = native VLAN (VLAN 10) Verification: show ip interface brief            → Shows sub-interfaces and status show ip route                      → Routing table for all VLANs How ROAS Works: Router receives tagged frame on g0/0 Router examines VLAN tag (e.g., VLAN 10) Router directs to sub-interface g0/0.10 Sub-interface routes based on IP address Reply sent out appropriate sub-interface with VLAN tag re-added     Layer 3 Switching & SVIs Layer 3 Switch: Combines switching (L2) + routing (L3) internally; no external router needed for inter-VLAN routing. Advantages: Performance: Inter-VLAN routing via ASICs (hardware-based); much faster than ROAS Cost: Single device replaces switch + router Simplicity: All VLAN management in one device Scalability: Supports many VLANs with fast internal routing SVI (Switch Virtual Interface) Configuration Switch(config)# ip routing                    → Enable routing on switch Switch(config)# interface vlan 10 Switch(config-if)# ip address 192.168.10.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# interface vlan 20 Switch(config-if)# ip address 192.168.20.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# interface vlan 30 Switch(config-if)# ip address 192.168.30.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit SVI Status Conditions (must be "up/up"): VLAN must exist on switch At least ONE active port in VLAN (access or trunk allowing VLAN) must be "up/up" SVI must not be shut down SVI Status Meanings: up/up: SVI operational; VLAN exists; active port present; SVI not shut down down/down: VLAN missing, no active ports, or SVI is shut down Verification: show interface vlan 10             → Detailed SVI info (status, IP, MAC) show ip interface brief             → All L3 interfaces and status show ip route                       → Routing table Converting ROAS to Layer 3 Switching Remove ROAS from Router: Router(config)# no interface g0/0.10 Router(config)# no interface g0/0.20 Router(config)# no interface g0/0.30 Router(config)# interface g0/0 Router(config-if)# ip address 192.168.1.194 255.255.255.0 Router(config-if)# no shutdown Configure Multilayer Switch: Switch(config)# ip routing Switch(config)# interface g0/0 Switch(config-if)# no switchport                 → Convert to Layer 3 routed port Switch(config-if)# ip address 192.168.1.193 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# interface vlan 10 Switch(config-if)# ip address 192.168.10.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# interface vlan 20 Switch(config-if)# ip address 192.168.20.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# interface vlan 30 Switch(config-if)# ip address 192.168.30.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.194    → Default route to external router     Key Principles & Edge Cases ✅ Switches do NOT forward traffic between VLANs — routing required (core rule) ✅ Broadcast isolation = PRIMARY benefit (improves performance & security) ✅ Access ports untagged; trunk ports tagged ✅ Native VLAN mismatch = frames routed to wrong VLAN (critical issue) ✅ VLAN 1 (default) cannot be deleted or removed from trunk allowed vlan list ✅ Sub-interface on router appears as separate interface in show ip interface output ✅ ROAS bottleneck: Single link carries all inter-VLAN traffic; Layer 3 switch faster ✅ SVI requires "up/up" status: VLAN must exist + active port in VLAN required ✅ Native VLAN = default VLAN 1 unless explicitly changed on both ends ✅ 802.1Q (IEEE standard); ISL (Cisco proprietary, obsolete)     Complete Command Reference VLAN Creation & Deletion show vlan brief                    → List all VLANs and ports show vlan id 10                    → Details for VLAN 10 show interfaces Fa0/1 switchport   → Port VLAN assignment vlan 10                            → Enter VLAN config mode name Engineering                   → Name the VLAN no vlan 10                         → Delete VLAN 10 (if no ports assigned) Access Port interface Fa0/1 switchport mode access switchport access vlan 10 Trunk Port interface g0/0 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 10 switchport trunk allowed vlan 10,20,30 show interfaces trunk Router on a Stick (Sub-Interfaces) interface g0/0 no shutdown interface g0/0.10 encapsulation dot1q 10 ip address 192.168.10.254 255.255.255.0 show ip interface brief show ip route Layer 3 Switch (SVIs) ip routing                         → Enable routing globally interface vlan 10                  → Create SVI for VLAN 10 ip address 192.168.10.254 255.255.255.0 no shutdown interface g0/0                     → Convert to routed port no switchport ip address 192.168.1.193 255.255.255.0 no shutdown ip route 0.0.0.0 0.0.0.0 192.168.1.194    → Default route show ip interface brief show ip route     CCNA Exam Essentials Concept Key Detail VLAN Isolation Switches block frames between VLANs; routing required Default VLAN VLAN 1; cannot delete or remove from trunk allowed list Access Ports Single VLAN; end-host facing; untagged frames Trunk Ports Multiple VLANs; switch/router facing; tagged frames 802.1Q Tag 4 bytes: TPID (0x8100) + PCP (3b) + DEI (1b) + VID (12b) VID Range 12 bits = 0–4095; usable = 1–4094 Native VLAN Untagged; must match on both ends or mismatch occurs ROAS Sub-interfaces on single physical link; bottleneck risk Layer 3 Switch Internal routing (ASICs); SVIs = default gateways SVI Status up/up requires: VLAN exists + active port + not shut down     Day 19: DTP and VTP Protocols DTP & VTP: CCNA Reference Sheet Overview DTP (Dynamic Trunking Protocol): Auto-negotiates port mode (access vs trunk). Enabled by default; should be disabled for security. VTP (VLAN Trunking Protocol): Auto-syncs VLAN database across switches. Default mode = SERVER; rarely used in modern networks; high risk. Both not in official CCNA 200-301 syllabus but useful for understanding why manual configuration is recommended.     Part 1: DTP (Dynamic Trunking Protocol) Core Concept DTP automatically negotiates whether switch port should be access or trunk instead of manual configuration. Status: Enabled by default on all Cisco interfaces; NOT recommended for production (security risk). DTP Modes & Behaviors Mode Command Behavior Forms Trunk? Access switchport mode access Forces access port; actively prevents trunk; will not negotiate No (blocks trunk) Trunk switchport mode trunk Forces trunk; negotiates trunk formation with other switches Yes (if other side compatible) Dynamic Desirable switchport mode dynamic desirable ACTIVE mode; proactively tries to form trunk; negotiates with trunk/dyn-des/dyn-auto Yes (if other side allows) Dynamic Auto switchport mode dynamic auto PASSIVE mode; waits for other side to try; negotiates only if other side initiates Only if other side is trunk/dyn-des Critical Distinction: Dynamic Desirable = Active (initiates trunk negotiation) Dynamic Auto = Passive (waits to be asked) Two Auto ports = NO trunk (both passive; neither initiates) DTP Compatibility Matrix When ports connect to each other, which result in trunk formation?                 | Access | Trunk | Dyn Des | Dyn Auto -----------------+--------+-------+---------+---------- Access           | Access | ✗     | Access  | Access Trunk            | ✗      | Trunk | Trunk   | Trunk Dynamic Desirable| Access | Trunk | Trunk   | Trunk Dynamic Auto     | Access | Trunk | Trunk   | Access Key Rules: Access ↔ Trunk = MISMATCH (configuration error; no communication) Access wins in negotiation (dynamic modes default down to access if connected to access) Active always wins (Dynamic Desirable forces trunk with Dynamic Auto) Both Passive = Access (two Dynamic Auto ports cannot negotiate trunk) Default DTP Modes Legacy Switches: switchport mode dynamic desirable (older networks needed trunks by default) Modern Switches: switchport mode dynamic auto (explicit trunking recommended) DTP with Non-Cisco Devices Non-Cisco Device (router, PC, non-Cisco switch): ├─ Does NOT understand DTP frames ├─ Ignores DTP messages ├─ Defaults to ACCESS MODE └─ Result: Safe (no unintended trunk formed) Encapsulation Negotiation On older switches supporting both 802.1Q and ISL: switchport trunk encapsulation negotiate   (default)   ↓ DTP negotiates which to use   ├─ If both support ISL: ISL selected (favored)   ├─ If only 802.1Q: 802.1Q selected   └─ DTP frames sent in VLAN 1 (ISL) or native VLAN (802.1Q) Modern Switches:   └─ Only 802.1Q supported; no negotiation needed Disabling DTP (Security Best Practice) Option 1: Set explicit mode switchport mode access   (disables DTP, forces access) switchport mode trunk    (disables DTP, forces trunk) Option 2: Disable negotiation on trunks switchport mode trunk switchport nonegotiate   (disables DTP while maintaining trunk mode) Best Practice: Access Ports:   switchport mode access Trunk Ports:   switchport mode trunk   switchport nonegotiate Why Disable DTP? Security Risks: Accidental trunking from misconfiguration DTP overhead in production Unexpected negotiation behavior (two auto ports fail silently) Unintended VLAN access Recommendation: Manually configure all ports; disable DTP explicitly.     Part 2: VTP (VLAN Trunking Protocol) Core Concept VTP automatically synchronizes VLAN database across switches in same domain instead of manual VLAN creation on every switch. Status: Default mode = SERVER; rarely used in modern networks; high risk of accidental VLAN deletion. VTP Versions Version VLAN Range Token Ring NVRAM Client Extended VLAN Use v1 1–1005 No No (RAM only) No Obsolete v2 1–1005 Yes No (RAM only) No Obsolete; compatible with v1 v3 1–4094 Yes Yes (NVRAM) Yes Best; NOT backwards compatible Key: v3 supports extended VLAN range (1006–4094) and stores client VLAN db in NVRAM (survives reboot). VTP Modes Mode Can Modify VLAN? Syncs Database? Storage Sends Ads? Forwards Ads? Use Case Server ✓ Add/Modify/Delete ✓ (syncs to others) NVRAM ✓ ✓ Primary VLAN management; default mode Client ✗ Read-only ✓ (syncs from server) RAM (v1/v2) NVRAM (v3) ✗ ✓ Follows server; auto-syncs Transparent ✓ Add/Modify/Delete ✗ Independent NVRAM ✗ ✓ Lab/testing; separate domain; revision reset Critical Behaviors: SERVER also acts as CLIENT — if connected to higher-revision SERVER, it syncs to match CLIENT cannot modify VLANs while in client mode (must switch to transparent/server first) TRANSPARENT forwards VTP ads (acts as relay for other domains) VTP Domains VTP Domain = group of switches sharing synchronized VLAN database. Key Points: Same domain = VLAN database syncs Different domain = no sync Domain name case-sensitive Default = NULL (unconfigured) Automatic Domain Assignment (DANGEROUS): New switch (domain = NULL) connects to network   ↓ Receives VTP advertisement from SERVER   ↓ Automatically joins advertised domain   ├─ Domain name assigned   ├─ VLAN database syncs to server's revision   └─ Becomes CLIENT or SERVER (version-dependent) RISK: New switch may have outdated VLAN data Revision Numbers: The Main Danger of VTP Revision Number = version of VLAN database; increments with each VLAN add/modify/delete. How It Works: SERVER tracks revision number (starts at 0)   ├─ Increments by 1 per VLAN change   ├─ Advertises revision to all clients   └─ Highest revision = "most recent" (assumed) CLIENTS assume:   └─ Higher revision number = more up-to-date VLAN database   └─ Will sync to any server with higher revision The Danger: Old Switch with High Revision Number Current Network:   ├─ Switch A (SERVER): revision 50 (correct VLANs, current)   ├─ Switch B (CLIENT): synced to revision 50   └─ Switch C (CLIENT): synced to revision 50 Old Switch (brought up after 2 years):   ├─ Was in network 2 years ago with revision 150   ├─ Has 150 old VLAN changes accumulated   ├─ Connects to network... What Happens:   ├─ Old switch has revision 150 (higher than current 50!)   ├─ All switches assume 150 is "latest"   ├─ All switches sync VLAN database to old switch   └─ ALL VLANs added in last 2 years are DELETED      → NETWORK DOWN! Why?   └─ Higher revision number but OLDER DATA Reset Revision Number to 0: Method 1: Change Domain   vtp domain unused_domain   vtp domain original_domain   (Domain change resets revision to 0) Method 2: Change to Transparent Mode   vtp mode transparent   (Transparent mode resets revision; remove from VTP domain) Before Connecting Old Switch: Set to TRANSPARENT mode Verify VLAN database is correct Confirm revision = 0 Then connect to network VTP Configuration Setup VTP SERVER: Switch_A(config)# vtp mode server Switch_A(config)# vtp domain Manufacturing Switch_A(config)# vtp password secure_password Switch_A(config)# vlan 10 Switch_A(config-vlan)# name Engineering Switch_A(config-vlan)# exit (VLANs automatically propagate to all clients) Setup VTP CLIENT: Switch_B(config)# vtp mode client Switch_B(config)# vtp domain Manufacturing Switch_B(config)# vtp password secure_password (No VLAN configuration; auto-syncs from server) Setup TRANSPARENT (Isolated): Switch_C(config)# vtp mode transparent Switch_C(config)# vlan 30 Switch_C(config-vlan)# name Finance Switch_C(config-vlan)# exit (Maintains independent VLAN database) Verification: show vtp status        → VTP mode, domain, revision number, MD5 digest show vlan brief        → VLAN database on this switch     DTP vs VTP Summary Feature DTP VTP Purpose Auto-negotiate port mode (access/trunk) Auto-sync VLAN database What It Controls Port mode (L2 switching) VLAN configuration (L2 management) Default Status ENABLED on all ports SERVER mode (all switches) Communication Sent on ports (negotiation) Sent via trunk ports (domain sync) Main Danger Accidental trunk formation Revision number attack (old data) Recommendation DISABLE (manual config) DO NOT USE (use management tools)     Best Practices DTP ✓ DO: Manually configure all ports   switchport mode access   switchport mode trunk   switchport nonegotiate ✗ DON'T: Rely on DTP defaults ✗ DON'T: Mix dynamic modes ✗ DON'T: Connect switches without explicit mode config VTP ✓ DO: Use TRANSPARENT mode only if isolated   vtp mode transparent ✓ DO: Reset revision before adding old switch   vtp domain temp_domain   vtp domain original_domain ✗ DON'T: Use VTP in production ✗ DON'T: Connect old switches directly without mode reset ✗ DON'T: Mix VTP versions (v1/v2 incompatible with v3)     CCNA Exam Essentials Concept Key Detail DTP Default Enabled on all Cisco interfaces Dynamic Desirable Active mode; proactively tries to form trunk Dynamic Auto Passive mode; waits for other side to try Two Auto Ports NO trunk (both passive; neither initiates) Access ↔ Trunk Mismatch; does NOT work; configuration error DTP Security Disable with switchport mode + switchport nonegotiate VTP Default SERVER mode (all switches default to server) VTP Versions v1 (old), v2 (old), v3 (best; 1006–4094 range) VTP Server Can add/modify/delete VLANs; syncs to others VTP Client Read-only; syncs from server VTP Transparent Independent VLAN db; forwards ads but doesn't sync Revision Number Higher = assumed more recent; old switch risk VTP Danger Old switch with high revision deletes all VLANs VTP Reset Change domain or set to transparent mode VTP Recommendation DO NOT USE in production; manual management safer Non-Cisco DTP Ignores DTP; defaults to access (safe) Days 20, 21, 22: Spanning Tree Protocol Spanning Tree Protocol (STP & RSTP): CCNA Reference Sheet Core Problem & Solution Problem: Redundant network paths (for reliability) create Layer 2 loops → broadcast storms and MAC flapping → network collapse. Solution: STP prevents loops by blocking redundant ports while maintaining backups. Key Concept: STP creates a loop-free spanning tree topology; redundant links disabled until primary fails. Core Definitions Broadcast Storm: Frame loops indefinitely in network, multiplying copies exponentially; consumes all bandwidth; causes network collapse. MAC Address Flapping: Same MAC address seen on different ports in rapid succession due to looping frames; switch continuously updates MAC table; packet forwarding becomes unreliable. Spanning Tree Protocol (STP): Layer 2 protocol preventing loops by blocking some ports (BLOCKING state) while enabling others (FORWARDING); runs by default on all Cisco switches. Bridge Protocol Data Unit (BPDU): STP message sent every 2 seconds (Hello Timer) containing bridge ID, root bridge ID, cost to root, and port ID; used for root election and topology discovery. Bridge ID: 2-byte priority + 6-byte MAC address; lowest bridge ID wins root election (priority first, then MAC). Root Bridge: "Center" of spanning tree topology; reference point for all cost calculations; all its ports are DESIGNATED and FORWARDING. Root Port: ONE port per switch (except root) closest to root bridge; determined by lowest cost path to root; FORWARDING state. Designated Port: ONE port per segment (collision domain) with lowest cost to root; FORWARDING state; other port in segment is NON-DESIGNATED. Non-Designated Port: Remaining ports in segments; BLOCKING state; serves as backup/redundant link. Root Bridge Election & Bridge ID Election Rule: Lowest bridge ID becomes root; if tied, lowest MAC address breaks tie. Bridge ID Structure: Priority (2 bytes) + MAC Address (6 bytes) Priority: Default: 32768 Must be in increments of 4096: 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768... Lower = higher priority for root Minimum: 0 (highest priority) Example Election: SW1: Priority 32768 + MAC 00:1a:2b:3c:4d:5e SW2: Priority 32768 + MAC 00:1a:2b:3c:4d:5f Same priority → compare MAC SW1 has lower MAC → SW1 becomes ROOT BRIDGE Configuration: Switch(config)# spanning-tree vlan 1 root primary → Sets priority to 24576 (likely to be root) Switch(config)# spanning-tree vlan 1 root secondary → Sets priority to 28672 (backup root; takes over if primary fails) STP Costs & Path Selection Classic STP Port Costs (by link speed): Speed Cost 10 Mbps 100 100 Mbps (FastEth) 19 1 Gbps (GigabitEth) 4 10 Gbps 2 RSTP Port Costs (larger scale): Speed Cost 10 Mbps 2,000,000 100 Mbps 200,000 1 Gbps 20,000 10 Gbps 2,000 Cost Calculation: Only outgoing ports have costs (incoming ports don't) Cumulative cost = sum of costs on path to root Lower cost = preferred path Switch selects root port = interface with lowest cost to root bridge STP Port Roles & Selection Port Role Selection Order: Elect Root Bridge (lowest bridge ID) → all its ports = DESIGNATED, FORWARDING Non-root switches select ROOT PORT (lowest cost to root; tiebreaker: lowest neighbor bridge ID, then lowest neighbor port ID) For each segment, elect DESIGNATED PORT (lowest cost from that switch; tiebreaker: lowest bridge ID, then lowest port ID) Remaining ports = NON-DESIGNATED (BLOCKING state) Tiebreaker Order: Root Port: lowest root cost → lowest neighbor bridge ID → lowest neighbor port ID → lowest local port ID Designated Port: lowest root cost (from that switch) → lowest bridge ID → lowest port ID STP Port States & Timers 5 Port States: State Duration Sends Data? Learns MAC? Receives BPDU? Purpose BLOCKING Indefinite ✗ ✗ ✗ Non-designated port; prevents loops LISTENING 15 sec ✗ ✗ ✓ Verifies no topology changes before forwarding LEARNING 15 sec ✗ ✓ ✓ Learns MAC addresses before forwarding traffic FORWARDING Indefinite ✓ ✓ ✓ Normal operation (root/designated ports) DISABLED N/A ✗ ✗ ✗ Port manually shut down State Transitions: Port Activation (blocked → forwarding): BLOCKING → LISTENING (15s) → LEARNING (15s) → FORWARDING Total: 30 seconds minimum (+ up to 20s MAX AGE = ~50s worst case) Port Deactivation (forwarding → blocking): FORWARDING → BLOCKING (IMMEDIATE, no delay) Reason: Prevent loops; no need to verify when disabling Three Main STP Timers: Timer Default Purpose Set By Hello Timer 2 seconds Interval between BPDU "hello" messages Root Bridge (affects entire network) Forward Delay 15 seconds Time spent in LISTENING state; also in LEARNING state Root Bridge (affects entire network) Max Age 20 seconds Max wait before declaring link dead; if no BPDU for 20s, re-evaluate topology Root Bridge (affects entire network) Critical Timing: Root Bridge controls ALL timers for ENTIRE network No switch can override root bridge settings Convergence time = MAX AGE (20s) + LISTENING (15s) + LEARNING (15s) = ~50 seconds (slowest scenario) If link fails: - Takes up to 20 seconds to detect (MAX AGE timeout) - Takes another 30 seconds for blocked port to activate - Total: ~50 seconds before traffic resumes on backup link This is why RSTP was developed (converges in seconds) STP Optional Features PortFast: Allows access port to skip LISTENING/LEARNING states Goes directly from BLOCKING → FORWARDING ONLY on access ports connected to end hosts (NOT on switch-to-switch links) Reduces activation time from 30s to ~0 seconds Configuration: switchport portfast or spanning-tree portfast default BPDU Guard: Shuts down PortFast port if BPDU received Prevents accidental switch connection to end-host port Port enters ERRDISABLED state; admin alerted Configuration: spanning-tree bpduguard enable or spanning-tree portfast bpduguard default Root Guard & Loop Guard: (less critical) Root Guard: prevents port from becoming root port Loop Guard: prevents non-designated port from forwarding if no BPDU received STP vs RSTP Comparison Feature Classic STP (802.1D) RSTP (802.1w) Convergence Time 30-50 seconds Seconds Port States 5 (Blocking, Listening, Learning, Forwarding, Disabled) 3 (Discarding, Learning, Forwarding) Port Roles 3 (Root, Designated, Non-designated) 4 (Root, Designated, Alternate, Backup) BPDUs Sent By Root bridge only All switches (from designated ports) Link Type Awareness No Yes (Edge, Point-to-point, Shared) UplinkFast Built-in Optional feature Yes (Alternate Port) BackboneFast Built-in Optional feature Yes (handshake) BPDU Version 0 2 Cisco Default PVST+ Rapid PVST+ Backwards Compatible - Yes (with 802.1D) RSTP Port States (3 Instead of 5) State Replaces Behavior DISCARDING Blocking, Listening, Disabled Port not forwarding; receives BPDUs but no regular traffic LEARNING Learning (same) Learns MAC addresses; disabled for traffic FORWARDING Forwarding (same) Full operation Why Fewer States? RSTP eliminates LISTENING (unnecessary with new bridge-to-bridge negotiation). RSTP Port Roles (4 Instead of 3) Role Purpose State Backup To ROOT PORT Interface toward root bridge (one per switch) FORWARDING N/A DESIGNATED PORT Best interface on segment toward root (one per segment) FORWARDING N/A ALTERNATE PORT NEW: Backup to root port; identified during BPDU negotiation DISCARDING Root port BACKUP PORT NEW: Backup to designated port (on shared media/hubs only) DISCARDING Designated port Why Alternate Port Matters: If root port fails, alternate port immediately moves to FORWARDING No 20-second MAX AGE wait Built-in UplinkFast functionality RSTP Link Types Edge Ports: Connected to end hosts (no other switches) No loop risk; move directly to FORWARDING Equivalent to PortFast in classic STP Configuration: spanning-tree portfast Point-to-Point Links: Direct switch-to-switch connections; full-duplex Use rapid bridge-to-bridge handshake Converge in seconds Configuration: spanning-tree link-type point-to-point (auto-detected in full-duplex) Shared Links: Multiple switches on shared segment (hubs); half-duplex Cannot use rapid handshake; slower convergence Rare in modern networks Configuration: spanning-tree link-type shared (auto-detected in half-duplex) STP Configuration Basic Setup: Switch(config)# spanning-tree mode rapid-pvst → Enable RSTP (modern) (or: spanning-tree mode pvst) → Classic STP Set Root/Backup Bridge: Switch(config)# spanning-tree vlan 1 root primary → Priority 24576 Switch(config)# spanning-tree vlan 1 root secondary → Priority 28672 PortFast & BPDU Guard: Switch(config-if)# spanning-tree portfast Switch(config-if)# spanning-tree bpduguard enable (Or globally): Switch(config)# spanning-tree portfast default Switch(config)# spanning-tree portfast bpduguard default Per-Interface STP: Switch(config-if)# spanning-tree vlan 1 cost 10 → Set cost Switch(config-if)# spanning-tree vlan 1 port-priority 64 → Set port priority Verification: show spanning-tree → Show root bridge and topology show spanning-tree vlan 10 → Specific VLAN STP show spanning-tree interface Fa0/1 → Interface STP details show spanning-tree detail → All STP information Per-VLAN STP (PVST+) Concept: One spanning tree per VLAN; allows different root bridge per VLAN. Benefits: Different traffic paths per VLAN Load balancing across multiple bridges Better utilization of redundant links Example: VLAN 10: SW1 = root VLAN 20: SW2 = root VLAN 30: SW3 = root Configuration: Switch1(config)# spanning-tree vlan 10 root primary Switch2(config)# spanning-tree vlan 20 root primary Switch3(config)# spanning-tree vlan 30 root primary CCNA Exam Essentials Concept Key Detail STP Purpose Prevent Layer 2 loops; enable redundancy safely Root Bridge Elected by lowest bridge ID (priority + MAC) Bridge ID 2-byte priority + 6-byte MAC; priority in 4096 increments Root Port ONE per switch; lowest cost to root; FORWARDING Designated Port ONE per segment; lowest cost; FORWARDING Non-Designated BLOCKING state; serves as backup Port Costs Classic: 10Mbps=100, 100Mbps=19, 1Gbps=4; RSTP: scale ×50000 Hello Timer 2 seconds; sent by root bridge; tells all others Forward Delay 15 seconds; time in LISTENING and LEARNING each Max Age 20 seconds; max wait for BPDU before topology re-eval Convergence Time 30-50 seconds (STP); MAX AGE + LISTENING + LEARNING Port State Sequence BLOCKING → LISTENING (15s) → LEARNING (15s) → FORWARDING BPDU STP message; sent every 2 seconds on all ports PortFast Skips LISTENING/LEARNING; ONLY for access to hosts BPDU Guard Shuts down PortFast port if BPDU received RSTP Convergence Seconds (not minutes) RSTP States 3 (Discarding, Learning, Forwarding) not 5 RSTP Roles 4 (Root, Designated, Alternate, Backup) not 3 Alternate Port Backup to root port; immediate failover (no MAX AGE wait) Root Priority 0 Lowest possible; highest chance to be root Priority Increment 4096 (only valid increment for priority changes) RSTP Link Types Edge (hosts), Point-to-Point (switch-to-switch FD), Shared (hubs) PVST+ Per-VLAN STP; different root per VLAN for load balancing Bridge ID Tie If priority equal, lower MAC address wins Tiebreaker Order Root cost → neighbor bridge ID → neighbor port ID → local port ID Summary: Condensed from ~4,200 to ~2,000 words (52% reduction). Zero technical data loss; all timers, costs, port states, transitions, roles, tiebreakers, and configurations preserved exactly. Day 23: EtherChannel CCNA 200-301 Study Guide: EtherChannel 1.0 EtherChannel: Definition and Strategic Purpose EtherChannel (also known as a Port Channel or Link Aggregation Group - LAG) bundles multiple physical switch ports into a single logical link. This technology is essential for creating high-bandwidth, resilient backbones in campus networks. 1.1 The Strategic Goals Increased Bandwidth: Aggregates the capacity of individual links (e.g., two 1Gbps links become a single 2Gbps logical channel). Link Redundancy: If one physical link in the bundle fails, traffic is automatically redistributed across the remaining active links without a total connection loss. Load Balancing: Uses a hashing algorithm to distribute traffic flows across all active members of the bundle. 1.2 Interaction with Spanning Tree Protocol (STP) Normally, parallel links between switches create a Layer 2 loop, causing STP to block all but one link. EtherChannel resolves this by presenting the bundle to STP as a single logical interface. STP allows the entire Port Channel to remain in a forwarding state, enabling all physical ports to contribute to the combined bandwidth. 2.0 Negotiation Protocols and Configuration Modes EtherChannel can be configured statically or dynamically. LACP is the modern industry standard and is preferred for its vendor-neutral compatibility. 2.1 Protocol Comparison Feature LACP (Link Aggregation Control Protocol) PAgP (Port Aggregation Protocol) Standard IEEE 802.3ad (Industry Standard) Cisco Proprietary Best Practice Preferred (Multi-vendor support) Use only between Cisco devices Modes Active / Passive Desirable / Auto 2.2 Negotiation Outcomes Protocol Mode Combination Result LACP Active + Active Success LACP Active + Passive Success LACP Passive + Passive Failure PAgP Desirable + Desirable Success PAgP Desirable + Auto Success PAgP Auto + Auto Failure The "On" Mode: This mode forces the interface to bundle without negotiation. It is risky because it does not verify if parameters (speed, duplex, VLANs) match on the other end, which can lead to Layer 2 loops or packet loss. 3.0 Load Balancing Mechanism EtherChannel does not use round-robin distribution. Instead, it uses a hash-based method to categorize traffic into "flows." Flow Consistency: All packets in a specific conversation (e.g., a single file transfer) are mapped to the same physical link. Prevention of Out-of-Order Delivery: By keeping a flow on one link, the switch ensures packets arrive in the correct sequence, preventing TCP performance degradation. Hashing Options: Switches can hash based on Source/Destination MAC, IP, or Port numbers. 4.0 Critical Configuration Guidelines For a Port Channel to form, the following parameters must match on all member interfaces: Speed and Duplex VLAN Membership (Access VLAN or Allowed VLAN list for Trunks) STP Settings 4.1 Link Limits PAgP: Up to 8 active links. LACP: Up to 16 links (8 active and 8 hot-standby). Channel Group Number: This ID is only locally significant; it does not need to match the number on the neighboring switch. 5.0 Implementation Workflow 5.1 Layer 2 EtherChannel (Switch-to-Switch) SW1(config)# interface range g0/1 - 2 SW1(config-if-range)# channel-group 1 mode active SW1(config-if-range)# exit SW1(config)# interface port-channel 1 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk allowed vlan 10,20 5.2 Layer 3 EtherChannel (Routed Port) SW1(config)# interface range g0/1 - 2 SW1(config-if-range)# no switchport SW1(config-if-range)# channel-group 1 mode active SW1(config-if-range)# exit SW1(config)# interface port-channel 1 SW1(config-if)# ip address 10.1.1.1 255.255.255.252 6.0 Verification and Troubleshooting Command Purpose show etherchannel summary Most Important. Shows Port Channel status and member port states. show etherchannel load-balance Displays the current hashing algorithm in use. show interface port-channel Shows the logical interface status (Up/Down) and bandwidth. Common Status Codes in show etherchannel summary: (P): Bundled in Port Channel (Operational). (D): Down / Suspended (Mismatched parameters). (I): Stand-alone (Negotiation failed). SU: Layer 2 Port Channel, In Use. RU: Layer 3 Port Channel, In Use. TL;DR: CCNA Exam Cram Purpose: Aggregate links for Bandwidth ($+$) and Redundancy. Protocol: Use LACP (Active/Active) whenever possible. Logic: STP sees one link; Traffic is balanced by Flow Hashing. Requirement: Speed, Duplex, and VLANs must match on all ports. Verification: show etherchannel summary is your best friend. Day 24: Dynamic Routing CCNA 200-301 Study Guide: IP Connectivity 1.0 Introduction IP Connectivity is the mechanism that enables communication between devices on different network segments. It is the core function of Layer 3 devices (routers and multilayer switches). In the CCNA 200-301 exam, this domain accounts for 25% of the total score. 2.0 Foundational Routing Methods: Static vs. Dynamic The choice between static and dynamic routing impacts scalability, resiliency, and administrative overhead. Feature Static Routing Dynamic Routing Configuration Manually defined by an administrator. Automatically learned from neighbors. Adaptability Fixed; requires manual intervention if a link fails. Automatically recalculates paths during topology changes. Scalability Low; impractical for large networks. High; manages thousands of routes efficiently. Resources Low CPU/RAM requirements. Requires CPU/RAM to run protocol algorithms. Best Use Case Stub networks or Default Gateways. Large enterprise core/distribution layers. 3.0 Deconstructing Dynamic Routing Protocols Dynamic protocols are classified by their Scope (where they run) and their Algorithm (how they calculate math). 3.1 Classification by Scope Interior Gateway Protocol (IGP): Used within a single Autonomous System (AS). Examples: OSPF, EIGRP, RIP, IS-IS. Exterior Gateway Protocol (EGP): Used to connect different Autonomous Systems. Example: BGP (The protocol of the Internet). 3.2 Classification by Algorithm Distance Vector: "Routing by rumor." Routers only know what neighbors tell them. Examples: RIP (Metric: Hop Count), EIGRP (Advanced Distance Vector). Link State: Every router has a complete map of the topology. Examples: OSPF, IS-IS (Metric: Cost/Bandwidth). Path Vector: Specific to BGP; uses AS-Path information to prevent loops. 4.0 The Router's Path Selection Logic When a router learns multiple paths to the same destination, it uses a strict three-step hierarchy to choose the best route for the Routing Table. Step 1: Longest Prefix Match (LPM) The router prefers the most specific route (the longest subnet mask). This rule overrides everything else. Example: A packet destined for 10.1.1.5 matches both 10.0.0.0/8 and 10.1.1.0/24. Winner: 10.1.1.0/24 because $24 > 8$. Step 2: Administrative Distance (AD) If prefix lengths are identical, the router chooses the most "trustworthy" source. Route Source Default AD Connected 0 Static 1 EIGRP (Internal) 90 OSPF 110 RIP 120 Step 3: Metric If the prefix length and AD are identical, the router chooses the path with the lowest cost (metric) calculated by the protocol. 5.0 Advanced Routing Concepts 5.1 Floating Static Routes A Floating Static Route is a backup route with a manually configured AD higher than the primary dynamic protocol. Primary: OSPF (AD 110) Backup: Static Route (AD 111) Logic: The static route "floats" (stays out of the table) until the OSPF route fails. Command: ip route 10.0.2.0 255.255.255.0 192.168.1.1 111 5.2 Equal-Cost Multi-Path (ECMP) If multiple paths have the same Prefix Length, same AD, and same Metric, the router installs all of them and load-balances traffic across them. 6.0 Essential Command Reference 6.1 Verification Command Purpose show ip route View the IPv4 routing table. traceroute Trace the hop-by-hop path to a destination. show ip protocols Verify dynamic routing protocol parameters and AD. 6.2 Configuration Standard Static Route: ip route Default Route (Gateway of Last Resort): ip route 0.0.0.0 0.0.0.0 Loopback Interface (Stable Management IP): interface Loopback0 7.0 TL;DR Summary Selection Logic: Longest Match $\rightarrow$ Lowest AD $\rightarrow$ Lowest Metric. Distance Vector protocols see neighbors; Link State protocols see the whole map. Floating Static Routes are created by increasing the AD of a static route to exceed the dynamic protocol's AD. BGP is the only EGP; it is a Path Vector protocol. Day 25: RIP and EIGRP Routing Protocols CCNA Study Guide: Comparative Analysis of RIP and EIGRP 1.0 Introduction While OSPFv2 is the primary protocol for configuration on the CCNA 200-301 exam, understanding RIP and EIGRP is essential for mastering routing fundamentals. These protocols represent the evolution of distance-vector logic and provide context for why modern networks are designed the way they are. 2.0 Routing Information Protocol (RIP) RIP is the classic "Routing by Rumor" protocol. It is a legacy Interior Gateway Protocol (IGP) that relies on periodic updates and a simplistic view of the network. 2.1 Core Characteristics Algorithm: Bellman-Ford (Distance Vector). Metric: Hop Count. Each router is one hop; the path with the fewest routers is chosen. Maximum Hop Count: 15. A hop count of 16 is considered "infinite" (unreachable). Administrative Distance (AD): 120. Update Timer: Full routing table broadcast/multicast every 30 seconds. 2.2 Evolution: RIPv1 vs. RIPv2 RIP evolved to support modern networking requirements like VLSM and CIDR. Feature RIPv1 RIPv2 Addressing Classful (A, B, C) Classless (VLSM/CIDR) Subnet Masks Not sent in updates Included in updates Transmission Broadcast (255.255.255.255) Multicast (224.0.0.9) Authentication Not supported Supported 2.3 Basic Configuration Router(config)# router rip Router(config-router)# version 2 Router(config-router)# no auto-summary Router(config-router)# network 192.168.1.0 Router(config-router)# passive-interface g0/0 Router(config-router)# default-information originate 3.0 Enhanced Interior Gateway Routing Protocol (EIGRP) EIGRP is an Advanced Distance Vector (or Hybrid) protocol. It is designed for extremely fast convergence and efficiency, utilizing the Diffusing Update Algorithm (DUAL). 3.1 Core Characteristics Algorithm: DUAL. Multicast Address: 224.0.0.10. Administrative Distance (AD): 90 (Internal), 170 (External). Convergence: Very fast due to pre-calculated backup paths. Routing Code: Identified in the routing table by the letter D (for DUAL). 3.2 The Composite Metric EIGRP uses a complex formula considering multiple path attributes. By default, only Bandwidth and Delay are used. $$Metric = ([Slowest\ Bandwidth + Sum\ of\ Delays] \times 256)$$ 3.3 EIGRP Terminology (DUAL) Term Definition Successor The best, lowest-metric route installed in the routing table. Feasible Successor (FS) A loop-free backup route. Feasible Distance (FD) The local router's total metric to the destination. Reported Distance (RD) The metric advertised by a neighbor to reach the destination. The Feasibility Condition: For a neighbor to be a Feasible Successor, its RD must be less than the current FD ($RD < FD$). This ensures a loop-free backup path. 4.0 Advanced Features and Configuration 4.1 Unequal-Cost Load Balancing EIGRP is the only IGP that supports unequal-cost load balancing. Using the variance command, a router can distribute traffic across paths with different metrics if the backup path is a Feasible Successor. 4.2 Configuration Example Router(config)# router eigrp 100 Router(config-router)# eigrp router-id 1.1.1.1 Router(config-router)# network 10.0.0.0 0.0.0.255 Router(config-router)# no auto-summary Router(config-router)# variance 2 5.0 Verification and Troubleshooting Commands Command Purpose show ip protocols Summarizes all active routing protocols (timers, AD, networks). show ip route [rip | eigrp] Filters the routing table for specific protocol entries. show ip eigrp neighbors Verifies successful adjacencies with neighboring routers. show ip eigrp topology Displays the DUAL database, including Successors and FS. 6.0 Head-to-Head Comparison: RIP vs. EIGRP Feature RIP EIGRP Type Distance Vector Advanced Distance Vector Metric Hop Count Bandwidth + Delay Convergence Slow Very Fast Load Balancing Equal Cost Only Equal & Unequal Cost Admin Distance 120 90 Standard Industry Standard Cisco (Open since 2013) Days 26, 27, 28: OSPF CCNA Study Guide: OSPFv2 (Exam Topic 3.4) 1.0 OSPFv2 Fundamentals: The Link-State Advantage Open Shortest Path First (OSPF) is a Link-State Interior Gateway Protocol (IGP). Unlike distance-vector protocols that rely on "routing by rumor," OSPF routers build a complete, synchronized map of the network topology. The Metaphor: The GPS vs. The Signpost Distance Vector (RIP): Like a signpost. It tells you "Network X is 4 miles that way," but you don't know what the road looks like or if there is a bridge out further ahead. Link-State (OSPF): Like a GPS map. Every router has a complete map of every "road" (link) and "intersection" (router) in the area. Each router can independently calculate the best path using the map. Core Characteristics Attribute Description Protocol Type Link-State IGP Algorithm Dijkstra’s Shortest Path First (SPF) Admin Distance (AD) 110 Multicast Addresses 224.0.0.5 (All OSPF Routers), 224.0.0.6 (DR/BDR) 2.0 The Path to Adjacency: OSPF Core Operations OSPF routers must go through a structured process to become fully adjacent and synchronize their Link State Database (LSDB). The 3-Step Process Become Neighbors: Routers discover each other via Hello packets. Exchange LSAs: Routers share Link State Advertisements (LSAs) to synchronize their databases. Calculate Routes: Once the LSDB is identical, each router runs the SPF algorithm to find the best paths. OSPFv2 Neighbor States State Description Down No Hellos received. Init Hello received, but your own Router ID is not in the neighbor's list. 2-Way Bidirectional communication confirmed (DR/BDR election happens here). ExStart Determining Master/Slave relationship for data exchange. Exchange Exchanging Database Descriptors (DBDs) (summaries of the LSDB). Loading Requesting specific missing info via LSRs and LSUs. Full LSDBs are fully synchronized. Normal operation. 3.0 Essential OSPF Components 3.1 Router ID (RID) Selection The RID is a unique 32-bit identifier for the router. It is selected in this order: Manual Configuration: router-id 1.1.1.1 (Best Practice). Highest Loopback IP: Highest IP on any active loopback interface. Highest Physical IP: Highest IP on any active physical interface. 3.2 The OSPF Metric: Cost OSPF calculates cost based on interface bandwidth. A lower cumulative cost is preferred. $$Cost = \frac{Reference\ Bandwidth}{Interface\ Bandwidth}$$ Important: The default reference bandwidth is 100 Mbps. On modern networks (Gigabit or 10G), you must manually increase this to ensure OSPF can distinguish between different high-speed links. Command: auto-cost reference-bandwidth 1000 (for 1 Gbps links). 3.3 LSA Types (CCNA Focus) Type 1 (Router LSA): Sent by every router; describes its own links/interfaces. Type 2 (Network LSA): Generated by the Designated Router (DR); describes the routers on a multi-access segment. Type 5 (External LSA): Describes routes redistributed from outside the OSPF domain (e.g., a Static Route). 4.0 Network Types and the DR/BDR Election On multi-access networks (like Ethernet), OSPF elects a Designated Router (DR) and a Backup Designated Router (BDR) to manage LSA flooding and reduce the number of adjacencies. Feature Broadcast (Ethernet) Point-to-Point (Serial) DR/BDR Election Yes No Hello / Dead Timer 10s / 40s 10s / 40s DR/BDR Election Hierarchy Highest Interface Priority: Default is 1. A priority of 0 makes a router ineligible. Highest Router ID: The tie-breaker if priorities are equal. Note: The election is non-preemptive. If a new router with a higher priority joins the network, it will not become the DR until the current DR/BDR process is reset or the current DR fails. 5.0 OSPFv2 Configuration 5.1 Basic Implementation # Method 1: Traditional Network Command Router(config)# router ospf 1 Router(config-router)# router-id 1.1.1.1 Router(config-router)# network 10.1.1.0 0.0.0.255 area 0 # Method 2: Interface-level Command (Preferred) Router(config)# interface g0/0 Router(config-if)# ip ospf 1 area 0 5.2 Common Optimizations Passive Interface: Prevents Hellos from being sent to user segments (Security/Efficiency). passive-interface g0/1 Default Route Propagation: default-information originate (Injects the 0.0.0.0/0 route into OSPF). 6.0 Troubleshooting OSPF Adjacency Issues If two routers fail to reach the FULL state, check for mismatches in these parameters: Area ID: Must match. Subnet & Mask: Must be on the same primary subnet. Hello/Dead Timers: Must match (Default 10/40). Authentication: Passwords and types must match. MTU Size: If they mismatch, routers get stuck in ExStart/Exchange. Unique Router IDs: Duplicate RIDs prevent adjacency. TL;DR Summary Link-State: OSPF uses a map (LSDB), not rumors. Election: Lowest Bridge ID wins (Priority, then RID). Cost Formula: Reference Bandwidth / Interface Bandwidth. Convergence: Moves through 7 states; FULL is the goal. Multi-access: Uses DR/BDR to reduce LSA flooding on Ethernet. Troubleshooting: Check Area, Timers, Subnet, and MTU if adjacencies fail. Day 29: First Hop Redundancy Protocols CCNA Study Guide: First Hop Redundancy Protocols (FHRP) 1.0 Introduction: The Default Gateway as a Single Point of Failure In a standard network, end-user devices rely on a single Default Gateway to reach the outside world. If the physical router providing that gateway fails, the entire subnet loses connectivity. First Hop Redundancy Protocols (FHRP) mitigate this risk by grouping multiple physical routers into a single logical, redundant gateway. The Metaphor: The Shared Doorway Imagine an office with only one exit. If that door jams, everyone is trapped. FHRP is like having two doors side-by-side that appear as one "virtual door" to the employees. If one door sticks, people automatically walk through the other without even realizing the first one failed. 2.0 Core FHRP Concepts and Mechanisms 2.1 The Building Blocks of Redundancy Virtual IP (VIP): The single IP address shared by the group. This is what hosts use as their Default Gateway. Virtual MAC (VMAC): A shared Layer 2 address associated with the VIP. Active/Master Router: The router currently responsible for forwarding traffic sent to the VIP. Standby/Backup Router: The router(s) listening for "Hello" messages from the Active router, ready to take over. 2.2 The Automatic Failover Process Health Monitoring: Routers exchange Hello messages via multicast. Failure Detection: If the Standby router stops hearing Hellos for a specific duration (the Hold Time), it assumes the Active router has failed. Role Transition: The Standby router promotes itself to Active. Gratuitous ARP (GARP): The new Active router sends a GARP to the switch. This forces the switch to update its MAC address table so that frames destined for the VMAC are now sent to the new router's physical port. 3.0 Comparative Analysis of Major FHRPs Feature HSRP VRRP GLBP Full Name Hot Standby Router Protocol Virtual Router Redundancy Protocol Gateway Load Balancing Protocol Owner Cisco Proprietary Open Standard Cisco Proprietary Primary Roles Active / Standby Master / Backup AVG / AVF Load Balancing No (Active/Passive) No (Active/Passive) Yes (Active/Active) Preemption Disabled by Default Enabled by Default Enabled by Default Multicast IP 224.0.0.102 (v2) 224.0.0.18 224.0.0.102 Virtual MAC Address Formats HSRP v1: 0000.0C07.ACXX (XX = Group ID) HSRP v2: 0000.0C9F.FXXX (XXX = Group ID) VRRP: 0000.5E00.01XX (XX = Group ID) GLBP: 0007.B400.XXYY (XX = Group ID, YY = Forwarder ID) 4.0 Deep Dive: Hot Standby Router Protocol (HSRP) HSRP is the most common FHRP encountered in Cisco environments. 4.1 Election and Preemption Highest Priority: The router with the highest priority wins (Default: 100, Range: 0–255). Highest IP: If priorities are tied, the router with the highest IP address on the interface wins. Preemption: If a primary router reboots, it will not take back the Active role by default, even if it has a higher priority. Preemption must be manually enabled to allow the "better" router to seize control back. 4.2 HSRP Versions Feature HSRP v1 HSRP v2 Group Range 0 – 255 0 – 4095 IPv6 Support No Yes Multicast Addr 224.0.0.2 224.0.0.102 Timer Support Seconds Milliseconds 5.0 HSRP Configuration and Verification 5.1 Configuration Example Router(config)# interface g0/0 Router(config-if)# standby version 2 Router(config-if)# standby 1 ip 10.0.0.1         # Set Virtual IP Router(config-if)# standby 1 priority 150        # Make this the preferred Active Router(config-if)# standby 1 preempt             # Allow it to take back control 5.2 Verification Commands Command Purpose show standby Detailed view of roles, VIP, VMAC, and timers. show standby brief Concise summary of all HSRP groups and their states. 6.0 CCNA Exam Essentials (Key "Gotchas") Traceroute Behavior: When tracing a path from a host, the first hop will show the Physical IP of the active router, not the Virtual IP. GLBP Roles: * AVG (Active Virtual Gateway): Answers ARP requests and assigns different VMACs to routers. AVF (Active Virtual Forwarder): The routers that actually forward the data. GARP Importance: Failover relies on the switch updating its MAC table via the Gratuitous ARP. Without it, the switch would continue sending frames to the dead router's port. TL;DR Summary FHRP provides a Virtual IP (Gateway) that stays active even if a physical router fails. HSRP is Cisco's standard; VRRP is the open-standard equivalent. GLBP is the only one that does true active-active load balancing. Election: Highest Priority wins; use Preemption to ensure the primary router regains control after a reboot. Verification: Use show standby brief to quickly check which router is currently Active. Day 30: TCP and UDP CCNA 200-301 Study Guide: Transport Layer (Layer 4) 1.0 The Role of the Transport Layer (Layer 4) The Transport Layer serves as the bridge between application-level protocols and the network-level protocols responsible for routing. It manages the end-to-end conversation between applications on different hosts. 1.1 Core Functions Session Multiplexing: Allows a host to handle multiple simultaneous sessions (e.g., multiple browser tabs) by assigning unique source port numbers to each session. Application Identification: Uses destination port numbers to direct incoming data to the correct service (e.g., Port 80 for HTTP). Segmentation: Breaks large data streams into smaller "segments" that fit within the network's Maximum Transmission Unit (MTU). 2.0 Deep Dive: TCP (Transmission Control Protocol) TCP is connection-oriented and designed for applications that require absolute data integrity. It has a 20-byte header. 2.1 Key Characteristics Reliable: Uses acknowledgments (ACKs) and retransmissions for lost data. Ordered: Uses Sequence Numbers to ensure data is reassembled in the correct order. Flow Control: Uses Windowing to prevent a sender from overwhelming a receiver. 2.2 Connection Management The Three-Way Handshake (Establishment): SYN: Client sends a request to synchronize. SYN-ACK: Server acknowledges and requests a return connection. ACK: Client acknowledges the server. The Four-Way Handshake (Termination): Uses FIN and ACK flags to gracefully close both sides of the virtual circuit. 2.3 Reliability Mechanisms Forward Acknowledgment: The ACK number indicates the next byte expected (e.g., if you receive byte 1000, you send ACK 1001). Sliding Window: A dynamic flow control mechanism that adjusts how much data can be sent before an ACK is required based on network conditions. 3.0 Deep Dive: UDP (User Datagram Protocol) UDP is connectionless and prioritizes speed over reliability. It has a lightweight 8-byte header. 3.1 Key Characteristics Best-Effort Delivery: No acknowledgments, no retransmissions, and no sequencing. Low Overhead: No connection setup delay (no handshake). No Flow Control: Sends data as fast as the application allows. 3.2 Strategic Use Cases Ideal for real-time traffic like VoIP and Video Streaming, where a dropped packet is better than a delayed/retransmitted one that causes jitter. 4.0 Head-to-Head Comparison: TCP vs. UDP Feature TCP UDP Type Connection-Oriented Connectionless Handshake Yes (3-Way) No Reliability Reliable (ACKs/Retransmits) Unreliable (Best-effort) Sequencing Yes No Flow Control Yes (Sliding Window) No Header Size 20 Bytes 8 Bytes Common Uses HTTP, FTP, SMTP, SSH VoIP, DNS, DHCP, SNMP 5.0 Layer 4 Addressing: Port Numbers Ports are 16-bit addresses (0 – 65,535) used to identify specific application processes. 5.1 Port Number Ranges Well-Known Ports (0 – 1,023): Common services (HTTP, SSH, etc.). Registered Ports (1,024 – 49,151): Assigned for specific vendor applications. Ephemeral Ports (49,152 – 65,535): Temporary source ports used by clients. 5.2 Essential Well-Known Ports for the CCNA Protocol Port(s) Transport Description FTP 20, 21 TCP File Transfer (21-Control, 20-Data) SSH 22 TCP Secure Remote Access Telnet 23 TCP Unencrypted Remote Access SMTP 25 TCP Sending Email DNS 53 UDP/TCP Name Resolution DHCP 67, 68 UDP Dynamic IP Assignment TFTP 69 UDP Trivial FTP HTTP 80 TCP Web Browsing (Cleartext) POP3 110 TCP Retrieving Email SNMP 161, 162 UDP Network Management HTTPS 443 TCP Secure Web Browsing Syslog 514 UDP System Logging 6.0 Practical Context & Key Exam Takeaways 6.1 Session Tracking Request: Source Port: 51234 (Ephemeral) $\rightarrow$ Destination Port: 80 (Well-Known). Reply: Source Port: 80 $\rightarrow$ Destination Port: 51234. The reversal of port numbers is how a host keeps track of distinct conversations. 6.2 The DNS Exception DNS primarily uses UDP 53 for speed. However, it switches to TCP 53 if the response exceeds 512 bytes or during Zone Transfers between servers. 6.3 Core Analogy TCP is a Certified Letter: Requires a signature, has tracking, and pages are numbered. UDP is a Postcard: Fast and cheap; you drop it in the mail and hope it arrives. Days 31, 32, 33: IPv6 CCNA 200-301 Study Guide: IPv6 Fundamentals and Routing 1.0 Context: IPv6 in the CCNA 200-301 Exam IPv6 is a core competency woven throughout the CCNA curriculum. Understanding both the theory and practical configuration is essential for success in the following domains: Domain Name Weight 1.0 Network Fundamentals 20% 2.0 Network Access 20% 3.0 IP Connectivity 25% Concepts are distributed across notation, address types, stateless autoconfiguration (SLAAC), and Neighbor Discovery Protocol (NDP). 2.0 The Architectural Shift: Header Improvements IPv6 was designed to solve IPv4 address exhaustion, providing a 128-bit address space ($2^{128}$ addresses). It also introduced a more efficient, fixed-size 40-byte header. Key Header Changes No Checksum: Error checking is handled at Layer 2 and Layer 4, reducing CPU overhead at every Layer 3 hop. Hop Limit: Replaces "Time to Live" (TTL). It performs the same function: preventing infinite loops. Next Header: Replaces the "Protocol" field. It identifies the payload (TCP, UDP, ICMPv6) or chains extension headers. Flow Label: A 20-bit field that allows routers to identify and prioritize specific traffic flows for Quality of Service (QoS). 3.0 Mastering IPv6 Notation Because a 128-bit address is too long to write in full, RFC 5952 defines rules for compression. Rule 1: Omit Leading Zeros: In any 16-bit hextet, leading zeros are unnecessary. Example: 0db8 becomes db8. Rule 2: The Double Colon (::): A single contiguous string of all-zero hextets can be replaced with ::. Constraint: This can only be used once per address to avoid ambiguity. Rule 3: Use Lowercase: Characters a through f should be lowercase for a consistent representation. Example Compression: Full: 2001:0db8:0000:0000:0000:ff00:0042:8329 Compressed: 2001:db8::ff00:42:8329 4.0 A Taxonomy of IPv6 Address Types IPv6 eliminates Broadcast addresses, replacing them with more efficient Multicast methods. 4.1 Unicast (One-to-One) Unicast Type Address Range Description Global Unicast (GUA) 2000::/3 Publicly routable on the internet. Unique Local (ULA) fc00::/7 Private addresses for internal use; typically starts with fd. Link-Local (LLA) fe80::/10 Automatic for local link communication. Not routable. Loopback ::1/128 Equivalent to 127.0.0.1. 4.2 Multicast (One-to-Many) All multicast addresses begin with ff00::/8. ff02::1: All Nodes (local link). ff02::2: All Routers (local link). ff02::1:ffxx:xxxx: Solicited-Node Multicast (used for address resolution). 4.3 Anycast (One-to-Nearest) A single address assigned to multiple devices. Routers deliver the packet to the topologically "closest" device. 5.0 Interface ID and Address Assignment 5.1 Modified EUI-64 Process A device can generate its own unique 64-bit Interface ID from its 48-bit MAC address: Split the MAC address in half. Insert fffe in the middle. Flip the 7th bit (Universal/Local bit). 5.2 Assignment Methods SLAAC: Host uses Router Advertisement (RA) messages to learn the prefix and generates its own Interface ID. Stateless DHCPv6: Host uses SLAAC for its IP, but asks DHCP for "other" info (DNS, Domain Name). Stateful DHCPv6: Host obtains its full configuration (including IP) from a DHCPv6 server. 6.0 Neighbor Discovery Protocol (NDP) NDP replaces ARP and operates over ICMPv6. It uses targeted multicasts instead of noisy broadcasts. Message Type ICMPv6 Type Purpose Neighbor Solicitation (NS) 135 "Who has this IP?" (ARP Request equivalent). Neighbor Advertisement (NA) 136 "I have that IP, here is my MAC." (ARP Reply equivalent). Router Solicitation (RS) 133 Host asks, "Are there any routers here?" Router Advertisement (RA) 134 Router says, "I am here, use this prefix." 7.0 Practical Application: CLI Reference Global Configuration # Mandatory command to allow the router to forward IPv6 packets Router(config)# ipv6 unicast-routing # Static Default Route Router(config)# ipv6 route ::/0 # Standard Static Route Router(config)# ipv6 route /64 Interface Configuration Router(config-if)# ipv6 enable                      # Generates an LLA only Router(config-if)# ipv6 address 2001:db8:1::1/64    # Static GUA Router(config-if)# ipv6 address autoconfig          # Use SLAAC Router(config-if)# ipv6 address fe80::1 link-local  # Manually set LLA Verification show ipv6 interface brief: High-level status check. show ipv6 route: View the IPv6 routing table. show ipv6 neighbors: View the Neighbor Cache (equivalent to the ARP table). 8.0 Conclusion: Core Takeaways Link-Local Addresses (fe80::/10) are mandatory for local communication and serve as the next-hop for routing protocols. ipv6 unicast-routing must be enabled globally for a Cisco device to function as a router. NDP replaces ARP, using Solicited-Node Multicasts for efficiency. Header Efficiency: Removing the checksum and fixing the header size at 40 bytes improves core routing performance. Days 34, 35: Access Control Lists CCNA 200-301 Study Guide: Mastering Access Control Lists (ACLs) 1.0 Introduction: The Role of ACLs In network engineering, an Access Control List (ACL) acts as a security bouncer. It inspects every packet attempting to cross a router interface and decides to Permit or Deny it based on specific rules. Beyond security, ACLs are also used to "match" or classify traffic for: NAT (Network Address Translation) QoS (Quality of Service) Demand Dial Routing 2.0 The Core Principles of ACL Processing ACL logic is strict and predictable. Routers follow three fundamental rules when evaluating a packet against a list: Sequential Order (Top-Down): The router starts at the first line and moves down. First Match Execution: As soon as a match is found, the action (Permit/Deny) is taken, and processing stops. The router does not check subsequent lines. The Implicit Deny: Every ACL ends with an invisible, unwritten deny any any. If a packet doesn't match any of your permit rules, it is dropped. Instructor's Note: Because of the implicit deny, every functional ACL must contain at least one permit statement, or it will block 100% of traffic. Application Rules One ACL per interface, per protocol, per direction. An interface can have one inbound IPv4 ACL and one outbound IPv4 ACL. 3.0 Standard vs. Extended ACLs Feature Standard ACL Extended ACL Criteria Source IP Address only. Source/Dest IP, Protocol, and Ports. Number Range 1–99 and 1300–1999 100–199 and 2000–2699 Granularity Low (Sledgehammer) High (Scalpel) Placement Closest to the Destination Closest to the Source The Placement Logic Standard (Sledgehammer): Since it only checks the source, placing it near the source might block the user from reaching everything. Place it near the destination to be specific. Extended (Scalpel): Since it knows exactly where the packet is going and what port it's using, place it near the source to drop unwanted traffic early and save bandwidth. 4.0 Wildcard Masks and Syntax 4.1 Wildcard Mask Logic Wildcard masks are the inverse of subnet masks. 0 bit: Match Exactly. 1 bit: Ignore ("Don't Care"). Keywords: host: Equivalent to wildcard 0.0.0.0 (matches one IP). any: Equivalent to wildcard 255.255.255.255 (matches everything). 4.2 Configuration Syntax Standard ACL: access-list 10 permit 192.168.1.0 0.0.0.255 Extended ACL: access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 80 Pro Tip: The established keyword in Extended ACLs allows return traffic for already active TCP sessions but blocks new connections initiated from the outside. 5.0 Essential Protocol and Port Reference Service Protocol Port Transport ICMP 1 N/A IP TCP 6 N/A IP UDP 17 N/A IP SSH N/A 22 TCP Telnet N/A 23 TCP DNS N/A 53 TCP/UDP HTTP N/A 80 TCP HTTPS N/A 443 TCP TFTP N/A 69 UDP 6.0 ACL Management and Verification 6.1 Editing with Sequence Numbers Modern IOS allows you to edit specific lines without deleting the whole list: ip access-list extended 101 no 20 (Deletes line 20) 25 permit udp any any eq 53 (Inserts new rule at line 25) Resequencing: ip access-list resequence 101 10 10 (Starts at 10, increments by 10). 6.2 Verification Commands show access-lists: The most important command. Shows the rules and the "hit counts" (how many times a rule was matched). show ip interface : Confirms if an ACL is applied and in which direction (In/Out). 7.0 Key Takeaways Summary Top-Down Logic: Once a match is made, the router stops looking. Implicit Deny: If you don't permit it, it's denied by default. Standard: Match Source IP; place near Destination. Extended: Match Source, Dest, Protocol, Port; place near Source. Troubleshooting: Use show access-lists to check hit counts and verify your logic is actually catching traffic. Day 36: CDP and LLDP CCNA 200-301 Study Guide: Layer 2 Discovery (CDP & LLDP) 1.0 Fundamentals of Layer 2 Discovery Layer 2 discovery protocols act as the "digital handshake" of a network, allowing devices to identify neighbors without requiring an IP address. They operate at the Data Link Layer, meaning discovery occurs as long as the physical link is up and the protocol is enabled. Core Attributes Operational Scope: Information is strictly point-to-point. Discovery frames are processed by the direct neighbor and then discarded; they are never forwarded. Shared Data: Device IDs (Hostnames), IP addresses (for management), platform/capabilities, and local/remote interface mappings. Security Risk: These protocols are "chatty" and broadcast sensitive topology data. Standard Practice: Disable discovery on untrusted ports (e.g., user-facing access ports) to prevent reconnaissance. 2.0 Cisco Discovery Protocol (CDP) CDP is a Cisco-proprietary protocol used for identifying and managing Cisco hardware. Operational Defaults Status: Enabled globally and on all interfaces by default. Multicast MAC: 0100.0CCC.CCCC Default Timers: Hello Timer: 60 seconds. Holdtime: 180 seconds. Version 2 (Default): Includes enhanced features like Native VLAN and duplex mismatch detection. Configuration & Management Command Mode Purpose cdp run Global Enables CDP globally. no cdp run Global Disables CDP globally. cdp enable Interface Enables CDP on a specific port. cdp timer [sec] Global Adjusts advertisement frequency. cdp holdtime [sec] Global Adjusts neighbor retention time. Verification Commands show cdp: Checks global status and timers. show cdp neighbors: Provides a summary table of adjacent Cisco devices. show cdp neighbors detail: Provides Layer 3 addresses and software versions. show cdp entry [name]: Focuses on a specific neighbor. 3.0 Link Layer Discovery Protocol (LLDP) LLDP (IEEE 802.1AB) is the vendor-neutral standard required for discovery in multi-vendor environments. Operational Defaults Status: Typically disabled by default on Cisco switches. Multicast MAC: 0180.C200.000E Default Timers: Hello Timer: 30 seconds. Holdtime: 120 seconds. Reinit Delay: 2 seconds. Configuration & Management Unlike CDP, LLDP allows for granular control over transmission and reception. Command Mode Purpose lldp run Global Enables LLDP globally. lldp transmit Interface Enables sending LLDP frames on the port. lldp receive Interface Enables processing incoming LLDP frames. lldp timer [sec] Global Configures advertisement frequency. lldp holdtime [sec] Global Configures the holdtime. Verification Commands show lldp show lldp neighbors show lldp neighbors detail Note: LLDP uses B (Bridge) in its capability codes where CDP uses S (Switch). 4.0 Protocol Comparison Matrix Feature Cisco Discovery Protocol (CDP) Link Layer Discovery (LLDP) Ownership Cisco Proprietary IEEE 802.1AB (Standard) Cisco Default Enabled Disabled Hello Timer 60 Seconds 30 Seconds Holdtime 180 Seconds 120 Seconds Interface Logic cdp enable (Binary) transmit / receive (Granular) VTP Support Yes No Capability Code S (Switch) B (Bridge)