Course syllabus

A network is a set of devices that exchange data using shared rules. This chapter introduces the core vocabulary — hosts, nodes, links, addresses, protocols — and walks through what physically happens when a single packet crosses the room.

• Define host, node, link, address, and protocol in plain language.
• Identify the four physical components that make any network possible.
• Trace, at a high level, how a packet moves between two hosts on the same LAN.

Two reference models describe the layered structure of networks. OSI has seven academic layers; TCP/IP has four practical ones. This chapter explains both, maps them to each other, and shows where every networking topic lives in the stack.

• List the seven OSI layers in order, top down and bottom up.
• Map each OSI layer to its equivalent TCP/IP layer.
• Place common protocols (HTTP, TCP, IP, Ethernet, Wi-Fi) on the correct layer.

Copper twisted-pair (UTP), fiber (single-mode and multi-mode), serial, and wireless. This chapter covers connector types, distance and speed limits, and how to pick the right media for the job.

• Choose the right cable category for a given speed and distance.
• Distinguish single-mode from multi-mode fiber and explain when to use each.
• Identify common interface types: RJ-45, SFP, SFP+, QSFP, console.

Even with the right IPs, a network can crawl or drop traffic because of L1 problems. This chapter teaches you to read 'show interfaces' counters, spot duplex/speed mismatches, and diagnose collisions versus runts versus CRC errors.

• Identify duplex mismatch from interface counters.
• Distinguish collisions, runts, giants, and CRC errors.
• Decide when to set speed/duplex statically vs auto.

Recognize routers, switches, firewalls, access points, controllers, and endpoints — and understand the three-tier hierarchical design (access / distribution / core) that organizes them in any enterprise.

• Describe the role of each common network device kind.
• Compare the two-tier collapsed-core and three-tier hierarchical designs.
• Explain spine-leaf data center topology and where it fits.

Layer 4 picks one of two transport protocols. TCP is reliable and ordered; UDP is fast and lossy. This chapter explains the three-way handshake, sliding windows, port numbers, and the table of well-known ports worth knowing cold.

• Describe the TCP three-way handshake and connection teardown.
• Explain when an application chooses UDP over TCP.
• Memorize the well-known ports for HTTP, HTTPS, SSH, DNS, DHCP, SMTP, FTP, Telnet, NTP, SNMP.

When a host can't reach the network, the first step is to read its IP, mask, gateway, and DNS — without logging into the switch. Each OS has a different command. This chapter is the reference.

• Read IPv4/IPv6 address, mask, and gateway on Windows.
• Read the same on macOS and Linux.
• Spot APIPA (169.254.x.x) and what it tells you.

Modern networks rarely connect physical hosts directly. This chapter covers server virtualization (hypervisors and VMs), containers (Docker / Kubernetes), and VRFs (virtual routing tables on a single router) — and how they show up in modern networks.

• Compare a VM and a container in terms of isolation and overhead.
• Explain what a hypervisor does (Type 1 vs Type 2).
• Describe a VRF and when an enterprise uses one.

An IPv4 address is 32 bits split into a network portion and a host portion. This chapter explains classful history (A/B/C), CIDR notation, and how every dotted-decimal address really lives in binary.

• Convert between dotted decimal and binary for any /8 boundary.
• Explain why classful addressing was replaced by CIDR.
• Describe what the prefix length actually counts.

Memorize the prefix-to-mask table and you have memorized half of subnetting. This chapter gives you the table, the trick to derive any mask from scratch, and the formulas for hosts-per-subnet and subnets-per-supernet.

• Convert any /n prefix to its dotted-decimal mask without a calculator.
• Compute usable hosts for any prefix in two seconds.
• Recognize /30, /31, and /32 by use case.

A repeatable five-step recipe that gives you the network address, broadcast address, usable range, and number of hosts for any IPv4 address and mask in under 30 seconds. Worked examples included.

• Find the network and broadcast for any IP/mask combination.
• Count usable hosts and list the first/last usable IP.
• Apply the method quickly against a practice set.

Variable-Length Subnet Masking lets you fit subnets of different sizes inside one address block without waste. This chapter walks through the standard 'biggest-first' planning method with a worked enterprise example.

• Design a VLSM plan for an organization with mixed subnet sizes.
• Justify the order in which subnets are allocated.
• Detect overlapping or wasteful allocations in a given plan.

RFC 1918 private space, link-local, loopback, multicast, and broadcast — when each is used, and a brief preview of NAT/PAT (covered in depth in Module 5, Running the Network).

• Identify the three RFC 1918 private ranges.
• Recognize loopback, link-local, multicast, and TEST-NET addresses.
• Explain at a high level why private addresses require NAT to reach the public Internet.

128-bit addresses, the eight 16-bit hextets, address types, EUI-64, SLAAC, and dual-stack operation. This chapter teaches just enough IPv6 to read an address, configure an interface, and work confidently with it in practice.

• Compress and expand any IPv6 address using the :: shorthand rules.
• Distinguish global unicast, unique local, link-local, multicast, and anycast.
• Describe SLAAC and how a host self-configures an IPv6 address.

A router receives a frame, strips the L2 header, looks up the IP destination in its routing table, picks the longest-prefix match, re-encapsulates in a new L2 frame for the outgoing interface, and sends it on. This chapter walks through that path step by step.

• Describe the per-packet process inside a router.
• Explain longest-prefix match and why it overrides administrative distance.
• Read 'show ip route' output cleanly.

Static routes give predictable behaviour with zero overhead. This chapter covers next-hop and exit-interface forms, default routes, host routes (/32), floating statics, and the IPv6 versions of all of them.

• Configure a next-hop static route and an exit-interface static route.
• Configure a default route and an IPv6 default route.
• Configure a host route (/32 or /128).
• Use a floating static route as a backup to a dynamic protocol.

OSPF builds a complete topological map by exchanging Link State Advertisements. This chapter walks through neighbour formation, the router ID, the DR/BDR election on multi-access segments, and a complete single-area configuration.

• Configure OSPFv2 in a single area with the network and router-id commands.
• Explain Hello/Dead timers and the conditions for adjacency.
• Identify when DR/BDR is elected and when it is bypassed.

When two routing sources offer the same prefix, AD picks the source. Within one source, the metric picks the best path. This chapter gives the standard AD table and explains the metric used by each protocol.

• Recite the default AD for connected, static, OSPF, EIGRP, RIP, and external BGP.
• Compare metric calculations between OSPF (cost) and RIP (hop count).

Endpoints have one default gateway. If that router dies, every host loses connectivity. FHRPs put two routers behind one virtual IP so failover is invisible to hosts. This chapter compares HSRP, VRRP, and GLBP.

• Explain why endpoints need a redundant first hop.
• Compare HSRP, VRRP, and GLBP feature by feature.
• Configure VRRP for a master/backup pair.

An L2 switch makes forwarding decisions by destination MAC. It builds its table from source MACs of arriving frames. This chapter walks through MAC learning, flooding, and the difference between a hub, switch, and router.

• Describe the format of an Ethernet II frame.
• Walk through how a switch learns and populates its MAC address table.
• State the three forwarding outcomes: forward, flood, drop.

A VLAN is a separate broadcast domain inside one physical switch. Access ports belong to one VLAN and carry untagged traffic for the connected host. This chapter teaches access-port configuration and verification.

• Create and name VLANs in the VLAN database.
• Assign an access port to a VLAN and verify with show vlan brief.
• Explain the default behaviour of unassigned switch ports.

A trunk port carries traffic for many VLANs over a single cable by tagging each frame with a 4-byte 802.1Q header. This chapter explains the tag format, the native VLAN concept, and the configuration on both sides of a trunk.

• Describe the 802.1Q tag format and the role of the native VLAN.
• Configure a trunk and restrict its allowed VLAN list.
• Diagnose a native-VLAN mismatch.

Three ways to route between VLANs: a separate router interface per VLAN (legacy), a single router-on-a-stick using subinterfaces, and an L3 switch with SVIs (Switched Virtual Interfaces). This chapter walks through the two modern patterns end to end.

• Configure router-on-a-stick with subinterfaces and 802.1Q encapsulation.
• Configure SVIs on an L3 switch and enable ip routing.
• Choose between router-on-a-stick and L3 switch for a given scale.

STP prevents L2 loops by electing a Root Bridge and blocking redundant links. This chapter covers the BPDU exchange, port roles and states, the Bridge ID, and Rapid Spanning-Tree improvements.

• Explain why L2 loops are catastrophic and how STP prevents them.
• Identify the Root Bridge from a set of Bridge IDs.
• Compare STP, PVST+, RPVST+, and MST.
• Use PortFast and BPDU Guard correctly on access ports.

Bundle 2–8 physical links into one logical link for more bandwidth and faster failover. This chapter compares LACP (open-standard) and PAgP (proprietary), and shows the configuration template both sides must agree on.

• Describe the benefits of EtherChannel over independent links.
• Configure an LACP EtherChannel between two switches.
• Identify which interface settings must match on both sides.

802.11 carries the same 48-bit MAC addresses as Ethernet, but in its own frame format over radio — the access point translates between the two. This chapter explains the autonomous vs split-MAC architectures, the SSID/BSSID/ESSID terminology, channel planning, and where the WLAN controller fits.

• Distinguish autonomous AP, lightweight AP + WLC, and cloud-managed AP architectures.
• Explain SSID, BSSID, and ESSID.
• Describe non-overlapping 2.4 GHz channels and the role of 5/6 GHz bands.

In a controller-based wireless network the 802.11 MAC layer is split between the access point and a central controller, and one design choice — where client traffic leaves the tunnel — decides whether an AP's switchport is an access port or a trunk. This chapter covers that split, the CAPWAP control and data tunnels, the jobs an AP's radio can be given, how a controller plugs into the wired network, channel-width planning, and what a wireless network profile decides.

• Split 802.11 responsibilities between a controller-based AP and its controller.
• Describe the CAPWAP control and data tunnels and the ports they use.
• Match a requirement to a radio role: serve clients (centrally or locally switched), monitor the air, capture frames, or carry mesh backhaul.
• Decide whether a given AP needs an access port or an 802.1Q trunk, and say why.
• Describe how a controller attaches to the wired network: a management address, client VLANs on a trunked uplink, an optional out-of-band port, and link aggregation.
• Plan 2.4 GHz channels and 5 GHz channel widths for coverage versus capacity.

Two L2 protocols let neighboring devices announce who they are and what ports they're on. CDP is vendor-proprietary; LLDP is the IEEE standard (802.1AB). This chapter covers both, including configuration, verification, and which is on by default.

• Enable and disable CDP and LLDP globally and per-interface.
• Read 'show cdp/lldp neighbors' output.
• Decide when to disable discovery for security.

DHCP gives every host an IP, mask, gateway, and DNS without anyone touching the keyboard. This chapter walks through the DORA exchange, configures a router as a DHCP server, and explains the ip helper-address relay.

• List the four DHCP messages in order: Discover, Offer, Request, Acknowledge.
• Configure a DHCP pool on a router.
• Explain when ip helper-address is required.

NAT translates private RFC 1918 addresses to a public address so private hosts can reach the Internet. PAT (overload) is the variant that maps many private hosts onto a single public IP via port numbers — the configuration almost every home and small office uses.

• Compare static NAT, dynamic NAT, and PAT.
• Identify the inside/outside interface roles.
• Configure PAT on a router for an entire LAN.

Four supporting services every production network depends on: DNS resolves names to IPs, NTP keeps clocks accurate, SNMP polls device health, and syslog records events centrally for forensics.

• Configure a router with DNS resolvers and an NTP server.
• Describe SNMPv2c vs SNMPv3 differences.
• Set up syslog to a remote collector.

Telnet sends credentials in plain text and has no place on a modern network. SSH replaces it with strong encryption. This chapter walks through generating RSA keys, enabling SSH version 2, and locking down VTY lines.

• Generate an RSA key pair for SSH.
• Configure local username/password and apply to VTY.
• Disable Telnet on VTY lines.

Network engineers move firmware images, configs, and certs constantly. TFTP and FTP are the two foundational transfer protocols. This chapter covers what each is, when to use it, and the exact 'copy' commands.

• Compare TFTP and FTP on ports, transport, auth, and reliability.
• Back up a running-config to a TFTP server.
• Restore a firmware image from FTP.

When a link is congested, Quality of Service decides which packets get the bandwidth and which wait. This chapter introduces the trust boundary, classification with DSCP, and the queueing behaviour you should expect on a router.

• Explain why QoS only matters during congestion.
• Identify common DSCP values: EF, AF41, CS6, default.
• Describe the role of marking, queueing, and policing.

Vocabulary for the security domain — threat, vulnerability, exploit, attack vector — followed by AAA (Authentication, Authorization, Accounting) and how 802.1X enforces port-based authentication on access switches.

• Define threat, vulnerability, exploit, and attack vector.
• Explain AAA's three components and the role of RADIUS and TACACS+.
• Describe 802.1X's three roles: supplicant, authenticator, authentication server.

Every control in this module assumes the attacker has to break something technical. Most intrusions don't bother — they ask a person, or they walk up to the console port. This chapter covers the human and physical half of security: awareness training, physical access control, modern password policy, multi-factor authentication, certificates, and biometrics.

• Explain why users are the dominant attack surface, and describe what a working awareness program contains and measures.
• Justify physical access control as a network security control — starting with why console access defeats every logical control on the device.
• Apply current password-policy guidance: length over composition, blocklist screening, rotation only on evidence of compromise, salted slow-hash storage.
• Distinguish the three authentication factor categories, and place certificate-based authentication and biometrics alongside their failure modes.

Layer 2 attacks (CAM overflow, rogue DHCP, ARP spoofing) bypass everything above. Port Security limits which MACs may appear on a port; DHCP Snooping permits DHCP responses only from trusted ports; Dynamic ARP Inspection rejects forged ARP.

• Configure port security with sticky MAC learning.
• Enable DHCP snooping and mark trusted ports.
• Explain how DAI builds on the snooping binding table.

ACLs filter packets by Layer 3/4 information. Standard ACLs match source IP only and live close to the destination. Extended ACLs match source, destination, protocol, and port — and live close to the source. This chapter walks through both with worked examples.

• Write a numbered standard ACL and apply it to an interface.
• Write a numbered or named extended ACL with protocol/port matches.
• Explain the implicit deny and the importance of order.

A VPN encapsulates and encrypts traffic across an untrusted network. Site-to-site IPsec connects two offices over the Internet. Remote-access VPNs (SSL/IKEv2) connect a single user. This chapter covers the moving parts without drowning in IKE phases.

• Compare site-to-site and remote-access VPN use cases.
• List the four IPsec services: confidentiality, integrity, authentication, anti-replay.
• Describe SSL VPN's advantage over IKEv2 for remote users.

Wireless is broadcast — anyone with a radio can capture your frames. WPA2 has been the workhorse since 2004 but has known weaknesses. WPA3 fixes the worst of them. This chapter compares them and clarifies PSK vs Enterprise.

• Describe the difference between WPA2-Personal and WPA2-Enterprise.
• List the security improvements WPA3 makes over WPA2.
• Recognize when 802.1X is in use.

Manual CLI doesn't scale. Network automation reduces error, accelerates change, and enables consistency at scale. This chapter introduces the why and the high-level patterns: configuration management, intent-based, GitOps.

• Spot the four ways hand-typed changes go wrong at scale — drift, delay, no audit trail, copy-paste mistakes.
• Define configuration management, infrastructure as code, and intent-based networking.
• Recognize the trade-off between flexibility and consistency.

Modern network devices expose REST APIs returning JSON. Configuration as code lives in YAML files. This chapter teaches the bare minimum to read and write both, plus a worked REST GET against a NetForge-like device.

• Read and modify a small JSON document.
• Read a YAML file and understand its mapping/list syntax.
• Identify HTTP verbs and status codes used in REST.

Software-Defined Networking separates the control plane from the data plane and exposes a centralized API. This chapter explains controllers, southbound vs northbound APIs, and intent-based software-defined fabrics.

• Define the control plane and data plane and where SDN moves the control plane.
• Compare northbound and southbound APIs.
• Recognize SDN controllers and software-defined fabrics at a high level.

Each of the major configuration tools has a different philosophy: agentless vs agented, push vs pull, declarative vs imperative. You should be able to recognize each.

• Identify each tool's transport model and language.
• Recognize a small Ansible playbook.

AI and ML are now core to modern network operations. This chapter explains the difference between generative and predictive AI, where each shows up in netops today (assistants, anomaly detection, capacity forecasting, ChatOps), and the limits you need to understand.

• Differentiate generative AI from predictive AI/ML.
• Cite at least three netops use cases for each.
• Recognise the operational and security risks of letting an AI touch production.

Automation is only as good as the data it pushes. This chapter covers where a network's intended state lives (the source of truth), the Git workflow engineers use to change it, the pipeline that reviews, tests, deploys, verifies and rolls back every change, and how drift between the source of truth and the running devices is found and handled.

• Explain what a source of truth is, and why it holds the intended state rather than the configuration running on the devices.
• Use the Git vocabulary of a network change: commit, branch, pull request, review, history and revert.
• Put the stages of a change pipeline in order and say what each one catches: peer review, CI checks, an approved deploy, post-change verification and rollback.
• Explain how a template and its variables render device configuration, so that the data is what gets reviewed.
• Detect configuration drift by comparing rendered intended configuration with running configuration, and choose what to do with each difference.

Scripts that scrape CLI text break whenever the text changes. This chapter shows what replaces it: YANG data models, NETCONF and its candidate datastore, RESTCONF URLs and media types, the same interface written in XML and in JSON, streaming telemetry, and how the CLI, SNMP, NETCONF and RESTCONF compare.

• Explain why scripts that screen-scrape CLI output break, and what a data model fixes.
• Read a small YANG model: module, container, list, key and leaf, and tell configuration data from state data.
• Describe a NETCONF change: SSH on port 830, get, get-config and edit-config, and the candidate and running datastores with lock and commit.
• Build and read a RESTCONF request: the URL that mirrors the YANG path, the HTTP method, and the JSON or XML media types.
• Compare the CLI, SNMP, NETCONF, RESTCONF and streaming telemetry, and choose one for a given job.

Every core CLI command you should be able to type from memory, organized by mode.

• Recall the most-used CLI commands without prompting.
• Recognize each command's mode and purpose.

A practice set of subnetting problems in the format and difficulty of the Final Weighted Exam (network and broadcast addresses, host and subnet counts, VLSM, summaries, wildcards and IPv6), each with the answer and reasoning a beginner can follow. Nothing is timed: time yourself.

• Subnet quickly under time pressure.
• Recognize trick wording around 'usable' vs 'total' addresses.

A capstone topology with two sites, VLANs, OSPF, DHCP, NAT, and SSH. The walkthrough explains the build order, the verification commands at each stage, and the most likely places to get stuck.

• Build a multi-site topology end to end without referring to the cheat sheet.
• Verify reachability layer by layer.
• Save and load the topology as a NetForge-AI JSON file.

The Final Weighted Exam is 105 minutes, 60 questions: single-answer multiple choice, multi-select, and exhibit questions built on simulator output. This chapter is the meta-game: time budget, when to flag, how to read an exhibit, and how to set yourself up beforehand.

• Allocate time across question types correctly.
• Decide when to flag and skip a question.
• Read an exhibit before the options, and answer from the evidence rather than from memory.

One pass through the seven topic areas of the Final Weighted Exam, in course order: the facts to know cold in each area, the one output that decides most of its questions, and the misconceptions that cost the most marks.

• State the key facts of each of the seven topic areas without looking them up.
• Read the decisive output for each area and name the line that answers the question.
• Recognise and correct the most common misconceptions in each area.
• Use the area scores on your results page to decide what to revise next.

A method for exhibit questions, then twelve outputs you will meet on the Final Weighted Exam, each captured from the simulator with the one line that decides it and the classic way it is misread.

• Apply a fixed method to an exhibit question: read the question first, find the one line that decides it, and ignore the rest.
• Name the deciding line in each of the common show outputs, and in a protocol ladder.
• Recognise the classic misreading of each output before it costs a mark.

Thirty new questions from all seven areas, mixed the way the Final Weighted Exam mixes them, about half with an exhibit to read. Do the set in one sitting, then review every miss against the chapter its explanation names.

• Answer 30 mixed questions from all seven topic areas at the exam's pace.
• Read show output, captures and ladders under time pressure.
• Trace every miss back to the chapter that teaches it, and close the gap before the exam.