Show Menu

Network Concepts Cheat Sheet (DRAFT) by

Study Material for CCNA Cyber Ops SECFND

This is a draft cheat sheet. It is a work in progress and is not finished yet.

OSI Layers

Applic­ation Layer
Includes all the services of a user applic­ation, including the intera­ction with the end user.
Protocols: FTP, HTTP, SMTP
Devices: Hosts, Servers
Presen­tation Layer
Provides services to the applic­ation layer to deal with specific syntax, which is how data is presented to the end user
Session Layer
Provides services to the presen­tation layer to establish a session and exchange presen­tation layer data
Transport Layer
Includes services for end-to-end connection establ­ishment and inform­ation delivery.
Protocols: TCP, UDP
Devices: Stateful firewalls
Network Layer
Includes the function necessary to transmit inform­ation across a network and provides abstra­ction on the underlying means of connec­tion.
Protocol: IP
Devices: Router
Data Link Layer
Includes protocols and functions to transmit inform­ation over a link between two connected devices.
Protocols: Ethernet, PPP, ATM
Devices: Switches
Physical Layer
Provides services for the transm­ission of bits over the data link.
Protocols: Ethernet, cable, optical
Devices: Repeater


Encaps­ula­tion: Each layer protocol adds its own protocol header and passes the inform­ation to the lower-­layer protocol
Protocol Control Inform­ation (PCI): Is the inform­ation added by the protocol
Protocol Data Unit (PDU): Is composed by the data produced at that layer plus the PCI for that layer
Service Data Unit (SDU): A unit of data that has been passed down from a layer or sublayer to a lower layer

Ethernet Physical Layer

IEEE standard: 802.3 (Ethernet)
Speed: 10 Mbps
Media: Twisted pair (copper)
Maximum Distance: 100 m
IEEE standard: 802.3u (FastE­the­rnet)
Speed: 100 Mbps
Media: Twisted pair (copper)
Maximum Distance: 100 m
IEEE standard: 802.3ab (GigaE­the­rnet)
Speed: 1000 Mbps
Media: Twisted pair (copper)
Maximum Distance: 100 m
IEEE standard: 802.3z (GigaE­the­rnet)
Speed: 1000 Mbps
Media: Long wavelength (singl­e-mode fiber)
Maximum Distance: 5 km
IEEE standard: 802.3an (10 GigaEt­hernet)
Speed: 10 Gbps
Media: Twisted pair (copper)
Maximum Distance: 100 m
Each standard name follows the format sTYPE-M
s: The speed. For example, 1000
TYPE: The modulation type. For example, baseband [BASE]
M: The inform­ation about the medium. Examples include T for twisted pair, F for fiber, L for long wavele­ngth, and X for external sourced coding

Ethernet Medium Access Control

Half duplex
Two Ethernet devices share a common transm­ission medium. The access is controlled by implem­enting Carrier Sense Multiple Access with Collision Detection (CSMA/CD)
Full duplex
Two devices can transmit simult­ane­ously because there is a dedicated channel allocated for the transm­ission. Because of that, there is no need to detect collisions or to wait before transm­itting


Carrier Sense Multiple Access­/Co­llision Detection:
When a collision occurs, it is detected by CSMA/C­D-e­nabled devices, which will then stop transm­itting and will delay the transm­ission for a certain amount of time, called the backoff time. The jam signal is used by the station to signal that a collision occurred. All stations that can sense a collision are said to be in the same collision domain

Ethernet Frame

Length in Bytes: 7
Function: Used for the two stations for synchr­oni­zation purposes
Start Frame Delimeter
Length in Bytes: 1
Function: Indicates the start of the Ethernet frame. This is always set to 10101011
Destin­ation Address
Length in Bytes: 6
Function: Contains the recipient address of the frame
Source Address
Length in Bytes: 6
Function: Contains the source of the frame
Length in Bytes: 2
Function: This field can contain either the length of the MAC Client Data (length interp­ret­ation) or the type code of the Layer 3 protocol transp­orted in the frame payload (type interp­ret­ation)
MAC Client Data and Pad
Length in Bytes: 46-1500
Function: This field contains inform­ation being encaps­ulated at the Ethernet layer. The minimum length is 46 bytes and the maximum length depends on the type of Ethernet frame:
- 1500 bytes for basic frames
- 1504 bytes for Q-tagged frames
- 1982 bytes for envelope frames
Frame Check Sequence
Length in Bytes: 4
Function: This field is used by the receiving device to detect errors in transm­ission

Ethernet Addresses

A broadcast MAC address is obtained by setting all 1s in the MAC address field. This results in an address like FFFF.F­FFF.FFFF. A frame with a broadcast destin­ation address is transm­itted to all devices within a LAN
A frame with a multicast destin­ation MAC address is transm­itted to all frames belonging to the specific group
A unicast address is associated with a particular device's NIC or port. It is composed of two sections. The first 24 bits contain the Organi­zat­ional Unique Identifier (OUI) assigned to an organi­zation. The other portion of the MAC address can be assigned by the vendor itself
To transmit a frame, Ethernet uses source and destin­ation addresses. The Ethernet addresses are called MAC addresses, or Extended Unique Identifier (EUI), and they are either 48 bits or 64 bits. The MAC address is usually expressed in hexade­cimal. The following two ways are the ones used the most:
01-23-­45-­67-­89-ab (IEEE 802 notation)
0123.4­567.89ab (Cisco notation)

LAN Switches

Collision Domain: Two or more stations needing to share the same medium.
LAN Switch: Device that allows multiple stations to connect in full-d­uplex mode. This creates a separate collision domain for each of the ports.

Switch Frame Fowarding

MAC address table
This table holds the link between a MAC address and the physical port of the switch where frames for that MAC address should be forwarded
Dynamic MAC address learning
This mechanism helps populating the MAC address table. When a switch receives an Ethernet frame on a port, it notes the source MAC address and inserts an entry in the MAC address table, marking that MAC address as reachable from that port
Ethernet Broadcast domain
A broadcast domain is formed by all devices connected to the same LAN switches. Broadcast domains are separated by network layer devices such as routers. An Ethernet broadcast domain is sometimes also called a subnet