Network Notes
CEF is the default forwarding engine: no per-packet CPU work. Two precomputed structures: FIB —
Agentless automation over SSH: a control node connects to managed nodes, runs YAML playbooks, and
ping + traceroute answer “which layer is broken?” — read the patterns, don’t guess: Symptom
Fabric thinking: a big L2-ish reach (VXLAN overlay) over a simple routed underlay, with identity
SDN is an architecture, not a protocol: separate control plane from data plane, put the
Routing protocols see up/down and adjacencies — never latency, jitter, loss or a dead application.
SNMP asks repeatedly and learns late. Telemetry inverts it: the device pushes state streams on
Interface counters say how much; NetFlow says who talks to whom, how, when. Flows are
Switches don’t let you sniff other people’s traffic — SPAN copies frames from source ports/VLANs
Every event is classified facility (which subsystem) + severity 0–7 (emergency → debug; “0 is
Manager ↔ agent over UDP: queries on 161, traps/informs on 162. Devices expose a MIB
Dynamic ARP Inspection (DAI) and IP Source Guard are Layer 2 features that validate ARP
DHCP snooping is a Layer 2 security feature that protects against rogue DHCP servers by
Port Security protects switch ports by limiting and controlling which MAC addresses may send traffic
Good ACL design is about correct placement, minimal traffic impact and easy troubleshooting – and
Routing protocol authentication ensures only legitimate routers can exchange routing updates by protecting the protocol’s
CoPP (Control Plane Policing) protects the device’s CPU from DoS and unwanted traffic by rate-limiting
TACACS+ is a Cisco-based AAA protocol that centralizes authentication, authorization and accounting for administrative access
RADIUS is a centralized AAA protocol that authenticates, authorizes and logs users (e.g. 802.1X, VPN,
AAA = Authentication (who are you?), Authorization (what may you do?), Accounting (what did you
Cloud service models (IaaS, PaaS, SaaS) describe how much responsibility the customer vs. the provider
Site-to-site VPN technologies: GRE over IPsec for simple tunnels, DMVPN for dynamic multipoint, FlexVPN for
IPsec is the IETF standard for VPNs: IKE negotiates keys, ESP encrypts the traffic. How
A VPN is an encrypted tunnel over an insecure network (usually the internet) that connects
WAN (Wide Area Network) connects geographically separated networks via service providers using dedicated, packet-switched or
MPLS forwards packets based on labels instead of IP lookups and enables scalable VPN solutions
NAT (Network Address Translation) translates IP addresses (and sometimes ports) between private and public networks.
QoS ensures that delay-sensitive traffic (voice and video) is prioritized correctly under network load. Facts
ICMP is used for error handling and diagnostics in IP networks by sending control and
DNS is a critical network service that translates domain names (e.g. www.cisco.com) into IP addresses.
NTP makes sure every network device has the same precise time so that logs, security
SLAAC: the IPv6 client builds its own address based on Router Advertisements (RA). DHCPv6: a
DHCP is a network service that automatically assigns IP addresses and other IP parameters to
ARP translates IPv4 addresses into MAC addresses so Layer 3 can communicate correctly over Layer
Prefix-lists are a precise and scalable tool to filter routes based on network prefix and
Route summarization/aggregation combines several more specific routes into one summary route: 10.1.1.0/24 10.1.2.0/24 → 10.1.0.0/16
Route redistribution shares routes between different routing protocols – but introduces complexity and potential routing
Switch Virtual Interface (SVI) – inter-VLAN routing A Switch Virtual Interface (SVI) is a logical
VRRP (open standard) and GLBP (Cisco, with load balancing) – the FHRP siblings of HSRP.
HSRP (Hot Standby Router Protocol) creates redundancy between routers by assigning a virtual IP and
FHRP (First Hop Redundancy Protocol) is a family of protocols – HSRP, VRRP and GLBP
VRF (Virtual Routing and Forwarding) lets one router keep several separate routing tables, so traffic
Where basic BGP is about neighbors and exchanging routes, advanced BGP is about scalability and
BGP is a path-vector routing protocol used between autonomous systems to select routes based on
EIGRP uses DUAL (Diffusing Update Algorithm) to select the best path and guarantee fast, loop-free
OSPF area types control which LSAs may exist in an area – to reduce routing-table
OSPF is a link-state IGP that uses cost as its metric and requires Area 0
A static route is manually configured by the administrator. The router does not learn it
Longest Prefix Match → Administrative Distance → Metric → ECMP → FIB (CEF) When a
STP design is about control: who is root, and how traffic flows. Design choice Why
STP failures are most often caused by missing BPDUs or bad links. Problem Solution Missing
UDLD (Unidirectional Link Detection) detects one-way links – when A → B works but B
Loop Guard is an STP security mechanism that protects against Layer 2 loops that can
What is Root Guard? Root Guard prevents a port from becoming a Root Port. Which
What is BPDU Filter? BPDU Filter prevents a port from sending and/or receiving BPDUs. In
What is BPDU Guard? BPDU Guard shuts a port down when a BPDU is received.
What is PortFast? PortFast makes a port go straight to forwarding. Which problem does it
IGMP snooping is a Layer 2 switch feature that listens to IGMP messages so that
Layer 2 multicast is about how switches forward multicast frames based on MAC addresses, and
A switch learns MAC addresses from the source MAC of incoming frames and uses the
Point Trunk Purpose Multiple VLANs over one link Standard 802.1Q Frames Tagged Native VLAN Untagged
A VLAN creates separate Layer 2 broadcast domains on the same physical switch. Devices in
BPDU (Bridge Protocol Data Unit) is STP’s control packet, used to elect the root bridge,
Different STP flavors solve the same problem – loop prevention – with different trade-offs in
Spanning Tree Protocol prevents Layer 2 loops by electing one active path and blocking redundant
EtherChannel is Cisco’s implementation of Link Aggregation (LAG), bundling multiple physical links into one logical
IPv6 address formats define the purpose and scope of an address – routing, local communication,
IPv6 is the next generation of IP, designed to replace IPv4 because IPv4 ran out
VLSM lets you use different subnet masks inside the same network, so IP space is
Special IPv4 addresses are reserved for specific purposes and cannot be used as normal host
IPv4 addressing gives every device a unique 32-bit address so packets can be identified and
The Cisco TCP/IP model has 5 layers – the Network Access layer is split into
OSI model – functions, scope and examples Layer Name Primary function Scope Typical protocols Data
The Ethernet II frame (with the physical-layer preamble/SFD) is built as follows: PREAMBLE START FRAME
The IPv6 header is a fixed 40-byte Layer 3 header designed for faster routing, better
The IPv4 header is a variable Layer 3 header (RFC 791, 20–60 bytes) containing everything
Encapsulation is the process where data is wrapped layer by layer with headers (and sometimes
Collision domain: where frames can collide (only relevant for half-duplex). Broadcast domain: where broadcasts (ff:ff:ff:ff:ff:ff)
The admin path is one jump host; this is the firewall layer that makes that
Every laptop that holds cluster credentials is a door left unlocked. After a podman toolbox
The other half of my container setup is the .vimrc. Two spaces is the standard
I use my k8s-admin container (ubuntu with kubectl, flux, helm and kustomize) for all kubernetes
Lorem ipsum dolor sit amet, consectet adipiscing elit,sed do eiusm por incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea sint occaecat cupidatat non proident, sunt in culpa qui officia mollit natoque consequat massa quis.
Donec pede justo, fringilla vitae, eleifend acer sem neque sed Lorem Lorem ipsum dolor sit amet, consectet adipiscing elit,sed do eiusm por incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ipsum. Nam quam nunc, blandit vel, ridiculus mus. Donec quam felis, ultricies nec, pellentesque eu, pretium consectetuer luculvinar, ids lorem. Maecenas nec odio et ante tincidunt tempus.
Lorem ipsum dolor sit amet, consectet adipiscing elit,sed do eiusm por incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea sint occaecat cupidatat non proident, sunt in culpa qui officia mollit natoque consequat massa quis enim.
Give options to click
