Network Notes
CEF is the default forwarding engine: no per-packet CPU work. Two precomputed structures: FIB —
Agentless automation over SSH: a control node connects to managed nodes, runs YAML playbooks, and
ping + traceroute answer “which layer is broken?” — read the patterns, don’t guess: Symptom
Fabric thinking: a big L2-ish reach (VXLAN overlay) over a simple routed underlay, with identity
SDN is an architecture, not a protocol: separate control plane from data plane, put the
Routing protocols see up/down and adjacencies — never latency, jitter, loss or a dead application.
SNMP asks repeatedly and learns late. Telemetry inverts it: the device pushes state streams on
Interface counters say how much; NetFlow says who talks to whom, how, when. Flows are
Switches don’t let you sniff other people’s traffic — SPAN copies frames from source ports/VLANs
Every event is classified facility (which subsystem) + severity 0–7 (emergency → debug; “0 is
Manager ↔ agent over UDP: queries on 161, traps/informs on 162. Devices expose a MIB
Dynamic ARP Inspection validates every ARP packet on untrusted ports against the DHCP snooping binding
The switch becomes an active DHCP referee: untrusted ports (all by default) may send Discover/Request;
Per access port: learn/limit MACs, act on violations. Default violation mode is shutdown (err-disable); protect
Design law: extended near the source, standard near the destination — stop unwanted traffic before
If routing updates are unauthenticated, anyone on-path can inject a better route. Per-interface (IGP) or
Packets destined to the router (OSPF, BGP, SSH, SNMP, ARP, ICMP-to-interface) get punted to the
Cisco’s device-administration AAA protocol: TCP 49, entire payload encrypted, and the three A’s are separate
Centralised AAA over UDP: authentication 1812, accounting 1813 (legacy 1645/1646). Only the password field is
AAA = who are you (Authentication), what may you do (Authorization), what did you do
The service models are just a sliding scale of who patches what: Model Provider runs
Three generations of Cisco multipoint VPN, all built from the same bricks (mGRE + IPsec
Layer 3 crypto suite: ESP (protocol 50) encrypts+authenticates — AH (51, auth only) is legacy;
Site-to-site: router↔router, permanent tunnel between offices. Remote access: client↔gateway, often SSL/TLS. GRE over IPsec when
Topologies: point-to-point (simple, costly), hub-and-spoke (cheap, hub = SPOF), full/partial mesh. Legacy still in syllabus
MPLS sits between L2 and L3 (“2.5”): forward by label, not longest-prefix. Ingress PE pushes,
NAT translates between inside-local (private), inside-global (public), outside-local and outside-global. Four flavours: Type Mapping Inbound
Best-effort default means voice competes with backups. QoS is the pipeline: classify → mark →
ICMP is Layer 3 error and diagnostic messaging — not TCP/UDP, and not a transport
Name → IP via a hierarchical distributed database. Client asks recursively; the resolver iterates: root
UDP 123, hierarchical strata (0 = reference clock, 1 = attached server, … max 15).
SLAAC Stateless DHCPv6 Stateful DHCPv6 Address from client itself client (RA prefix) server DNS no
UDP 67 (server) / 68 (client). IPv4 clients start with a broadcast DORA: Discover →
ARP maps IPv4 → MAC inside one broadcast domain: request is a broadcast “who has
Route filtering needs to match both address and mask length — ACLs don’t. Prefix-lists do:
Collapsing many specific routes into one supernet. Same math, two exam words: summarization inside an
Redistribution feeds routes learned by one protocol into another at a router running both. Two
Two ways to route between VLANs. SVI on a Layer 3 switch ip routing interface
VRRP — the open one RFC 5798, IP protocol 112, multicast 224.0.0.18, virtual MAC 0000.5e00.01XX,
Cisco’s classic FHRP: one virtual IP + virtual MAC 0000.0c07.acXX, one Active + one Standby
First-Hop Redundancy Protocols hand hosts one virtual gateway (VIP + virtual MAC) backed by several
VRF gives one router multiple independent routing contexts — separate RIB, separate CEF table, separate
Advanced BGP is three things: scale, protect, control. Scaling iBGP — Route Reflectors iBGP split
Path-vector protocol between autonomous systems, over TCP 179, AD 20 (eBGP) / 200 (iBGP). No
Advanced distance vector with DUAL: per-destination, loop-free by math, near-instant failover when a backup already
Area types control which LSAs are allowed, to shrink tables and speed convergence. All routers
Link-state IGP, metric = cost, Dijkstra (SPF), protocol 89, AD 110, multicast 224.0.0.5 / 224.0.0.6
Manual routes with ip route <net> <mask> <next-hop|interface> — four flavours worth knowing: Default route
How a Cisco router picks one best path — one fixed chain: Longest Prefix Match
STP design is control: who is root and where traffic flows. Choice Why Explicit root
Most STP problems reduce to missing BPDUs or bad links. Symptom Likely cause / tool
UDLD detects unidirectional links — classic on fiber where TX works, RX is dead: the
Loop Guard handles the subtle failure: a blocked port stops receiving BPDUs (upstream STP process
Root Guard blocks a port from ever becoming the root port: if a superior BPDU
BPDU Filter hides STP on a port — it solves no loop problem and can
BPDU Guard: receive a BPDU on a (Port)Fast port → error-disable it. “No switches here.”
PortFast skips Listening+Learning: the port goes straight to forwarding — for access ports facing end
IGMP Snooping is a Layer 2 feature: the switch listens to IGMP Join/Leave traffic and
Switches only know MACs, never IPs — so multicast frames without help flood like broadcast.
A switch builds its MAC (CAM) table by learning the source MAC of every incoming
802.1Q trunks carry multiple VLANs on one link by tagging each frame (12-bit VID); frames
A VLAN is a separate Layer 2 broadcast domain on shared switches. Hosts in the
The BPDU is STP’s control packet: root election, path cost and port roles all flow
Six flavours, three axes: standard vs Cisco, one instance vs per-VLAN, slow vs rapid. Flavour
STP prevents Layer 2 loops (broadcast storms, MAC flapping) by electing one active path and
EtherChannel bundles multiple physical links into one logical Port-Channel: more bandwidth, redundancy — and one
Address formats at a glance Type Prefix Scope Use Global Unicast 2000::/3 Global The routable
IPv6 is the next generation of IP, designed to replace IPv4 because IPv4 ran out
VLSM makes it possible to use different subnet masks within the same network so IP
Network & broadcast address Network address: all host bits = 0 Broadcast address: all host
IPv4 addressing gives every device a unique 32-bit address so packets can be identified and
The Cisco TCP/IP model has 5 layers, where Network Access is split into Data Link
The OSI model – functions, scope and examples Layer Name Primary function Communication scope Typical
The Ethernet II frame consists of seven fields: Preamble Start Frame Delimiter Destination MAC Source
The IPv6 header is a fixed 40-byte Layer 3 header designed for faster routing, better
The IPv4 header is a variable Layer 3 header (RFC 791, 20–60 bytes) containing everything
Encapsulation is the process where data is wrapped layer by layer with headers (and sometimes
Collision domain: where frames can collide (only relevant for half-duplex). Broadcast domain: where broadcasts (ff:ff:ff:ff:ff:ff)
The admin path is one jump host; this is the firewall layer that makes that
Every laptop that holds cluster credentials is a door left unlocked. After a podman toolbox
The other half of my container setup is the .vimrc. Two spaces is the standard
I use my k8s-admin container (ubuntu with kubectl, flux, helm and kustomize) for all kubernetes
Lorem ipsum dolor sit amet, consectet adipiscing elit,sed do eiusm por incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea sint occaecat cupidatat non proident, sunt in culpa qui officia mollit natoque consequat massa quis.
Donec pede justo, fringilla vitae, eleifend acer sem neque sed Lorem Lorem ipsum dolor sit amet, consectet adipiscing elit,sed do eiusm por incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ipsum. Nam quam nunc, blandit vel, ridiculus mus. Donec quam felis, ultricies nec, pellentesque eu, pretium consectetuer luculvinar, ids lorem. Maecenas nec odio et ante tincidunt tempus.
Lorem ipsum dolor sit amet, consectet adipiscing elit,sed do eiusm por incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea sint occaecat cupidatat non proident, sunt in culpa qui officia mollit natoque consequat massa quis enim.
Give options to click
