CEF — FIB, Adjacency & Why Process Switching Died
CEF is the default forwarding engine: no per-packet CPU work. Two precomputed structures: FIB — optimised copy of the RIB, longest-prefix entries, best path per prefix. Adjacency table — the rewritten L2 header per next-hop (MAC + outgoing interface), built from ARP/ND. Flow: RIB → FIB → Adjacency. Both update event-driven on routing or ARP […]
Ansible — Agentless Network Automation
Agentless automation over SSH: a control node connects to managed nodes, runs YAML playbooks, and enforces desired state — idempotent, so re-running a correct playbook changes nothing. Inventory groups hosts ([routers] R1 ansible_host=10.1.1.1); variables cascade inventory → group_vars → host_vars for templating. Network modules (ios_config, ios_command) speak CLI through netconf/ssh connection plugins. Push model, no […]
Ping & Traceroute as Diagnostic Patterns
ping + traceroute answer “which layer is broken?” — read the patterns, don’t guess: Symptom Diagnosis ping gateway fails wrong IP/mask — host can’t even reach the local router gateway ✅ but 8.8.8.8 ❌, traceroute dies at hop 0 missing/wrong default gateway ping 8.8.8.8 ✅, ping google.com ❌ DNS — the network is fine ping […]
SDN — Centralised Control Plane
SDN is an architecture, not a protocol: separate control plane from data plane, put the brain in a controller, program devices over APIs. Southbound: OpenFlow/NETCONF/RESTCONF; northbound: REST for applications. (“SDN = OpenFlow” is the classic false statement — OpenFlow is one implementation.) Devices become flow-table forwarders; the controller computes paths and installs entries. Design prerequisites: […]
IP SLA & Object Tracking — Failover on Health
Routing protocols see up/down and adjacencies — never latency, jitter, loss or a dead application. IP SLA injects synthetic probes (ICMP echo, UDP jitter, TCP connect, HTTP GET, DNS) every 60 s and measures what real traffic would feel. ip sla 1 icmp-echo 10.0.0.1 source-interface Gi0/0 threshold 100 frequency 10 ip sla schedule 1 life […]
NetFlow & Flexible NetFlow
Interface counters say how much; NetFlow says who talks to whom, how, when. Flows are keyed on the classic 7-tuple minus two (src/dst IP, src/dst port, protocol, ToS, interface), counted in a cache and exported to a collector when the flow ends or times out. v5 fixed format; v9 template-based; Flexible NetFlow = build your […]
SPAN, RSPAN & ERSPAN
Switches don’t let you sniff other people’s traffic — SPAN copies frames from source ports/VLANs (rx, tx or both) to a dedicated monitor port feeding Wireshark or an IDS. Original traffic untouched; the monitor port stops switching. RSPAN: mirrors across switches through a dedicated remote-span VLAN — L2 domain only. ERSPAN: GRE-encapsulated, routable across L3 […]
Syslog — Facilities, Severity & Timestamps
Every event is classified facility (which subsystem) + severity 0–7 (emergency → debug; “0 is worst, 7 is chattiest”), shipped to a central server over UDP/514 — or TCP/6514 with TLS when logs matter for compliance. service timestamps log datetime msec localtime show-timezone logging host 192.168.1.50 transport tcp logging trap informational logging source-interface Loopback0 logging […]
SNMP — Polls, Traps & v3 Security Model
Manager ↔ agent over UDP: queries on 161, traps/informs on 162. Devices expose a MIB tree addressed by OIDs; managers poll (GET/GETNEXT/GETBULK) or receive async TRAP (fire-and-forget) / INFORM (acknowledged). Version Security Notes v1 cleartext community legacy v2c still cleartext adds GETBULK, everywhere v3 auth (SHA) + priv (AES) the only correct choice; needs NTP […]
DAI & IP Source Guard — the Binding-Table Duo
Dynamic ARP Inspection validates every ARP packet on untrusted ports against the DHCP snooping binding table — forged “I am the gateway” replies (ARP spoofing / MITM) are dropped. Trusted ports skip validation. ip arp inspection vlan 10,20 interface Gi1/0/24 ip arp inspection trust IP Source Guard closes the other half: on untrusted ports, frames […]