Networking Cheat Sheet

OSI              PDU        TCP/IP
7 Application    data       Application
6 Presentation
5 Session
4 Transport      segment    Transport
3 Network        packet     Internet
2 Data Link      frame      Link
1 Physical       bits

# top down, each layer adds a header
data → segment (TCP/UDP)
     → packet  (IP)
     → frame   (Ethernet)
     → bits
# a hop strips what it must, then rebuilds

# bandwidth   capacity, bits/sec
# throughput  what you actually get
# latency     one-way delay
# RTT         there and back
# jitter      delay that keeps changing

# one hex digit = 4 bits (a nibble)
# 0xFB = 11111011 = 251
# octet = 8 bits = 0–255
192.168.1.10
= 11000000 10101000 00000001 00001010

# MAC  48 bits, layer 2, this link
#      3c:22:fb:a0:14:09
# IPv4 32 bits, layer 3, end to end
# a switch forwards on MAC
# a router forwards on IP

10.0.0.0/8          RFC 1918
172.16.0.0/12
192.168.0.0/16
127.0.0.0/8        loopback
169.254.0.0/16     link-local

ip addr     # addresses and masks
ip route    # the routing table
# default via 192.168.1.1 dev eth0

192.168.1.0/24
mask       255.255.255.0
network    192.168.1.0
first host 192.168.1.1
last host  192.168.1.254
broadcast  192.168.1.255

# usable = 2^(32 - prefix) - 2
# /24 → 254    /26 → 62    /30 → 2
# /32 is one host route
# /31 point-to-point uses both
# addresses (no broadcast)

# block = 2^(32-26) = 64
192.168.1.0/26     .0   – .63
192.168.1.64/26    .64  – .127
192.168.1.128/26   .128 – .191
192.168.1.192/26   .192 – .255

# FLSM: every subnet the same length
# VLSM: mix lengths in one network
# /26 for a LAN, /30 for a link,
# /28 for a small lab
# subnets must not overlap

# 8 groups of 16 bits
2001:db8:0:0:0:0:0:1 → 2001:db8::1
# one :: only; drop leading zeros
::1            loopback
fe80::/10      link-local
2000::/3       global unicast

# unicast    one interface
# multicast  a group (ff00::/8)
# anycast    nearest of a shared address
# no broadcast
# a LAN prefix is usually a /64

# router advertisement gives the prefix
# EUI-64: split the MAC, insert ff:fe,
#   flip the universal/local bit
# Neighbor Solicitation replaces ARP

# dst MAC | src MAC | type | payload | FCS
# 0x0800 IPv4   0x0806 ARP
# 0x86DD IPv6
# switch learns source MAC → port
# that table is the CAM table

# who has 192.168.1.1?
#   tell 192.168.1.10
# reply: the MAC, then it is cached
# same subnet → frame to the host MAC
# other subnet → frame to the gateway

# tag after the source MAC
# TPID 0x8100 | PCP | VLAN id (12 bits)
# access port: one VLAN, untagged
# trunk: many VLANs, tagged
# VLAN id 1–4094

# open
client → SYN
server → SYN-ACK
client → ACK
# close: FIN/ACK each way
# RST aborts; no polite close

# src port, dst port
# sequence, acknowledgment
# flags: SYN ACK FIN RST
# window: how much the receiver allows
# cwnd: sender slows after loss

# src, dst, length, checksum — then data
# no handshake, no retry, no order
# DNS, voice, games
# HTTP/3 (QUIC) rides on UDP

# 22 SSH   53 DNS
# 80 HTTP  443 HTTPS
# client port: ephemeral, often high
# socket = src IP+port, dst IP+port,
#   and TCP or UDP

10.1.0.0/16   via A
10.1.8.0/24   via B   # more specific wins
0.0.0.0/0     via gw  # default
# TTL drops by 1 each hop
# TTL 0 → ICMP Time Exceeded

# static: you type the next hop
# OSPF: link-state, inside one AS
# BGP: path vector, between ASes
# a route is prefix + next hop + out iface

# same subnet? send to that host MAC
# else send to the gateway MAC
# the IP addresses do not change
# the MACs are rewritten each hop

# stub → recursive resolver
#   → root → TLD → authoritative
# the answer is cached until TTL
# the resolver does the walking

A       name → IPv4
AAAA    name → IPv6
CNAME   alias → canonical name
MX      where mail goes
NS      who is authoritative
TXT     SPF and other text

dig example.com A +short
dig example.com AAAA
dig example.com MX
dig example.com NS

GET /learn/networking HTTP/1.1
Host: example.com

# GET    safe and idempotent
# PUT    idempotent
# POST   neither
# DELETE idempotent

# 1xx informational
# 2xx  200 OK   201 Created
# 3xx  301  302  304 Not Modified
# 4xx  400  401  403  404
# 5xx  500  502  503

Content-Type: application/json
Authorization: Bearer …
Cache-Control, Set-Cookie
# HTTP/2: many streams, one connection
# HTTPS is HTTP on port 443

# ClientHello
# ServerHello + certificate
# client checks the chain to a trusted CA
# then application data is encrypted
# TLS 1.3 folds this into fewer flights

# many private hosts, one public IP
# table: private IP:port
#    ↔  public IP:port
# outbound creates the row
# inbound needs a mapping you made

# Discover  client broadcast
# Offer     a server proposes an address
# Request   client accepts it
# Ack       lease starts
# renew before the lease ends

# ICMP echo request / echo reply = ping
ping -c 3 192.168.1.1
# traceroute sends TTL 1, then 2, then 3
# each hop answers Time Exceeded