# Computer Networks: Protocols, Routing and Security > Computer-networking notes spanning physical transmission and application protocols through routing, security, data-center and cloud networking, and network automation. - Author: Muhammet Ali Köker - Language: en - Canonical: https://alikoker.com.tr/en/computer-networks-protocols-routing-security - Translation: https://alikoker.com.tr/bilgisayar-aglari-protokoller-yonlendirme-guvenlik - Published: 2013-11-17T17:30:00+03:00 - Modified: 2026-08-09T12:10:00+03:00 - Type: article I wrote the first version of these notes in 2013 for the Computer Networks course during my [Computer Engineering studies at Kırıkkale University](/en/kirikkale-university-computer-engineering). The original material centered on the OSI and TCP/IP models, Ethernet, IPv4, subnetting, switching, routing and basic network services. In the later technical revision I kept that course sequence while adding topics that matured afterwards, including IPv6, QUIC and HTTP/3, current Ethernet and Wi-Fi standards, network security, VPNs, SD-WAN, Segment Routing, EVPN/VXLAN, cloud networking and model-driven automation. Standards and RFC material dated 2024-2026 therefore belongs to the later revision, not to the original 2013 notes. ## Unit 1: The Fundamental Network Model ### What is a network? A computer network is a communication system in which end systems exchange data according to common rules. A network is not formed by a cable or wireless link alone; addressing, protocols, transmission media and intermediate devices must work together. The components can be considered in three groups: - **End systems:** computers, servers, phones, cameras, sensors, virtual machines and container workloads. - **Intermediate devices:** switches, routers, access points, firewalls and load balancers. - **Transmission media:** copper, fiber and radio. In modern networks, a physical device and a network function are not necessarily the same thing. Routing, firewalling or load balancing may run on dedicated hardware, a virtual machine, container infrastructure or a cloud service. ### Network performance Link speed alone does not describe network quality. Important measures include: - **Bandwidth:** the theoretical carrying capacity of a link. - **Throughput:** the transfer rate actually obtained by an application. - **Goodput:** useful application-data rate after protocol overhead and retransmissions are removed. - **Latency:** end-to-end delivery time. - **Jitter:** variation in latency over time. - **Loss:** the proportion of packets that are not delivered. - **Availability:** the proportion of time a service remains usable. Total delay can be separated approximately as: ```text total delay = transmission + propagation + processing + queuing ``` Increasing bandwidth can reduce transmission time, but it does not remove propagation delay. Physical distance continues to matter on long intercontinental paths. Different traffic types give different weights to these measures. Backup traffic is often dominated by total transfer time; interactive applications are sensitive to latency; voice and live video depend jointly on latency, jitter and loss. ### Topology **Physical topology** is the real arrangement of devices and links. **Logical topology** describes the virtual or routed paths used by traffic. Classical physical arrangements include: - **Bus:** a shared medium, historically important for Ethernet. - **Ring:** nodes form a closed loop. - **Star:** endpoints connect to a central switch; this is the normal pattern in current access networks. - **Mesh:** multiple alternative paths exist among nodes. A full mesh requires: ```text n(n - 1) / 2 ``` links, so cost grows quickly with the number of nodes. Enterprise campuses often use access, distribution and core layers. Data centers commonly use a **leaf-spine** fabric in which each leaf connects to each spine, producing a more predictable path length for east-west server traffic. ### Layered communication A layered model divides complex communication into smaller responsibilities. If the interface is preserved, the implementation of one layer can change without forcing all other layers to be redesigned. The OSI model is a seven-layer reference: | Layer | Responsibility | | --- | --- | | 7 Application | Network service to applications | | 6 Presentation | Encoding, representation, encryption | | 5 Session | Session life cycle | | 4 Transport | End-to-end communication and ports | | 3 Network | IP addressing and routing | | 2 Data link | Local delivery and framing | | 1 Physical | Carrying bits over the medium | Internet systems are usually explained with the TCP/IP model: ```text Application HTTP, DNS, DHCP, SSH, SMTP Transport TCP, UDP, QUIC over UDP Internet IPv4, IPv6, ICMP, ICMPv6 Access Ethernet, Wi-Fi, PPP ``` QUIC shows that layer boundaries are not absolute. It runs over UDP but implements reliability, flow control and congestion control itself. ### Encapsulation At the sender, each layer adds its own control information as data moves downward: ```text application data | TCP segment / UDP datagram | IP packet | Ethernet or Wi-Fi frame | bits / symbols ``` The receiver performs the reverse process. On an ordinary routed path, the destination IP address identifies the final Layer 3 endpoint, while the destination Ethernet MAC address identifies only the next Layer 2 delivery point. Each router creates a new data-link frame. NAT, tunneling and some gateways are explicit exceptions to the simplest end-to-end model. ### LAN and WAN A **LAN** covers a limited area and is usually operated within one administrative domain. A **WAN** joins geographically separate networks through carrier infrastructure. PANs, campus networks and metropolitan networks are useful intermediate classifications. In cloud and data-center design, administrative boundaries and latency budgets often matter more than physical-area labels. ## Unit 2: Physical Transmission and Ethernet ### Copper Twisted-pair cabling reduces electromagnetic interference and crosstalk by twisting conductors together. UTP does not use shielding; shielded variants can be useful in electrically noisy environments. Shielding is effective only when grounding is designed correctly. Common categories include: ```text Cat5e 1 Gbit/s 100 m Cat6 1 Gbit/s 100 m Cat6A 10 Gbit/s 100 m Cat8 25/40 Gbit/s short data-center links ``` Cat6 can carry 10GBASE-T over shorter distances. Total channel length, connection points and patch leads must be considered together. T568A and T568B serve the same electrical purpose with different color orders. Consistent termination throughout an installation matters more than choosing one scheme over the other. Older Ethernet installations required crossover cables for some like-device connections. Auto MDI/MDIX has largely removed this distinction. ### Fiber Optical fiber carries light rather than electrical current and is not affected by electromagnetic interference. **Single-mode fiber** is used for long-distance and backbone links. **Multimode fiber** is common for shorter building and data-center links. Common connector and transceiver families include: ```text LC, SC, MPO/MTP SFP, SFP+, SFP28 QSFP+, QSFP28 QSFP-DD, OSFP ``` A transceiver is not selected by speed alone. Wavelength, fiber type, reach, connector, FEC requirements and compatibility at both ends must also be checked. ### Ethernet speeds Ethernet preserves the same broad MAC-frame model across different physical layers: ```text 100BASE-TX 100 Mbit/s 1000BASE-T 1 Gbit/s 10GBASE-T 10 Gbit/s 25G / 40G data center 100G / 400G fabric and backbone 800G high-speed fabric ``` IEEE 802.3df-2024 defines additional physical-layer and management parameters for 400 and 800 Gbit/s Ethernet. As of August 2026, 1.6 Tbit/s Ethernet remains work in progress under IEEE P802.3dj and should not be treated as a completed standard. At high speeds, nominal bandwidth is only one design parameter. SerDes rate, FEC latency, optical power budget, cable reach, switch radix and total fabric capacity all matter. IEEE 802.3dg, approved in 2026, moves in a different direction: it defines 100 Mbit/s Ethernet over a single balanced copper pair with optional power delivery. Single Pair Ethernet is aimed especially at industrial automation, building systems and long-reach sensor or actuator connections. Its significance is not peak speed but extending the Ethernet ecosystem to field devices with fewer conductors. ### Power over Ethernet Power over Ethernet carries electrical power over the data cabling. It reduces the need for separate power wiring for access points, IP phones, cameras and IoT devices. Approximate source power classes are: ```text 802.3af 15.4 W 802.3at 30 W 802.3bt T3 60 W 802.3bt T4 90 W ``` The power available at the powered device is lower because of cable losses. Switch sizing must account for the **total PoE budget**, not only the per-port maximum. ### Ethernet frame A basic Ethernet frame contains: ```text Preamble + SFD 8 bytes Destination MAC 6 bytes Source MAC 6 bytes Type/Length 2 bytes Payload 46-1500 bytes FCS 4 bytes ``` The FCS uses a CRC to detect transmission errors; it does not correct them. Corrupted frames are discarded. The common IP MTU on standard Ethernet is 1500 bytes. There is no single IEEE size for a "jumbo frame"; values near 9000 bytes are common implementation conventions. If an IPv4 packet exceeds the outgoing MTU, fragmentation is possible only when protocol and DF conditions allow it. IPv6 routers do not fragment packets in transit; the source adapts to Path MTU Discovery information. Tunnels add headers and reduce the effective payload MTU. With GRE, IPsec, VXLAN or other encapsulations, successful small pings do not prove that the path carries full-size traffic correctly. ### MAC address A conventional Ethernet MAC address is 48 bits: ```text 00:1A:2B:3C:4D:5E ``` The leading bits encode unicast/multicast and universal/local administration. In vendor-assigned addresses, the OUI identifies the assigning organization. For a destination on the same LAN, the frame is sent to the target host's MAC address. For a destination on another network, the frame is sent to the default gateway's MAC address. In short: ```text IP destination = final Layer 3 target MAC destination = target on the current Layer 2 hop ``` ### Unicast, multicast and broadcast **Unicast** targets one receiver, **multicast** a group, and **broadcast** all stations in the same Layer 2 broadcast domain. The Ethernet broadcast address is: ```text FF:FF:FF:FF:FF:FF ``` IPv6 does not use broadcast; equivalent functions are implemented with defined multicast groups. ## Unit 3: Switching and the Local Network ### How does a switch learn? A switch learns its MAC table by associating the **source MAC address** of an incoming frame with the ingress port. For the destination MAC: - if it is known, the frame is forwarded only toward the corresponding port; - if it is unknown, the frame is flooded to the other appropriate ports in the same VLAN; - if it is broadcast, it is distributed through the VLAN broadcast domain. The MAC table is a dynamic cache. Entries age out, and a new source frame updates the table when a host moves. ### Store-and-forward and cut-through **Store-and-forward** switching receives the entire frame and checks the FCS before forwarding. It is common in enterprise Ethernet. **Cut-through** switching can begin forwarding as soon as the destination MAC has been read. It reduces latency, but the FCS at the end of the frame is not yet known, so a corrupt frame can be propagated. It is used in selected very-low-latency fabrics. ### Duplex Full-duplex Ethernet allows both ends to transmit and receive simultaneously. There is no collision domain and CSMA/CD is not used. Hubs and half duplex are not the normal operating model of current enterprise Ethernet. Autonegotiation should normally be enabled at both ends. If speed or duplex is configured manually, both ends must be changed consistently. A duplex mismatch may produce poor throughput, FCS errors and late-collision-like symptoms rather than a complete link failure. ### VLAN A VLAN creates a separate Layer 2 broadcast domain on shared physical switching infrastructure. ```text VLAN 10 -> users VLAN 20 -> voice VLAN 30 -> servers ``` A VLAN and an IP subnet are not the same concept. One belongs to Layer 2 and the other to Layer 3, although enterprise designs commonly map one VLAN to one IP subnet. An access port normally carries one VLAN. A trunk carries multiple VLANs. ### 802.1Q An 802.1Q tag adds VLAN information to an Ethernet frame. The VLAN identifier field is 12 bits, leaving approximately 4094 usable ordinary VLAN IDs. The tag also carries priority and drop-eligibility information. The PCP bits, historically associated with 802.1p terminology, can be used for Layer 2 QoS marking. With a native VLAN, selected traffic may travel untagged on a trunk. A native-VLAN mismatch can cause incorrect VLAN delivery and security problems. Production trunks are safer when explicitly configured, limited to the necessary VLANs and protected from unnecessary automatic trunk negotiation. ### Inter-VLAN routing Communication between different VLANs requires Layer 3 routing. Classical methods include: - separate physical router interfaces; - router-on-a-stick; - switched virtual interfaces on a Layer 3 switch. Router-on-a-stick uses multiple subinterfaces over one trunk: ```text interface g0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 ``` For larger LANs, Layer 3 switches and SVIs scale better because routing can be performed in switching hardware at rates close to line speed. ### Layer 2 loops Ethernet frames have no general lifetime field equivalent to the IP TTL. If redundant Layer 2 paths form an uncontrolled loop, broadcast storms, MAC-table instability and frame multiplication can result. Spanning Tree exists to block redundant paths that would create such loops. ### STP and RSTP The basic process is: 1. elect a root bridge; 2. determine each switch's best path to the root; 3. assign port roles; 4. keep loop-forming paths out of forwarding state. Classical STP converges slowly. Rapid Spanning Tree reduces convergence time and is more appropriate for current designs. PVST+, Rapid PVST+ and MST are vendor-specific or multiple-tree approaches suited to different VLAN scales. The 802.1D, 802.1w and 802.1s designations remain historically useful, but many current bridging and VLAN specifications are consolidated in the IEEE 802.1Q family. Important protections include: - **PortFast/edge:** moves a host-facing port quickly to forwarding. - **BPDU Guard:** protects an edge port when an unexpected BPDU appears. - **Root Guard:** prevents an unwanted superior BPDU from changing the root. - **Loop Guard:** reduces the risk of a blocked port opening incorrectly after failures such as a unidirectional link. ### Link aggregation Several physical links can operate as one logical link. The current standard is **IEEE 802.1AX**; older documentation often calls the mechanism 802.3ad. LACP provides dynamic member selection and aggregation. Cisco PAgP is vendor-specific. Member links should agree in properties such as: - speed and duplex; - access/trunk mode; - native VLAN; - allowed VLANs. Load distribution usually uses a flow hash. Four 10G members therefore do not guarantee 40 Gbit/s to one TCP flow; aggregate capacity emerges across many flows. ### First-hop redundancy A host that depends on one default gateway has an availability problem. First-hop redundancy protocols present multiple routers behind one virtual gateway. - HSRP is Cisco-specific. - VRRP is an open standard; the current core specification is RFC 9568. - GLBP is Cisco-specific and also supports load sharing. Redundancy should not track only whether the inside interface is up. If uplink or route state is ignored, a gateway may remain active while upstream connectivity has failed. ### 802.1X and MACsec Port security cannot be reduced to limiting the number of MAC addresses. IEEE 802.1X authenticates an endpoint or user through EAP/EAPOL before network access is granted. A typical enterprise model is: ```text Supplicant -> Switch/AP -> RADIUS ``` The switch or AP acts as the authenticator and the AAA service provides the authentication backend. IEEE 802.1AE **MACsec** provides confidentiality, integrity and source authentication on an Ethernet link. It is used especially on data-center, campus-backbone and carrier-Ethernet links that require Layer 2 protection. ## Unit 4: IPv4 and Subnet Design ### IPv4 An IPv4 address is 32 bits: ```text 192.168.10.25/24 ``` The prefix length separates network and host portions. `/24` corresponds to: ```text 255.255.255.0 ``` Classful A/B/C addressing has been replaced by CIDR. The historical classes may still appear in teaching material, but current routing and address planning use prefix lengths. ### Network address The network address is obtained by applying the mask to the IP address with a bitwise AND: ```text IP 192.168.10.25 Mask 255.255.255.0 Network 192.168.10.0 ``` If a host determines that the destination belongs to its own prefix, it performs direct Layer 2 resolution. Otherwise it sends the packet to its default gateway. ### Private and reserved blocks ```text 10.0.0.0/8 RFC 1918 private 172.16.0.0/12 RFC 1918 private 192.168.0.0/16 RFC 1918 private 127.0.0.0/8 loopback 169.254.0.0/16 link-local 100.64.0.0/10 shared address space / CGNAT 224.0.0.0/4 multicast ``` `100.64.0.0/10` is not RFC 1918 private space. It is shared address space reserved for carrier-grade NAT. ### Subnetting If `h` bits are available for hosts, the total number of addresses is: ```text 2^h ``` In a conventional unicast subnet, network and broadcast addresses are not assigned to hosts, giving: ```text usable hosts = 2^h - 2 ``` Important exceptions are: - `/31`: both IPv4 addresses can be used on a point-to-point link; - `/32`: one host route or loopback address. Example: ```text 192.168.1.0/26 Mask: 255.255.255.192 Block: 64 Network 192.168.1.0 First host 192.168.1.1 Last host 192.168.1.62 Broadcast 192.168.1.63 ``` A practical shortcut for the relevant octet is: ```text block = 256 - mask_value ``` ### VLSM and summarization VLSM assigns different prefix lengths to subnets with different host requirements, reducing address waste. Planning normally starts with the largest host requirement. Route summarization works in the opposite direction by combining contiguous prefixes under a shorter prefix. It reduces routing-table size, but an overly broad summary can create a black hole. ### ARP ARP resolves a known IPv4 address to a MAC address in the same Layer 2 domain. ```text ARP Request -> broadcast ARP Reply -> usually unicast ``` A host does not resolve the MAC address of a remote IP destination. It resolves the MAC address of the default gateway. Gratuitous ARP can announce address ownership, detect conflicts or refresh neighbor tables after failover. The same trust model enables ARP-spoofing attacks. IPv6 does not use ARP; equivalent functions belong to Neighbor Discovery. ### NAT and PAT NAT rewrites addresses. PAT allows many internal flows to share a smaller number of public IPv4 addresses by translating both address and port. A typical PAT mapping is: ```text 192.168.1.10:53124 | 203.0.113.10:41001 ``` NAT is not a firewall. Making unsolicited inbound connections more difficult is a side effect, not a replacement for security policy. NAT also breaks simple end-to-end address transparency and forces some protocols to use additional gateway logic. It remains important because of IPv4 address scarcity. ## Unit 5: IPv6 ### Address structure IPv6 uses 128-bit addresses. Eight 16-bit hextets are written in hexadecimal: ```text 2001:0db8:0000:0000:0211:22ff:fe33:4455 ``` Leading zeros can be omitted: ```text 2001:db8:0:0:211:22ff:fe33:4455 ``` One contiguous run of zero hextets may be compressed with `::` once in an address: ```text 2001:db8::211:22ff:fe33:4455 ``` ### Address types ```text 2000::/3 global unicast fc00::/7 unique local fe80::/10 link-local ff00::/8 multicast ::1/128 loopback ::/128 unspecified ``` IPv6 has no broadcast. **Anycast** is not a separate address format. The same unicast address is announced from multiple nodes and routing leads traffic to an appropriate instance. A `/64` is the normal and architecturally important LAN prefix length. IPv6 address planning should not simply copy the IPv4 habit of creating tiny prefixes for every few hosts. ### Link-local addresses An IPv6-enabled interface uses a link-local address for communication on its local link. Neighbor Discovery, Router Advertisement and many routing protocols rely on these addresses. Link-local addresses are not routed. Because the same value can exist on more than one interface, an outgoing interface may need to be specified when a link-local next hop is used. ### Interface identifiers and privacy EUI-64 is a historical method for deriving an interface identifier from a MAC address. Exposing stable hardware information in the address creates tracking concerns. Modern clients commonly use stable identifiers that are not directly derived from hardware, as well as temporary privacy addresses. RFC 7217 and RFC 8981 are important references for these approaches. ### SLAAC and DHCPv6 A simplified SLAAC sequence is: ```text Router Solicitation | Router Advertisement | prefix + network information | host creates address | Duplicate Address Detection ``` DHCPv6 can operate in stateless or stateful modes. The M and O flags in Router Advertisements signal expected configuration methods, while actual client behavior also depends on operating-system and network policy. ### Neighbor Discovery ICMPv6 is not an optional helper around IPv6; it is part of the protocol's fundamental operation. Neighbor Discovery messages include: ```text RS Router Solicitation RA Router Advertisement NS Neighbor Solicitation NA Neighbor Advertisement Redirect ``` They provide: - router discovery; - prefix learning; - address resolution; - Duplicate Address Detection; - neighbor-reachability detection. Blocking all ICMPv6 at a firewall can therefore break IPv6. Filtering should be based on message type and purpose. ### IPv6 header and fragmentation The IPv6 base header is simpler than the IPv4 header, with optional information moved to extension headers. Intermediate IPv6 routers do not fragment packets. If a packet is larger than the path MTU, the source is informed with an ICMPv6 Packet Too Big message. Selecting an appropriate packet size at the source is the basis of Path MTU Discovery. ### Transition methods IPv4 and IPv6 will coexist for a long time. Common approaches include: - **Dual stack:** operate both protocols at the same time. - **NAT64/DNS64:** allow IPv6 clients to reach IPv4 services. - **464XLAT:** provide compatibility for IPv4-only applications, especially in IPv6-only mobile networks. - **Tunnels:** carry IPv6 over another network in selected transition or private-connectivity scenarios. The purpose of IPv6 is not to make NAT mandatory. Its large address space restores end-to-end addressing; security still depends on stateful firewalls and access policy. ## Unit 6: Transport and Application Protocols ### Ports and sockets The transport layer distinguishes applications on the same host by port number. A socket endpoint can be represented as: ```text IP address + port ``` A TCP connection is distinguished by the source and destination address/port pairs: ```text source IP source port destination IP destination port ``` IANA port ranges are: ```text 0-1023 well-known 1024-49151 registered 49152-65535 dynamic/private ``` Frequently encountered ports include: ```text 22 SSH 25 SMTP 53 DNS 67/68 DHCPv4 80 HTTP 123 NTP 143 IMAP 161 SNMP 443 HTTPS 445 SMB ``` A port number does not prove that a particular protocol is running or that the traffic is secure. Port 443 commonly carries HTTPS, but a network device cannot identify the application with certainty from the port number alone. ### TCP TCP provides a connection-oriented, ordered byte stream. Important mechanisms include: - sequence numbers; - acknowledgments; - retransmission; - flow control; - congestion control; - error detection. Connection establishment uses the three-way handshake: ```text Client -> SYN Server -> SYN, ACK Client -> ACK ``` This synchronizes connection state and initial sequence numbers. A TCP connection normally closes through separate FIN/ACK exchanges in each direction. RST terminates a connection abruptly. ### Flow and congestion control These mechanisms solve different problems. **Flow control** prevents a fast sender from overflowing a slow receiver's buffers. The receiver's advertised window is the important limit. **Congestion control** protects the network path. A sender adjusts the amount of data in flight according to loss, ECN signals and measured delivery behavior. TCP congestion-control algorithms have evolved over time. Reno and related algorithms are classical loss-based designs, CUBIC is widely deployed, and BBR models bandwidth and round-trip time differently. The operational point is more important than memorizing algorithm names: packet loss can affect both application performance and the sender's congestion window. ### UDP UDP is connectionless and small. Its header is only eight bytes: ```text source port destination port length checksum ``` UDP itself: - does not guarantee delivery; - does not retransmit; - does not preserve ordering; - does not maintain connection state. This simplicity is useful when latency is critical or when the application implements its own transport behavior. Common examples include: - DNS; - DHCP; - some SNMP operations; - real-time media; - QUIC. A protocol built on UDP can still implement reliability. QUIC is the most important current example. ### QUIC and HTTP/3 QUIC is a secure transport protocol that runs over UDP. It integrates the TLS 1.3 handshake into transport establishment and offers independent streams within one connection. HTTP/3 carries HTTP semantics over QUIC. Important benefits include: - reducing separate TCP and TLS handshake work; - isolating streams from one another; - avoiding dependence on only the IP/port four-tuple for connection identity; - allowing transport evolution in user space. HTTP/2 multiplexes many application streams over one TCP connection. If one TCP segment is lost, later bytes must wait for the missing data at the connection level, which can affect all HTTP/2 streams. QUIC orders different streams independently, so loss normally stalls only the affected stream. Ordering still applies within that stream. QUIC uses Connection IDs, which makes connection migration across IP changes - for example from Wi-Fi to mobile access - more natural than with ordinary TCP. ### DNS DNS is a distributed hierarchical system that maps names to resource records. A simplified resolution chain is: ```text client | recursive resolver | root | TLD | authoritative server ``` Common record types include: ```text A IPv4 AAAA IPv6 CNAME alias MX mail server NS authoritative name server PTR reverse mapping TXT text / policy information SRV service location CAA certificate-authority policy ``` TTL determines how long a record can remain cached. If TTL is not lowered before a planned DNS change, stale data may remain in caches longer than expected. ### DNSSEC and encrypted DNS DNSSEC signs DNS data and helps validate origin and integrity. It does not encrypt DNS traffic. Privacy-oriented transports include: - **DoT:** DNS over TLS. - **DoH:** DNS over HTTPS. - **DoQ:** DNS over QUIC. These mechanisms protect queries between a client and resolver. They do not encrypt the entire authoritative-resolution chain and do not replace DNSSEC. Encrypted DNS also creates an enterprise-management issue: if a client independently selects an external resolver, central DNS policy can be bypassed. The appropriate response is to manage enterprise resolvers and client policy together, not simply to disable encryption. ### HTTP and TLS HTTP versions differ in framing and transport: - HTTP/1.1 uses a text-oriented message format over TCP. - HTTP/2 uses binary framing and multiplexing, normally over TLS/TCP. - HTTP/3 uses QUIC. TLS 1.3 removed many obsolete cipher choices, simplified the handshake and favors modern ephemeral key agreement. Forward secrecy depends on the actual key-agreement mode, so it should not be claimed unconditionally for every conceivable TLS 1.3 session. ### Post-quantum TLS NIST standardized ML-KEM, ML-DSA and SLH-DSA in 2024. For networks, one of the most visible migration areas is key agreement. RFC 10024, published in July 2026, standardizes hybrid groups for TLS 1.3 including: ```text X25519MLKEM768 SecP256r1MLKEM768 SecP384r1MLKEM1024 ``` The hybrid construction combines classical ECDHE with ML-KEM. The purpose is to preserve both classical and post-quantum security assumptions during migration. This does not mean quantum computers are currently breaking TLS. The motivation includes "harvest now, decrypt later" risk for information that must remain confidential for many years. ### Other application protocols **SSH** is the standard secure choice for remote administration. Telnet does not encrypt credentials or session data and should not be used for production management. FTP itself is not encrypted. Secure file transfer should use SFTP or an appropriate TLS-protected alternative. **NTP** synchronizes time. Clock errors can disrupt: - log correlation; - certificate validity checks; - Kerberos and similar authentication; - distributed-system analysis. **Syslog** centralizes events. Traditional UDP/514 is simple but does not guarantee delivery; critical environments should prefer reliable and encrypted transport. ## Unit 7: Routing ### Router data plane A router receives a packet, finds the best matching prefix for the destination IP address and forwards the packet toward the selected next hop. A typical IPv4 forwarding sequence is: 1. remove the incoming Layer 2 header; 2. perform a FIB lookup for the destination IPv4 address; 3. decrement TTL; 4. update the required IP header fields; 5. create a new Layer 2 frame; 6. transmit through the outgoing interface. The control-plane RIB and the forwarding FIB are related but not identical. The RIB contains routes learned from protocols and other sources; the FIB contains the selected information used for actual forwarding. ### Longest prefix match The first routing rule is **longest prefix match**. Given: ```text 10.0.0.0/8 10.1.0.0/16 10.1.20.0/24 ``` a destination of `10.1.20.5` matches the `/24` route. Route-source preference and metrics matter only after the destination-prefix specificity has been resolved. In a Cisco-oriented teaching model, the order is: 1. longest prefix; 2. if the same prefix exists from different route sources, administrative distance; 3. among candidates from the same protocol, the protocol metric. ### Static routes A static route is explicit and predictable: ```text ip route 10.20.0.0 255.255.0.0 192.168.1.2 ``` It is appropriate for small stub networks, but manual management becomes difficult as topology grows. Default routes are: ```text IPv4 0.0.0.0/0 IPv6 ::/0 ``` and are used when no more-specific route matches. A **floating static route** is configured with a less-preferred administrative distance so that it becomes active when the normal dynamic or primary route disappears. ### Dynamic-routing families **Distance-vector** protocols learn destinations and metrics from neighbors. RIP is the classical example. EIGRP uses a more advanced distance-vector design. **Link-state** protocols distribute topology information. Each router calculates its own shortest-path tree from a common link-state database. OSPF and IS-IS belong to this family. **Path-vector** protocols carry autonomous-system path and policy information. BGP is the principal example. ### RIP RIPv2 uses hop count as its metric. Fifteen is the largest valid hop count and sixteen means unreachable. Periodic full-table updates and slow convergence make RIP unsuitable for large current production networks. Split horizon, route poisoning and hold-down mechanisms were developed to reduce distance-vector loops. RIP remains useful mainly as a teaching model for routing loops, distributed knowledge and convergence. ### EIGRP EIGRP is a Cisco-originated advanced distance-vector protocol. Its design was published informationally as RFC 7868; that document is not an IETF Standards Track specification. The DUAL algorithm uses: - **successor:** the selected best route; - **feasible successor:** a loop-free backup satisfying the feasibility condition. If a feasible successor already exists, failover can occur without a full route recomputation. The conventional composite metric is based primarily on bandwidth and delay. Including load and reliability in the metric can make route selection unstable and is not normal practice. ### OSPF OSPF is a link-state IGP. A simplified process is: ```text Hello | neighbor relationship | LSDB synchronization | SPF / Dijkstra | shortest-path tree | routing table ``` OSPFv2 was defined for IPv4 and OSPFv3 for IPv6. Later OSPFv3 extensions can also carry IPv4 address families. For course purposes, the v2/IPv4 and v3/IPv6 mapping remains a useful starting model. Neighbors must agree on parameters required by their network type, such as area, timers and authentication. MTU mismatches can leave some platforms stuck around EXSTART/EXCHANGE. ### Router ID The Router ID is a logical 32-bit identifier. In the traditional Cisco selection process, an explicitly configured value takes precedence; otherwise a suitable loopback or interface address may be selected. Production designs normally set it explicitly so that replacing or renumbering a physical interface does not unexpectedly change the routing-protocol identity. ### DR and BDR On a broadcast multi-access network, forming a full adjacency among every pair of OSPF routers would create unnecessary scale. OSPF therefore elects a Designated Router and Backup Designated Router. Selection is based on: 1. OSPF interface priority; 2. Router ID. A router with priority `0` is not a candidate. The election is normally non-preemptive: a router with a higher priority arriving later does not automatically replace the current DR. Point-to-point OSPF networks do not require DR/BDR election. ### OSPF areas A very large OSPF area increases LSDB size and broadens the effect of topology changes. Multi-area design limits that scope. Area 0 is the backbone. An ABR connects areas; an ASBR introduces routes from other routing domains into OSPF. Cisco OSPF cost is traditionally calculated as: ```text cost = reference_bandwidth / interface_bandwidth ``` The historical default reference bandwidth of 100 Mbit/s cannot distinguish modern 1G, 10G and 100G links usefully. Current networks should select a more appropriate reference bandwidth and configure it consistently. ### BGP BGP performs policy-oriented routing among autonomous systems at Internet scale. - eBGP operates between different ASes; - iBGP operates within one AS. BGP uses TCP port 179. BGP is not a shortest-physical-path protocol. Route selection is shaped by attributes and policy such as local preference, AS_PATH, origin, MED and platform-specific rules. Its scale comes partly from treating reachability as policy-bearing information, not merely as a numeric shortest path. ### BGP security Incorrect prefix announcements can divert traffic. **RPKI Route Origin Validation** helps verify which AS is authorized to originate a prefix. RPKI/ROV does not validate the complete AS path. It checks origin authorization, not whether every intermediate relationship in AS_PATH is genuine. Route leaks are a different problem: a legitimately learned route is announced to an inappropriate neighbor. RFC 9234 defines BGP Roles and the **Only-to-Customer (OTC)** attribute to reduce this class of error. Secure BGP operations require a combination of controls: prefix filters, max-prefix limits, RPKI/ROV, session protection and correct peering policy. ### Segment Routing Segment Routing allows a source or ingress node to select a logical sequence of segments for a packet. Two principal data planes are: - **SR-MPLS:** segments are encoded as MPLS labels; - **SRv6:** segments are represented by IPv6 Segment Identifiers. The central idea is to express policy at the ingress rather than maintaining complex per-flow signaling state throughout the core. Uses include: - traffic engineering; - fast reroute; - service chaining; - infrastructure for network slicing; - centralized or hybrid control. SRv6 is not a replacement for ordinary IPv6 routing by itself. It adds programmable segment behaviors to the IPv6 data plane. ## Unit 8: IP Services and QoS ### DHCP DHCPv4 lets a client obtain basic network configuration automatically. The DORA sequence is: ```text Discover Offer Request Ack ``` A server can provide: - IPv4 address; - subnet mask; - default gateway; - DNS server; - lease time; - additional options. If client and server are in different broadcast domains, a **DHCP relay** on a router or Layer 3 switch forwards the client request to the server. DHCP assumes a level of trust. A rogue server can distribute a false gateway or DNS server. DHCP snooping distinguishes trusted uplinks from client-facing ports and helps reduce this risk. ### DNS, DHCP and ARP These services are often confused: ```text DNS name -> IP ARP IPv4 -> MAC DHCP network configuration -> client ``` Selecting the correct layer is one of the quickest ways to narrow a connectivity problem. ### NTP Time in a distributed system is not merely a display value. Log ordering, certificate validation, event correlation and some authentication mechanisms depend on consistent time. NTP sources are distributed through a stratum hierarchy. Enterprise devices should normally use controlled internal time sources rather than arbitrary public servers. ### SNMP SNMP has long been used to read device state, collect counters and receive notifications. Core concepts are: - manager/NMS; - agent; - MIB; - OID. SNMPv1 and v2c depend on community strings and are weak choices for secure management. SNMPv3 adds authentication and privacy and is preferable where SNMP is used. SNMP remains useful for broad monitoring, but polling is not the same model as streaming telemetry. Polling asks periodically for values; streaming systems push periodic or changed data to subscribers. ### Syslog and event management Central log collection supports: - fault timelines; - security-event correlation; - capacity analysis. A wrong clock on one device can mislead a multi-device investigation. NTP and syslog therefore belong in the same operational design. ### QoS QoS does not create bandwidth. It applies different treatment to traffic classes when a resource becomes scarce. A common workflow is: ```text classify | mark | queue | schedule | shape or police when required ``` DSCP is commonly used at Layer 3 and PCP/CoS at Layer 2. **Classification** determines the traffic class. **Marking** records that class in a packet or frame. **Queuing/scheduling** determines which traffic is sent first when an egress link is congested. **Shaping** buffers excess traffic and releases it at a controlled rate. **Policing** can drop or remark traffic that exceeds a configured rate. ### Trust boundary If every endpoint can mark itself as high priority, every application can claim to be voice traffic. A network must therefore define where markings are trusted. Classification and marking should happen near the source, but markings should be preserved only from trusted devices. An access switch may reclassify traffic received on untrusted ports. ### ECN Explicit Congestion Notification allows compatible endpoints and network devices to signal congestion by marking packets rather than dropping them. ECN is important in some low-latency data-center designs, but it does not solve queue management by itself. AQM behavior, endpoint congestion control and switch thresholds must be designed together. ### DetNet and TSN Traditional QoS prioritizes traffic within a best-effort environment. Guaranteeing an upper delay bound requires stronger control. IETF **Deterministic Networking (DetNet)** targets managed domains with techniques such as: - reserved resources; - explicit paths; - packet replication and elimination. The objective is very low loss and bounded latency. IEEE **Time-Sensitive Networking (TSN)** addresses related deterministic requirements at Layer 2 through a family of Ethernet standards. Applications include: - industrial control; - professional media; - in-vehicle networks; - critical real-time systems. DetNet is not a method for guaranteeing deterministic delay across the public Internet. It assumes a controlled administrative domain. RFC 9912, published in 2026, extends reliability and availability considerations to variable wireless links through the **Reliable and Available Wireless (RAW)** architecture. The objective is not to pretend that radio is lossless, but to improve predictability through path diversity and local repair. ## Unit 9: Wireless Networks ### Why the medium is different An Ethernet switch port is usually a dedicated full-duplex link between two endpoints. Wi-Fi uses a shared radio medium. Therefore: ```text high PHY rate != equal application throughput ``` Actual performance depends on airtime access, retransmissions, channel width, client count, modulation, interference and airtime fairness. Wi-Fi uses CSMA/CA rather than collision detection. ### Frequency bands Enterprise WLANs mainly use three bands: - **2.4 GHz:** good reach, few non-overlapping channels and substantial interference. - **5 GHz:** more channel choices and broad enterprise use. - **6 GHz:** wide cleaner spectrum for Wi-Fi 6E and Wi-Fi 7, with reach and regulatory availability depending on region. Increasing channel width raises peak throughput for one client but reduces the number of independent channels in the same area. The widest channel is therefore not always the best choice in dense deployments. ### 802.11 generations Important milestones include: ```text Wi-Fi 4 802.11n MIMO Wi-Fi 5 802.11ac wider 5 GHz channels, MU-MIMO Wi-Fi 6 802.11ax OFDMA, dense-client efficiency Wi-Fi 6E 802.11ax in 6 GHz Wi-Fi 7 802.11be EHT, 320 MHz, MLO, higher capacity ``` IEEE 802.11be-2024 is an active standard defining Extremely High Throughput features. One of Wi-Fi 7's important mechanisms is **Multi-Link Operation (MLO)**. Compatible clients and APs can use multiple links more flexibly, improving not only peak rate but also latency and connection resilience. ### Wi-Fi 8 IEEE P802.11bn, Ultra High Reliability, remains a draft project as of August 2026. Its targets are not limited to a higher peak PHY rate. Relative to EHT, the task group focuses on improvements in selected scenarios such as: - throughput; - 95th-percentile latency; - MPDU loss, particularly around BSS transitions; - AP power consumption. Wi-Fi 8 should therefore not be reduced to "the next speed generation." Reliability and predictable behavior under difficult radio conditions are central themes. Other working-group projects cover areas such as enhanced privacy, ambient-power communications, integrated mmWave, light communications and post-quantum cryptography for Wi-Fi. These projects have different maturity levels and should not be treated as completed features. By contrast, **IEEE 802.11bf-2025 WLAN Sensing** is a published standard. Wi-Fi channel measurements can be used not only for data communication but also to detect movement and physical changes in the environment. Privacy and misuse risks are as important as the sensing capability itself. ### WLAN components Basic terms include: - **STA:** client station. - **AP:** access point. - **BSS:** the basic service set associated with one AP. - **ESS:** multiple BSSs providing one service. - **SSID:** logical WLAN name. - **BSSID:** identifier for a particular radio/BSS. A simplified association process is: ```text discovery | authentication | association | key establishment | IP configuration ``` Hiding an SSID is not a security control. MAC filtering is also weak authentication because MAC addresses can be observed and imitated. ### AP architectures **Autonomous AP:** configuration is stored and managed on each AP. **Controller-based AP:** a central wireless LAN controller manages radio policy and WLAN configuration. **Cloud-managed AP:** the management plane is provided as a cloud service; user traffic may remain local or follow a centralized path depending on the architecture. CAPWAP is a core standard for control communication between APs and controllers in controller-based architectures. The main value of centralized management is not merely "one screen." It is consistent channel, power, roaming, security and firmware policy across many APs. ### Roaming When a client moves from one AP to another, application sessions should continue with as little interruption as possible. 802.11k, 802.11v and 802.11r improve different aspects of roaming, including: - neighbor information; - steering assistance; - fast BSS transition. The client makes a substantial part of the roaming decision. A stronger neighboring AP does not guarantee that a client immediately moves to it. ### WPA2 and WPA3 WEP and original WPA are no longer acceptable security choices. AES-CCMP is the standard secure option in WPA2. WPA3: - strengthens password-based authentication with SAE; - strengthens use of Protected Management Frames; - offers stronger cryptographic profiles for enterprise deployments. In enterprise WLANs, 802.1X/EAP with RADIUS provides better user and device identity management than one shared PSK. Wireless security is not only the WPA version. Rogue APs, evil twins, weak onboarding, disabled certificate validation and incorrect VLAN policy can create more serious practical failures. ## Unit 10: Network Security ### Security objectives Network security is not limited to encrypting traffic. Core objectives include: - confidentiality; - integrity; - availability; - authentication; - authorization; - accountability. A network is not automatically trustworthy because it is "inside." Credential theft, misconfiguration and lateral movement require trust decisions to be based on identity and context rather than network location alone. ### Attack surface Common risk areas include: - management interfaces; - weak authentication; - obsolete protocols; - exposed services; - Layer 2 trust assumptions; - DNS and routing redirection; - software vulnerabilities; - incorrect cloud policy; - user endpoints. The first security step is reducing unnecessary exposure. Unused services, ports and management protocols should be disabled. ### Layer 2 attacks **MAC flooding** attempts to fill a switch's MAC table and increase flooding of unknown unicast traffic. **ARP spoofing** associates an attacker's MAC address with another IPv4 address. **DHCP spoofing** uses a rogue DHCP server to distribute incorrect gateways or DNS servers. **VLAN hopping** can exploit trunk negotiation or tagging mistakes. Defensive controls include: - port security; - DHCP snooping; - Dynamic ARP Inspection; - IP Source Guard; - BPDU Guard; - explicit access/trunk configuration; - shutting down unused ports. These controls complement one another. Dynamic ARP Inspection, for example, often obtains trusted IP-MAC bindings from the DHCP snooping database. ### ACLs An ACL matches Layer 3/4 traffic criteria and applies permit or deny decisions. A useful principle is: ```text narrowest required permission + default denial ``` Direction and placement matter. A correct rule on the wrong interface or in the wrong direction may be ineffective or may block legitimate traffic. The classical Cisco teaching rule - place extended ACLs close to the source and standard ACLs close to the destination - is a useful starting point. Real designs also consider topology, asymmetric paths and processing cost. ### Firewalls A stateful firewall does more than inspect independent packet fields; it tracks connection state. It can evaluate: - who initiated a new connection; - which policy applies; - whether return traffic belongs to an existing session. A next-generation firewall can combine application awareness, user identity, TLS inspection, IPS and threat intelligence. Concentrating many functions in one device, however, also concentrates performance demands and failure impact. ### IDS and IPS An IDS detects suspicious behavior and reports it. An IPS sits in the traffic path and can intervene. Detection methods include: - signatures; - protocol-anomaly analysis; - behavioral analysis. There is always a balance between false positives and missed attacks. An uncontrolled "block everything suspicious" policy is not sustainable in production. ### AAA AAA means: ```text Authentication who are you? Authorization what may you do? Accounting what did you do? ``` RADIUS is common for network access, VPNs and 802.1X. TACACS+ is often selected for network-device administration where detailed command authorization is required. Managing separate local administrative accounts on every device does not scale. Central AAA improves both authorization lifecycle and auditability. A controlled local break-glass account may still be retained for emergencies. ### Encryption **Symmetric encryption** protects bulk data efficiently. AES is the standard example. **Public-key methods** are used for authentication, signatures and key agreement. RSA and elliptic-curve methods remain central classical mechanisms. A **cryptographic hash function** creates a fixed-length representation of data. New designs requiring collision resistance should use SHA-256 or stronger current families. MD5 and SHA-1 are unsuitable where signature or collision security matters. ### PKI and certificates PKI establishes a trust chain binding a public key to an identity. Certificate validation must consider together: - signature chain; - hostname/SAN; - validity period; - revocation status; - algorithm policy. A common TLS mistake is assuming that "encryption is enabled, therefore it is secure." If the client does not validate the certificate, it can establish an encrypted session with an attacker. ### Zero Trust In NIST SP 800-207, network location is not sufficient evidence of trust. Each access request is evaluated using identity, device state, context and policy. Operational consequences include: - least privilege; - strong identity; - continuous verification; - microsegmentation; - detailed telemetry. Zero Trust is not a single product or protocol. Increasing the number of VLANs is not, by itself, a Zero Trust architecture. ### ZTNA and SASE ZTNA aims to grant an authenticated user access to a specific application rather than automatically attaching the user to an entire remote network. This can reduce broad VPN exposure but does not eliminate every use case for VPN technology. SASE brings WAN connectivity and security functions closer together through cloud-delivered policy. SD-WAN, secure web gateways, firewall services, CASB and ZTNA can be combined under a common policy plane. The engineering objective is not to collect product categories but to apply consistent access policy to users and workloads regardless of location. ### MACsec, IPsec and TLS The protection layer depends on the threat boundary: ```text MACsec Layer 2 link IPsec Layer 3 network / tunnel TLS application/transport-level session ``` MACsec protects an Ethernet link. IPsec can secure site-to-site or host-to-network traffic. TLS protects application endpoints. They are not absolute alternatives. One system can use more than one when different trust boundaries require protection. ## Unit 11: WAN, VPN and Programmable Paths ### WAN options WAN design is broader than selecting a carrier. Important criteria include: - latency; - bandwidth; - SLA; - redundancy; - cost; - cloud-egress model; - security. Common transport types include: ```text leased line Metro Ethernet MPLS service public Internet fiber access 4G/5G LEO satellite ``` MPLS is not itself a VPN protocol. It provides label switching in a provider backbone; services such as L2VPN and L3VPN can be delivered over that infrastructure. ### WAN topology **Hub-and-spoke** is simple to manage, but the hub can become both a bottleneck and a large failure domain. **Partial mesh** adds direct paths among critical sites. **Full mesh** is resilient but the number of links and policies grows rapidly. As cloud use increases, forcing every branch flow through a central data center can create unnecessary latency. Local Internet breakout and security policy are therefore considered together in SD-WAN and SASE designs. ### IPsec IPsec secures traffic at the IP layer. Core components include: - IKE for authentication and key agreement; - ESP for data confidentiality and integrity; - Security Associations. Two principal operating modes are: - **Transport:** primarily protects the upper-layer payload. - **Tunnel:** encapsulates the original IP packet inside a new IP packet. Tunnel mode is common for site-to-site VPNs. IPsec affects MTU. Encryption and encapsulation overhead make Path MTU and TCP MSS important troubleshooting points. ### GRE and WireGuard GRE can tunnel different Layer 3 protocols and can carry multicast, but it does not provide confidentiality by itself. It can be combined with IPsec when encryption is required. WireGuard is a lightweight VPN design with a small protocol surface and a fixed modern cryptographic suite. Key distribution, identity management and access policy remain separate operational concerns. ### SD-WAN SD-WAN manages multiple WAN transports through a common policy plane. A conceptual structure is: ```text management / orchestration | control policy | branch edge devices | MPLS + Internet + mobile and other transports ``` Paths can be selected according to application class: ```text voice -> low-latency path backup -> lower-cost high-capacity path critical -> multiple paths / fast failover ``` The main value of SD-WAN is not one "faster link." It is centralized, measurable policy across heterogeneous access networks. ### Traffic engineering with Segment Routing A conventional IGP normally calculates a shortest path. Traffic engineering may require a selected workload to use a path that is: - lower latency; - avoiding selected links; - redundant; - passing through a service chain. Segment Routing expresses such a policy as a segment list. SR-MPLS uses the MPLS data plane; SRv6 uses IPv6 Segment Routing Headers and SID behaviors. This can reduce per-path signaling state in the core compared with approaches such as RSVP-TE. In return, controllers, SID planning and observability become new operational responsibilities. ## Unit 12: Data Center, Overlay and Cloud Networking ### Traffic direction Traditional campus networks carry substantial north-south traffic between clients and servers. In modern data centers, microservices, distributed storage and AI clusters generate large east-west traffic volumes. A leaf-spine fabric: ```text Spine1 Spine2 / | | \ / | | \ Leaf1 Leaf2 Leaf3 Leaf4 ``` provides multiple equal-cost paths from each leaf. Layer 3 underlay routing with ECMP reduces dependence on large Layer 2 domains and STP. ### Underlay and overlay The **underlay** is the real routed transport network that provides IP reachability among VTEPs or edge nodes. The **overlay** is the logical tenant network built over it. This creates a useful troubleshooting split: ```text overlay fails | is underlay reachability working? | then check control plane / VNI / policy ``` Following that order can save substantial troubleshooting time. ### VXLAN VXLAN carries an Ethernet frame over a Layer 3 network by encapsulating it in UDP. A VLAN ID is 12 bits. VXLAN uses a 24-bit VNI field, allowing approximately 16 million logical segments. Conceptually: ```text inner Ethernet | VXLAN header | UDP | outer IP | underlay Ethernet ``` A VXLAN tunnel endpoint is called a **VTEP**. Encapsulation increases frame size, so the underlay MTU must be planned to carry the inner packet plus VXLAN overhead. ### EVPN VXLAN alone does not define how MAC and IP reachability information is distributed. Early implementations can use flood-and-learn behavior. **BGP EVPN** distributes MAC and IP reachability in the control plane. This can: - reduce unknown-traffic flooding; - advertise host mobility through the control plane; - combine Layer 2 and Layer 3 services in one fabric; - scale multi-tenant networking more effectively. EVPN-VXLAN is a common current data-center design. VXLAN supplies the data plane and EVPN provides the control-plane function in this use. ### Anycast gateway In an EVPN fabric, the same default-gateway MAC/IP information can be presented on several leaf switches. The first Layer 3 routing decision can therefore occur on the local leaf to which the host is attached. This avoids unnecessary traffic through a central router and preserves gateway behavior when a host moves. ### Virtualization Virtual machines and containers break the old one-to-one relationship between a physical switch port and a workload. Traffic between two virtual machines on the same host can remain inside a virtual switch without reaching the physical network. Monitoring or security tools that observe only physical links can therefore miss relevant traffic. ### Container networking The Kubernetes network model uses separate abstractions for pod addressing and service discovery. A CNI implementation provides the actual data path. eBPF-based networking can provide programmable packet processing, observability and identity-aware policy inside the kernel. It can reduce some scaling and visibility problems associated with large dynamic iptables rule sets. The statement "eBPF makes networking faster" is too broad. Results depend on workload, program design, NIC offload and kernel version. ### Cloud networking Cloud-provider product names differ, but the underlying concepts are similar: - virtual private network/VPC; - subnet; - route table; - security group; - network ACL; - Internet gateway; - NAT gateway; - peering; - transit gateway; - private service endpoint; - dedicated private connectivity. The emphasis moves from configuring individual physical switches to defining logical network resources through APIs. A "private subnet" in a cloud environment is not automatically secure. Routes, security groups, IAM controls and service-endpoint policies must be considered together. ### Load balancing and anycast Modern service access is not necessarily tied to one server IP. An **L4 load balancer** distributes flows by IP and port. An **L7 load balancer or reverse proxy** can make decisions using application information such as HTTP requests. **Anycast** advertises the same IP prefix from several locations and lets routing guide clients toward an appropriate service site. CDNs, DNS infrastructure and global edge services often combine these techniques. ### AI and HPC fabrics Distributed accelerator clusters generate large concurrent east-west traffic volumes. Relevant design factors include: - high switch radix; - multiple ECMP paths; - low oversubscription; - fast telemetry; - queue and congestion control; - high-speed Ethernet. 800G Ethernet is standardized, while 1.6T work continues. These speeds are not merely larger port numbers: 200G-class lane technologies, FEC, optical reach, thermals and power become fabric-engineering concerns. Ethernet fabrics seeking lossless behavior may use mechanisms such as Priority Flow Control. Poor PFC design can create head-of-line blocking and congestion propagation. "Lossless" therefore requires careful joint design of flow control and queue management. ## Unit 13: Management, Automation and Observability ### Management plane A network device can be considered as three logical planes: - **Data plane:** forwards packets. - **Control plane:** creates route, neighbor and protocol state. - **Management plane:** provides configuration, monitoring and administrative access. The distinction matters for both security and automation. Management traffic should use a separate VRF, management network or out-of-band path where practical. ### SDN Software-Defined Networking logically separates control decisions from packet forwarding. This does not mean every switch becomes "dumb." The data plane still performs high-speed forwarding, while policy and topology decisions can be programmed through centralized or distributed controllers. ```text application / intent | control plane | programmable interface | data plane ``` OpenFlow was an important southbound interface in early SDN work. Current networks can combine NETCONF, gNMI, BGP, PCEP and vendor APIs. The deeper change is not one protocol but making network state readable and changeable by software. ### Basic Cisco IOS/IOS XE workflow Classical CLI modes include: ```text Switch> user EXEC Switch# privileged EXEC Switch(config)# global configuration Switch(config-if)# interface configuration ``` A basic example: ```text enable configure terminal hostname SW1 interface gigabitEthernet 1/0/1 description USER switchport mode access switchport access vlan 10 no shutdown end copy running-config startup-config ``` CLI syntax varies by platform and release. The educational goal is not memorizing every command but understanding working configuration, persistent configuration and hierarchical context. Modern IOS XE platforms can store configuration and boot information differently from older Catalyst/IOS examples. The model "running-config in RAM, startup-config in NVRAM" remains conceptually useful, but the actual file system should be checked against platform documentation. ### Secure remote management SSH should be used and Telnet disabled. Important principles include: - a separate management network; - AAA; - ACLs limited to required source addresses; - strong keys and algorithms; - centralized logging; - time synchronization; - avoiding shared or default accounts. If a web interface is necessary, HTTPS and proper certificate management are required. ### Neighbor discovery CDP is Cisco-specific. LLDP is the open standards-based approach defined by IEEE 802.1AB. Neighbor discovery helps with: - physical-link verification; - port mapping; - device identity; - PoE and selected capability information. Discovery protocols can also expose topology information. Unnecessary announcements can be disabled on untrusted access ports. ### Troubleshooting order Troubleshooting should proceed by layer instead of by random command selection. A practical order is: 1. **Physical:** link state, optical power, cable and error counters. 2. **Layer 2:** VLAN, trunk, STP, MAC table and LACP. 3. **Layer 3:** address, prefix, ARP/ND, gateway and routes. 4. **Transport:** port reachability, TCP state and firewalls. 5. **Application:** DNS, TLS and service state. Jumping to an upper layer before confirming the lower one usually increases diagnosis time. ### Basic tools On a host: ```text ping traceroute / tracert ip addr ip route ip neigh ss dig nslookup arp -a tcpdump / Wireshark ``` On Linux, `ifconfig` and `netstat` are historical tools; the modern iproute2 equivalents are `ip` and `ss`. On a network device, useful commands include: ```text show interfaces show interfaces counters show mac address-table show vlan show interfaces trunk show spanning-tree show etherchannel summary show ip interface brief show ip route show arp show ipv6 neighbors show logging ``` They help separate a problem by layer. ### What does ping prove? Ping proves only that ICMP echo works along the tested path. By itself it does not prove: - that a TCP port is open; - that DNS works; - that an application is healthy; - that large packets pass; - that forward and return paths are identical. Therefore, "ping works, so the network is healthy" is not a valid conclusion. ### Traceroute Traceroute gradually increases TTL or Hop Limit and observes ICMP Time Exceeded responses from intermediate routers. The observed path can be: - asymmetric; - incomplete because some routers do not reply; - different among probes because of load balancing. Traceroute is an observed path sample, not a direct dump of every routing table. ### Packet capture Packet analysis tests assumptions across layers. A useful reading order is: ```text Ethernet | IP | TCP/UDP/ICMP | application protocol ``` For an apparent DNS problem, for example, first verify that a query is actually sent and then whether a response returns. Packet capture turns a vague complaint such as "the application is slow" into measurable events. ### YANG YANG is a data-modeling language for network configuration and state. Its purpose is to use a semantically defined data tree rather than scrape unstructured CLI output. A model can define a hierarchy such as: ```text interfaces interface[name] config state ``` Vendor-neutral models such as OpenConfig are valuable in multi-vendor automation alongside vendor-specific models. ### NETCONF and RESTCONF **NETCONF** uses structured RPC operations and can work with YANG-modeled datastores. **RESTCONF** exposes YANG-modeled data through an HTTP-based REST interface. They are related but not identical: ```text NETCONF RPC / datastore oriented RESTCONF HTTP resource model YANG data model ``` ### gNMI and OpenConfig gNMI is a network-management interface based on gRPC and Protocol Buffers. Its core operations are: - Get; - Set; - Subscribe. OpenConfig supports model-driven management through vendor-neutral data models and the gNMI ecosystem. The OpenConfig gNMI specification was at version 0.11.0 in March 2026. The version number is less important than understanding why **Subscribe** fits continuous telemetry. ### Streaming telemetry SNMP polling uses a model like: ```text NMS -> device: what is the value? ``` Streaming telemetry moves toward: ```text subscribe | device -> stream updates ``` YANG-Push defines standardized mechanisms for delivering YANG datastore updates periodically or when values change. Benefits include: - higher sampling rates; - less unnecessary polling; - structured data; - lower delay between an event and its observation. Telemetry can generate much more data, so collector capacity, storage cost and metric cardinality must also be engineered. ### Automation The main purpose of network automation is not to type commands faster but to apply the same intent repeatedly and predictably. Two styles are useful to distinguish. **Imperative:** ```text enter the interface run the VLAN command change the description ``` **Declarative:** ```text the desired final state of this port is VLAN 10 ``` Declarative management makes idempotency and configuration-drift detection easier. ### Git and validation Network configuration can be managed like code: ```text change | version control | lint / schema validation | lab / digital twin / test | approval | deployment | validation through telemetry ``` This makes who changed what, why and when more visible. Automation can automate mistakes as well. Scope controls, dry runs, diffs, canary deployment and rollback plans matter more than raw speed. ### Intent-based networking Intent-based networking raises the abstraction from device commands toward desired business or network outcomes. ```text intent | policy | device configuration | telemetry | compliance check ^ | ``` The last step is the important distinction. If a system only generates configuration, it is conventional automation. If it measures whether the desired outcome was actually achieved, it moves toward closed-loop management. ### API security A network API is a management surface and must be protected as carefully as the CLI. Controls include: - strong authentication; - least-privilege tokens; - TLS; - secret storage; - audit logs; - rate limiting; - certificate validation; - keeping secrets out of source code. Giving one automation account unrestricted administrative access to the entire network can turn centralized control into a single high-impact compromise point. ## Relationships Among the Topics A network failure is often not the failure of one protocol. It appears when an assumption between layers no longer holds. A simplified path of a web request is: ```text application constructs URL | DNS resolves name | host decides whether target is local or remote | ARP or Neighbor Discovery resolves next hop | switch forwards frame | router performs longest-prefix match | NAT / security policy is applied when required | TCP or QUIC session is established | TLS validates identity and establishes keys | HTTP request is carried ``` Troubleshooting means validating this chain either forward or backward. The evolution of current networks can also be viewed as a change in the managed abstraction: ```text physical device | IP fabric | overlay | identity and policy | API-based management | continuous telemetry ``` VLANs, STP and ordinary router commands remain important. In data centers, cloud environments and large campus networks, however, the operator increasingly manages the **desired state of the network**, not only one device at a time. ## Conceptual Distinctions **Bandwidth is not throughput.** Throughput is measured transfer rate; goodput is useful application payload rate. **Latency and jitter are different.** Jitter is variation in latency. **OSI is a reference model; TCP/IP is the protocol architecture used by the Internet.** **MAC addresses support local delivery while IP addresses support Layer 3 routing.** A normal router hop changes the Layer 2 frame. **NAT is an explicit exception to the simplest end-to-end addressing model.** **Ethernet FCS detects corruption; it does not repair it.** **There is no universal IEEE rule that a jumbo frame must be exactly 9000 bytes.** **IPv6 routers do not fragment packets in transit.** **A switch learns from source MAC addresses and forwards according to destination MAC addresses.** **Unknown unicast traffic is flooded within the applicable VLAN.** **CSMA/CD is not used on full-duplex Ethernet.** **A VLAN is a Layer 2 concept; a subnet is a Layer 3 concept.** **An access port normally carries one VLAN; a trunk carries multiple VLANs.** **STP prevents Layer 2 forwarding loops. RSTP converges faster than classical STP.** **The current link-aggregation standard is IEEE 802.1AX; 802.3ad is the historical designation.** **One flow does not automatically consume the sum of all link-aggregation member rates.** **The current core VRRP specification is RFC 9568.** **802.1X provides network-access control; MACsec protects Layer 2 links.** **CIDR replaced classful IPv4 routing.** **A /31 can be used on point-to-point IPv4 links; a /32 represents one IPv4 host route or loopback.** **VLSM divides address space according to need; summarization combines compatible prefixes.** **ARP resolves IPv4 to MAC, DNS resolves names to resource records, and DHCP distributes client configuration.** **NAT is not a firewall.** **IPv6 is 128 bits and has no broadcast. Neighbor Discovery replaces ARP functions.** **Blocking all ICMPv6 can break IPv6 operation.** **SLAAC and DHCPv6 are different mechanisms.** **EUI-64 is not the only modern IPv6 interface-identifier method; privacy addresses are common.** **TCP provides a reliable ordered byte stream. UDP does not provide those guarantees itself.** **TCP flow control protects the receiver; congestion control protects the network path.** **QUIC uses UDP but implements its own reliability and congestion behavior. HTTP/3 runs over QUIC.** **DNSSEC protects authenticity and integrity of DNS data; it does not encrypt queries. DoT, DoH and DoQ encrypt DNS transport.** **Hybrid ML-KEM groups for TLS 1.3 were standardized by RFC 10024 in July 2026.** **Routing starts with longest-prefix match. Administrative distance and protocol metrics are secondary comparisons.** **RIP uses hop count, OSPF uses cost, EIGRP uses a composite metric and BGP is policy-oriented.** **EIGRP is described informationally in RFC 7868; the document is not Standards Track.** **OSPF runs SPF over a link-state database. DR/BDR is relevant on broadcast multi-access networks, not ordinary point-to-point links.** **BGP carries reachability and policy; it is not required to choose the shortest physical path.** **RPKI/ROV validates route origin authorization, not the complete AS path. RFC 9234 adds BGP Roles and OTC mechanisms for reducing route leaks.** **QoS does not create capacity. Shaping buffers excess traffic while policing limits or remarks it.** **DetNet targets bounded behavior inside managed domains, not deterministic guarantees across the public Internet.** **Hiding an SSID and filtering MAC addresses are not strong WLAN security controls.** **Wi-Fi 7 is based on IEEE 802.11be and MLO is one of its important features. IEEE P802.11bn, associated with Wi-Fi 8, remains a draft as of August 2026 and emphasizes reliability and latency as well as throughput.** **Zero Trust does not automatically trust an internal network and is not a single product.** **MACsec, IPsec and TLS protect different layers. GRE tunnels traffic but does not encrypt it by itself.** **SD-WAN manages multiple WAN paths under centralized policy. Segment Routing expresses paths as segment or SID sequences, with SR-MPLS and SRv6 as the principal data planes.** **The underlay supplies real IP reachability; the overlay creates logical networking above it.** **VXLAN uses a 24-bit VNI and extends segmentation beyond the VLAN ID space, but it is not itself a VLAN. EVPN can distribute MAC/IP reachability for VXLAN through BGP.** **800G Ethernet is standardized; 1.6T work under P802.3dj remains draft as of August 2026.** **SNMP polling and streaming telemetry are different operational models. YANG is a data model; NETCONF and RESTCONF are management protocols. gNMI provides Get/Set/Subscribe operations and OpenConfig supplies vendor-neutral models.** **The main benefit of automation is consistency and repeatability, not typing speed.** **Ping does not prove that an application is healthy. Troubleshooting should move through measured evidence from physical connectivity to application behavior.** ## References - James F. Kurose, Keith W. Ross. *Computer Networking: A Top-Down Approach*, 8th Edition. Pearson, 2021. - Andrew S. Tanenbaum, Nick Feamster, David J. Wetherall. *Computer Networks*, 6th Edition. Pearson, 2021. - Cisco Systems. *Cisco Networking Academy and CCNA training resources*. https://www.netacad.com/ - Cisco Systems. *CCNA Certification and Training*. https://learningnetwork.cisco.com/ - Wendell Odom. *CCNA 200-301 Official Cert Guide*, Volumes 1-2. Cisco Press. - Cemal Taner. *Ağ Yöneticiliğinin Temelleri*. - IEEE. *IEEE Std 802.3df-2024: 800 Gb/s Ethernet*. https://standards.ieee.org/standard/802_3df-2024.html - IEEE 802.3 Working Group. *IEEE Std 802.3dg-2026: 100 Mb/s Long-Reach Single Pair Ethernet*. https://grouper.ieee.org/groups/802/3/dg/index.html - IEEE. *IEEE P802.3dj: 1.6 Tb/s Ethernet Amendment, Active PAR*. https://standards.ieee.org/ieee/802.3dj/11115/ - IEEE. *IEEE Std 802.11-2024: Wireless LAN MAC and PHY Specifications*. https://standards.ieee.org/ieee/802.11/10548/ - IEEE. *IEEE Std 802.11be-2024: Extremely High Throughput*. https://standards.ieee.org/ieee/802.11be/7516 - IEEE. *IEEE Std 802.11bf-2025: Enhancements for Wireless LAN Sensing*. https://standards.ieee.org/ieee/802.11bf/11574/ - IEEE 802.11 Working Group. *P802.11bn Ultra High Reliability Task Group*. https://www.ieee802.org/11/Reports/tgbn_update.htm - IEEE 802.11 Working Group. *Active Task Groups and Project Status*. https://www.ieee802.org/11/overview.html - IEEE. *IEEE Std 802.1AX-2020: Link Aggregation*. https://standards.ieee.org/ieee/802.1AX/6768/ - IEEE 802.1 Working Group. *IEEE 802.1X Port-Based Network Access Control*. https://1.ieee802.org/security/802-1x/ - IEEE. *IEEE Std 802.1AE-2018: MAC Security*. https://standards.ieee.org/ieee/802.1AE/7154/ - IETF. *RFC 8200: Internet Protocol, Version 6 (IPv6) Specification*. https://www.rfc-editor.org/rfc/rfc8200.html - IETF. *RFC 4861: Neighbor Discovery for IP version 6*. https://www.rfc-editor.org/rfc/rfc4861.html - IETF. *RFC 7217: Semantically Opaque Interface Identifiers*. https://www.rfc-editor.org/rfc/rfc7217.html - IETF. *RFC 8981: Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6*. https://www.rfc-editor.org/rfc/rfc8981.html - IETF. *RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport*. https://www.rfc-editor.org/rfc/rfc9000.html - IETF. *RFC 9114: HTTP/3*. https://www.rfc-editor.org/rfc/rfc9114.html - IETF. *RFC 7858: DNS over TLS*. https://www.rfc-editor.org/rfc/rfc7858.html - IETF. *RFC 8484: DNS Queries over HTTPS*. https://www.rfc-editor.org/rfc/rfc8484.html - IETF. *RFC 9250: DNS over Dedicated QUIC Connections*. https://www.rfc-editor.org/rfc/rfc9250.html - IETF. *RFC 7868: Cisco's Enhanced Interior Gateway Routing Protocol (EIGRP)*. https://www.rfc-editor.org/rfc/rfc7868.html - IETF. *RFC 9234: Route Leak Prevention and Detection Using Roles in UPDATE and OPEN Messages*. https://www.rfc-editor.org/rfc/rfc9234.html - IETF. *RFC 9568: Virtual Router Redundancy Protocol Version 3*. https://www.rfc-editor.org/rfc/rfc9568.html - IETF. *RFC 8402: Segment Routing Architecture*. https://www.rfc-editor.org/rfc/rfc8402.html - IETF. *RFC 8986: Segment Routing over IPv6 Network Programming*. https://www.rfc-editor.org/rfc/rfc8986.html - IETF. *RFC 7348: Virtual eXtensible Local Area Network (VXLAN)*. https://www.rfc-editor.org/rfc/rfc7348.html - IETF. *RFC 8365: Network Virtualization Overlay Solution Using EVPN*. https://www.rfc-editor.org/rfc/rfc8365.html - IETF. *RFC 9135: Integrated Routing and Bridging in Ethernet VPN*. https://www.rfc-editor.org/rfc/rfc9135.html - IETF. *RFC 6241: Network Configuration Protocol (NETCONF)*. https://www.rfc-editor.org/rfc/rfc6241.html - IETF. *RFC 7950: The YANG 1.1 Data Modeling Language*. https://www.rfc-editor.org/rfc/rfc7950.html - IETF. *RFC 8040: RESTCONF Protocol*. https://www.rfc-editor.org/rfc/rfc8040.html - IETF. *RFC 8641: Subscription to YANG Notifications for Datastore Updates*. https://www.rfc-editor.org/rfc/rfc8641.html - OpenConfig. *gRPC Network Management Interface (gNMI) Specification*. https://openconfig.net/docs/gnmi/gnmi-specification/ - IETF. *RFC 5415: Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification*. https://www.rfc-editor.org/rfc/rfc5415.html - Cilium Project. *Cilium Documentation*. https://docs.cilium.io/ - WireGuard. *WireGuard Documentation*. https://www.wireguard.com/ - Wi-Fi Alliance. *Wi-Fi Security and Certification Resources*. https://www.wi-fi.org/ - IETF. *RFC 8655: Deterministic Networking Architecture*. https://www.rfc-editor.org/rfc/rfc8655.html - IETF. *RFC 9912: Reliable and Available Wireless Architecture*. https://www.rfc-editor.org/rfc/rfc9912.html - NIST. *SP 800-207: Zero Trust Architecture*. https://csrc.nist.gov/pubs/sp/800/207/final - NIST. *FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard*. https://csrc.nist.gov/pubs/fips/203/final - NIST. *FIPS 204: Module-Lattice-Based Digital Signature Standard*. https://csrc.nist.gov/pubs/fips/204/final - NIST. *FIPS 205: Stateless Hash-Based Digital Signature Standard*. https://csrc.nist.gov/pubs/fips/205/final - IETF. *RFC 10024: Post-Quantum Traditional Hybrid Key Agreement Mechanisms for TLS 1.3*. https://www.rfc-editor.org/rfc/rfc10024.html ## Cite This Work Köker, M. A. (2013). Computer Networks: Protocols, Routing and Security. alikoker.com.tr. https://alikoker.com.tr/en/computer-networks-protocols-routing-security - BibTeX: https://alikoker.com.tr/en/computer-networks-protocols-routing-security.bib - RIS: https://alikoker.com.tr/en/computer-networks-protocols-routing-security.ris - CSL-JSON: https://alikoker.com.tr/en/computer-networks-protocols-routing-security.csl.json