Networking

Follow the packet

A large percentage of technical problems eventually become networking questions: can the device reach the server? Can the server reach the database? Is DNS resolving correctly? Is a firewall blocking the connection? Is the traffic using the expected route? Is the VPN connected? Is the user on the correct VLAN? Is the destination port listening? Is NAT translating the address correctly? Is latency occurring on the local network, WAN, Internet, VPN or application? Did the packet leave the computer at all?

For someone starting a career in IT or cybersecurity, networking can initially appear difficult because there are many protocols, acronyms, ports and devices. The best way to understand networking is not to memorise hundreds of definitions. Instead, learn to follow the packet.

Consider a user in a company's London office opening https://portal.company.com. Their computer may have to:

1. Determine whether the destination is local or remote.
2. Ask DNS for the IP address of portal.company.com.
3. Send traffic to the local Ethernet or Wi-Fi network.
4. Pass through an access switch.
5. Traverse one or more VLANs.
6. Reach a router or Layer 3 switch.
7. Pass through a firewall.
8. Potentially be translated using NAT.
9. Travel across an ISP, MPLS network, SD-WAN network or the Internet.
10. Enter a cloud environment such as AWS, Azure or Google Cloud.
11. Pass another firewall or security control.
12. Reach a load balancer.
13. Finally reach the application server.

If something fails anywhere along that path, networking knowledge helps you identify where.

What You Will Learn

By the end of this module, you should understand the OSI and TCP/IP models, IPv4 and IPv6, public and private addressing, subnetting and CIDR, default gateways, DNS, DHCP, NAT, TCP, UDP, ICMP, ports, VPNs, firewalls, routing, switching, VLANs, trunking, Spanning Tree, dynamic routing protocols, enterprise WAN technologies, cloud networking, basic network security, packet captures, Wireshark, ping, traceroute, and practical network troubleshooting.

You'll also learn about both current technologies and older technologies that still exist inside enterprise environments — real networks are rarely 100% modern.

1🌐 Understanding a Network

At its simplest, a network allows devices to communicate — laptops, desktops, servers, phones, printers, CCTV cameras, IoT devices, Wi-Fi access points, switches, routers, firewalls, storage systems, virtual machines, containers, and cloud services.

A home network might contain ten devices. A multinational company could operate hundreds of thousands of devices across offices, data centres, factories, retail stores, cloud environments, remote workers, and partner networks. The underlying concepts remain largely the same.

LAN – Local Area Network

A LAN usually represents a network within a relatively small physical location, for example Laptop → Switch → Office Network. An office may have multiple LANs separated into VLANs.

WAN – Wide Area Network

A WAN connects geographically separated locations:

Large organisations may connect offices using MPLS, SD-WAN, site-to-site VPN, dedicated leased circuits, metro Ethernet, or cloud WAN services. Older environments may still contain Frame Relay, ATM, ISDN, or older leased-line technologies — these are becoming uncommon but remain useful historically because many enterprise networking concepts evolved from them.

The Internet

The Internet is effectively a massive network of networks. Your organisation does not directly connect to every website. Instead, traffic passes through multiple interconnected networks operated by ISPs, cloud providers, telecommunications companies, content delivery networks, enterprises, governments, and universities. Routers determine how traffic moves between these networks.

2🖼️ The OSI Model

The OSI model is one of the most important concepts for someone learning networking. OSI stands for Open Systems Interconnection. It divides network communication into seven conceptual layers.

You will rarely troubleshoot a real network by literally saying "Layer 5 appears to be broken." However, understanding the model helps you determine where a problem exists.

A useful mnemonic, bottom to top, is Please Do Not Throw Sausage Pizza Away — Physical, Data Link, Network, Transport, Session, Presentation, Application.

Layer 1 – Physical

Layer 1 deals with physically transmitting information — copper Ethernet cables, fibre optic cables, radio frequencies used by Wi-Fi, network interface hardware, SFP/SFP+/QSFP modules, and patch panels. Typical Layer 1 problems include a disconnected or damaged cable, a faulty transceiver, incorrect fibre type, no Wi-Fi signal, a disabled switch port, or incorrect cable termination.

Imagine a user says:

"I have no network connection."

Before investigating DNS or firewalls, check whether they are physically connected. This is why troubleshooting normally starts from the bottom.

Layer 2 – Data Link

Layer 2 deals primarily with communication between devices on the same local network — Ethernet, MAC addresses, Ethernet frames, switches, VLANs, ARP, and Spanning Tree Protocol. A typical MAC address looks like 00:1A:2B:3C:4D:5E. Switches learn which MAC addresses exist behind which switch ports.

Layer 3 – Network

Layer 3 is where IP addressing and routing occur — IPv4, IPv6, routers, route tables, and ICMP. Example IPv4 address: 192.168.10.25. Example IPv6 address: 2001:db8:1234:5678::25. Routers make decisions based primarily on the destination IP address.

Layer 4 – Transport

The major Layer 4 protocols are TCP and UDP. Layer 4 introduces the concept of ports, for example Server IP: 10.20.30.40, Port: 443, Protocol: TCP — this generally represents an HTTPS service.

Layers 5–7

In real troubleshooting, Layers 5–7 are frequently discussed collectively as the application layer — HTTP, HTTPS, DNS, SMTP, LDAP, SSH, SMB, and REST APIs. An application may fail even though basic network connectivity works:

ping server = successful
TCP 443 connection = successful
HTTP request = 500 Internal Server Error

At that point, the underlying network is probably functioning and investigation moves towards the application.

Using OSI for Troubleshooting

Imagine a user cannot access https://banking.company.com. Think through the layers:

This approach prevents random troubleshooting.

3🔌 TCP/IP

The Internet primarily uses the TCP/IP protocol suite. Although OSI has seven layers, TCP/IP is usually represented using four or five layers:

Encapsulation

When an application sends data, headers are added as it travels down the networking stack:

On the receiving system, the opposite happens — this is known as encapsulation and de-encapsulation.

TCP

TCP stands for Transmission Control Protocol. TCP is connection-oriented and attempts to provide reliable, ordered communication. It's commonly used where losing data would be problematic — HTTPS, SSH, SMB, LDAP, and database connections.

The modern consolidated IETF TCP specification is RFC 9293, which replaced the much older RFC 793 that many legacy networking books still reference.

The TCP Three-Way Handshake

Before normal TCP data communication starts, TCP typically establishes a connection:

Client                     Server
SYN ---------------------->
    <---------------- SYN-ACK
ACK ---------------------->
Connection established

This is extremely important when analysing packet captures. If you see SYN, SYN, SYN, SYN with no response, something may be blocking traffic, dropping traffic, incorrectly routed, or offline. If you see SYN, RST, the destination may be reachable but the service might not be listening. That distinction is extremely useful for troubleshooting.

TCP Reliability

TCP provides sequence numbers, acknowledgements, retransmissions, flow control, and congestion control. If packets disappear, TCP can retransmit them. Wireshark may show TCP Retransmission. Frequent retransmissions could indicate packet loss, congestion, Wi-Fi problems, WAN problems, firewall problems, or server performance problems.

UDP

UDP stands for User Datagram Protocol. UDP is connectionless — it does not establish a TCP-style connection before sending data. UDP generally has less overhead than TCP but does not provide TCP's reliability mechanisms. Common UDP-based services include DNS, DHCP, VoIP, streaming, some VPN technologies, and QUIC/HTTP/3 traffic.

Modern HTTPS traffic may therefore use UDP 443 when HTTP/3/QUIC is involved rather than traditional TCP 443. This is important because someone who assumes "HTTPS always means TCP" may incorrectly diagnose modern traffic.

ICMP

ICMP stands for Internet Control Message Protocol. It is used for network control and diagnostic communication. Ping commonly uses ICMP. ICMP can also report conditions such as destination unreachable, TTL expired, and fragmentation problems. Blocking all ICMP can sometimes make network troubleshooting unnecessarily difficult.

4🏷️ IP Addressing

Every device communicating using IP needs an IP address. There are currently two major versions: IPv4 and IPv6.

IPv4

IPv4 uses a 32-bit address, for example 192.168.1.20. Each section is called an octet: 192 . 168 . 1 . 20. Each octet can range from 0–255.

Public IP Addresses

Public IP addresses can be routed across the public Internet. An organisation may receive public address space from an ISP, a Regional Internet Registry, or a cloud provider. Large organisations may own entire public IP ranges.

Private IPv4 Addresses

Most internal enterprise devices use private IP addressing. RFC 1918 defines three primary private IPv4 ranges:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

For example 10.40.52.20 might be an internal corporate server. These addresses are not directly routed across the public Internet.

Why Enterprises Often Use 10.0.0.0/8

Large companies commonly use addresses such as 10.10.1.0/24, 10.20.1.0/24, 10.50.20.0/24 because the 10.0.0.0/8 range provides a very large private address space. A company could create an addressing scheme such as:

10.10.x.x = London
10.20.x.x = Frankfurt
10.30.x.x = New York
10.40.x.x = Singapore

Real enterprise designs can be considerably more complex.

Loopback

IPv4 loopback addresses are within 127.0.0.0/8. The most familiar is 127.0.0.1, which usually means this computer itself. Hostname: localhost.

APIPA

Windows may automatically assign an address in 169.254.0.0/16 when it cannot obtain a normal IPv4 address through DHCP. If you run ipconfig and see 169.254.x.x, that is often an immediate clue that DHCP communication failed.

IPv6

IPv6 was designed as the successor to IPv4. IPv6 addresses contain 128 bits, dramatically increasing the available address space compared with IPv4's 32 bits. Example: 2001:db8:85a3::8a2e:370:7334. IPv6 supports address types including global unicast, link-local, multicast, and anycast. IPv6 does not use broadcast in the same way IPv4 does.

IPv6 Link-Local Addresses

IPv6 interfaces normally have link-local addresses beginning with fe80::, used for communication on the local link.

IPv4 and IPv6 in Global Companies

Many organisations currently operate IPv4 only, dual-stack IPv4/IPv6, IPv6 internally in selected environments, or IPv6 in cloud or Internet-facing environments. Consequently, IT professionals need to understand both. Do not assume IPv6 is something that can simply be ignored because an organisation historically used IPv4.

Legacy Concept – Classful Networking

Older networking materials describe Class A, Class B, and Class C networks. Modern networks generally use CIDR – Classless Inter-Domain Routing. You should understand classful terminology because older engineers, documentation and systems may still refer to it. However, designing networks purely around class A/B/C boundaries is legacy thinking.

5🧡 Subnets

Subnetting divides a larger network into smaller networks. Suppose a company owns 10.20.0.0/16. Instead of placing thousands of devices on one enormous Layer 2 network, it can divide the space:

10.20.10.0/24 – Employee laptops
10.20.20.0/24 – Servers
10.20.30.0/24 – Printers
10.20.40.0/24 – Voice
10.20.50.0/24 – CCTV
10.20.60.0/24 – Guest Wi-Fi

This provides better organisation, smaller broadcast domains, easier routing, better security, easier troubleshooting, and better policy enforcement.

CIDR Notation

You will frequently see 192.168.1.0/24. The /24 means that 24 bits identify the network. Equivalent subnet mask: 255.255.255.0.

Common Subnet Sizes

Traditional IPv4 subnet calculations generally reserve a network address and broadcast address, although infrastructure and cloud platforms can reserve additional addresses depending on implementation.

Example /24 Network

Consider 192.168.10.0/24. Network: 192.168.10.0. Common usable host range: 192.168.10.1–192.168.10.254. Broadcast: 192.168.10.255.

Example /26

Take 192.168.10.0/26. The block size is 64, so the subnets are:

192.168.10.0/26
192.168.10.64/26
192.168.10.128/26
192.168.10.192/26

Understanding this is important when configuring firewalls, VPNs, routing, cloud VPCs/VNets, access control lists, and IP allowlists.

Why Cybersecurity Professionals Need Subnetting

Imagine someone asks:

"Please allow 10.20.32.0/21 through the firewall."

You need to understand what addresses that includes. Similarly, if an attacker is observed connecting from 172.16.50.20, you need to understand whether the address is public, private, internal, or part of a known subnet. Subnetting is not just something network engineers use — SOC analysts, cloud engineers, security engineers and systems administrators use it constantly.

6🚪 Default Gateway

A device needs to know where to send traffic destined for another network. This is normally the job of the default gateway. Example workstation:

IP address:     192.168.10.50
Subnet mask:    255.255.255.0
Gateway:        192.168.10.1
DNS:            10.50.1.10

If the workstation wants to communicate with 192.168.10.60, the destination is local. If it wants to communicate with 8.8.8.8, that destination is outside the local subnet. The packet is therefore sent towards 192.168.10.1, the default gateway.

A common troubleshooting test is therefore ping <default-gateway>.

7📜 DNS

DNS stands for Domain Name System. DNS translates human-readable names into information computers can use. For example www.company.com might resolve to 203.0.113.50. Without DNS, users would have to remember IP addresses for services.

Simplified DNS Resolution

A user enters portal.company.com. Their computer asks "what IP address belongs to portal.company.com?" A DNS resolver eventually returns an answer, and the application can then connect to that IP.

Recursive and Authoritative DNS

DNS infrastructure generally includes recursive resolvers, which find answers on behalf of clients, and authoritative DNS servers, which hold authoritative information about a domain.

Simplified DNS Hierarchy

Caching means this complete process does not necessarily occur for every request.

Important DNS Records

DNS in Active Directory

DNS is extremely important to Active Directory. Windows computers locate services such as domain controllers through DNS. If DNS is incorrectly configured, users may experience domain login problems, Group Policy failures, domain join failures, Kerberos issues, and application problems. One of the classic Active Directory mistakes is configuring corporate computers to use public DNS servers instead of the organisation's internal DNS infrastructure.

Split DNS

Global organisations commonly maintain different answers depending on where the request originates. Internal users might receive portal.company.com → 10.50.10.20; Internet users might receive portal.company.com → 203.0.113.20. This is sometimes called split DNS, or split-horizon DNS.

DNS Security

Modern DNS environments may use DNSSEC, DNS filtering, DNS logging, DNS over HTTPS, DNS over TLS, and protective DNS services. Security teams frequently investigate DNS because malware also needs to locate infrastructure — unusual DNS activity may therefore provide an important security signal.

DNS Troubleshooting

Windows: nslookup google.com. PowerShell: Resolve-DnsName google.com. Linux/macOS: dig google.com or nslookup google.com.

If ping 8.8.8.8 works but ping google.com does not, investigate DNS.

8🏷️ DHCP

DHCP stands for Dynamic Host Configuration Protocol. Without DHCP, administrators would have to manually configure every device with an IP address, subnet mask, gateway, DNS servers, and other network parameters. DHCP automates this process.

The DHCP DORA Process

A simplified IPv4 DHCP process — remember DORA:

DHCP Scope

A DHCP server may have a scope such as 10.20.10.100–10.20.10.250, and could provide a subnet mask, gateway, and DNS servers along with the lease.

DHCP Reservations

Some devices should consistently receive the same address. A DHCP reservation can associate a MAC address with a specific IP address — typical examples include printers, appliances, and infrastructure devices.

DHCP Relay

The DHCP server may not exist on the same subnet as the client. Enterprise routers and switches can relay DHCP requests between networks. Cisco environments historically use configurations such as ip helper-address. Without the relay configuration, a newly created VLAN might be unable to obtain DHCP addresses.

DHCP Troubleshooting

Windows: ipconfig /all. Release: ipconfig /release. Renew: ipconfig /renew. If the computer receives 169.254.x.x, investigate the DHCP server, VLAN, DHCP relay, switch configuration, Wi-Fi network, or DHCP scope exhaustion.

IPv6 Address Assignment

IPv6 introduces additional concepts including SLAAC, DHCPv6, and Router Advertisements. IPv6 addressing therefore should not simply be thought of as "IPv4 DHCP with longer addresses."

9🔐 NAT

NAT stands for Network Address Translation. NAT modifies IP addressing as traffic passes through a network device. One common use is allowing privately addressed devices to communicate with the Internet.

Example

Internal laptop 192.168.1.50 accesses a website through a public firewall address 198.51.100.25. The Internet server sees traffic originating from 198.51.100.25 rather than 192.168.1.50.

PAT

Many devices can share a single public IP address by using different port mappings — commonly called PAT / Port Address Translation / NAT overload:

192.168.1.10:50001  →  198.51.100.25:40001
192.168.1.20:50001  →  198.51.100.25:40002

SNAT

Source NAT modifies the source address. Commonly used for outbound connections.

DNAT

Destination NAT modifies the destination address. It may be used to publish an internal service externally, for example 198.51.100.50:443 → 10.20.30.40:443.

NAT in Cloud Environments

Cloud providers implement the same concepts using managed networking components. AWS uses VPC route tables to determine where subnet traffic should be directed, with possible targets including Internet gateways, NAT gateways, VPN connections and peering connections. Azure similarly provides managed NAT Gateway functionality for outbound connectivity from virtual network subnets. The implementation is cloud-based, but the underlying networking principles remain familiar.

NAT Is Not a Firewall

A common beginner mistake is: "NAT protects the network, therefore NAT is a firewall." NAT and firewalling are different concepts — a firewall decides whether traffic should be permitted, NAT modifies addressing. A device may perform both jobs, but they are not the same function.

10🔌 Ports

An IP address identifies a system. A port helps identify a service on that system. Think of it as: IP address = building address, port = room or department. For example 10.10.20.50:443 means host 10.10.20.50, port 443.

Source and Destination Ports

Suppose your laptop opens a website. It might create a connection from source 192.168.1.50:53124 to destination 203.0.113.50:443. The client's source port is usually dynamically selected; the server listens on 443.

Port Ranges

Ports range from 0–65535: well-known ports 0–1023, registered ports 1024–49151, and dynamic/private ports 49152–65535. Exact operating system behaviour can differ.

Important Ports to Recognise

You do not need to memorise every port on the Internet. However, IT professionals should recognise common ones.

Ports alone do not guarantee which application is running. An administrator could technically configure SSH on TCP 5000. Port numbers are conventions, not absolute proof of an application.

Legacy Protocols

Students should recognise protocols that are considered insecure or legacy: Telnet (TCP 23), FTP (TCP 21), HTTP (TCP 80), TFTP (UDP 69). The problem is not necessarily that using the port itself is insecure — the underlying protocol may transmit information without appropriate encryption. Modern alternatives: Telnet → SSH, FTP → SFTP/FTPS, HTTP → HTTPS.

Legacy systems may still depend on these protocols, particularly manufacturing, industrial environments, banking, government, embedded devices, and older network equipment. Never assume something does not exist simply because it should have been retired.

11🛡️ Firewalls

A firewall controls network traffic according to rules or policies:

Basic Firewall Rule

Source:      10.20.10.0/24
Destination: 10.50.20.10
Protocol:    TCP
Port:        443
Action:      ALLOW

This means users from that subnet can access HTTPS on the specified server.

Stateless Firewalls

Stateless filtering considers individual packets according to rules.

Stateful Firewalls

Stateful firewalls track connections. If an internal user initiates Client → Website, the firewall understands that the website's response belongs to an established connection. Most enterprise firewalls perform stateful inspection.

Next-Generation Firewalls

Modern enterprise products may provide application identification, IPS, IDS, malware inspection, URL filtering, TLS inspection, user-based policies, VPN, threat intelligence, DNS security, and sandboxing. Common enterprise vendors include Palo Alto Networks, Fortinet, Check Point, Cisco, and Juniper. Different organisations use different products, but the underlying concepts are transferable.

Host Firewalls

Firewalls can also exist directly on endpoints — Windows Defender Firewall, Linux nftables/iptables, macOS firewall technologies. This means a connection can be blocked even when the corporate network firewall allows it. Always consider both the network firewall and the host firewall.

Cloud Firewalls

Cloud platforms introduce controls such as AWS Security Groups, AWS Network ACLs, Azure Network Security Groups, Azure Firewall, and Google Cloud firewall policies. Students should avoid thinking that moving an application to the cloud eliminates networking — cloud environments still have IP addresses, subnets, routes, firewalls, DNS, NAT, and VPNs. They are simply software-defined.

WAF

A Web Application Firewall is different from a traditional Layer 3/4 firewall. A WAF understands HTTP/HTTPS application traffic and can detect patterns associated with SQL injection, cross-site scripting, malicious HTTP requests, bots, and application attacks.

Traditional firewall asks: "Can IP A connect to IP B on TCP 443?" A WAF asks: "What is actually contained inside this HTTP request?"

Firewall Drop vs Reject

A firewall can potentially drop (silently discard traffic — the client may continue waiting until a timeout occurs) or reject (actively respond that the traffic is not permitted). These behaviours can produce very different troubleshooting symptoms.

12🔒 VPNs

VPN stands for Virtual Private Network. VPNs create protected communication across networks that may not be trusted — common scenarios include remote employees, office-to-office connectivity, data centre-to-cloud connectivity, business partner connections, and administrator access.

Remote Access VPN

After connecting, the employee may receive access to internal resources.

Site-to-Site VPN

Azure VPN Gateway, for example, supports architectures including site-to-site and point-to-site VPN connectivity.

IPsec

IPsec is extensively used for site-to-site VPNs. Important concepts include IKE, encryption, authentication, security associations, encryption domains, pre-shared keys, and certificates. You do not need to master every IPsec parameter at beginner level, but you should understand the purpose.

SSL/TLS VPN

Many remote-access products use TLS-based connectivity. This can often traverse corporate Internet environments more easily than older VPN protocols.

WireGuard

WireGuard is a modern VPN protocol designed around a comparatively small and simple architecture. It is increasingly common in Linux, cloud environments, consumer VPNs, remote administration, and modern networking products.

Legacy VPN Technologies

You may encounter PPTP, L2TP, older IPsec implementations, or older proprietary VPN clients. PPTP is considered obsolete for security-sensitive use. Older organisations may nevertheless contain legacy VPN dependencies.

Split Tunnelling vs Full Tunnelling

With split tunnelling, corporate traffic goes over the VPN while Internet traffic uses the local Internet connection. With full tunnelling, both corporate and Internet traffic go over the VPN. Full tunnelling gives the organisation greater inspection and policy control but increases bandwidth requirements.

VPN Security

Modern remote access commonly combines VPN technology with MFA, device certificates, endpoint compliance, and conditional access / identity-based policies. Some organisations are replacing parts of traditional VPN architecture with Zero Trust Network Access – ZTNA.

Instead of "you connected to the VPN, so you can access the network," ZTNA attempts to make access decisions based on identity, device, application, risk, authentication strength, and policy. VPNs remain extremely common, however.

13🧭 Routing

Routing determines how packets travel between networks. A router examines the destination IP address and determines where the packet should go next.

Route Table

Destination        Next Hop
10.10.0.0/16       Internal
10.20.0.0/16       10.1.1.2
172.16.0.0/16      VPN
0.0.0.0/0          Internet Router

Default Route

IPv4 default route: 0.0.0.0/0 — essentially "if there is no more specific route, send the traffic here." IPv6 default route: ::/0.

Longest Prefix Match

Routers normally prefer the most specific matching route. Suppose the routing table contains 10.0.0.0/8, 10.50.0.0/16, and 10.50.20.0/24. Traffic destined for 10.50.20.25 matches all three — the /24 route is the most specific and therefore wins. Understanding this becomes extremely important when troubleshooting complex enterprise and cloud environments.

Static Routing

An administrator manually creates the route, for example 10.50.0.0/16 via 10.20.1.1. Static routes are simple, predictable, and easy to understand, but become difficult to manage at very large scale.

Dynamic Routing

Dynamic routing protocols allow routers to exchange information — important protocols include OSPF, BGP, IS-IS, EIGRP, and RIP.

OSPF (Open Shortest Path First) is a link-state Interior Gateway Protocol commonly used inside organisations, remaining supported in current enterprise and SD-WAN networking platforms. OSPF environments contain areas, neighbours, costs, LSAs, and DR/BDR concepts.

BGP (Border Gateway Protocol) is critical to the Internet, used to exchange routing information between autonomous systems. Large enterprises also use BGP internally for cloud connectivity, data centres, MPLS, SD-WAN, and WAN connectivity. Cloud technologies such as AWS Direct Connect and Azure ExpressRoute also commonly interact with BGP.

RIP (Routing Information Protocol) is historically important but largely considered legacy for significant enterprise deployments — it uses relatively simplistic route selection and does not scale as well as more modern protocols. You may still see it in exams, old networks, old documentation, and lab environments.

EIGRP has historically been strongly associated with Cisco environments. You may encounter it in established enterprise networks, although organisations increasingly favour technologies with broader multi-vendor adoption.

Routing Loops

Incorrect routing can cause packets to bounce between routers. IP prevents packets from circulating forever through its TTL/Hop Limit mechanism. Traceroute takes advantage of this behaviour.

14🔭 Switching

Switches connect devices within Ethernet networks. A switch learns which MAC addresses are reachable through which ports, storing this in a MAC/CAM table.

Switch vs Router

Very simply: a switch primarily connects devices inside Layer 2 networks; a router connects different Layer 3 networks. Modern enterprise switches may perform both Layer 2 and Layer 3 functions — these are often called Layer 3 switches.

VLANs

VLAN stands for Virtual Local Area Network. VLANs logically separate devices even when they share physical switches, for example VLAN 10 (Corporate Users), VLAN 20 (Servers), VLAN 30 (Voice), VLAN 40 (CCTV), VLAN 50 (Guest Wi-Fi). A device in VLAN 10 cannot communicate directly at Layer 2 with VLAN 20 — routing is required between them.

Why VLANs Matter for Security

If Guest Wi-Fi and Finance Servers existed on the same unrestricted network, that would be a serious security concern. Instead, the guest VLAN should route only through a firewall to the Internet — the network should prevent guests from accessing sensitive corporate systems.

Access Ports and Trunk Ports

An access port normally belongs to one VLAN, for example a switch port carrying VLAN 10 to an employee laptop. A trunk can carry multiple VLANs between switches, using IEEE 802.1Q tagging.

Inter-VLAN Routing

If 10.10.10.50 is in VLAN 10 and 10.20.20.50 is in VLAN 20, communication normally requires routing — this might occur on a router, Layer 3 switch, or firewall.

Spanning Tree Protocol

Redundant network links are important, but redundant Layer 2 paths can create loops. A Layer 2 loop can produce a broadcast storm, potentially making the network unusable. Spanning Tree Protocol helps prevent this by logically blocking redundant paths until required. Versions include STP, RSTP, and MSTP. Legacy networks may still use older STP designs; modern environments frequently use RSTP/MSTP or architectures that reduce reliance on large Layer 2 domains.

Link Aggregation

Multiple physical connections can sometimes operate together — technologies include LACP and EtherChannel (Cisco terminology). Benefits include additional capacity and redundancy.

PoE

PoE stands for Power over Ethernet. It allows Ethernet cabling to provide power — common devices include Wi-Fi access points, IP phones, CCTV cameras, and IoT devices.

15📋 ARP

ARP stands for Address Resolution Protocol. ARP connects the IPv4 Layer 3 world to Ethernet Layer 2 communication. Suppose Computer A (192.168.1.10) needs to communicate with 192.168.1.20 — it knows the destination IP but needs the destination MAC address. ARP effectively asks "who has 192.168.1.20?" and the destination replies with its MAC address.

View ARP Cache

Windows: arp -a. Linux: ip neigh.

ARP and Cybersecurity

ARP was not designed with strong authentication. This enables attacks such as ARP spoofing, ARP poisoning, and man-in-the-middle attacks. Enterprise switches may therefore use protections including DHCP snooping, Dynamic ARP Inspection, and port security.

IPv6 and ARP

IPv6 does not use ARP. IPv6 uses Neighbour Discovery Protocol, which is based on ICMPv6.

16🏢 Enterprise Network Architecture

A traditional global corporate environment might look like:

Modern organisations increasingly combine on-premises + AWS + Azure + SaaS + remote workers — this is known as a hybrid environment.

Three-Tier Campus Architecture

Traditional enterprise campus networks often use an access layer (where endpoints — PCs, phones, printers, Wi-Fi APs — connect), a distribution layer (aggregates access switches and provides routing/policy), and a core layer (high-speed network backbone). Smaller organisations may use a collapsed design combining distribution and core functions.

DMZ

DMZ stands for Demilitarised Zone. Internet-facing systems may be separated from internal systems:

Possible DMZ systems include reverse proxies, web servers, VPN gateways, email gateways, and public DNS infrastructure. Cloud architecture implements similar concepts through separate subnets, firewalls, load balancers and security policies.

17🌐 Enterprise WAN Technologies

Global companies need connectivity between offices, data centres and cloud environments. Historically this has included leased lines, Frame Relay, ATM, and MPLS. Modern networks increasingly use Internet VPN, SD-WAN, cloud interconnect, and SASE architectures.

MPLS

MPLS stands for Multiprotocol Label Switching. Telecommunications providers have used MPLS extensively to build private enterprise WANs:

London ─────┐
Paris ──────┼── MPLS Provider ── Data Centre
Frankfurt ──┘

Benefits historically included predictable connectivity, QoS, private WAN connectivity, and provider management. Disadvantages can include cost, provisioning time, and provider dependency. MPLS remains in use globally — it has not simply disappeared because SD-WAN exists.

SD-WAN

SD-WAN stands for Software-Defined Wide Area Networking. It can intelligently use different connectivity methods such as broadband Internet, fibre, MPLS, 4G, and 5G. Instead of manually managing every branch router independently, administrators can centrally define policies — for example, Microsoft 365 traffic via local Internet breakout, a financial application via private WAN, and backup traffic via a secondary ISP. Major networking vendors provide SD-WAN solutions.

18☁️ Cloud Networking

Cloud computing does not remove networking — it makes networking programmable. Consider AWS:

AWS VPC  10.50.0.0/16
        |
        +--- Public Subnet
        |       |
        |     Load Balancer
        |
        +--- Private Application Subnet
        |
        +--- Private Database Subnet

AWS route tables contain routes directing traffic towards destinations such as Internet gateways, NAT gateways, VPNs and other network connections.

Azure

Microsoft Azure uses terminology including VNet, Subnet, Network Security Group, route table, NAT Gateway, VPN Gateway, ExpressRoute, Azure Firewall, and Private Endpoint. Azure's networking portfolio also provides services for hybrid connectivity, firewalls, DNS, load balancing and global networking.

AWS

Common AWS networking technologies include VPC, subnets, route tables, Internet Gateway, NAT Gateway, Security Groups, Network ACLs, Transit Gateway, Direct Connect, Site-to-Site VPN, Route 53, VPC Peering, and PrivateLink.

Google Cloud

Google Cloud provides similar concepts using VPC, subnets, Cloud Router, Cloud NAT, Cloud VPN, Cloud Interconnect, firewall policies, and Cloud DNS.

Once networking fundamentals are understood, moving between cloud providers becomes much easier. The names change. The concepts often do not.

19🏭️ Modern Data Centre Networking

Modern data centres may use leaf-spine architectures, VXLAN, EVPN, BGP, and software-defined networking. Traditional data centre design relied heavily on VLANs and Spanning Tree. Large modern environments may use Layer 3 fabrics and overlay networking to improve scale, redundancy, automation, and workload mobility.

Beginners do not need to configure EVPN/VXLAN immediately. They should recognise the terminology when encountering modern enterprise architecture diagrams.

20🎫 Network Access Control

Modern organisations increasingly control not only "which IP can access which server?" but also "who is connecting?" Technologies include 802.1X, RADIUS, Network Access Control, and certificate authentication.

A laptop connecting to corporate Wi-Fi might have to authenticate as an employee, on a managed laptop, with a device certificate, before receiving normal corporate network access. Products from vendors such as Cisco, Aruba, Fortinet and others provide network access control capabilities.

21⌛ Legacy vs Modern Networking

IT professionals will often work with a mixture of generations of technology.

Do not assume a global enterprise is entirely modern. A multinational bank could simultaneously have modern Azure workloads, AWS applications, Cisco SD-WAN, MPLS circuits, 20-year-old applications, old FTP integrations, mainframes, and legacy network appliances. Understanding older technology therefore remains valuable.

22🧩 Network Troubleshooting Methodology

When something fails, avoid immediately blaming the firewall. Start systematically.

Each step narrows the search. By the time you reach a packet capture, you already know roughly which layer the problem lives in.

Lab🧭 Lab 1 — Learn Your Network Configuration

ipconfig /all

IPv4 Address:
IPv6 Address:
Subnet Mask:
Default Gateway:
DNS Servers:
DHCP Enabled:
DHCP Server:
Physical Address:

ip addr
ip route

Lab📡 Lab 2 — Ping

ping 8.8.8.8

Reply from 8.8.8.8: bytes=32 time=15ms TTL=117

ipconfig
ping <gateway>

ping 8.8.8.8
ping google.com

Lab🗺️ Lab 3 — Traceroute

1    1 ms     192.168.1.1
2    8 ms     10.100.0.1
3    12 ms    ISP-Router
4    18 ms    Transit-Router
5    20 ms    Destination

Lab📜 Lab 4 — DNS Troubleshooting

Lab🔌 Lab 5 — Port Testing

Test-NetConnection google.com -Port 443

Lab🦥 Lab 6 — Wireshark

dns                    # DNS traffic
icmp                   # ICMP (ping) traffic
tcp                    # TCP traffic
udp                    # UDP traffic
tcp.port == 443        # HTTPS TCP traffic
udp.port == 53         # DNS
ip.addr == 192.168.1.20  # specific IP (either direction)
ip.dst == 192.168.1.20   # traffic TO an IP
ip.src == 192.168.1.20   # traffic FROM an IP

Lab📡 Lab 7 — Capture a Ping

icmp

ping 8.8.8.8

Echo Request   your-IP  → 8.8.8.8
Echo Reply     8.8.8.8  → your-IP
Echo Request   your-IP  → 8.8.8.8
Echo Reply     8.8.8.8  → your-IP

Lab📜 Lab 8 — Capture DNS

dns

nslookup example.com

DNS Query      your-IP  → DNS-server   "example.com? (A)"
DNS Response   DNS-server → your-IP    "example.com is 93.184.x.x"

Lab🤝 Lab 9 — Capture a TCP Handshake

tcp.port == 443

your-IP:53124  → server:443   [SYN]
server:443     → your-IP:53124  [SYN, ACK]
your-IP:53124  → server:443   [ACK]

Lab🏷️ Lab 10 — DHCP Capture

ipconfig /release
ipconfig /renew

DHCP Discover
DHCP Offer
DHCP Request
DHCP ACK

Lab🌐 Lab 11 — Follow a Packet

🧩 Practical Troubleshooting Scenarios

Scenario 1 — "The Internet is down"

A user says "the Internet is down." Their config: IP 10.10.20.52, Gateway 10.10.20.1, DNS 10.10.1.10.

ping 10.10.20.1   → successful
ping 8.8.8.8      → successful
nslookup google.com → fails

What is probably wrong? DNS. The Internet itself is not necessarily down.

Scenario 2 — "I cannot access the finance server"

ping finance-server → successful
Test-NetConnection finance-server -Port 443 → fails

Layer 3 connectivity exists, but TCP 443 does not. Investigate the network firewall, the server's own firewall, whether the application is listening on that port, the service status, and any load balancer.

Scenario 3 — London works, Singapore doesn't

Possible causes: WAN routing, regional firewall policy, DNS differences, proxy configuration, VPN problem, cloud security rules, geo-restrictions, or a local ISP issue. This is a realistic multinational enterprise troubleshooting problem.

Scenario 4 — unreachable internal subnet

A server can reach 10.50.20.10 but not 10.60.20.10. Check route print / ip route — there may simply be no route to 10.60.20.0/24.

Scenario 5 — private AWS instance needs Internet access

An AWS application server at 10.50.20.50 needs Internet access but has no public IP:

AWS specifically documents private-subnet architectures where Internet-bound traffic is sent through a NAT gateway while avoiding unsolicited inbound Internet connections to the private instances. The principles are exactly the same concepts learned earlier: IP, subnet, route, NAT, gateway, firewall.

🧠 What You Should Be Able to Explain

Try answering each question yourself before revealing the model answer.

💼 Skills Relevant to Different Careers

Help Desk

IP addresses, DHCP, DNS, Wi-Fi, gateways, ping, VPN, basic ports.

Desktop Support

Everything above, plus VLAN concepts, switch ports, DHCP scopes, DNS troubleshooting, and packet captures.

Systems Administrator

Routing, firewalls, DNS infrastructure, DHCP servers, Active Directory DNS, VPN, server networking, VLANs.

Network Engineer

Much deeper into switching, OSPF, BGP, STP, QoS, wireless, MPLS, SD-WAN, VXLAN, EVPN, and network automation.

SOC Analyst

IP addresses, ports, protocols, DNS, TCP flags, network flows, firewalls, VPNs, proxies, packet captures. Without networking knowledge, interpreting security logs becomes considerably harder.

Security Engineer

Firewalls, WAFs, VPN, network segmentation, Zero Trust, cloud networking, IDS/IPS, TLS, DNS security, network access control.

Cloud Engineer

CIDR, subnets, route tables, NAT, DNS, VPN, firewalls, load balancing, peering, private connectivity, BGP. Cloud networking becomes much easier once traditional networking concepts are understood.

Penetration Tester

TCP/IP, ports, routing, VLANs, DNS, NAT, VPN, ARP, network segmentation, firewalls, packet captures. Many penetration-testing techniques are impossible to properly understand without networking fundamentals.

🏆 Final Module Challenge

Module 3 Key Principle

Do not try to memorise networking as hundreds of unrelated acronyms. Instead, always ask:

Where is the packet now, where does it need to go, and what device or protocol decides what happens next?

When troubleshooting, think:

If you can logically follow that path, you already have the foundation required for considerably more advanced subjects including Active Directory, Microsoft 365, Linux administration, cloud computing, cybersecurity, identity and access management, SOC operations, incident response, APIs, logs, and penetration testing.

Networking is not simply another topic within IT. It is the infrastructure that connects nearly every other topic in this course.