What networking fundamentals cover

This area is the foundation for the whole exam: how data actually gets from one device to another, and the shared language (the OSI model) used to describe it. Get this solid and everything else - cabling, routing, troubleshooting - slots into place.

The OSI model - 7 layers

Learn it bottom to top and top to bottom. A classic mnemonic: 'Please Do Not Throw Sausage Pizza Away'.

• Layer 1 Physical - bits, cables, connectors, voltages, hubs
• Layer 2 Data Link - frames, MAC addresses, switches, ARP sits here (conceptually)
• Layer 3 Network - packets, IP addresses, routers, routing
• Layer 4 Transport - segments, TCP and UDP, ports, reliability, flow control
• Layer 5 Session - opens, manages and closes sessions between apps
• Layer 6 Presentation - formatting, encryption, compression (SSL/TLS historically placed here)
• Layer 7 Application - the actual protocol the user-facing app talks, eg HTTP, FTP, DNS

Common mistakes

• Mixing up Layer 2 (MAC/switches) with Layer 3 (IP/routers) - a switch forwards by MAC, a router forwards by IP.
• Forgetting that a firewall can operate at multiple layers depending on type (packet-filtering = L3/L4, next-gen/application = up to L7).
• Thinking TCP/IP has the same 7 layers - it doesn't, it's a 4-layer model (Network Interface, Internet, Transport, Application) that maps loosely onto OSI.
• Confusing encapsulation direction: data is encapsulated (headers added) going DOWN the stack on send, and de-encapsulated going UP the stack on receive.

The PDU (protocol data unit) at each layer

Each layer has its own name for the data unit: Data (L7-5), Segment (L4), Packet (L3), Frame (L2), Bits (L1). The exam loves testing this sequence directly.

TCP vs UDP

• TCP is connection-oriented, uses a three-way handshake (SYN, SYN-ACK, ACK), guarantees delivery and order - used for web, email, file transfer.
• UDP is connectionless, no handshake, no guarantee - used for speed-critical traffic like VoIP, video streaming, DNS lookups.

Key numbers to lock in

• 7 OSI layers, 4 TCP/IP layers
• MAC address = 48 bits (6 bytes), written as 12 hex characters
• IPv4 address = 32 bits; IPv6 address = 128 bits
• Standard Ethernet MTU = 1500 bytes

Revise this by drawing the stack from memory with the PDU name and one device example against each layer - that single diagram covers a big chunk of exam marks.

Physical topologies

A topology describes how devices are physically or logically connected.

• Star: every device connects to a central switch. Most common in modern LANs — a single cable break only drops one device, but the switch is a single point of failure.
• Bus: all devices share one backbone cable with terminators at each end. Legacy Ethernet (10BASE2/5) — a single break takes the whole segment down.
• Ring: each device connects to exactly two neighbours forming a loop. Token Ring and some fibre metro networks (FDDI, SONET) use this — a single break can be tolerated if the ring is dual/counter-rotating.
• Mesh: full mesh means every device connects to every other device, giving n(n-1)/2 links for n nodes — very resilient but expensive to cable. Partial mesh links only the critical nodes.
• Hybrid: a mix of the above, e.g. a star-of-stars or extended star, common in real enterprise builds.

Network types by scale

• PAN (Personal Area Network): a few metres, e.g. Bluetooth pairing.
• LAN: a single site/building.
• WLAN: wireless version of a LAN.
• CAN (Campus Area Network): several buildings on one site.
• MAN (Metropolitan Area Network): a city.
• WAN: spans countries/continents, links multiple LANs, usually via a service provider.
• SD-WAN: software-defined WAN — centrally manages and steers traffic across multiple WAN links (MPLS, broadband, LTE) based on policy.

Deployment models

• On-premises: you own and run the hardware.
• Cloud: IaaS (rent infrastructure), PaaS (rent platform), SaaS (rent finished application).
• Hybrid: mix of on-prem and cloud, common for gradual migration.
• SASE: converges SD-WAN with cloud-delivered security (SWG, CASB, ZTNA, FWaaS) into one service edge.

Common architectures

• Three-tier hierarchical: core, distribution (aggregation), access layers — the classic campus design, each layer has a distinct job (core = fast forwarding, distribution = policy/routing, access = end-device connectivity).
• Collapsed core/spine-leaf: two-tier, used heavily in data centres — every leaf switch connects to every spine switch, giving predictable low-latency east-west traffic and easy scale-out.
• Software-defined networking (SDN): separates the control plane from the data plane, centralising decisions in a controller.

Common mistakes

• Confusing physical topology (how cables run) with logical topology (how data actually flows) — Ethernet is physically star but logically behaves like a bus/switch fabric.
• Forgetting mesh link-count math: for 5 nodes full mesh that's 5x4/2 = 10 links, not 5.
• Assuming SD-WAN and SDN are the same thing — SDN is generally LAN/data-centre control-plane separation, SD-WAN is WAN-link management and traffic steering.
• Mixing up spine-leaf (data centre, non-blocking, two-tier) with three-tier hierarchical (campus, core/distribution/access).

What IP addressing is for

Every device on a network needs a unique address so traffic knows where to go. Network+ tests both IPv4 and IPv6, plus the subnetting maths that splits one big network into smaller, manageable pieces.

IPv4 basics

An IPv4 address is 32 bits, written as four decimal octets (0-255) separated by dots, eg 192.168.1.10. The subnet mask marks which bits are network and which are host - eg 255.255.255.0 (/24) means the first 24 bits are network, leaving 8 bits (256 addresses, 254 usable) for hosts.

CIDR notation

CIDR (Classless Inter-Domain Routing) writes the mask as a slash and a bit count, like /24 or /26. Usable hosts = 2^(host bits) - 2, because the first address is the network ID and the last is the broadcast address. A /30 gives 4 addresses, 2 usable - perfect for a point-to-point link.

Private address ranges (RFC 1918)

• Class A: 10.0.0.0 - 10.255.255.255 (/8)
• Class B: 172.16.0.0 - 172.31.255.255 (/12)
• Class C: 192.168.0.0 - 192.168.255.255 (/16)

These never route on the public internet - NAT translates them at the edge.

Special addresses to know

• 127.0.0.1 is loopback (localhost).
• 169.254.x.x is APIPA - a device gives itself this when DHCP fails.
• 255.255.255.255 is the limited broadcast address.
• 0.0.0.0/0 in routing means 'any network' (default route).

Subnetting method

Work out the block size by subtracting the interesting octet's mask value from 256. Eg mask 255.255.255.192 (/26): 256-192=64, so subnets run 0, 64, 128, 192. Each subnet's broadcast is the next subnet's start minus 1. Practise this both ways - given a mask, find the subnets; given a required host count, find the smallest mask that fits.

IPv6 essentials

128-bit address written in 8 groups of hex, eg 2001:0db8::1. Leading zeros in a group can be dropped, and one run of consecutive all-zero groups can be shortened to '::' (only once per address). fe80::/10 is link-local, and there's no broadcast in IPv6 - multicast replaces it.

Common exam traps

• Forgetting to subtract 2 for network and broadcast addresses.
• Confusing the network ID with a usable host address.
• Mixing up /24 (256 addresses) with 255.255.255.0 - they're the same thing written differently, so be fluent converting between them.
• Applying '::' shortcut twice in one IPv6 address (not allowed).

Why network operations & monitoring matters

Network+ tests whether you can keep a network healthy day to day, not just build it once.

This means documentation, monitoring protocols, log management, and business continuity concepts.

Documentation you must know

• Physical and logical network diagrams show cabling versus IP/VLAN layout.
• Wiring diagrams, rack diagrams and IDF/MDF documentation locate hardware.
• Standard operating procedures (SOPs) and policies keep changes consistent.
• A baseline is the normal performance snapshot used to spot anomalies later.

Monitoring protocols and tools

• SNMP (Simple Network Management Protocol) polls devices for status; v1 and v2c use plain-text community strings, v3 adds authentication and encryption - always prefer v3.
• SNMP traps are unsolicited alerts sent from a device to the manager when a threshold is breached.
• Syslog collects log messages centrally; severity levels run 0 (Emergency) to 7 (Debug) - lower number means more severe.
• NetFlow (Cisco) and sFlow/IPFIX (vendor-neutral) capture flow data for traffic analysis and capacity planning.
• Packet capture (e.g. Wireshark) inspects traffic at the frame level for deep troubleshooting.
• SIEM (Security Information and Event Management) aggregates logs from many sources for correlation and alerting.

Performance metrics

• Bandwidth is the maximum capacity; throughput is what's actually achieved.
• Latency is delay (measured in ms); jitter is the variation in latency, critical for VoIP.
• Packet loss is the percentage of packets that never arrive; anything above roughly 1-2% harms VoIP/video quality.

Availability and continuity concepts

• Uptime is often expressed as 'nines': 99.9% ('three nines') allows about 8.76 hours downtime a year; 99.999% ('five nines') allows about 5.26 minutes a year.
• MTBF (Mean Time Between Failures) measures reliability; MTTR (Mean Time To Repair) measures how fast you recover.
• RTO (Recovery Time Objective) is the target time to restore service; RPO (Recovery Point Objective) is the acceptable data loss window, both set by business needs not IT preference.
• Redundancy methods include NIC teaming, multipathing, clustering, and diverse ISP paths.

Common mistakes

• Confusing SNMP polling with SNMP traps - polling is pull, traps are push.
• Mixing up MTTR (repair) with MTBF (between failures) - they measure opposite things.
• Assuming higher syslog severity numbers mean more urgent - it's the reverse, 0 is worst.
• Forgetting that a baseline must be captured BEFORE a problem, so you can compare against normal.

Network security: the big picture

Network+ tests defence in depth - layering controls so no single failure exposes the network. Expect questions on device placement, wireless security, and remote access.

Firewalls and segmentation

• A firewall filters traffic by rules: source/destination IP, port, protocol.
• Stateful firewalls track connection state (the session); stateless ones inspect each packet alone.
• A DMZ (demilitarised zone) sits between two firewalls and hosts public-facing servers (web, mail) so a breach there does not reach the internal LAN.
• VLANs segment broadcast domains logically; combine with ACLs to stop lateral movement between segments.
• The screened subnet is another name for a DMZ - expect both terms.

AAA and access control

• AAA = Authentication (who you are), Authorization (what you can do), Accounting (logging what you did).
• RADIUS uses UDP (ports 1812/1813) and encrypts only the password; TACACS+ uses TCP port 49 and encrypts the whole packet - a classic exam trap.
• 802.1X provides port-based network access control, often paired with RADIUS for wired/wireless authentication (EAP).
• Least privilege: give users the minimum access needed, nothing more.

Wireless security

• WPA3 is the current standard: uses SAE (Simultaneous Authentication of Equals) instead of the old WPA2 PSK 4-way handshake, closing the KRACK vulnerability.
• WPA2 uses AES-CCMP; avoid WEP and WPA(1)/TKIP entirely - both are deprecated and insecure.
• Enterprise wireless (WPA2/3-Enterprise) authenticates each user via 802.1X/RADIUS rather than one shared key.

VPNs and remote access

• IPSec provides site-to-site or client VPNs using two modes: Transport (payload only) and Tunnel (whole packet, used for site-to-site).
• IPSec has two core protocols: AH (Authentication Header - integrity only, no encryption) and ESP (Encapsulating Security Payload - encryption and integrity).
• SSL/TLS VPNs (often via a web portal) need no special client software - simpler for remote users.

Threats and mitigations

• Know the difference: a vulnerability is a weakness, a threat is what could exploit it, and risk is the likelihood x impact.
• On-path (man-in-the-middle) attacks intercept traffic between two parties - mitigate with encryption and certificate checks.
• DoS floods a target; DDoS uses many distributed sources - mitigate with rate limiting and traffic scrubbing.
• Social engineering (phishing, tailgating) bypasses technical controls entirely - user training is the real defence.

Common mistakes

• Mixing up RADIUS (UDP, partial encryption) and TACACS+ (TCP, full encryption).
• Forgetting WPA3 uses SAE, not PSK, for its key exchange.
• Confusing AH (no encryption) with ESP (encrypts) in IPSec.

The troubleshooting methodology

CompTIA expects a repeatable process, not guesswork. Learn the seven steps in order:

• Identify the problem — gather info, question users, identify symptoms, duplicate the problem if possible, approach multiple problems individually.
• Establish a theory of probable cause — question the obvious first, consider common causes before rare ones.
• Test the theory to determine cause — once confirmed, work out the next step; if not confirmed, re-theorise or escalate.
• Establish a plan of action and identify potential effects.
• Implement the solution or escalate.
• Verify full system functionality and, if applicable, implement preventive measures.
• Document findings, actions, outcomes and lessons learned.

Cable and physical-layer problems

Check the physical layer first — it is the cheapest and fastest thing to rule out.

• Attenuation (signal weakens over distance), latency and jitter all point to cabling or interference.
• Crosstalk (near-end NEXT, far-end FEXT) comes from untwisted pairs or poor termination.
• Wrong cable category (Cat5e vs Cat6a) or exceeding the 100 metre copper Ethernet limit causes intermittent drops.
• Open/short circuits, bad connectors (TIA/EIA-568A vs 568B mismatches) and split pairs are found with a cable tester or TDR (time-domain reflectometer).
• Fibre issues need an OTDR (optical time-domain reflectometer) or a light meter to check dB loss.

Common software and configuration issues

• Duplicate IP address — two devices with the same IP causes intermittent connectivity; the OS will usually warn you.
• Incorrect subnet mask or default gateway stops traffic leaving the local segment.
• DNS problems (wrong server, expired record, no reverse lookup) look like 'the internet is down' but only name resolution has failed — test with ping to an IP versus a hostname.
• DHCP scope exhaustion or APIPA addresses (169.254.x.x) mean a client couldn't lease an IP.
• VLAN mismatch — a port assigned to the wrong VLAN cuts a device off from its expected network silently.
• Asymmetrical routing and routing loops cause one-way traffic or high latency.

Wireless-specific issues

• Interference from other 2.4GHz devices (microwaves, Bluetooth) or channel overlap.
• Wrong SSID, weak signal (RSSI), or wrong encryption (WPA2 vs WPA3) causing failed associations.
• Antenna placement, absorption and reflection cause dead zones.

Common mistakes to avoid

• Skipping the identify step and jumping straight to fixing — you may fix the wrong thing.
• Not documenting the fix, so the same fault recurs and nobody learns from it.
• Changing multiple variables at once, making it impossible to know what actually fixed it.
• Forgetting to verify full functionality after the fix — a partial fix can look complete but isn't.

Key tools to know

• ping, traceroute/tracert, nslookup/dig, ipconfig/ifconfig, netstat, arp -a, tcpdump/Wireshark, and cable testers/toner probes for physical faults.