The OSI Model and the TCP/IP Stack
Networking uses layered reference models so that each function can be designed, taught and troubleshot in isolation. The OSI model splits communication into seven layers: physical, data link, network, transport, session, presentation and application. The TCP/IP stack that real networks actually run collapses those into four: network access (link), internet, transport and application. Data moves down the sending stack, gaining a header at each layer in a process called encapsulation, and moves back up the receiving stack as each header is stripped off during de-encapsulation. The name for the data unit changes as it descends: a segment at transport, a packet at the network layer, a frame at the data link layer and bits on the wire. On the CCNA you are constantly asked to map a device, protocol or symptom to a layer, so learn which layer owns which addressing scheme: MAC addresses at layer 2, IP addresses at layer 3, port numbers at layer 4.
Exam tip. When a question describes a symptom, translate it into a layer before you answer. A link that is up but with no IP reachability points at layer 3, a port that never comes up points at layer 1 or 2, and an application that fails while ping succeeds points above layer 3.
Network Components and Device Roles
The CCNA expects you to describe what each box in a network diagram does, not just to configure it. Routers connect different IP networks and make forwarding decisions using the routing table, breaking up broadcast domains. Layer 2 switches forward Ethernet frames using a MAC address table and break up collision domains, while layer 3 switches add routing between VLANs at hardware speed. Firewalls enforce policy between security zones and are usually stateful, tracking connections rather than inspecting each packet independently. Access points provide the wireless medium, and in a controller-based design they tunnel client traffic to a wireless LAN controller. Endpoints and servers are the things the network exists to connect, and Power over Ethernet lets a switch power access points, phones and cameras over the same copper cable that carries their data.
Exam tip. Learn the domain counting rule cold: a switch creates one collision domain per port and one broadcast domain per VLAN, while a router creates one broadcast domain per routed interface. Questions phrase this as 'how many broadcast domains exist in this topology'.
Network Topology Architectures
Campus and data centre networks follow recognisable design patterns, and the exam asks you to characterise them. A two-tier collapsed core design merges the core and distribution layers and suits small to medium sites. A three-tier design keeps access, distribution and core separate so that the core stays fast and simple while policy and aggregation live at distribution. Data centres increasingly use spine and leaf, where every leaf connects to every spine and no leaf connects to another leaf, giving predictable east to west latency of exactly two hops. Outside the campus you have WAN designs joining sites over provider circuits, small office and home office designs that collapse routing, switching, wireless and firewalling into one box, and cloud designs where some or all of the workload moves off premises.
Exam tip. Remember that in spine and leaf a leaf never connects to another leaf and a spine never connects to another spine. Any answer that adds leaf to leaf links is wrong.
Cabling, Optics and Interface Issues
Choosing a physical medium is a trade between distance, bandwidth and cost. Copper twisted pair is cheap and simple but is limited to about 100 metres per link and is vulnerable to electromagnetic interference. Multimode fibre uses a wider core with LED or VCSEL sources and is the normal choice inside a building or data centre, reaching hundreds of metres. Single-mode fibre uses a narrow core with a laser source and carries signals for tens of kilometres, so it is used for campus backbones and WAN links. You also need to recognise the difference between straight-through and crossover copper, although most modern switch ports auto-negotiate the crossover with Auto-MDIX. Finally, learn to read interface counters: a duplex mismatch shows as late collisions on the half-duplex side, and cabling or optical faults show as CRC errors and input errors.
Exam tip. Late collisions on a link that is up almost always mean a duplex mismatch. Increasing CRC errors on both sides point at the physical medium instead.
TCP versus UDP and Common Port Numbers
TCP and UDP both sit at layer 4 and both use port numbers, but they solve different problems. TCP is connection oriented: it opens a session with a three-way handshake of SYN, SYN-ACK and ACK, numbers every byte so lost data can be retransmitted, acknowledges receipt, and uses a sliding window to control how much unacknowledged data may be in flight. That reliability costs a 20-byte minimum header and extra round trips. UDP is connectionless with an 8-byte header, no handshake, no retransmission and no ordering, which makes it the right choice for voice, video, DNS lookups and other traffic where a late packet is worse than a lost one. Applications that need reliability without TCP simply implement it themselves, which is exactly what TFTP does.
Exam tip. Memorise the everyday ports: FTP 20 and 21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67 and 68, TFTP 69, HTTP 80, NTP 123, SNMP 161 and 162, syslog 514, HTTPS 443. Questions often hinge on whether the port runs over TCP, UDP or both.
IPv4 Addressing, Subnetting and Private Address Space
An IPv4 address is 32 bits split into a network portion and a host portion by the subnet mask. Subnetting means borrowing host bits to create more networks, each with fewer hosts. For any prefix length the number of usable hosts is two to the power of the remaining host bits, minus two for the network address and the directed broadcast address. The block size, or increment, in the interesting octet is 256 minus the mask value in that octet, and that single trick answers most subnetting questions quickly: find the increment, count up to find the subnet the address falls in, and the last address before the next subnet is the broadcast. RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use, so these must be translated before traffic reaches the internet. Also recognise 169.254.0.0/16 as APIPA link-local, which signals that a host failed to reach a DHCP server.
Exam tip. Practise until you can find a subnet, its broadcast and its usable range in under fifteen seconds. Expect questions that give you a host count and ask for the smallest mask that fits, so know that a /30 gives two hosts for point-to-point links.
IPv6 Address Types and Formatting
IPv6 uses 128-bit addresses written as eight groups of four hexadecimal digits. Two compression rules apply: leading zeros in any group may be dropped, and one run of consecutive all-zero groups may be replaced by a double colon, but only once per address. Unlike IPv4 there is no broadcast; its job is done by multicast and anycast. Every interface that is IPv6 enabled automatically gets a link-local address from fe80::/10, used for neighbour discovery and as the next hop for routing, and it never leaves the local link. Global unicast addresses from 2000::/3 are the public, internet-routable range, and unique local addresses from fc00::/7 play a role similar to RFC 1918 private space. A standard subnet is a /64, with the last 64 bits forming the interface identifier, generated either by EUI-64 from the MAC address or randomly by SLAAC privacy extensions.
Exam tip. IPv6 has no broadcast address, so any answer offering one is wrong. Remember ff02::1 is all nodes on the link and ff02::2 is all routers on the link, which are common answer choices.
Switching Concepts: MAC Learning, Flooding and Forwarding
A switch builds its MAC address table by reading the source MAC address of every frame that arrives and recording it against the port it arrived on, together with a VLAN. When a frame arrives, the switch looks up the destination MAC address in that table: a hit means the frame is forwarded out one port only, which is unicast forwarding, and a miss means the frame is flooded out every port in the VLAN except the one it came from. Broadcast frames destined for ffff.ffff.ffff and unknown multicast are also flooded. Entries age out after a default of five minutes of inactivity so that the table stays accurate when hosts move. Because a frame is discarded on the port it arrived on, a switch never sends a frame back where it came from, and layer 2 loops are prevented by spanning tree rather than by any TTL in the frame.
Exam tip. Expect a diagram with an empty or partial MAC table and a question about what the switch does with one frame. Work it in order: learn the source, then look up the destination, then forward or flood.