CompTIA Network+ : visual study guide

OSI Model — 7 Layers

The 7 layers of the OSI model: what each one does, and how data gets wrapped as it travels.

📚

OSI Model Deep Dive: Where Protocols Live

A thorough exploration of all 7 OSI layers — what each layer adds to a packet, encapsulation/decapsulation as data moves through the stack, Protocol Data Units (PDUs) at each layer, and why the model matters for troubleshooting when something breaks.

📦

OSI Encapsulation: Data Wrapping Layer by Layer

How data is wrapped with headers as it travels down the OSI stack — application data becomes a TCP segment, then an IP packet, then an Ethernet frame, then physical bits — and unwrapped in reverse at the receiver. Includes PDU naming, what each layer adds, and why encapsulation enables protocol independence.

Physical Layer: Signals

How bits become electrical signals, light pulses, or radio waves — and travel from one device to another.

🖼️

Ethernet Frames

The structure of a Layer 2 Ethernet frame — preamble, MAC addresses, EtherType, payload, and FCS.

IP addressing, subnetting and DHCP

📍

IP Addresses Explained

Public vs private IPs, what they mean, and how NAT lets millions of devices share one public IP.

Subnets & Routing

How networks are divided into subnets and how routers forward packets between them.

IP Address Types & Ranges

Public vs private, loopback, link-local, multicast, and broadcast addresses — what each range means and when packets using them can cross a router.

6️⃣

IPv6 Addresses

IPv6 address format, types (link-local, global, multicast), NDP replacing ARP, and dual-stack operation.

🔢

IPv6 Addressing: Prefixes, Scopes & Address Types

How IPv6 addressing works beyond the basics — address format and compression rules, link-local vs global unicast vs ULA, prefix delegation (PD) from ISP to CPE, address scopes and their routing implications, and why every interface gets multiple IPv6 addresses.

🔢

IPv6 SLAAC — Auto-Configuration

How IPv6 devices configure their own addresses without DHCP using router advertisements and EUI-64 or random IIDs.

🌍

IPv4 Exhaustion & Address Conservation

How the Internet ran out of IPv4 addresses, how IANA and RIRs manage the remaining space, and the technical mechanisms (NAT, CGNAT, IPv6) that extended IPv4's lifespan.

NAT — Network Address Translation

How your router lets multiple devices share one public IP address using port mapping.

🔺

NAT Types: Full Cone, Symmetric, and Hairpinning

The four types of NAT (Full Cone, Restricted Cone, Port Restricted, Symmetric) and how they affect peer-to-peer connectivity — plus NAT hairpinning for same-network communication.

🗃️

IP Address Management (IPAM)

How IPAM systems track IP address allocation across subnets, integrate with DHCP and DNS to prevent conflicts, and enforce address policies.

🪪

DHCP — Getting an IP Address

The DORA process: how your device automatically gets an IP, subnet mask, gateway, and DNS server.

📋

DHCP Relay & Snooping

How DHCP relay agents forward broadcasts across subnets, and how DHCP snooping prevents rogue DHCP servers from hijacking address assignment.

💻

DHCP Options & PXE Boot

How DHCP option 43, 66, 67 enable network booting via PXE — BIOS requests an IP and a boot server address in the same DHCP exchange.

6️⃣

DHCPv6 & IPv6 Address Assignment

How DHCPv6 assigns IPv6 addresses statefully, how it differs from SLAAC (stateless autoconfiguration), and how the M/O flags in Router Advertisements control which method hosts use.

Switching and VLANs

🏷️

MAC Addresses & ARP

What MAC addresses are, how ARP discovers them, and what happens when two devices want to talk.

📢

Broadcast, Multicast & Unicast

The three ways to address network traffic: one-to-one, one-to-group, and one-to-all.

📍

ARP — Address Resolution

How ARP maps IP addresses to MAC addresses on a local network, ARP caching, and what happens when the cache entry expires.

🔀

Switches & VLANs

How switches learn MAC addresses, and how VLANs segment a network into isolated broadcast domains.

🔀

Ethernet Switching: MAC Tables, Flooding & Port Security

How Layer 2 switches work in depth — MAC address table learning and aging, unknown unicast flooding, broadcast domain containment, MAC flooding attacks and port security, and why switches outperform legacy hubs.

🌳

Spanning Tree Protocol

How STP eliminates loops in Ethernet networks by blocking redundant ports, electing a root bridge, and converging after a topology change.

🌳

STP vs RSTP: Spanning Tree Loop Prevention

How Spanning Tree Protocol prevents broadcast storms by blocking redundant paths — root bridge election, port roles, the slow STP convergence problem, and how RSTP achieves sub-second convergence with proposal/agreement.

🔗

Link Aggregation (LACP/802.3ad)

How LACP bonds multiple physical links into a single logical channel, distributing traffic across them for both redundancy and increased bandwidth.

🔗

LACP & Link Bonding: Aggregated Link Internals

How LACP (802.3ad) negotiates link aggregation between switches, LAG hashing algorithms that determine which link each flow uses, active vs passive LACP modes, LACP PDU exchange and port priority, bonding modes in Linux, and why LAG doesn't double throughput for a single TCP flow.

🔌

Ethernet Autonegotiation

How Ethernet autonegotiation (IEEE 802.3u) selects the best speed and duplex between two devices — and why duplex mismatches cause mysterious 50% throughput drops and late collision errors.

Power over Ethernet (PoE)

How PoE (IEEE 802.3af/at/bt) delivers DC power over Ethernet cables to IP cameras, access points, and VoIP phones — including power negotiation, budget management, and the difference between PoE standards.

Routing

IP Routing: How Routers Forward Packets

How a router makes forwarding decisions — longest prefix match, routing table vs FIB, administrative distance between routing protocols, recursive next-hop resolution, and what happens at each hop across the internet.

Static Routing

How manually configured static routes direct packets, why default routes matter, and how floating static routes provide automatic failover.

📏

RIP — Distance Vector Routing

How RIP routers share routing tables with neighbors, count hops to build a network map, and why RIP is limited to small networks.

🗂️

OSPF — Link State Routing

How OSPF routers discover neighbors, flood link state advertisements, and compute shortest paths with Dijkstra's algorithm.

🌍

BGP & Internet Routing

How BGP connects autonomous systems, routes packets across the internet, and what happens when it goes wrong.

Routing Algorithms: Link State vs Distance Vector

How link-state (OSPF) and distance-vector (RIP) algorithms discover topology and compute paths — Dijkstra's SPF, the Bellman-Ford equation, count-to-infinity, and why IS-IS and OSPF dominate modern networks.

⚖️

ECMP Load Balancing

How routers distribute traffic across multiple equal-cost paths using hashing, and the reordering problems that arise when paths change.

Policy-Based Routing (PBR)

How policy-based routing overrides the normal destination-based forwarding table to send traffic based on source IP, DSCP marks, port, or application — enabling traffic engineering beyond static routes.

Route Redistribution: Connecting Different Routing Protocols

How routers redistribute routes between OSPF, BGP, and static routes — administrative distance deciding which source wins, seed metrics when redistributing into RIP/OSPF, redistribution loops and how route maps prevent them, and the typical enterprise boundary where OSPF meets eBGP.

Network Convergence: How Routes Propagate After Failure

What happens in the seconds after a network link fails — IGP convergence with OSPF LSA flooding, BGP withdrawal propagation, the role of timers, and why convergence time determines how long users see an outage.

Ports, protocols and services

🤝

TCP 3-Way Handshake

How two computers establish a reliable connection before any data is sent.

TCP State Machine

The complete TCP connection lifecycle: LISTEN → ESTABLISHED → TIME_WAIT, what each state means, and why sockets pile up in CLOSE_WAIT or TIME_WAIT.

📦

UDP: When to Use It and Why

Why UDP's simplicity makes it the right choice for DNS, video streaming, VoIP, and gaming — the tradeoffs between TCP reliability overhead and UDP's speed, plus how QUIC builds reliability on top of UDP.

📖

DNS Resolution

How a domain name like 'example.com' gets translated into an IP address before connecting.

📋

DNS Record Types

The difference between A, AAAA, CNAME, MX, TXT, and SRV records — and when each is used.

⏱️

NTP Time Synchronization

How computers on the internet keep their clocks accurate using the Network Time Protocol hierarchy.

📊

SNMP Monitoring

How network management systems poll routers and switches with SNMP to collect metrics, and how traps alert on failures.

🚨

SNMP Traps & Alerts

How network devices send unsolicited SNMP Trap messages to NMS when events occur — link down, CPU spike, temperature threshold — and v3 authentication.

💻

SSH — Secure Shell

How SSH establishes an encrypted tunnel using key exchange, host authentication, and public-key login.

📁

FTP File Transfer

How FTP uses two separate TCP connections — one for commands, one for data — to transfer files.

📁

FTP Active vs Passive Mode

Why FTP uses two TCP connections (control and data), the fundamental difference between active and passive mode, and why passive mode is required when clients are behind NAT/firewalls.

📨

How Email Works (SMTP)

The full email delivery chain: SMTP relay, MX records, SMTP commands, and SPF/DKIM authentication.

📬

IMAP vs POP3: Email Retrieval Protocols

How email clients fetch mail from servers — IMAP4 folder sync and server-side storage vs POP3 download-and-delete, IMAP IDLE push notifications, IMAP flags and UIDs, and why IMAP won for multi-device access.

🪟

SMB/CIFS: Windows File Sharing

How SMB (Server Message Block) enables Windows file and printer sharing, how SMBv3 signing and encryption work, and the security vulnerabilities that made WannaCry possible.

📞

SIP Call Setup

How a VoIP call is established using the Session Initiation Protocol: INVITE, 100 Trying, 180 Ringing, 200 OK, and the RTP audio stream.

🏢

LDAP & Active Directory: Enterprise Identity

How Active Directory uses LDAP for directory queries, Kerberos for authentication, and LDAPS/SASL for security — the flow from user login to domain controller lookup to group membership resolution.

🌐

How a Web Request Works

What happens when you type a URL and press Enter — from your browser to the server and back.

Wireless

How WiFi Works

802.11 association, channels, WPA2 authentication, and why WiFi is slower than wired.

WiFi Bands: 2.4 / 5 / 6 GHz

Why the 2.4 GHz band is congested, how 5 GHz and 6 GHz provide more channels and less interference, and how to choose the right band.

📡

802.11 Frame Types

The three classes of WiFi frames: management (beacons, probe, association), control (ACK, RTS/CTS), and data — and what happens during the join process.

📻

CSMA/CA — WiFi Collision Avoidance

How WiFi devices take turns sharing a radio channel using carrier sense, random backoff, and acknowledgments — and why WiFi can't detect collisions like Ethernet.

🔐

WEP → WPA → WPA2 → WPA3

The evolution of WiFi security protocols: why WEP was broken, how WPA patched it, what WPA2 got right, and what WPA3 adds.

WPA2 — WiFi Authentication

How WPA2 authenticates devices to a WiFi network and derives unique per-session encryption keys via the 4-way handshake.

🐲

WPA3 — SAE Handshake

How WPA3's Simultaneous Authentication of Equals (Dragonfly) eliminates offline dictionary attacks and provides forward secrecy.

📡

Wi-Fi Roaming — 802.11r

How devices seamlessly hand off between access points as you walk through a building, and why 802.11r Fast BSS Transition eliminates the auth delay.

🚀

WiFi 6 — OFDMA & Target Wake Time

How WiFi 6 (802.11ax) uses OFDMA to serve multiple devices simultaneously, BSS coloring to reduce interference, and TWT to save battery life.

WiFi 7 (802.11be): MLO, 320 MHz & 4K-QAM

How WiFi 7 achieves up to 46 Gbps — Multi-Link Operation (MLO) aggregating 2.4+5+6 GHz simultaneously, 320 MHz channels doubling WiFi 6E bandwidth, 4096-QAM for denser encoding, multi-RU puncturing to work around interference, and the WiFi generation speed timeline from 802.11b to 802.11be.

MU-MIMO & Beamforming

How multiple antennas create directed signal beams to serve multiple clients simultaneously, and why this doubles throughput in real environments.

🔑

Captive Portal

How hotel and airport WiFi intercepts your HTTP traffic to show a login page before granting internet access, and the HTTPS chicken-and-egg problem.

Network operations and monitoring

🔬

Packet Capture & Analysis

How tcpdump and Wireshark capture network traffic, what promiscuous mode does, and how to read packet headers for debugging.

🔭

Network TAP & SPAN Ports

How network TAPs and SPAN ports create passive copies of traffic for IDS, monitoring, and forensics — without interrupting production flows.

📊

NetFlow Traffic Analysis

How Cisco NetFlow (and IPFIX) samples network traffic into flow records, enabling bandwidth analysis, anomaly detection, and capacity planning.

🎚️

QoS — Traffic Prioritization

How routers use DSCP markings and queuing to guarantee voice quality while allowing bulk transfers — ensuring VoIP stays crystal clear even during downloads.

QoS Deep Dive: DSCP Marking and Queuing

How DSCP markings classify traffic at the IP layer, how routers queue packets into priority lanes, and why VoIP needs strict priority queuing while video needs bandwidth guarantees.

📊

IP SLA & BFD: Active Path Monitoring

How Cisco IP SLA and BFD (Bidirectional Forwarding Detection) actively probe network paths to detect failures in milliseconds rather than waiting for routing protocol convergence — jitter probes, threshold alerts, track objects for PBR and static route failover, and when to use each.

⚖️

Load Balancer

How load balancers distribute traffic across multiple servers to handle massive scale.

🏥

Load Balancer Health Checks & Failover

How load balancers detect unhealthy backends and reroute traffic — passive vs active health checks, connection draining during deploys, circuit breakers, and the thundering herd problem when a backend recovers.

DNS-Based Failover

How Route 53 health checks and weighted/failover routing policies automatically redirect traffic away from failed servers using DNS TTL.

Data center and cloud

🏢

Three-Tier Network Architecture

The access, distribution, and core layers of enterprise networks — how traffic flows from a laptop to the internet.

🌿

Spine-Leaf Data Center Topology

How modern data centers use a spine-leaf fabric to provide predictable latency, high bandwidth, and easy horizontal scaling.

🏗️

Data Center Network Topologies

How modern data center networks evolved from three-tier (core/distribution/access) to spine-leaf and fat-tree — the bandwidth, fault tolerance, and east-west traffic tradeoffs of each design.

🧅

VXLAN — Overlay Networking

How VXLAN encapsulates Layer 2 frames inside UDP to stretch virtual networks across physical boundaries in data centers.

🧠

SDN & OpenFlow

How Software-Defined Networking separates the control plane from the data plane, letting a centralized controller program forwarding rules across the entire network.

🌐

SD-WAN: Software-Defined WAN

How SD-WAN intelligently routes enterprise traffic across multiple WAN links — MPLS, broadband, LTE — using centralized policy, real-time path quality monitoring, and application-aware routing.

🖥️

Network Virtualization: NSX & Open vSwitch

How software-defined networking virtualizes the network inside hypervisors — Open vSwitch flow tables, NSX distributed logical switches, and microsegmentation enforced at the hypervisor, not the physical switch.

☁️

AWS VPC Networking: Subnets, Routing & Security

How AWS VPC creates isolated virtual networks — public vs private subnets, Internet Gateway, NAT Gateway, route tables, Security Groups vs NACLs, and the flow of traffic from EC2 to the internet and back.

☁️

VPC Peering

How AWS VPC peering connects two isolated virtual networks privately, avoiding the public internet, and why non-transitive routing matters.

💾

iSCSI: Storage Over IP

How iSCSI encapsulates SCSI commands in TCP/IP to create storage area networks (SANs) over standard Ethernet, replacing expensive Fibre Channel.

💾

Network Storage Protocols: NFS, SMB & Object Storage

How network storage works — NFS v4.1 pNFS for parallel access, SMB3 multichannel over multiple NICs, S3 object storage vs block/file semantics, and the network performance considerations for latency-sensitive storage workloads.

Network security

🛡️

Firewall Rules

How firewalls inspect traffic and block or allow connections based on rules.

🔒

Network ACLs vs Security Groups

How AWS Network ACLs (stateless) and Security Groups (stateful) differ, when to use each, and how they interact to create layered cloud network security.

🧱

Network Segmentation

How VLANs, DMZs, and firewall zones limit blast radius: why a compromised printer can't reach your database server.

🪪

802.1X / EAP — Port-Based Auth

How enterprise Wi-Fi and wired networks authenticate every device before granting network access using RADIUS and EAP.

🎫

RADIUS & TACACS+: Network Authentication

How RADIUS and TACACS+ centralize authentication for network devices and VPN users — AAA (Authentication, Authorization, Accounting), and why enterprises use RADIUS for WiFi/VPN and TACACS+ for device management.

🔒

VPN Tunnel

How a VPN encrypts your traffic and hides your real IP address from websites and ISPs.

🌉

GRE Tunneling

How Generic Routing Encapsulation wraps any network-layer packet inside IP to create overlay tunnels — the building block for site-to-site VPNs and SD-WAN.

☠️

ARP Spoofing Attack

How an attacker poisons ARP caches to intercept all traffic on a local network (Man-in-the-Middle).

🔍

DHCP Snooping & Dynamic ARP Inspection

How DHCP snooping prevents rogue DHCP servers from hijacking client IP assignments, and how Dynamic ARP Inspection (DAI) uses the snooping table to block ARP spoofing attacks.

👿

Evil Twin AP Attack

How attackers create a rogue access point with the same SSID to intercept traffic, and why HTTPS and VPNs protect against it.

WiFi Deauth Attack

How attackers send forged 802.11 deauthentication frames to disconnect clients, capture WPA handshakes, and how Management Frame Protection (PMF) stops it.

💥

DDoS Attacks & Defense

How Distributed Denial of Service attacks work: SYN floods, amplification attacks, botnets, and how scrubbing centers defend against them.

🕵️

Man-in-the-Middle Attack

How an attacker intercepts and reads traffic between two parties using ARP spoofing, and how TLS prevents it.

🔐

Zero Trust Networking

How Zero Trust replaces the perimeter model: identity-aware proxy, mTLS, policy engine, and why 'never trust, always verify' prevents lateral movement.

🔍

Port Scanning

How attackers and security teams discover open services using TCP SYN scanning, and how firewalls respond.

Troubleshooting

🔍

Network Troubleshooting: OSI-Layer Methodology

A systematic approach to diagnosing network problems — starting from physical layer and working up, using ping/traceroute/nmap/ss/tcpdump at each layer, common failure patterns (no link, no IP, no route, DNS failure, port blocked), and building a troubleshooting mental model.

🏓

Ping & ICMP

How ICMP works, what ping measures, TTL hop counting, and how traceroute maps a network path.

Traceroute — Path Discovery

How traceroute reveals every router hop between you and a destination by exploiting IP TTL values.

📨

ICMP Message Types

The complete ICMP toolbox: echo request/reply (ping), destination unreachable, time exceeded (traceroute), redirect, and why blocking all ICMP is harmful.

📦

Path MTU Discovery

How TCP discovers the maximum packet size that fits through every link on a path, avoiding fragmentation for best performance.

✂️

IP Fragmentation & MTU: Why Large Packets Get Split

How IP fragmentation works when packets exceed the MTU — the DF bit, ICMP 'fragmentation needed' messages, why fragmentation is problematic in modern networks, and how PMTUD and TCP MSS prevent it.

🔁