Day 5 - Week 8 Comprehensive Review: Threading Networking Together on a Single Layer Map

📌 Key Takeaways

• Everything in networking boils down to "at which layer, using which address, via which path, under which name" communication happens.
• The layer is your diagnostic navigation — if the MAC won't resolve, arp (2); if it's unreachable, ping (3); if a port isn't open, ss (4); if a name won't resolve, dig (7).
• Subnet in 3 steps: hosts = 2^(host bits) − 2, network address = the largest multiple of the block size that is at most the IP, broadcast = the last address of that block.
• Two boundary traps: 169.254 is not a private IP but APIPA (DHCP failure), and the 172 private range is only 16-31.
• The distinction temporary (ip, ifconfig, editing resolv.conf directly) vs permanent (ifcfg, nmcli con mod) is the biggest exam point of this week.

The Layer Model — Devices, Protocols, and Tools in One Table

Points to lock into memory:

• IP, router, ping = Layer 3; MAC, switch, ARP = Layer 2; port, TCP/UDP, ss = Layer 4
• A hub (1) handles only signals, a switch (2) learns MACs, a router (3) does IP routing and separates broadcasts
• DNS and DHCP are Layer 7 application protocols

If you first ask "which layer is this problem at?", the inspection tool is chosen automatically. If the MAC won't resolve, arp (2); if it's unreachable, ping (3); if a port isn't open, ss (4); if a name won't resolve, dig (7). The layer is the navigation for diagnosis.

IP Classes, Private Ranges, and CIDR Review

Points to lock into memory:

• 127.x = loopback (localhost), 169.254.x = APIPA (DHCP failure signal)
• The 172 private range is only 16-31, while all of 192.168 is private
• Mask octet sequence: 128 · 192 · 224 · 240 · 248 · 252 · 254 · 255

⚠️ Trap review: 169.254.x.x is not a private IP but APIPA (link-local) and is a signal that "no DHCP server was found". 172.32.x.x is outside the private range (16-31) and is a public IP. These two boundaries easily become traps.

Subnet Calculation — 3 Steps by Hand

# Example: analyzing 192.168.1.200/26
# /26 → 6 host bits → 2^6 - 2 = 62 hosts, block size 64
# Among multiples of 64 (0,64,128,192), the largest at most 200 = 192
Network address  : 192.168.1.192
Usable range     : 192.168.1.193 ~ 192.168.1.254
Broadcast        : 192.168.1.255

Key distinction: the −2 in the host count is because the network address (all host bits 0) and the broadcast (all 1s) cannot be given to hosts. /30 gives 2 hosts (router-to-router links), /29 gives 6, /28 gives 14, /26 gives 62. You should be able to answer these values instantly.

Temporary vs Permanent Configuration — Command Lifetime Review

⚠️ Trap review: in a NetworkManager environment, a direct edit to resolv.conf disappears on reboot or restart. With ONBOOT=no, the interface does not come up after boot even if the settings are right. You must distinguish "temporary is ip/ifconfig, permanent is ifcfg/nmcli".

Diagnostic Flow — From Near to Far

ping 127.0.0.1     # 1. Is the TCP/IP stack OK?
ping 192.168.1.1   # 2. Gateway (L2/L3)?
ping 8.8.8.8       # 3. External IP (routing/firewall)?
ping google.com    # 4. DNS?
ss -tlnp           # 5. Local service ports?

The step at which it first gets blocked is the location of the problem. If 3 works and 4 fails, it is DNS; if 2 works and 3 fails, it is routing/firewall beyond the gateway. "IP works but the domain doesn't" = a definitive DNS signal.

Protocols and Ports Quick Review

The first questions of real-world troubleshooting are exactly this week's content — "Is the IP right (Day 1-2), can we reach the gateway (Day 2-3), does DNS resolve (Day 2-3), which layer's device is the problem (Day 4)". Network outages can usually be narrowed down to a cause by checking these four in turn. This week is the foundation of practical networking, beyond just the exam.

📖 Glossary

• Layer: a stage into which communication responsibilities are divided. It determines both the location of the problem and the inspection tool.
• Collision domain / broadcast domain: the scope within which frames can collide (divided by a switch) / the scope over which a broadcast spreads (divided only by a router or VLAN).
• Block size: the interval at which subnets are cut for that CIDR. 64 for /26, 32 for /27, 16 for /28.
• −2 rule: subtracting the network address and broadcast address when counting hosts. Neither can be given to a host.
• Mask octet sequence: 128 · 192 · 224 · 240 · 248 · 252 · 254 · 255. Values filled from the left according to the number of 1s.
• APIPA (169.254.x.x): an address a host assigns itself when DHCP fails. It is not a private IP.
• Temporary / permanent configuration: commands that vanish on reboot (ip, ifconfig) / settings that remain in files (ifcfg, nmcli).
• ONBOOT: the ifcfg entry that decides whether to bring the interface up automatically at boot. If no, the network doesn't come up.
• DORA: the 4 steps of DHCP: Discover → Offer → Request → Acknowledge.
• Scope of ARP: only within the same L2 network. When going to another network, it uses the gateway's MAC.
• active-backup / LACP: a redundancy mode that fails over when something breaks / a mode that combines multiple links to increase bandwidth.