1 Networking Fundamentals and Protocols

Learn how network models, protocols, addressing, subnetting, and packet forwarding work together to move data between applications and devices.

Network models and devices

A network moves data between devices using agreed rules called protocols. Protocols specify how data is formatted, addressed, transmitted, routed, and received. A suite coordinates multiple protocols; is the suite used by the Internet and most modern networks.

Models and layers

The organizes networking functions into seven layers. A data unit (PDU) is the data unit associated with a layer.

Application (Layer 7): Network services used by applications; examples include HTTP, , and SMTP. Its PDU is data.
Presentation (Layer 6): Data representation, encryption, and compression; examples include TLS and character encoding. Its PDU is data.
Session (Layer 5): Starts, manages, and ends communication sessions. Its PDU is data.
Transport (Layer 4): Process-to-process delivery, reliability, and ports; examples include and . Its PDU is a segment for or a datagram for .
Network (Layer 3): Logical addressing and routing between networks; examples include , , and ICMP. Its PDU is a packet.
Data Link (Layer 2): Local-network framing and hardware addressing; examples include Ethernet, Wi-Fi, and VLANs. Its PDU is a frame.
Physical (Layer 1): Signals, cabling, radio, and connectors, including copper, fiber, and radio. Its PDU is bits.

The model groups these functions into link, internet, transport, and application layers. Models help narrow troubleshooting: determine whether the problem concerns a physical link, local frame delivery, IP routing, a transport , or an application service. The OSI layers are a conceptual guide; real protocols do not always fit neatly into only one layer.

Network devices

A switch usually forwards frames within a LAN using MAC addresses. A router forwards packets between IP networks using routing tables. A firewall allows or blocks traffic according to policy, and an access point connects wireless clients to a LAN. A modem adapts a signal for a particular access technology. Gateway is a general term for a device or service connecting dissimilar networks; in everyday IP configuration, the usually means the local router used to reach other networks.

and transport

As data is sent, each layer adds control information through . An application message becomes a transport segment or datagram, then an IP packet, then a link-layer frame. At the destination, decapsulation removes the headers in reverse order.

Transport and control protocols

is connection-oriented. It uses connection setup, sequence numbers, acknowledgments, retransmission, and flow control to provide ordered, reliable byte-stream delivery. Use when an application needs dependable delivery.

is connectionless and has less delivery machinery. It does not itself guarantee delivery, order, or duplicate protection. Applications can use when low overhead or timely delivery matters and can manage loss themselves.

ICMP carries network-control and diagnostic messages, such as the echo requests used by ping; it does not use or ports. ARP resolves an address to a on a local link. uses Neighbor Discovery rather than ARP.

Ports and common services

A identifies an application service or process at the transport layer. An IP address and together identify an endpoint. A or connection is distinguished by its source and destination addresses and ports. numbers are separate from IP numbers: 's IP number is 6, while 443 is commonly used by HTTPS. A registered indicates an assignment, not proof that a particular service is running.

Common defaults include the following; services can be configured to use other ports, and a number alone does not verify traffic's identity.

FTP uses ports 20 and 21 for data and control in traditional FTP.
SSH uses 22 for secure remote login; Telnet uses 23 for unencrypted remote login.
SMTP uses 25 for server-to-server email transfer.
commonly uses 53; it also uses , including for some responses and transfers.
DHCPv4 uses 67 on the server and 68 on the client for automatic configuration.
HTTP uses 80, and HTTPS uses 443 for web traffic; HTTPS uses TLS.
POP3 uses 110, and IMAP uses 143 for email retrieval.
NTP uses 123 for time synchronization.
SNMP commonly uses ports 161 and 162 for queries and notifications.
SMB commonly uses 445; LDAP uses 389, and LDAPS uses 636 for directory services.
RDP uses and/or 3389 for remote desktop.
HTTP/3 uses 443 for HTTP over QUIC.

Addressing and host configuration

MAC addresses support local-link delivery, while IP addresses logically identify network interfaces and guide packet routing across interconnected networks. A host can communicate directly with another host on its own subnet at the link layer. To reach a different subnet, it sends the frame to its .

and

uses 32-bit addresses, commonly written as four decimal octets, such as 192.168.10.25. A subnet mask or prefix length divides an address into network and host portions. CIDR notation makes the prefix explicit: 192.168.10.0/24 means that the first 24 bits are the network prefix. Modern addressing is classless; do not infer a subnet mask from old Class A, B, or C labels.

Private ranges commonly used inside organizations are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are not globally unique and generally need translation, such as NAT, to communicate with public destinations. The range 127.0.0.0/8 is used for loopback, and 169.254.0.0/16 is used for link-local addressing.

uses 128-bit addresses written in hexadecimal groups separated by colons. Consecutive zero groups can be shortened with :: once in an address. greatly expands address capacity. It has no broadcast addressing and uses multicast and Neighbor Discovery for related local-link functions. Common forms include ::1 for loopback, fe80::/10 for link-local, fc00::/7 for the unique-local range, and 2000::/3 for global unicast space. A typical LAN prefix is /64.

Host configuration and name resolution

dynamically supplies settings such as an IP address, prefix or subnet mask, , and server. resolves names such as example.com to resource records, including IP addresses. Neither service forwards an application's final traffic by itself: helps find an address, and helps a host obtain configuration.

and CIDR

divides an address block into smaller networks. For an prefix of length $n$ , the number of host bits is $32-n$ , and the block contains $2^{32-n}$ total addresses. For a conventional subnet, subtract the network and broadcast addresses to find the number of assignable host addresses. Special-purpose point-to-point /31 links and /32 host routes are exceptions to this usual host-count shortcut.

Example: `192.168.10.64/26`

The prefix corresponds to subnet mask 255.255.255.192.
There are $6$ host bits, so the block has $2^6 = 64$ total addresses.
Subnet boundaries in the last octet occur every $64$ : .0, .64, .128, and .192.
The network address is 192.168.10.64; the broadcast address is 192.168.10.127.
The conventional usable host range is 192.168.10.65–192.168.10.126, or $62$ addresses.

For , allocate a block large enough for each subnet's host requirement, then place blocks on valid boundaries without overlap. To check a answer, confirm the prefix, mask, block size, network address, broadcast address, and usable range. CIDR prefix lengths support flexible allocation and route aggregation.

How packets cross networks

Consider a laptop opening a website hosted on a different IP network.

The laptop uses , if needed, to look up the site's IP address.
It compares the destination address with its own subnet using its prefix. Because the destination is remote, the laptop selects the as the next hop.
If needed, it uses ARP to learn the gateway's . It creates a frame addressed to the gateway's that contains an IP packet addressed to the website server. The IP destination normally remains the server's address across routed hops, unless a function such as NAT changes it.
A switch forwards the frame within the LAN. The router removes the incoming link-layer frame, examines the IP destination, selects a route, decreases the packet's TTL for or Hop Limit for , and sends the packet in a new frame on the next link. Each router repeats this process.
On the destination LAN, the final router delivers a frame to the server. The server processes the IP packet and uses the transport and destination to deliver data to the correct application.

The distinction is important: MAC addresses deliver a frame across a local link, IP addresses guide packets across networks, and ports deliver transport data to an application endpoint. Because ARP operates on the local link, a host resolving a remote destination normally resolves the gateway's , not the remote server's .

Putting the concepts together

Use the network models to locate a function by layer. Keep the addressing roles distinct: MAC addresses are for local-link delivery, IP addresses identify and route between networks, and transport ports identify application endpoints. prioritizes reliable, ordered delivery; has less overhead and does not guarantee delivery.

When , derive the host-bit count from the prefix, calculate the block size, and identify the network and broadcast boundaries. When tracing packet flow, first determine whether the destination is local. If it is remote, send the frame to the .

Knowledge check

Which provides ordered, reliable transport: or ? .
What is the next hop when a host needs to reach an IP outside its subnet? Its .
How many conventional usable host addresses are in an /27 subnet? 30, calculated as $2^5 - 2$ .