Cisco Certified Support Technician: Networking (CCST Networking) — knowledge map
The 59 core concepts of Cisco Certified Support Technician: Networking (CCST Networking) and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (59)
IP address (IPv4 / IPv6)
A number identifying a host on a network: IPv4 is 32 bits in dotted quads (192.168.1.10), IPv6 is 128 bits in colon-hex, structurally solving address exhaustion; an fe80:: link-local address auto-configures for on-link traffic.
Prerequisites: Link-Local Address
Related: IPv6 Address
PDU, frame, and packet
The unit of data exchanged at each layer is called a PDU (protocol data unit), and its name changes by layer: a frame at the data-link layer, a packet at the network layer, and a segment at the transport layer.
Encryption
Transforming data with a key so only authorized parties can decrypt; symmetric/asymmetric, at rest/in transit.
Port number
A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.
Prerequisites: HTTP、HTTPS、Firewall、IP address (IPv4 / IPv6)
Wi-Fi and IEEE 802.11
Wi-Fi is the Wi-Fi Alliance's interoperability-certification brand for wireless LAN equipment, built on the IEEE 802.11 family of standards. IEEE 802.11 includes variants such as b/g/n/ac/ax/be, which use the 2.4 GHz, 5 GHz, and 6 GHz bands in different combinations.
Related: Wi-Fi Frequency Bands (2.4/5/6 GHz)
HTTP
The unencrypted application-layer protocol (port 80) that browsers and servers use to exchange pages and data. Because its traffic is plaintext and open to eavesdropping or tampering, using TLS-protected HTTPS is now the standard.
Prerequisites: Encryption
Related: HTTPS
ULA and APIPA
A ULA (unique local address) is an IPv6 address in the fc00::/8 range that is defined in fc00::/7 (in practice the locally-assigned fd00::/8 range is what is used), not routed on the internet and scoped to an organization (the IPv6 counterpart of an IPv4 private address). APIPA is an IPv4 address in the 169.254.0.0/16 range that Windows and similar systems assign automatically when no DHCP server can be found, usable only within the local segment.
Prerequisites: DHCP、IP address (IPv4 / IPv6)、IPv6 Address、Private Address
HTTPS
HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.
Prerequisites: Encryption
Related: HTTP
ICMP
A protocol for control and diagnostic messages rather than data transfer. It powers ping (reachability checks) and traceroute (path checks), and carries unreachable/TTL-exceeded notifications—essential for diagnosing network connectivity issues.
Related: ping / traceroute (reachability and path)、Port number、TCP、UDP
CIDR notation
A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.
Prerequisites: Firewall、IP address (IPv4 / IPv6)
IPv6 Address
A 128-bit Internet-layer address written as eight 16-bit hexadecimal fields separated by colons, where a single run of consecutive zero fields may be abbreviated once with '::'. Its prefix length denotes the network portion, with the interface identifier typically occupying the lower 64 bits — a structural contrast to IPv4 subnet masking.
Prerequisites: CIDR notation、Subnet mask
Related: IP address (IPv4 / IPv6)
Layer 2 Switch
An L2 switch forwards frames at the data-link layer based on MAC addresses, relaying frames on a per-port basis by learning and consulting its MAC address table. It does not handle IP addressing or routing, so it is limited to forwarding within the same network (subnet/VLAN); communication between different networks requires an L3 switch or router. It is also the unit at which VLANs and STP are implemented.
Prerequisites: PDU, frame, and packet、IP address (IPv4 / IPv6)、VLAN (Virtual LAN)
Related: MAC address table and MAC address filtering、Layer 3 Switch
VLAN (Virtual LAN)
A technique that logically divides switch ports into multiple broadcast domains without changing physical wiring. IEEE 802.1Q tagged VLAN adds a VLAN ID tag to frames so a single trunk link carries multiple VLANs distinctly. Communication between VLANs requires inter-VLAN routing by an L3 switch or router.
Prerequisites: PDU, frame, and packet
Related: Broadcast Domain、Layer 3 Switch
Subnet mask
A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.
Prerequisites: On-premises、IP address (IPv4 / IPv6)、CIDR notation
TCP
A reliability-focused transport-layer protocol that establishes a connection (three-way handshake), guarantees ordering, and retransmits lost data. Used for HTTP, SSH, database connections, and anywhere data loss or reordering is unacceptable.
Prerequisites: HTTP
Related: ICMP、Port number、UDP
IP phone
A telephone that carries voice as IP packets over the network instead of a traditional phone line, using VoIP technology; most receive power over the same LAN cable via PoE.
Prerequisites: PDU, frame, and packet
ipconfig and tracert
Basic Windows network diagnostic commands. ipconfig displays and refreshes a machine's own IP configuration (/all for detail, /release and /renew to re-acquire a DHCP lease), and tracert shows each router hop on the path to a destination (the Windows equivalent of traceroute on Linux/macOS).
Prerequisites: DHCP、IP address (IPv4 / IPv6)、ping / traceroute (reachability and path)
WPA (Wi-Fi Protected Access)
A wireless LAN encryption/authentication standard. The original Wi-Fi Protected Access (WPA), introduced to address WEP's weaknesses, uses TKIP but is now deprecated in favor of the stronger WPA2 and WPA3.
Prerequisites: Wi-Fi and IEEE 802.11、Encryption、WPA3 and SAE
DHCP
A protocol that automatically assigns the network settings a device needs — including an IP address — when it connects to the network, saving an administrator the trouble of manually configuring an IP address on every device.
Prerequisites: IP address (IPv4 / IPv6)
Broadcast Domain
A broadcast domain is the extent to which a broadcast frame can propagate; an entire network (or VLAN) connected via L2 switches forms a single broadcast domain. While an L2 switch segments collision domains, it does not segment broadcast domains—only routers or VLAN segmentation can divide a broadcast domain. A larger broadcast domain means a broader blast radius for broadcast storms.
Prerequisites: PDU, frame, and packet、Layer 2 Switch
Related: VLAN (Virtual LAN)
WPA3 and SAE
SAE (Simultaneous Authentication of Equals, aka Dragonfly), the key-establishment method adopted by the wireless LAN security standard WPA3. It resolves the offline-dictionary-attack weakness of WPA2-PSK's four-way handshake with a scheme that cannot be brute-force-verified from mere traffic interception.
Prerequisites: WPA2-PSK and WPA2-Enterprise
UDP
A lightweight, connectionless transport-layer protocol with no ordering guarantee or retransmission. Its low overhead makes it fast, so it's used for DNS lookups and video/audio streaming—cases that prefer low latency over occasional loss.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: ICMP、Port number、TCP
Wireless LAN
A technology that connects devices to a network wirelessly using radio waves (WLAN), based on the IEEE 802.11 family (b/g/n/ac/ax/be; 11n=Wi-Fi 4, 11ac=Wi-Fi 5, 11ax=Wi-Fi 6, the 6 GHz extension=Wi-Fi 6E, 11be=Wi-Fi 7). It supports infrastructure mode via access points and ad-hoc mode for direct device-to-device links, with WPA2/WPA3 for encryption. "Wi-Fi" is the Wi-Fi Alliance interoperability-certification brand, often used loosely for wireless LAN but not strictly synonymous.
Prerequisites: Wi-Fi and IEEE 802.11、Encryption、WPA3 and SAE
Address classes and public addresses
IPv4 addresses are classified as Class A through E by the pattern of their leading bits (Class A starts 1-126, Class B 128-191, Class C 192-223, and so on), which historically set the default network/host boundary. Unlike a private address, a public address is one that is uniquely routable on the internet.
Prerequisites: IP address (IPv4 / IPv6)、Private Address
MAC address table and MAC address filtering
The MAC address table is the record an L2 switch builds of learned MAC-address-to-port mappings, used to forward frames to the correct port. MAC address filtering restricts which MAC addresses are allowed on a given port, an access-control measure that rejects unregistered devices.
Prerequisites: PDU, frame, and packet
Related: Layer 2 Switch
Default route (default gateway)
The exit for packets destined outside your network; check with ip route (or route -n)—without it nothing leaves the local segment. Fix a wrong routing table with ip route del/add default.
Prerequisites: PDU, frame, and packet、Network configuration (ip / ifconfig / nmcli)
Firewall
A mechanism that controls traffic according to allow/deny rules. On Linux it is implemented via iptables / firewalld, and in cloud environments it is offered as constructs like security groups.
ping / traceroute (reachability and path)
Tools to isolate network faults by layer: ping (ping6) checks reachability via ICMP, and traceroute/tracepath show each router hop to pinpoint where traffic stops; tracepath needs no privileges and probes MTU.
Related: ICMP
Layer 3 Switch
An L3 switch integrates network-layer routing functions with the fast physical/data-link-layer switching of an L2 switch, performing tasks such as inter-VLAN routing in hardware (ASIC) rather than relying primarily on software-based routing as a conventional router does. Because it can both create VLANs and route between them in a single device, it is widely deployed as the core switch in large-scale LANs.
Related: Layer 2 Switch、VLAN (Virtual LAN)
Private Address
IPv4 address ranges defined by RFC 1918 for use solely within private organizational networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). They are not routed on the public Internet, so external communication requires NAPT translation to a global address.
Prerequisites: IP address (IPv4 / IPv6)
WPA2-PSK and WPA2-Enterprise
WPA2 offers two authentication modes. WPA2-PSK (WPA2-Personal) authenticates every device with one shared passphrase, a simple scheme suited to homes and small sites; WPA2-Enterprise authenticates each device or user individually via 802.1X/RADIUS, suited to large organizations that need per-user access control.
Transmission media (UTP, coax, fiber)
Transmission media for wired networks. UTP (unshielded twisted pair) twists copper wire pairs to reduce noise and is the mainstay of LAN cabling (up to about 100 m); coaxial cable is an older design with a center conductor wrapped in braided shielding; fiber optic cable transmits light signals, is immune to electromagnetic interference, and is used for long-distance, high-speed links (laser-driven single-mode fiber for long distances, LED-driven multimode fiber for short-to-medium distances).
Cellular communication
The wireless communication method provided by mobile phone networks. Unlike Wi-Fi, which uses unlicensed spectrum, cellular communication uses licensed spectrum allocated by the government to a carrier, communicating through base stations (cells) that cover a wide area.
Prerequisites: Wi-Fi and IEEE 802.11
Connectors (RJ-45 / RJ-11)
Connector standards for plugging cables into equipment. RJ-45 is an 8-pin connector for twisted-pair cable and the Ethernet standard; RJ-11 is a smaller 4-to-6-pin connector for analog telephone lines, similar in appearance to RJ-45 but smaller.
Prerequisites: Transmission media (UTP, coax, fiber)
FTP, SFTP, and TFTP
A family of file-transfer protocols. FTP (ports 20/21) sends authentication and data in plaintext and is vulnerable to eavesdropping; SFTP transfers files securely, encrypted over SSH (port 22); TFTP (port 69, UDP) is a lightweight, unauthenticated transfer used for things like router configuration files.
Prerequisites: Encryption
Non-overlapping channel
The set of channels in the 2.4 GHz Wi-Fi band whose frequencies do not overlap, typically channels 1, 6, and 11, chosen to avoid interference between channels. Assigning different non-overlapping channels to neighboring access points preserves communication quality.
Prerequisites: Wi-Fi and IEEE 802.11、Wi-Fi Frequency Bands (2.4/5/6 GHz)
nslookup
A command that queries a DNS server for the IP address corresponding to a given domain name (or the reverse) and displays the result. Used to isolate name-resolution failures and to investigate suspicious domains.
Prerequisites: IP address (IPv4 / IPv6)
On-premises
Deploying and operating servers and network equipment within an organization's own facilities, as opposed to the cloud. It requires up-front investment and operational effort but keeps data and systems under the organization's own control; combining it with the cloud in a hybrid cloud setup is common.
Related: Hybrid cloud
SFP and PoE
An SFP (small form-factor pluggable) is a swappable optical/copper transceiver module that plugs into an expansion slot on a switch or router. PoE (Power over Ethernet) sends both data and electrical power over the same Ethernet cable, powering devices such as IP phones, access points, and security cameras without separate electrical wiring.
Prerequisites: IP phone
SSID
The name (Service Set Identifier) that identifies a wireless LAN access point. A client selects the SSID to connect to and authenticates/encrypts (with WPA2/WPA3, etc.) accordingly. Disabling SSID broadcast can still be discovered by sniffing traffic, so it is not a security measure on its own.
Prerequisites: Encryption、WPA3 and SAE
TCP/IP model
A model that organizes communication into four simplified layers (application, transport, internet, network interface), compared with the OSI model. Real internet technology (TCP/IP) is built on this model, and in practice it is referenced more often than the OSI model.
Prerequisites: OSI reference model
VPN (virtual private network)
A technology that builds an encrypted virtual private line over a public network, securely connecting sites or remote workers to an internal network. Tunneling and encryption prevent eavesdropping and tampering.
Prerequisites: Encryption
Network configuration (ip / ifconfig / nmcli)
Viewing/changing host networking: the current standard is the ip command (ip addr for addresses, ip route for routes), legacy is ifconfig/route. ip/ifconfig changes are temporary and vanish on reboot; persist via NetworkManager nmcli or config files. ifup/ifdown bring interfaces up/down from config. The hostname is in /etc/hostname.
SSH
A protocol for securely logging in to and operating a remote server over an encrypted connection (TCP port 22); the standard for remote Linux administration.
Prerequisites: Encryption
Encapsulation and Decapsulation
Encapsulation is the process of successively adding lower-layer headers (and trailers) to upper-layer data to form a PDU, while decapsulation is the reverse process at the receiver, stripping headers layer by layer before passing data upward. This mechanism lets each OSI layer operate independently, since lower layers need not interpret the payload's content. A typical example is an IP packet carried inside an Ethernet frame, itself carrying a TCP segment.
Prerequisites: PDU, frame, and packet、OSI reference model
Global Unicast Address
An IPv6 address that is globally routable and unique across the Internet, falling within the 2000::/3 range — the IPv6 counterpart to an IPv4 global address. Unlike a link-local address, it is reachable across routers and can be auto-configured via SLAAC or DHCPv6.
Prerequisites: IP address (IPv4 / IPv6)、IPv6 Address
Related: Link-Local Address
Link-Local Address
An IPv6 address valid only within a single link, drawn from the fe80::/10 range. It is never forwarded across routers and is automatically assigned to every interface, distinguishing it from a global unicast address. It underlies link-local control traffic such as Neighbor Discovery Protocol exchanges.
Prerequisites: IPv6 Address
Related: Global Unicast Address
Endpoint device
A general term for devices connected at the edge of a network that a user directly operates or that exchange data, including computers, smartphones, IP phones, printers, IoT devices, and servers.
Prerequisites: IP phone
Telnet and RDP
Protocols for operating a remote device. Telnet (port 23) is an older remote-login method that does not encrypt its traffic and is now deprecated; RDP (Remote Desktop Protocol, port 3389) provides graphical remote control of a Windows desktop.
Prerequisites: Encryption
Wireshark and packet capture
An open-source packet analyzer that captures and inspects packets flowing on a network. Captures can be saved in .pcap format and inspected in detail down to each layer's headers and payload, making it useful for troubleshooting communication problems and learning protocols.
Prerequisites: PDU, frame, and packet
OSI reference model
A standard model that organizes network communication functions into seven layers — physical, data link, network, transport, session, presentation, and application. Understanding each layer's role helps clarify where a given protocol fits.
NAT (Network Address Translation)
A mechanism that translates private IP addresses to public IP addresses and back, running on a router or gateway so many internal hosts can share a small number (or just one) of public IPs to reach the internet (NAPT / IP masquerading). On Linux this is implemented via the iptables MASQUERADE target, among others.
Prerequisites: IP address (IPv4 / IPv6)
Wi-Fi Frequency Bands (2.4/5/6 GHz)
The 2.4 GHz band penetrates obstacles well and reaches farther but suffers from interference (e.g., microwave ovens) and few available channels. The 5 GHz band offers more channels and higher speed at shorter range. The 6 GHz band (Wi-Fi 6E/7) adds a wide contiguous spectrum largely free of legacy interference, providing many additional high-speed channels.
Related: Wi-Fi and IEEE 802.11
CDP (Cisco Discovery Protocol)
A Cisco proprietary Layer 2 protocol that lets neighboring Cisco devices exchange information such as device type, hostname, IP address, and connected port, letting administrators map the topology. Unlike the vendor-neutral LLDP, it works only between Cisco devices, and is often disabled on ports facing untrusted external connections to limit information disclosure.
Prerequisites: IP address (IPv4 / IPv6)
Digital certificate
An electronic certificate issued by a certificate authority (CA) that binds a public key to its owner and vouches for that binding. A web server's certificate is what a browser verifies during an HTTPS connection to confirm the site is not impersonated.
Prerequisites: HTTPS
Hybrid cloud
Combining and linking public with private (on-prem); balances regulation with cloud flexibility.
Related: On-premises
DNS (Domain Name System)
A mechanism that maps human-friendly domain names (e.g., example.com) to IP addresses, so that a user need only type a domain name to automatically reach the IP address of the corresponding server.
Prerequisites: IP address (IPv4 / IPv6)
DoS/DDoS attacks and SYN flood attacks
A DoS attack overwhelms a service by flooding it with excessive requests or malformed packets from a single source. A DDoS attack is a distributed DoS carried out simultaneously from many compromised hosts (e.g., a botnet), making it hard to block since sources are spread out. A SYN flood attack is a representative DoS technique that abuses the TCP three-way handshake, sending a flood of SYN packets without completing the handshake, leaving the server with many half-open connections and exhausting its resources; SYN cookies are a common countermeasure.
Prerequisites: PDU, frame, and packet
Performance metrics (IOPS/throughput/bandwidth/latency)
Core vocabulary for performance: IOPS = I/O operations per second (small random access, e.g., EBS io2); throughput = data volume per time (MB/s, large sequential transfer); bandwidth = link capacity; latency = delay per operation. Design and monitor by the metric that fits the workload.