Network Specialist Examination — knowledge map
The 137 core concepts of Network Specialist Examination and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (137)
MAC Address
A MAC address is a 48-bit physical address that uniquely identifies a network interface at the data-link layer, composed of a 24-bit OUI (vendor identifier) and a 24-bit vendor-assigned serial number. Unlike an IP address, it is fixed to the device rather than changing with network topology, and is used to identify frame destinations within a single data-link (L2) segment.
IPsec
A protocol suite that encrypts and authenticates traffic at the IP packet level, used to encrypt the path in site-to-site VPNs (on-prem to a cloud VNet/VPC). The tunnel won't establish unless both ends agree on encryption, integrity, and key-exchange settings.
Prerequisites: Site-to-Site VPN and Remote Access VPN
Ethernet
Ethernet is a LAN data-link/physical-layer technology standardized as IEEE 802.3, using MAC addressing and Ethernet frames for data transfer. It originally used shared-bus CSMA/CD access, but modern deployments use switched, full-duplex point-to-point links, with speeds ranging from 10 Mbps to 400 Gbps across various standards. Exams often test frame format details and the naming convention of speed standards (e.g., 1000BASE-T).
Prerequisites: Transmission Rate
Related: Media access control (CSMA/CD, CSMA/CA)、Full Duplex、WAN services (leased line, wide-area Ethernet)
IPv6 Address
A 128-bit Internet-layer address written as eight 16-bit hexadecimal fields separated by colons, where a single run of consecutive zero fields may be abbreviated once with '::'. Its prefix length denotes the network portion, with the interface identifier typically occupying the lower 64 bits — a structural contrast to IPv4 subnet masking.
Prerequisites: Subnet mask
Encapsulation and Decapsulation
Encapsulation is the process of successively adding lower-layer headers (and trailers) to upper-layer data to form a PDU, while decapsulation is the reverse process at the receiver, stripping headers layer by layer before passing data upward. This mechanism lets each OSI layer operate independently, since lower layers need not interpret the payload's content. A typical example is an IP packet carried inside an Ethernet frame, itself carrying a TCP segment.
Prerequisites: OSI reference model、Ethernet
Load balancer (L4/L7)
A device that distributes load across multiple servers. An L4 load balancer distributes based on IP address and port; an L7 load balancer can interpret application-layer information such as HTTP URL paths and cookies, enabling path-based routing and cookie-based session persistence. Health checks automatically remove failed servers from rotation.
DHCP
A protocol that automatically assigns the network settings a device needs — including an IP address — when it connects to the network, saving an administrator the trouble of manually configuring an IP address on every device.
Broadcast Domain
A broadcast domain is the extent to which a broadcast frame can propagate; an entire network (or VLAN) connected via L2 switches forms a single broadcast domain. While an L2 switch segments collision domains, it does not segment broadcast domains—only routers or VLAN segmentation can divide a broadcast domain. A larger broadcast domain means a broader blast radius for broadcast storms.
Prerequisites: Broadcast storm、Layer 2 Switch、RADIUS
Related: Collision Domain、VLAN (Virtual LAN)
DNS Delegation and Zone
A zone is the portion of the DNS namespace for which a specific set of authoritative servers holds management responsibility. Delegation is the mechanism by which a parent zone's name server hands off authority for a subdomain to another name server via NS records, enabling hierarchical, distributed administration where the delegated portion becomes an independent subzone.
Flooding
Flooding is the behavior by which an L2 switch forwards a frame out all ports except the ingress port, occurring when the destination MAC address is not in its MAC address table or when the destination is a broadcast/multicast address. While useful for resolving unknown destinations, excessive flooding wastes bandwidth and, in looped topologies, can trigger broadcast storms.
Prerequisites: Broadcast storm、Layer 2 Switch、MAC Address
Layer 2 Switch
An L2 switch forwards frames at the data-link layer based on MAC addresses, relaying frames on a per-port basis by learning and consulting its MAC address table. It does not handle IP addressing or routing, so it is limited to forwarding within the same network (subnet/VLAN); communication between different networks requires an L3 switch or router. It is also the unit at which VLANs and STP are implemented.
Prerequisites: MAC Address
Related: Layer 3 Switch
Metric
A metric is the numeric value a routing protocol uses to select the best path, calculated from criteria such as hop count, bandwidth, delay, or cost depending on the protocol. Lower metric values are preferred and installed in the routing table; metrics compare routes within the same protocol, while administrative distance is used to compare routes learned from different protocols.
Tunneling
A technique that encapsulates packets of one protocol inside packets of another to traverse dissimilar networks or unsupportive segments. It underlies IPv6-over-IPv4 mechanisms (e.g., 6to4) and VPNs (GRE, IPsec tunnel mode), letting intermediate devices forward traffic without inspecting the encapsulated payload.
Prerequisites: IPsec、Encapsulation and Decapsulation、IPsec transport mode and tunnel mode
VLAN (Virtual LAN)
A technique that logically divides switch ports into multiple broadcast domains without changing physical wiring. IEEE 802.1Q tagged VLAN adds a VLAN ID tag to frames so a single trunk link carries multiple VLANs distinctly. Communication between VLANs requires inter-VLAN routing by an L3 switch or router.
Internet VPN
A VPN built over the shared public Internet using IPsec or SSL/TLS tunnels for encryption and authentication, emulating a private line virtually. It is far cheaper than closed networks or wide-area Ethernet but offers only best-effort bandwidth and latency with no QoS guarantee.
Prerequisites: IPsec、closed network、Ethernet、WAN services (leased line, wide-area Ethernet)
NAPT (IP masquerade)
A technique letting multiple private-IP hosts share one global IP address for Internet access by also translating port numbers, managing flows via an IP-and-port mapping table. ESP (protocol number 50, having no port number) cannot be translated as-is, so IPsec VPN needs NAT-T to cope.
Prerequisites: IPsec
Related: NAT-T (NAT traversal)
Routing Table
A routing table is the data structure a router maintains, mapping destination networks to next hops, outgoing interfaces, and metrics needed to reach them. It merges static routes, routes learned via dynamic protocols, and directly connected routes; the longest-match entry is selected when forwarding packets.
Prerequisites: Longest prefix match
Related: Metric
WAN services (leased line, wide-area Ethernet)
Wide-area network services connecting sites. A leased line is occupied by one company over a specific span, physically isolated from others (high quality, high cost). Wide-area Ethernet and IP-VPN share a carrier network with logical isolation (more cost-effective). Choose per requirements (isolation, bandwidth guarantee, cost).
Related: Ethernet
Default route (default gateway)
The exit for packets destined outside your network; check with ip route (or route -n)—without it nothing leaves the local segment. Fix a wrong routing table with ip route del/add default.
Prerequisites: Routing Table
Resource record (RR)
The individual configuration entries written in a DNS zone file. Types include SOA (zone authority info), NS (name server), A/AAAA (IPv4/IPv6 address), MX (mail server), CNAME (alias), and PTR (reverse lookup).
Prerequisites: DNS Delegation and Zone、IPv6 Address
Broadcast storm
A failure where, with a loop present in an L2 network, broadcast frames (which lack a TTL) circulate and amplify endlessly between switches, spiking CPU usage and congesting links until the network becomes unusable. It is prevented by loop avoidance via STP.
DNS resource records and reverse lookup
Information registered in a DNS zone: A/AAAA (hostname to IP), MX (mail destination plus preference), CNAME (alias), NS (delegation), PTR (reverse lookup IP to hostname), TXT (e.g., SPF), etc. Reverse lookup places PTR records in an in-addr.arpa zone (ip6.arpa for IPv6) with the IP address reversed, realized by receiving delegation of that IP block's reverse zone.
Prerequisites: DNS Delegation and Zone、IPv6 Address
Related: Resource record (RR)
Full Duplex
Full duplex is a communication mode in which transmission and reception occur simultaneously and independently, and it is the standard mode for modern switched Ethernet links using dedicated point-to-point connections. Because send and receive never contend, CSMA/CD collision detection is unnecessary and no collision domain exists. Its counterpart, half duplex, allows transmission and reception only alternately, as seen with hub connections or some wireless LAN modes.
Prerequisites: WAN services (leased line, wide-area Ethernet)
Related: Collision Domain、Ethernet、Media access control (CSMA/CD, CSMA/CA)
IPsec transport mode and tunnel mode
IPsec encapsulation forms. Transport mode preserves the original IP header and protects only the payload, so it is mainly used for host-to-host communication. Tunnel mode wraps the entire original IP packet (including its header) inside a new IP header, so it is used for site-to-site VPNs (gateway-to-gateway) and also hides the original addresses in transit.
Prerequisites: IPsec、Encapsulation and Decapsulation、Site-to-Site VPN and Remote Access VPN
IPv4 Address
A 32-bit Internet-layer address consisting of a network portion and a host portion, with the boundary expressed via subnet mask or CIDR notation (e.g., /24). Address exhaustion has driven widespread use of NAPT and IPv6 coexistence. Frequently tested as the basis for subnetting and CIDR aggregation calculations.
Prerequisites: IPv6 Address、NAPT (IP masquerade)、Subnet mask
MAC Address Learning
MAC address learning is a function by which an L2 switch dynamically records the mapping between a received frame's source MAC address and the ingress port in its MAC address table (FDB); subsequent frames destined to that MAC address are then forwarded only to the corresponding port. Before learning occurs, or when the destination is unknown, the switch floods the frame to all ports. Entries not referenced within an aging timeout are removed from the table.
Prerequisites: Flooding、Layer 2 Switch、MAC Address
Spanning Tree Protocol (STP)
A protocol that, when redundant paths (loops) form in an L2 network, elects the switch with the lowest bridge ID (priority + MAC address) as the root bridge and automatically blocks redundant ports to prevent loops and broadcast storms. RSTP is a faster-converging variant.
Prerequisites: Broadcast storm、MAC Address、Root Bridge and Root Bridge Election、STP Port States (Blocking/Listening/Learning/Forwarding)
STP Port States (Blocking/Listening/Learning/Forwarding)
STP moves a port through a sequence of states before convergence to prevent loops while stabilizing the topology. Blocking receives BPDUs only, forwarding no traffic and learning no MAC addresses; listening sends/receives BPDUs to compute the topology but still forwards no traffic; learning begins building the MAC address table but still does not forward traffic; forwarding is the final state where the port both forwards traffic and learns addresses.
Prerequisites: Convergence、MAC Address、MAC Address Learning
VXLAN
An overlay tunneling technique that encapsulates L2 frames in UDP/IP over an L3 network. Its 24-bit segment identifier (VNI) allows about 16.77 million segments, breaking the 4094-segment limit of IEEE 802.1Q VLAN IDs (12 bits). VTEPs perform (de)encapsulation; it is used in large multi-tenant data centers.
Prerequisites: Encapsulation and Decapsulation、Tunneling、VLAN (Virtual LAN)
Related: Overlay and Underlay
Availability rate
The proportion of time a system operates correctly. Availability = MTBF ÷ (MTBF + MTTR); it rises as time-between-failures grows and repair time shrinks. A core availability metric, also used as an agreed SLA target (e.g., 99.9%).
Prerequisites: MTBF (mean time between failures)、Metric
Administrative distance (AD)
A value indicating how trustworthy a routing information source is relative to others; a smaller value is preferred. When routes of equal prefix length are learned from multiple protocols, AD decides the source priority before comparing metrics (e.g., static 1, OSPF 110, RIP 120).
ARP spoofing and countermeasures
An attack that sends forged ARP replies on the LAN to register a wrong IP-to-attacker-MAC mapping in victims' ARP tables, relaying traffic through the attacker (a foothold for man-in-the-middle). The countermeasure is Dynamic ARP Inspection (DAI), which uses a legitimate IP-MAC table built by DHCP snooping to block forged ARP packets.
Prerequisites: DHCP、DHCP snooping
Related: Man-in-the-middle (MITM) attack
closed network
A carrier-provided private network (L2 wide-area Ethernet or L3 IP-VPN) that does not traverse the public Internet, logically isolated from other subscribers' traffic and typically backed by an SLA for bandwidth and latency. Wide-area Ethernet and IP-VPN services (e.g., MPLS-based) are common implementations.
Prerequisites: Ethernet、MPLS、WAN services (leased line, wide-area Ethernet)
Collision Domain
A collision domain is the network segment within which simultaneous transmissions by multiple devices can collide, with an entire hub- or repeater-connected segment forming one collision domain. An L2 switch isolates each port into its own collision domain, and full-duplex links effectively eliminate collisions altogether. A frequently tested contrast is that collision domains are segmented per switch port, unlike broadcast domains.
Prerequisites: Layer 2 Switch
Related: Full Duplex、Broadcast Domain
Media access control (CSMA/CD, CSMA/CA)
Media access control on shared media. CSMA/CD (collision detection) is used on half-duplex wired Ethernet to detect collisions and retransmit. CSMA/CA (collision avoidance) is used on wireless LAN, where detecting collisions is hard, waiting/checking before sending to avoid them. A duplex mismatch (one side half-, the other full-duplex) causes frequent late collisions and FCS errors.
Related: Ethernet、Full Duplex
Fixed Allocation and Lease
Fixed (reserved) allocation binds a client identifier such as a MAC address to a specific IP address so the DHCP server always issues the same address — used for devices like servers that require a stable address. A lease is the validity period assigned to a dynamically allocated IP address; as expiry approaches the client sends a DHCPREQUEST (renewal) to extend it, and the address must be reacquired once the lease expires unrenewed.
Prerequisites: DHCP、MAC Address
DNS cache poisoning
An attack that injects forged name-resolution results into a caching DNS server so users are directed to an attacker-controlled fake site. It works by racing a forged response — guessing the query's transaction ID and source port — to the resolver before the legitimate authoritative server's real reply arrives, so the forged answer gets cached. Countermeasures include randomizing the source port and transaction ID, and DNSSEC, which cryptographically signs and validates responses.
Prerequisites: Route 53 DNSSEC
Forward Lookup
DNS resolution that maps a domain name to an IP address, using A records for IPv4 and AAAA records for IPv6. It is the counterpart to reverse lookup (which maps an IP address back to a domain name via PTR records); ordinary web access and mail delivery rely on forward lookup for name resolution.
Prerequisites: DNS resource records and reverse lookup、IPv6 Address
Global Unicast Address
An IPv6 address that is globally routable and unique across the Internet, falling within the 2000::/3 range — the IPv6 counterpart to an IPv4 global address. Unlike a link-local address, it is reachable across routers and can be auto-configured via SLAAC or DHCPv6.
Prerequisites: IPv6 Address
Related: Link-Local Address、SLAAC and NDP (IPv6)
Layer 3 Switch
An L3 switch integrates network-layer routing functions with the fast physical/data-link-layer switching of an L2 switch, performing tasks such as inter-VLAN routing in hardware (ASIC) rather than relying primarily on software-based routing as a conventional router does. Because it can both create VLANs and route between them in a single device, it is widely deployed as the core switch in large-scale LANs.
Related: Inter-VLAN Routing、Layer 2 Switch、VLAN (Virtual LAN)
Man-in-the-middle (MITM) attack
A general term for an attack in which the attacker inserts themselves between two communicating parties, making each believe it is communicating directly with the other, while eavesdropping on or tampering with the traffic. Techniques used to set it up include ARP spoofing, gateway impersonation via a rogue DHCP server, and DNS cache poisoning. Countermeasures include mutual authentication (e.g., verifying digital certificates) and encrypting/integrity-protecting the communication path.
Prerequisites: DHCP、DNS cache poisoning
Related: ARP spoofing and countermeasures
NAT-T (NAT traversal)
A mechanism to establish IPsec VPN from behind NAPT. Since ESP packets lack a port number and cannot be translated by NAPT, NAT-T detects NAPT during IKE negotiation and encapsulates ESP in UDP (commonly port 4500) so NAPT devices can translate and forward it like ordinary UDP traffic.
Prerequisites: IPsec、Encapsulation and Decapsulation
Related: NAPT (IP masquerade)
NS Record
A DNS resource record that specifies the hostname of an authoritative name server for a zone. NS records placed in the parent zone express delegation to a child zone, and matching NS records within the child zone itself preserve consistency. Unlike an A record used for forward lookup, its essence is indicating where resolution authority resides.
Prerequisites: Resource record (RR)、Forward Lookup
Related: DNS Delegation and Zone
OSPF
A link-state interior gateway protocol (IGP). Each router shares full topology information (LSAs) and selects the least-cost path by summing costs derived from link bandwidth. It scales to large networks via areas and converges quickly on topology changes; its default administrative distance is 110.
Related: Administrative distance (AD)、Routing protocol types (distance-vector, link-state, path-vector)
QoS (prioritization & rate control)
Mechanisms to control the quality of multiple traffic types sharing limited bandwidth. Delay/jitter-sensitive voice/video get prioritization (priority queuing); bursty traffic gets shaping (buffering the excess to smooth transmission) or policing (dropping/marking the excess). DiffServ (DSCP) classifies traffic.
Prerequisites: Jitter and jitter buffer、Priority Scheduling (Strict Priority / WFQ)、Traffic Shaping and Policing
RIP
A distance-vector IGP that uses hop count as its metric. It treats hop count 16 as unreachable (infinity), so the maximum usable hop count is 15. Simple to configure but slow to converge and unsuited to large networks; its default administrative distance is 120.
Prerequisites: Administrative distance (AD)、Metric、Routing protocol types (distance-vector, link-state, path-vector)
Root Bridge and Root Bridge Election
The root bridge is the reference point at the top of the tree topology that STP builds; every other switch computes its shortest path toward it. Election is automatic: the switch with the lowest bridge ID (bridge priority plus MAC address) in exchanged BPDUs becomes root, with MAC address as a tiebreaker when priorities are equal. Administrators can force a specific switch to become root by manually lowering its priority value.
Prerequisites: MAC Address
Routing protocol types (distance-vector, link-state, path-vector)
This classifies routing protocols by their operating principle. Distance-vector protocols exchange only distance-and-direction information with neighbors and update routes incrementally (e.g., RIP). Link-state protocols have each router hold a full topology map and compute shortest-path trees (e.g., OSPF). Path-vector protocols exchange the sequence of traversed AS numbers as a route attribute, used for loop prevention and policy control (e.g., BGP).
Prerequisites: Routing Table
Related: BGP (path-attribute selection)、OSPF
Session key
A shared secret key freshly generated for each communication and discarded after that session ends. In TLS and IPsec, the session key is securely established using public-key cryptography or a key-exchange algorithm (e.g., Diffie-Hellman), after which the actual data is encrypted with fast symmetric-key cryptography. If a session key leaks, the impact is limited to that one session, not past or future ones.
Prerequisites: Symmetric-key cryptography、IPsec
SLAAC and NDP (IPv6)
IPv6 address autoconfiguration. NDP (Neighbor Discovery Protocol) unifies IPv4's ARP and router discovery; routers announce prefixes via RA (Router Advertisement). A host combines the RA prefix with its interface ID to autogenerate a global unicast address (SLAAC = stateless address autoconfiguration), needing no DHCPv6 server.
Prerequisites: IPv6 Address、Stateless
Related: Global Unicast Address
Site-to-Site VPN and Remote Access VPN
Site-to-site VPN establishes a persistent tunnel between VPN gateways at two locations so all devices behind them communicate transparently, while remote access VPN has individual client devices run VPN software to connect a single user into the corporate network. The former suits inter-site traffic; the latter suits telework and mobile access.
VRRP (gateway redundancy)
A protocol that groups multiple physical routers into one virtual router sharing a common virtual IP and virtual MAC address. Setting the virtual IP as the clients' default gateway lets a backup automatically take over the virtual IP/MAC if the master fails, eliminating the gateway single point of failure without changing client settings. HSRP is a similar protocol.
Prerequisites: Default route (default gateway)、MAC Address、Single point of failure (SPOF)
Subnet mask
A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.
Route 53 DNSSEC
Signs DNS responses so tampering and cache poisoning are detected via validation. In Route 53 it is enabled via zone signing with a KMS key.
Prerequisites: DNS Delegation and Zone
Virtualization
Technology that uses software to create multiple virtual computers (virtual machines) on a single physical computer (server virtualization); storage, network, and desktop resources can likewise be virtualized. It allows hardware resources to be used efficiently and enables consolidation and flexible reconfiguration.
NAT (Network Address Translation)
A mechanism that translates private IP addresses to public IP addresses and back, running on a router or gateway so many internal hosts can share a small number (or just one) of public IPs to reach the internet (NAPT / IP masquerading). On Linux this is implemented via the iptables MASQUERADE target, among others.
Prerequisites: NAPT (IP masquerade)、Network Address and Broadcast Address
MTBF (mean time between failures)
For a repairable system, the average operating time from one failure to the next. A larger value means fewer failures and higher reliability. Computed as total operating time ÷ number of failures.
IEEE 802.1X (port-based authentication)
A standard for per-port LAN access authentication. Until the supplicant (device) is authenticated by an authentication server (RADIUS), the switch port permits only EAPoL authentication traffic and blocks normal data traffic; the port opens after success. EAP-TLS is a strong mutual-authentication method using client certificates.
Related: RADIUS
ARP
A protocol in IPv4 that resolves the MAC address for a target IP address: it broadcasts an ARP request, and the matching host returns its MAC in an ARP reply; results are cached in the ARP table. In IPv6, NDP serves the equivalent role.
Prerequisites: IPv6 Address、MAC Address
Authentication VLAN
A mechanism by which a switch dynamically assigns a device's VLAN based on the result of authentication such as IEEE 802.1X. On successful authentication, the port is placed into the business VLAN matching the user's role/permissions; when unauthenticated or on failure, it is automatically placed into a restricted quarantine or guest VLAN with limited access to internal resources or the Internet.
Prerequisites: IEEE 802.1X (port-based authentication)、VLAN (Virtual LAN)
BGP (path-attribute selection)
A path-vector protocol for routing between autonomous systems (AS). Rather than OSPF cost sums or RIP hop counts, it compares multiple path attributes (local preference, AS_PATH length, origin, MED) in a defined priority order, selecting routes that reflect inter-provider contracts and policy.
Prerequisites: OSPF
Related: Routing protocol types (distance-vector, link-state, path-vector)
Convergence
Convergence is the process—or the time required—for all routers in a network to reach a consistent view of routing information after a topology change such as a link failure or new route. Slow convergence can cause temporary routing loops or black holes, making convergence time a key metric for evaluating routing protocol design.
Prerequisites: Metric
Device Redundancy and Path Redundancy
Device redundancy deploys duplicate devices performing the same function (e.g., a virtual gateway via VRRP/HSRP, or dual power supplies and fans), automatically failing over to the surviving unit if one fails. Path redundancy provisions physically distinct transmission paths (links or switch paths) so that routing protocols or STP automatically reroute traffic if one path fails. The two address different failure domains: device-level availability versus link/path-level availability.
Prerequisites: Route Redundancy、VRRP (gateway redundancy)
DHCP relay agent
Because DHCP DISCOVER and similar messages are broadcasts that do not cross routers, a relay function (IP helper) is configured on each segment's router (default gateway) so clients on a server-less segment can use a server on another segment. It relays received DHCP broadcasts to the specified server as unicast, letting one server serve multiple subnets.
Prerequisites: DHCP、Default route (default gateway)
DoS/DDoS attacks and SYN flood attacks
A DoS attack overwhelms a service by flooding it with excessive requests or malformed packets from a single source. A DDoS attack is a distributed DoS carried out simultaneously from many compromised hosts (e.g., a botnet), making it hard to block since sources are spread out. A SYN flood attack is a representative DoS technique that abuses the TCP three-way handshake, sending a flood of SYN packets without completing the handshake, leaving the server with many half-open connections and exhausting its resources; SYN cookies are a common countermeasure.
Prerequisites: DDoS attack types (L3/L4 vs L7)、Flooding
Dynamic Routing vs. Static Routing
Dynamic routing uses a routing protocol to automatically exchange and learn route information, updating the routing table as topology changes occur. Static routing relies on administrator-configured fixed routes that persist until manually changed. Dynamic routing reduces operational burden in large networks, while static routing offers predictability and no protocol overhead in small or stub networks.
Prerequisites: Routing Table
Inter-VLAN Routing
Because different VLANs are separate broadcast domains, layer-3 routing is required for hosts in one VLAN to reach another, a process called inter-VLAN routing. Two common implementations are router-on-a-stick, using per-VLAN subinterfaces over a single trunk link to an external router, and a layer-3 switch with per-VLAN SVIs (switch virtual interfaces) performing the routing internally.
Prerequisites: Broadcast Domain
Related: Layer 3 Switch、VLAN (Virtual LAN)
Jitter and jitter buffer
Jitter is the variation in packet inter-arrival times (delay variation). Even with acceptable average delay, high jitter causes voice/video to stutter. Placing a jitter buffer (de-jitter buffer) on the receiver, which buffers arriving packets briefly before playing them out at a steady rate, absorbs the variation for smooth playback.
Key distribution problem
The problem that, in symmetric-key cryptography, both parties must securely share the same key, but a separate secure means is needed to deliver that key itself. This is solved by hybrid schemes that use public-key cryptography to encrypt and deliver the symmetric (session) key, or by Diffie-Hellman key exchange, which lets both parties derive the shared key without ever sending the key itself over the wire.
Prerequisites: Symmetric-key cryptography、Session key
Layer 2 Loop
A layer 2 loop is a forwarding loop that arises when switches are interconnected via redundant paths without an active loop-prevention mechanism such as STP. Because layer 2 frames have no TTL, broadcast frames circulate and multiply endlessly around the loop, causing a broadcast storm and MAC address table instability that can disable the entire network.
Prerequisites: Broadcast storm、MAC Address
Link-Local Address
An IPv6 address valid only within a single link, drawn from the fe80::/10 range. It is never forwarded across routers and is automatically assigned to every interface, distinguishing it from a global unicast address. It underlies link-local control traffic such as Neighbor Discovery Protocol exchanges.
Prerequisites: IPv6 Address、SLAAC and NDP (IPv6)
Related: Global Unicast Address
NFV (Network Functions Virtualization)
A technology that implements functions formerly provided by dedicated hardware appliances (firewall, load balancer, router, etc.) as virtualized software (VNFs) on commodity servers, eliminating per-function hardware procurement and letting functions scale up/down in software. Its focus differs from SDN, which addresses control/data-plane separation.
Prerequisites: Virtualization、Load balancer (L4/L7)
Overlay and Underlay
The underlay is the physical switching/routing infrastructure providing basic IP reachability, while the overlay is a logical network built on top of it via tunneling protocols such as VXLAN or GRE. Overlays decouple virtual network segmentation from the physical topology, enabling flexible multi-tenant designs.
Prerequisites: Tunneling
Related: VXLAN
Priority Scheduling (Strict Priority / WFQ)
Strict priority queuing (PQ) always services the highest-priority non-empty queue first, minimizing delay and jitter for high-priority traffic but risking starvation of lower-priority queues under sustained high-priority load. Weighted fair queuing (WFQ) instead services multiple queues in proportion to assigned weights, guaranteeing each queue a minimum bandwidth share and preventing starvation while still differentiating priority.
Prerequisites: Jitter and jitter buffer
Private Address
IPv4 address ranges defined by RFC 1918 for use solely within private organizational networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). They are not routed on the public Internet, so external communication requires NAPT translation to a global address.
Prerequisites: IPv4 Address、NAPT (IP masquerade)
Route Redundancy
Route redundancy is a design approach that provisions multiple paths to a destination so that a single link or device failure does not cause total loss of reachability. It is typically combined with dynamic routing's automatic failover to alternate paths and equal-cost multi-path load balancing to improve availability.
Prerequisites: Dynamic Routing vs. Static Routing
SD-WAN
A technology applying SDN concepts to the WAN, centrally managing multiple links (leased lines, Internet lines, etc.) in software and dynamically steering traffic to the optimal path per application characteristics and policy, improving agility and cost-efficiency of inter-site WANs.
Prerequisites: WAN services (leased line, wide-area Ethernet)
Stateless
Stateless describes processing each request or packet independently, without retaining or referencing prior communication state (connection or session information). Stateless packet filtering evaluates only each packet's header, making it fast and low-overhead but incapable of the session-context-aware controls that stateful inspection provides. From a load-balancing and scale-out perspective, stateless server design is advantageous because requests can be freely routed to any server without needing to preserve server-side state.
Prerequisites: Stateful inspection
STP Port Roles (Root Port/Designated Port)
STP assigns each port a role to determine which ports actively forward traffic. The root port is the single port on a non-root bridge with the lowest-cost path toward the root bridge (exactly one per switch), while the designated port is the port responsible for forwarding traffic onto a given segment (one per segment). Ports selected for neither role become blocking, non-designated ports.
Prerequisites: Root Bridge and Root Bridge Election、STP Port States (Blocking/Listening/Learning/Forwarding)
Transmission Rate
Transmission rate is a metric expressing the number of bits transmittable per unit time, denoted in bps (bits per second), representing the nominal theoretical capacity (bandwidth) of a link or interface. It is distinct from throughput, the actual effective data transfer rate, since transmission rate is a physical/data-link-layer nominal value unaffected by protocol overhead or congestion; it frequently appears in calculations involving transmission efficiency (transmission rate × efficiency = effective throughput).
Prerequisites: Metric
VNF (Virtualized Network Function)
A network function such as a router, firewall, or load balancer that was traditionally implemented in dedicated hardware, reimplemented as software running in a virtual machine or container on general-purpose servers. VNFs run atop an NFV infrastructure (NFVI), enabling rapid deployment, elastic scaling, and flexible hardware refresh.
Prerequisites: Virtualization、Load balancer (L4/L7)
Single point of failure (SPOF)
A component whose failure brings down the whole system. Eliminated via multi-AZ placement, redundancy, load balancing, and automatic failover. The starting point of availability design is to find and remove SPOFs.
Prerequisites: Load balancer (L4/L7)
DHCP snooping
A switch feature that classifies ports as trusted (connected to a legitimate DHCP server) or untrusted (general endpoints) and discards DHCP server replies (OFFER/ACK) arriving on untrusted ports, preventing a rogue DHCP server from distributing a fake gateway (a man-in-the-middle attack).
Prerequisites: DHCP、Man-in-the-middle (MITM) attack
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Load balancer (L4/L7)
AWS WAF
A web application firewall that inspects and blocks malicious HTTP requests (e.g., SQL injection, XSS) using managed rules and rate limits; attaches to CloudFront, ALB, and API Gateway.
Prerequisites: SQL injection
DDoS attack types (L3/L4 vs L7)
L3/L4 attacks saturate links/resources with volumetric packets (SYN flood, reflection/amplification)—absorbed by Shield/NLB/scrubbing. L7 attacks exhaust the app with legitimate-looking requests—mitigated by WAF rate-based rules and Shield Advanced. Layer defenses by tier.
Edge computing
Processing near users/data (the edge) to cut latency. On AWS via CloudFront/Lambda@Edge/CloudFront Functions (delivery edge), Local Zones and Wavelength (low-latency zones), and Outposts (on-premises).
Prerequisites: DNS Delegation and Zone
Sender domain authentication (SPF/DKIM/DMARC)
The three pillars of sender domain authentication. SPF lists which IPs may send for a domain; DKIM cryptographically signs mail to prove it's unaltered and from the claimed source; DMARC declares a policy (quarantine/reject) based on SPF/DKIM results plus where to send reports. Set via TXT records to fight spoofing/phishing, and it strongly affects spam filtering on the receiving side, including Google Workspace.
Prerequisites: Digital signature
Hybrid cryptography
A scheme that combines the processing speed of symmetric-key cryptography with the secure key distribution of public-key cryptography. The data itself is encrypted with a symmetric key, and that symmetric key is then encrypted with the recipient's public key before being sent. Used in S/MIME, PGP, and TLS 1.2 and earlier (note that current TLS 1.3 uses (EC)DHE key exchange and no longer sends a symmetric key encrypted under a public key).
Prerequisites: Symmetric-key cryptography
SQL injection
An attack technique that injects malicious SQL fragments into a web application's input fields to manipulate or view a database in unintended ways. It is prevented by using bind variables (placeholders) and validating input values.
VPN (virtual private network)
A technology that builds an encrypted virtual private line over a public network, securely connecting sites or remote workers to an internal network. Tunneling and encryption prevent eavesdropping and tampering.
Prerequisites: Tunneling
Digital signature
A technology that uses public-key cryptography to prove both that an electronic document was created by the claimed author (authenticity) and that the document has not been tampered with (integrity).
Symmetric-key cryptography
An encryption method that uses the same key (a shared secret key) for both encryption and decryption. Processing is fast, but the key must be shared securely with each communication partner, making key management increasingly complex as the number of partners grows.
Access Port and Trunk Port
An access port belongs to a single VLAN and forwards untagged frames to end devices, while a trunk port carries frames for multiple VLANs over one physical link, tagging them (e.g., via IEEE 802.1Q) to identify their VLAN. On trunks, a native VLAN (the untagged default VLAN) mismatch between switches can create security issues such as VLAN hopping.
Prerequisites: VLAN (Virtual LAN)
Capacity Management and Bottleneck Diagnosis
Capacity management continuously monitors traffic volume and utilization of links and devices to forecast and plan future upgrades. Bottleneck diagnosis compares utilization, delay, and drop rate across each segment of a path to pinpoint the segment with the highest load relative to capacity (i.e., utilization closest to 1 in queueing terms), narrowing down where reinforcement is needed. Traffic statistics from SNMP or NetFlow typically provide the underlying data.
Prerequisites: Queueing theory (M/M/1)、SNMP
Control Plane and Data Plane
The control plane handles route computation and policy decisions that determine forwarding rules, while the data plane executes the actual packet forwarding according to those rules. SDN separates the two and centralizes the control plane, allowing flexible, network-wide programmatic control.
DHCP Scope Design
The design of a DHCP server's address pool (scope) per subnet, including exclusion ranges, lease duration, and accompanying options such as default gateway and DNS server. Key considerations are carving out exclusion ranges for fixed allocations or other reserved uses, and balancing concurrent client count against lease duration to avoid address pool exhaustion.
Prerequisites: DHCP、Default route (default gateway)、Fixed Allocation and Lease
Error Control
Error control refers to mechanisms for detecting and correcting bit errors introduced during transmission, broadly divided into error detection (parity checks, CRC—cyclic redundancy check), error correction via forward error correction such as Hamming codes, and ARQ schemes that request retransmission upon detecting an error. Ethernet frames perform error detection only, via the FCS (CRC) field, leaving error correction and retransmission to upper layers such as TCP.
Prerequisites: Ethernet
Firewall types (packet filtering / application gateway)
Packet filtering is the most basic type, judging each packet's allow/deny by source/destination IP address and port number (up to the transport layer). An application gateway (proxy) type interprets the application-layer protocol and terminates/relays the session itself, allowing inspection of commands and data content, but it needs dedicated handling per protocol and has higher processing overhead. Stateful inspection, which dynamically tracks session state, is a separate method from these two.
Prerequisites: Stateful inspection
Health Check
A health check is a mechanism used by load balancers and redundant configurations to periodically verify that backend servers or devices are responding correctly. L4 health checks simply test whether a TCP connection can be established, while L7 health checks send an HTTP request and validate the status code or response content; targets detected as unhealthy are automatically excluded from traffic distribution or failover.
Related: Load balancer (L4/L7)
Load Balancing Algorithms (Round Robin / Least Connections)
Round robin is the simplest load-balancing algorithm, assigning requests to backend servers in sequential, equal turns; it works well when per-request processing load is uniform but can leave load unevenly distributed when processing times vary. Least connections instead routes each new request to the server currently handling the fewest active connections, balancing load more accurately in environments where request processing times differ significantly.
Prerequisites: Load balancer (L4/L7)
Line Coding
Line coding is the scheme for converting a digital bit stream into an electrical or optical waveform suitable for transmission over a physical medium, with examples including Manchester encoding, NRZ, 4B/5B, and 8B/10B. Key selection criteria include ease of clock recovery at the receiver, suppression of DC bias, and coding efficiency, and different Ethernet standards (e.g., 10BASE-T, 1000BASE-T) adopt different line coding schemes.
Prerequisites: Ethernet
Longest prefix match
The IP routing principle of preferring, among multiple matching routes, the one with the longest (most specific) prefix. The default route (0.0.0.0/0) is used only as a last resort when no other route matches.
Multiplexing
Multiplexing is a technique for sending multiple signals or data streams simultaneously over a single transmission medium, with schemes including FDM (frequency division), TDM (time division), WDM (wavelength division, used in optical fiber), and CDMA (code division). It allows efficient sharing of a single physical link, but requires the receiver to correctly demultiplex the combined signal back into its original streams.
Recursive Query and Iterative Query
In a recursive query, the receiving DNS server continues querying other servers on the requester's behalf until it obtains a final answer (or confirms non-existence), returning only that final result. In an iterative query, the receiving server returns the best answer it currently holds — typically a referral to another server — leaving the requester to continue querying itself. Conventionally, stub resolvers issue recursive queries to caching servers, which in turn issue iterative queries to authoritative servers.
Prerequisites: Authoritative Server and Caching Server
SDN (Software-Defined Networking)
An architecture that separates the control plane (routing decisions) from the data plane (packet forwarding); an SDN controller centrally computes routing with a full network view and distributes forwarding rules to switches via protocols such as OpenFlow, enabling centralized control and automation without per-device configuration.
Prerequisites: Control Plane and Data Plane
Session Persistence (Sticky Sessions)
Session persistence (sticky sessions) is a load balancer feature that consistently routes all requests from a given client to the same backend server, implemented via methods such as source-IP-based binding or embedding a server identifier in a cookie. It is needed for applications that store session state (e.g., login status) on the server side, where routing successive requests to different servers would cause state inconsistency.
Related: Load balancer (L4/L7)
Traffic Shaping and Policing
Shaping buffers and delays traffic exceeding a rate limit to smooth the output rate, avoiding drops at the cost of added latency, and is typically applied on egress. Policing instead drops or remarks (e.g., re-tags DSCP) excess traffic immediately without buffering, adding no delay but risking packet loss, and is typically applied on ingress to enforce a contracted rate.
SSL-VPN
A remote-access VPN using HTTPS (TLS/SSL). The clientless mode in particular needs no dedicated VPN software and works with just a web browser, easily limiting access to specific web apps mediated by the gateway. It suits limited access from unmanaged personal or contractor PCs.
Prerequisites: Site-to-Site VPN and Remote Access VPN
SASE (Secure Access Service Edge)
A concept that integrates network functions (such as SD-WAN) and security functions (SWG, CASB, zero-trust network access) in the cloud so that users and devices can access resources securely from anywhere under consistent policy. It supports the shift from perimeter defense to cloud-centric defense.
Prerequisites: SD-WAN
Stateful inspection
A firewall method that dynamically remembers the connection (session) state of passing traffic and automatically permits only the return packets corresponding to internally initiated communications. Unlike simple packet filtering, it needs no static rule for each return flow.
Queueing theory (M/M/1)
A theory that models arrivals and service events as random processes to analyze waiting time and queue length probabilistically. In the M/M/1 model, the utilization ρ=λ/μ is derived from the arrival rate λ and service rate μ; as ρ approaches 1, the average wait time and queue length increase sharply. Used to design counter counts and service capacity.
OSI reference model
A standard model that organizes network communication functions into seven layers — physical, data link, network, transport, session, presentation, and application. Understanding each layer's role helps clarify where a given protocol fits.
MTTR (mean time to repair)
The average time from a failure until recovery. A smaller value means faster recovery and better maintainability. Computed as total repair time ÷ number of failures; it is part of the denominator in availability = MTBF ÷ (MTBF + MTTR), assessed together with MTBF (mean time between failures) for reliability and maintainability.
Prerequisites: Availability rate、MTBF (mean time between failures)
Head-of-Line Blocking
Head-of-line (HOL) blocking occurs when the packet or request at the front of a queue is delayed for some reason (e.g., receiver buffer exhaustion, waiting for in-order delivery), stalling all subsequent packets or requests behind it even though they could otherwise be processed. It arises with shared single FIFO queues, TCP's in-order delivery guarantee after packet loss, and HTTP/1.1 pipelining, and is mitigated by techniques such as virtual output queuing (VOQ) or HTTP/2+ multiplexing.
Prerequisites: Multiplexing
MPLS
A label-switching technique that attaches labels to packets so routers in the network forward them by label without re-parsing the IP header each time. As the basis of IP-VPN services, it isolates per-customer routing over a shared network and efficiently provides any-to-any site connectivity.
MTU and MSS
MTU (Maximum Transmission Unit) is the largest upper-layer packet (such as an IP packet) that a data-link frame can carry (for example, 1500 bytes on Ethernet). When encapsulation (e.g., VPN) adds headers, the effective MTU shrinks, increasing fragmentation/retransmission for large packets so that only certain apps slow down. MSS (Maximum Segment Size) is the max data TCP sends per segment; adjusting it for the tunnel overhead avoids fragmentation.
Prerequisites: Encapsulation and Decapsulation、Ethernet
Network Address and Broadcast Address
Within an IPv4 subnet, the network address (host bits all zero) identifies the subnet itself, while the broadcast address (host bits all one) targets all hosts on that subnet simultaneously. Neither is assignable to a host, so usable host count equals the subnet's total addresses minus two.
Port security
A switch feature that sets, per port, a maximum number of learned/allowed MAC addresses or specific permitted MACs, and shuts the port down or drops frames when the limit is exceeded or an unauthorized MAC is seen. It prevents MAC address table overflow (MAC flooding) attacks that flood the table with forged source MACs.
Prerequisites: Flooding、MAC Address
SNMP
A protocol for monitoring and managing network devices. In addition to polling (GET) where the manager periodically queries agents, it has traps by which an agent proactively notifies on events. Management data is structured in a MIB (identified by OIDs). SNMPv3 adds authentication and encryption, resolving the plaintext-community weakness of v1/v2c.
Related: SNMP Community String
SPF Algorithm (Dijkstra's Algorithm)
Dijkstra's algorithm computes the shortest path from a source node to every other node in a weighted graph. Link-state routing protocols use it as the underlying theory for building a topology graph from collected link-state information and computing the shortest-path tree rooted at the local router.
Prerequisites: Routing protocol types (distance-vector, link-state, path-vector)
Wi-Fi Frequency Bands (2.4/5/6 GHz)
The 2.4 GHz band penetrates obstacles well and reaches farther but suffers from interference (e.g., microwave ovens) and few available channels. The 5 GHz band offers more channels and higher speed at shorter range. The 6 GHz band (Wi-Fi 6E/7) adds a wide contiguous spectrum largely free of legacy interference, providing many additional high-speed channels.
Related: Wi-Fi 6 (IEEE 802.11ax)
Wi-Fi 6 (IEEE 802.11ax)
The IEEE 802.11ax wireless LAN standard. Using OFDMA (Orthogonal Frequency-Division Multiple Access), it divides one channel into resource units to serve multiple devices simultaneously, greatly improving effective throughput in dense multi-device environments. Wi-Fi 6E extends it to the 6 GHz band.
Related: Wi-Fi Frequency Bands (2.4/5/6 GHz)
AH (Authentication Header)
One of the protocols composing IPsec; it provides integrity and source authentication for IP packets but does not encrypt (no confidentiality). Because it also authenticates the IP header, it conflicts with NAT, which rewrites addresses in transit; use ESP when confidentiality is required.
Prerequisites: IPsec
RADIUS
A protocol for centralized authentication, authorization, and accounting (AAA). Used as an authentication server in wireless LAN, VPN, and IEEE 802.1X environments, it centrally manages per-user credentials to control network access.
VLSM (Variable Length Subnet Mask)
A technique that divides a single address space into subnets with different mask lengths according to the host count each department or segment needs. Assigning right-sized blocks avoids address waste and unnecessary enlargement of the attack surface.
Prerequisites: Subnet mask
MTU and jumbo frames
The maximum packet size on a path: up to 9001 within a VPC (jumbo frames), 1500 over an IGW/VPC peering, 8500 over Transit Gateway, and up to 1500 over Site-to-Site VPN (less in practice with IPsec). Exceeding a smaller MTU with the DF bit set requires path MTU discovery’s ICMP (Fragmentation Needed); blocking it in an SG/NACL causes the classic failure where connections establish but large transfers hang.
Prerequisites: IPsec
Hash function (tamper detection)
A function that computes a fixed-length value (a hash value) from data of arbitrary length. The same input always produces the same output, and even a tiny change drastically alters the value, which is why hash functions are used for tamper detection and password storage.
IKE policy
The Internet Key Exchange settings that define how an IPsec tunnel exchanges keys—encryption algorithm, hash, Diffie–Hellman group, and SA lifetime—must match on both the on-prem device and the cloud-side VPN gateway.
Prerequisites: IPsec
Targeted attack
An attack that aims at a specific organization or individual, for example through a targeted attack email disguised as being related to the recipient's work, in order to steal confidential information or damage systems — unlike scattershot attacks aimed at an unspecified large number of targets.
SNMP Community String
In SNMP v1/v2c, the community string is a plaintext shared value used to authenticate requests between manager and agent, with read-only and read-write permission levels; requests lacking the correct community string are rejected by the agent. Because it is transmitted in cleartext, it is vulnerable to eavesdropping and guessing, so environments requiring confidentiality should migrate to SNMPv3's user-based authentication and encryption.
Related: SNMP
Cyber kill chain
A model that organizes the stages of a targeted attack as reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives. It is used to consider effective defenses at each stage and analyze where the attack chain can be broken.
Prerequisites: Targeted attack
HMAC (keyed-hash message authentication code)
A scheme that generates a message authentication code (MAC) by combining a shared secret key with a hash function. The receiver recomputes it with the same key to verify integrity and that the message came from a party holding the key, providing integrity and authenticity without a public-key infrastructure.
Prerequisites: Hash function (tamper detection)
EDR (Endpoint Detection and Response)
A mechanism that continuously monitors and records behavior on endpoints such as PCs and servers, detecting suspicious post-intrusion activity (process launches, network connections, file changes) and enabling isolation or investigation. Whereas antivirus is an entry-point control that detects known patterns, EDR assumes intrusion will happen and provides after-the-fact response and visibility.
Prerequisites: Layered defense (entry, internal, and exit controls)
Layered defense (entry, internal, and exit controls)
A design philosophy premised on the idea that intrusion can never be prevented with 100% certainty, combining entry controls (firewalls/WAF to block intrusion itself), internal controls (privilege management and EDR to contain damage after intrusion), and exit controls (DLP and proxies to stop data exfiltration) in multiple layers, avoiding over-reliance on any single measure.