Networking: Beginner to Job-Ready

The physical topology is how cables are actually run. The logical topology is how data actually flows, which can be different. A classic example: older Ethernet hubs were wired in a physical star, but every device still received every signal — behaving logically like a bus. Don't assume the cable diagram tells you the whole story of how traffic moves.

Ethernet cables contain 4 pairs of copper wires, twisted together specifically to cancel out electrical interference between them. UTP (Unshielded Twisted Pair) is standard for most offices; STP (Shielded Twisted Pair) adds a foil/braid shield for environments with heavy electrical interference.

The connector on the end of an Ethernet cable is called RJ45. The order the 8 wires are terminated in follows one of two color-code standards, T568A or T568B — either works as long as both ends of one cable match.

Common fiber connectors: SC (square, push-pull), LC (small form factor, most common today), ST (round, twist-lock, older).

The same cable type used for cable TV, still commonly used by cable internet modems for the "last mile" connection from the ISP into a building. You likely won't terminate coax yourself often, but you'll recognize it at the demarc point where an ISP's responsibility ends and yours begins.

A MAC address is 48 bits, written as 12 hexadecimal characters, e.g. 3C:5A:B4:12:9F:E1. It's split into two halves:

A switch builds and maintains a MAC address table (also called a CAM table) by watching incoming traffic:

1. A frame arrives on Port 3 with source MAC AA:AA:.... The switch records "MAC AA:AA:... lives on Port 3."
2. When a later frame's destination is AA:AA:..., the switch checks its table and sends the frame only out Port 3 — not to every port.
3. If the destination MAC isn't in the table yet, the switch temporarily floods the frame out every port except the one it arrived on, until it learns the real location from a reply.

A VLAN (Virtual LAN) lets you split one physical switch into multiple logically separate networks — devices on VLAN 10 can't directly talk to devices on VLAN 20, even though they're plugged into the exact same physical switch, without a router or layer-3 device passing traffic between them.

If you accidentally cable two switches together with two separate cables (often by mistake, sometimes intentionally for redundancy), you create a loop — frames can circle forever, rapidly overwhelming the network (a "broadcast storm"). STP (Spanning Tree Protocol) detects loops and automatically disables the redundant path, keeping one clean logical path while keeping the backup cable ready if the primary fails.

An IPv4 address is 32 bits, written as 4 decimal numbers (0–255) separated by dots — e.g. 192.168.1.42. Each of those 4 numbers is one octet (8 bits).

An IP address alone doesn't tell you which part identifies the network and which part identifies the specific host on it. That's the subnet mask's job — it draws the line.

CIDR notation (the /24 shorthand) is just a faster way of writing how many bits are the network portion, instead of writing out the full mask.

Say you're given the network 192.168.1.0/24 and told to split it into 4 smaller subnets. Here's the exact process:

1. Figure out how many bits you need to borrow. To create 4 subnets, you need enough new bit-combinations to count 0,1,2,3 — that's 2 bits (2² = 4).
2. Borrow those bits from the host portion. /24 + 2 borrowed bits = /26 — your new subnet mask is 255.255.255.192.
3. Calculate the block size. With 2 bits borrowed, each subnet is 2^(8-2) = 64 addresses wide.
4. List the subnets by counting up in that block size:

NAT (Network Address Translation) is what your router does to let every device on your private network share one public IP address. When your laptop (192.168.1.42) sends a request to the internet, your router swaps that private source address for its own public IP before sending it out, and keeps a table so it can correctly route the response back to your laptop specifically.

IPv4 provides about 4.3 billion possible addresses (32 bits). That sounded infinite in the 1980s — it isn't anymore, with billions of phones, laptops, IoT devices, and servers all needing addresses. IPv6 uses 128 bits instead of 32, providing an almost incomprehensibly larger address space — enough to assign a unique address to every grain of sand on Earth many times over.

An IPv6 address is written as 8 groups of 4 hexadecimal digits, separated by colons:

Two shortcuts make these more manageable:

1. Leading zeros in each group can be dropped: 0db8 becomes db8.
2. One run of consecutive all-zero groups can be replaced with ::, one time only per address: 2001:db8:85a3:0:0:8a2e:370:7334 becomes 2001:db8:85a3::8a2e:370:7334.

The internet didn't switch from IPv4 to IPv6 overnight — most networks today run dual stack, meaning every device has both an IPv4 and an IPv6 address simultaneously, and can communicate over either depending on what the destination supports. You'll be working with both address families for the foreseeable future, not one replacing the other on any fixed timeline.

Every router keeps a routing table — a list of known networks and which direction (which interface, or which "next hop" router) to send traffic for each one. When a packet arrives, the router checks its destination IP against this table and forwards it accordingly.

Recall from Module 1: a switch forwards traffic within one network using MAC addresses; a router forwards traffic between different networks using IP addresses. Everything in this module is what a router is actually doing under the hood to make that second job possible.

The SSID is simply the network name you see when choosing a Wi-Fi network. A channel is a specific frequency range within a band — think of a band as a highway and channels as individual lanes. Overlapping channels between nearby networks (like apartment neighbors) causes interference and slower speeds for everyone.

• Access point placement — central, elevated, away from thick walls and metal objects where possible, since both significantly reduce signal range.
• Overlap between APs — in a multi-AP setup, aim for a small amount of coverage overlap so devices can roam between APs without a dead zone, but not so much overlap that APs interfere with each other on the same channel.
• Interference sources — microwaves, cordless phones, and Bluetooth devices all commonly interfere with 2.4GHz specifically.

Without DHCP, every device joining a network would need someone to manually type in an IP address, subnet mask, default gateway, and DNS server. DHCP (Dynamic Host Configuration Protocol) automates all of that the moment a device connects.

Computers route traffic using IP addresses, but humans remember names. DNS (Domain Name System) is the internet's phonebook, translating a name like example.com into the IP address a router can actually deliver a packet to.

1. You type example.com into a browser.
2. Your device asks a DNS server (often your ISP's, or a public one like 1.1.1.1 or 8.8.8.8) to resolve that name.
3. The DNS server returns the corresponding IP address.
4. Your device connects directly to that IP address — DNS's job is now done.

DHCP doesn't just hand out an IP address — it typically also tells the client which DNS server to use. This is why "no internet access" on a device is often actually a DHCP or DNS problem rather than a true connectivity problem: the device might have a valid IP and a working path to the internet, but no way to resolve names into addresses.

Every TCP connection — every webpage load, every file transfer — starts with this exact 3-step exchange before any real data is sent. This is also exactly what TCP's connection-oriented reliability is built on top of.

An IP address gets data to the right device; a port number gets it to the right application running on that device. Ports 0–1023 are "well-known" ports, reserved for standard services.

An IP address plus a port number together form a socket, written as 192.168.1.10:443 — this fully identifies not just which device, but which specific application/service on that device a connection is talking to.

A firewall inspects traffic and allows or blocks it based on a set of rules — the single most fundamental network security device.

An ACL is an ordered list of rules, applied on a router or switch, that permit or deny specific traffic — essentially a lightweight, more targeted firewall ruleset applied directly at a network device.

A VPN (Virtual Private Network) creates an encrypted tunnel across a public network (like the internet), so traffic inside that tunnel is protected from anyone intercepting it along the way — commonly used for remote employees securely reaching an internal company network, or connecting two office sites together over the internet instead of an expensive dedicated line.

ping 8.8.8.8
ping google.com

Sends a small packet and waits for a reply, confirming basic reachability and round-trip time. Pinging a known-good public IP (like 8.8.8.8) versus a name (like google.com) is a classic first split-test: if the IP works but the name doesn't, you're looking at a DNS problem (Module 9), not a connectivity problem.

# Linux/macOS
traceroute google.com

# Windows
tracert google.com

Shows every router hop between you and the destination, with the response time at each one. If the trace consistently fails or spikes at one particular hop, that's exactly where to focus — the problem almost certainly isn't your local machine if the first several hops respond fine.

# Windows
ipconfig /all

# Linux/macOS
ifconfig
ip addr

Shows your device's own IP address, subnet mask, default gateway, and DNS servers — the first thing to check when a device can't reach anything: does it even have a valid configuration in the first place?

nslookup google.com

Manually queries DNS and shows exactly what IP address a name resolves to — useful for confirming whether a "site won't load" complaint is a DNS issue before looking anywhere else.

Wireshark captures and displays every packet crossing a network interface, letting you inspect headers and payloads directly — the deepest level of troubleshooting available short of physical hardware testing. You won't need it for most day-to-day issues, but it's the tool that answers "what is actually being sent" when every higher-level tool has failed to explain a problem.

Two office locations, each with their own router, establish a permanent encrypted tunnel between them over the internet. Once established, devices on each side can reach devices on the other side as if they were on the same local network — the same idea as the individual remote-access VPN from Module 11, just connecting two whole networks instead of one user.

Cloud providers (AWS, Azure, Google Cloud) let you build virtual versions of the same networking concepts from this entire course, just software-defined instead of physical hardware.

SNMP (Simple Network Management Protocol) lets a central monitoring system regularly poll routers, switches, and servers for health data — CPU load, interface traffic, error counts, temperature — without needing to log into each device individually.

Syslog is a standard for devices to send log messages to a central logging server, instead of each device only keeping logs locally (where they're easy to lose, and hard to correlate across multiple devices during an incident).

• Network diagrams — a current, accurate map of every device and connection. Out-of-date diagrams are worse than none, because they actively mislead.
• IP address inventory — what's assigned where, so you're not guessing (or causing a conflict) when adding a new device.
• Configuration backups — saved device configs you can restore from, so a failed device or a bad change isn't a from-scratch rebuild.

A formal process for proposing, reviewing, approving, and documenting any change to network configuration — even a "simple" one. The point isn't bureaucracy for its own sake; it's making sure someone else knows what changed, why, and how to undo it if something breaks.

A small business is moving into a new office: 3 departments (Sales, Engineering, Guest Wi-Fi), around 40 employees, one internet connection, and a requirement that guest devices must never reach internal resources. You're designing the network from scratch.

1. Topology (Module 2): A star topology from a central switch stack, uplinked to a router/firewall at the network edge.
2. Cabling (Module 3): Cat6 for all desk drops, planned to stay within the 100m distance limit from the wiring closet.
3. VLANs (Module 4): Three VLANs — Sales, Engineering, Guest — on the same physical switches, keeping Guest traffic logically isolated.
4. IP addressing (Module 5): Subnet a private block (e.g. 192.168.0.0/22) into three right-sized subnets, one per VLAN, using the same borrowing method from Module 5.
5. Routing (Module 7): A default route out to the internet, with static routes (or a routing protocol, if the network grows) between VLANs where needed.
6. Wireless (Module 8): Separate SSIDs for Corporate and Guest, mapped to their respective VLANs, WPA3 (or WPA2 minimum) on both.
7. Services (Module 9): DHCP scopes per VLAN, each handing out the correct subnet, gateway, and DNS servers automatically.
8. Security (Module 11): A firewall at the edge, with ACLs specifically blocking the Guest VLAN from reaching Sales/Engineering subnets.
9. Documentation (Module 14): A network diagram, IP address inventory, and VLAN assignment sheet — the artifacts a real employer would expect handed off.

A truly comprehensive capstone isn't just designing a working network — it's also being handed a broken one. Practice each of these scenarios using the methodology from Module 12:

• Build a home lab — even a cheap used switch/router setup lets you practice VLANs, subnetting, and basic routing hands-on, which matters far more to interviewers than a certificate alone.
• Learn to explain your capstone out loud — being able to walk someone through why you chose a /22 subnet split, or why Guest Wi-Fi needs its own VLAN, is exactly what a help-desk or NOC interview will probe for.
• Target entry roles precisely — Help Desk, NOC Technician, and Network Support Technician are the standard first rungs; they lean heavily on exactly the troubleshooting methodology from Module 12.