Network Concepts and Protocols 2

Table of Contents

• Module 1: The Big Picture of Networking
  • A Bird’s Eye View of Network Communication
  • The OSI Reference Model
  • The TCP/IP Model
  • Application Layer Protocols and HTTP
  • Data Encapsulation and De-encapsulation
  • Transport Layer Protocols: TCP, UDP, and QUIC
  • The Network Layer: Routing with IP
  • The Data Link Layer Preview: Switching with Ethernet
  • The Physical Layer Preview
  • Putting It All Together: An End to End Walkthrough
• Module 2: The Physical Layer
  • Copper Network Cable Types
  • Twisted Pair Cable Construction and Wiring Standards
  • Cable Categories and Bandwidth
  • Structured Cabling: IDFs, Patch Panels, and Keystone Jacks
  • Cable Construction Details and Jacket Ratings
  • Power over Ethernet
  • Demo: Crimping an RJ45 Connector and Punching Down a Keystone Jack
  • Troubleshooting Copper Cable Issues
  • Copper Cable Troubleshooting Tools
  • Fiber Optic Cable Construction
  • Single Mode vs Multimode Fiber
  • Fiber Connectors and Optical Transceivers
  • Demo: Mechanically Splicing Fiber Optic Cable
  • Demo: Fusion Splicing Fiber Optic Cable
  • Common Fiber Optic Issues and Attenuation
  • Fiber Optic Troubleshooting Tools
  • Direct Attach Cables and Active Optical Cables
  • Other Physical Layer Devices
• Module 3: The Data Link Layer
  • The 802.3 Ethernet Standard
  • Anatomy of an Ethernet Frame
  • Layer 2 Switches vs Hubs
  • How Switches Learn MAC Addresses
  • Switch Form Factors and Management Methods
  • Switch Features Overview
  • Demo: Exploring a Network Switch CLI
  • MAC Addresses and the OUI
  • MAC Address Randomization and Rotation
  • The Broadcast Address
  • Address Resolution Protocol (ARP)
  • Broadcast Storms and Loop Prevention
  • Multicast and the Internet Group Management Protocol (IGMP)
• Summary

Networking plays a critical role in how users access services from their computers, whether that is web pages, databases, chatbots, or file storage. None of that happens without traffic being sent over networks. This course builds a foundation in core networking concepts and maps them to the industry-standard models that describe how network components interact with each other. It then moves down into the lower levels of the network — starting with physical connections such as cables and how to work with them (including hands-on crimping of copper connections and splicing of fiber cable) — and finishes by covering switching on a local network and how layer 2 switches actually work.

Module 1: The Big Picture of Networking

A Bird’s Eye View of Network Communication

Consider a simple illustration of a network from an end user’s perspective: a computer connects to a web server to request and view a web page. In reality, this is not a simple, direct connection. The computer is likely connected to a network switch, which contains other computers that pass traffic around the local network. That switch is connected to a router, which routes (forwards) packets to other routers until the traffic reaches the network where the web server resides.

Once a physical path exists to route traffic from client to server, the two devices need a method of establishing communication — a transport protocol such as TCP or UDP — over which the real payload (the application data, in this case web traffic) can be carried. The client sends a request to the server, and the server passes the requested web data back over that established transport connection, allowing the browser to render the page.

Even at this high level, it becomes clear that although all of these parts work together, there is a specific order to things. Network protocols and devices are aware of this structure, and in networking this organizational structure is described using models. Two models are commonly used today: the OSI model and the TCP/IP model.

The OSI Reference Model

OSI stands for Open Systems Interconnection, formalized by the International Organization for Standardization (ISO) in the early 1980s as a reference model for people developing network protocols in an open way so that they would all work together. The model is made up of seven layers:

flowchart TB
    L7["Layer 7 - Application<br/>HTTPS, FTP, DNS, SMTP"]
    L6["Layer 6 - Presentation<br/>Compression, encryption"]
    L5["Layer 5 - Session<br/>Session creation/management/termination"]
    L4["Layer 4 - Transport<br/>TCP, UDP"]
    L3["Layer 3 - Network<br/>IP addressing and routing"]
    L2["Layer 2 - Data Link<br/>Ethernet, MAC addresses, switches"]
    L1["Layer 1 - Physical<br/>Cables, hubs, repeaters, bits/signals"]
    L7 --> L6 --> L5 --> L4 --> L3 --> L2 --> L1

The TCP/IP Model

The TCP/IP model is specific to the Transmission Control Protocol/Internet Protocol suite. Historically, this model combines OSI layers 1 and 2 into a single data link layer, keeps the network and transport layers the same as OSI, and wraps OSI layers 5, 6, and 7 into a single application layer. This doesn’t mean the session and presentation functions don’t exist on a TCP/IP network — they are simply grouped into the higher-level application layer for categorization purposes. This four-layer version is the official model described in RFC 1122 (Requests For Comments 1122, written in 1989 — RFCs are one of the methods used by the Internet Engineering Task Force to submit standards and protocol specifications).

Since then, a five-layer model has become common, which keeps the physical layer and the data link layer separate (this is the model used by Cisco training material, and the one used throughout this course).

flowchart LR
    subgraph OSI["OSI Model (7 layers)"]
        direction TB
        O7[Application]
        O6[Presentation]
        O5[Session]
        O4[Transport]
        O3[Network]
        O2[Data Link]
        O1[Physical]
    end
    subgraph TCPIP["TCP/IP Model (5-layer variant)"]
        direction TB
        T4[Application]
        T3b[Transport]
        T3[Network]
        T2[Data Link]
        T1[Physical]
    end
    O7 --- T4
    O6 --- T4
    O5 --- T4
    O4 --- T3b
    O3 --- T3
    O2 --- T2
    O1 --- T1

Both models serve a couple of purposes. First, they give a simple top-down framework for organizing the protocols and technologies being learned. Second, they establish a common vocabulary for talking with network engineers and vendors — for example, network equipment vendors commonly describe products as “layer 2 switches” or “layer 3 switches,” and distributed denial-of-service (DDoS) protection products are commonly advertised as operating at layer 3, 4, or 7. Understanding what happens at those layers helps when discussing equipment and reading vendor material.

Application Layer Protocols and HTTP

From this point forward, the TCP/IP model’s terminology is used, so protocols that would be OSI session-layer protocols (such as SIP, the Session Initiation Protocol) are simply grouped under “application” since they sit above the transport layer.

Common application-layer protocols include:

How an HTTP request/response works. When a browser is given a website name, it makes an HTTP request to the web server. That request looks something like this:

GET / HTTP/1.1
Host: example.com

This is called the header. The GET portion is the HTTP method. Common HTTP methods include:

The server then sends back a response:

HTTP/1.1 200 OK
Date: ...
Server: ...

<html>...the requested page...</html>

The response includes the HTTP version and a status code — 200 OK tells the browser everything returned as expected. Other status codes communicate different outcomes, including the well-known 404 NOT FOUND, returned when a requested web page or resource cannot be found. The response also carries metadata (such as date and server version) and, most importantly, the requested data itself (in this case, the web page). This process repeats for every file the page needs — scripts, stylesheets, images — each requested individually and answered with the appropriate file.

Importantly, HTTP itself is not concerned with packets or IP addresses. It deals with web pages and files: a browser requests a page and a server returns the requested file. All the additional networking machinery happens at the lower layers of the TCP/IP model.

Data Encapsulation and De-encapsulation

Encapsulation is the process of putting one piece of data inside another — similar to putting a letter inside an envelope. The letter is the HTTP data, and the envelope is the layer 4 protocol (in this case, a TCP segment). That envelope is, in turn, placed inside a layer 3 IP envelope, which is placed inside a layer 2 Ethernet envelope. These “envelopes” are more formally called PDUs — Protocol Data Units. Most PDUs have a header containing the necessary protocol information, and a data field — the opening into which the higher-layer data is placed.

De-encapsulation is the reverse process: a device receives a PDU and opens the envelope to process the data. That data can then be re-encapsulated into a new PDU to be sent on to wherever it needs to go next.

flowchart TB
    subgraph Encapsulation["Encapsulation (sender side)"]
        direction TB
        A["HTTP Data<br/>(Layer 7)"] --> B["TCP Segment<br/>TCP Header + HTTP Data<br/>(Layer 4)"]
        B --> C["IP Packet<br/>IP Header + TCP Segment<br/>(Layer 3)"]
        C --> D["Ethernet Frame<br/>Ethernet Header + IP Packet + Trailer<br/>(Layer 2)"]
        D --> E["Bits<br/>(Layer 1)"]
    end

Transport Layer Protocols: TCP, UDP, and QUIC

The transport layer exists because applications like HTTP are not aware of how large an IP packet can be, and when an application wants to send a large file, it just wants to send the large file. A mechanism is needed to understand the underlying packet size, break application data into segments sized for those packets, and label them so they can be reconstructed on the other end. In a modern network, three protocols commonly fill this role: TCP, UDP, and QUIC.

TCP (Transmission Control Protocol) — the reliable transmission method. TCP establishes a connection using the three-way handshake:

sequenceDiagram
    participant C as Client
    participant S as Server
    C->>S: SYN (synchronize)
    S->>C: SYN, ACK (synchronize + acknowledge)
    C->>S: ACK (acknowledge)
    Note over C,S: Connection established

1. The client sends a SYN flag to the server (“Can I talk to you?”).
2. The server responds with an ACK flag, and also sends its own SYN flag (“Yes, you can talk to me. Can I talk to you?”).
3. The client responds to the server’s SYN with its own ACK (“Yes, you can talk to me.”).

TCP also supports retransmission of lost packets. Inside the TCP header there is a sequence number (the starting byte of the segment) and an acknowledgment number (the next expected sequence number from the other host). As data is sent, the sequence number increases accordingly, and the receiving host confirms receipt via the acknowledgment number. If the expected ACK number is not received (for example, an ACK of 4 after sending sequence numbers 4 and 5 were expected to have been acknowledged as received), the sender knows the other host did not receive those sequence numbers and retransmits from that point. Note that the sequence number is the starting byte, so it increases by the amount of data sent — starting at sequence number 1 and sending 200 bytes means the next sequence number is 201.

The TCP header and data together form the TCP PDU, called a segment. Two critical fields inside the segment header are the source port and destination port. When a computer runs an application that accepts connections, it needs a way to know which application should receive incoming data — this is the purpose of port numbers. For example, a web server (such as Apache) typically listens on port 80 (HTTP) or port 443 (HTTPS). Port numbers range from 1 to 65,535; most applications allow the port to be changed, but well-known defaults exist (80, 443, etc.). The source port lets the receiving computer know what to send data back to.

UDP (User Datagram Protocol) — the fast, connectionless transport method. UDP does not establish a connection; it simply sends data to the host and hopes it arrives. This means UDP has less overhead than TCP, but there is no built-in mechanism for retransmitting dropped or lost packets — if a packet is lost, that data is lost. This can actually be desirable for real-time traffic such as VoIP (Voice over IP) phone calls and video calls, where retransmitting old data is less useful than simply moving forward. UDP is also used heavily by network utilities that want minimal overhead, such as NTP (time sync) and DNS (name resolution).

The UDP header is much simpler than TCP’s, containing just the bare minimum: source port, destination port, length (size of the data), and a checksum for integrity. In UDP, the PDU is called a datagram. UDP ports and TCP ports are entirely separate — a process can listen on TCP port 80 and a different process can listen on UDP port 80 simultaneously without conflict.

QUIC is a more modern, hybrid transport protocol, only becoming an official standard in 2021 (in contrast to TCP and UDP, standardized in the 1980s). QUIC runs on top of UDP but adds TCP-like mechanisms such as connections and retransmission of lost packets. A key advantage of QUIC is that TLS (Transport Layer Security) encryption is built directly into the protocol instead of running on top of it as it does with TCP. TLS itself requires a handshake to establish a secure connection, similar to how TCP establishes a connection. For encrypted TCP traffic like HTTPS, a TCP handshake and a separate TLS handshake are both required before data can flow. With QUIC, this is done in the same handshake, saving round-trip time and letting data start flowing sooner. Because TLS is integrated, part of QUIC’s header is encrypted, unlike TCP’s header, which is unencrypted. QUIC is most commonly used for HTTP traffic (with estimates suggesting around 30% of HTTP traffic uses QUIC in early 2026), but it is also used elsewhere, such as SMB over QUIC for secure file access over the internet.

The Network Layer: Routing with IP

The network layer is responsible for getting data from one computer to another — and, more importantly, from one network to another. The primary protocol is the Internet Protocol (IP), which uses packets to send data from one IP address to another.

An IPv4 address is paired with a subnet mask, which denotes the separation between the network identifier portion and the host identifier portion of the address. For example, an address starting with 192.168.100 paired with a subnet mask of 255.255.255.0 means the first three octets (255.255.255) form the network identifier and the last octet (0) denotes the host identifier. So an address like 192.168.100.17/255.255.255.0 describes “host 17 on the 192.168.100 network.”

If an IP packet needs to reach a host on the same network (e.g., host 192.168.100.23 when the sender is on 192.168.100.x), it can be sent directly at the data link layer. If the destination is outside the local network (e.g., 192.168.200.9, which doesn’t match the local network identifier), the packet is sent to the router (also called the default gateway) — a layer 3 device that routes the packet toward the destination network, whether that network is directly connected to the router or reachable via a routing table. That table may be populated by routing protocols such as BGP (Border Gateway Protocol) or OSPF (Open Shortest Path First).

flowchart TD
    Start["Computer wants to send<br/>an IP packet"] --> Check{"Is destination on<br/>the same network?"}
    Check -->|Yes| Local["Send directly at Layer 2<br/>using switching/MAC addresses"]
    Check -->|No| Gateway["Send to default gateway/router"]
    Gateway --> Table{"Is destination network<br/>directly connected to router?"}
    Table -->|Yes| Deliver["Router forwards packet<br/>to destination network"]
    Table -->|No| RoutingProtocol["Router consults routing table<br/>(populated by BGP/OSPF/etc.)<br/>and forwards to next router"]

The Data Link Layer Preview: Switching with Ethernet

Continuing down from routing, the network moves to switching at layer 2, the data link layer. This layer uses network switches to forward Ethernet frames. Ethernet is the layer 2 protocol used to encapsulate packets and send them to computers on the same network; its PDU is called a frame. Ethernet frames use MAC addresses to reach their destination.

The MAC (Media Access Control) address is the physical address associated with the actual Network Interface Card (NIC). It is generally assigned by the manufacturer and is intended to be a globally unique address attached to the NIC. A physical NIC can have multiple ports, and on the software side each port is also sometimes referred to as a NIC or network interface — each with its own MAC address, rather than one MAC per physical card.

The Physical Layer Preview

The physical layer comprises the physical items and devices used to transmit data from all layers above it as bits — 1s and 0s. This can be done using electricity over copper cables, light over fiber optics, or radio waves for wireless transmission. It also includes devices that manipulate and move these physical signals — connectors, optics, media converters, and repeaters, essentially any device that processes only bits as signals. Devices like routers and switches, even though they’re hardware, are not physical-layer-only devices in this sense, because they process data as packets and frames, not merely as bits.

Putting It All Together: An End to End Walkthrough

Consider accessing an internal website at IP address 10.0.0.9 from a computer at 192.168.100.17, entering the IP address directly into a browser.

1. The browser wants to send an HTTP GET request, but first needs a TCP connection.
2. A TCP SYN is sent to 10.0.0.9, encapsulated inside an IP packet addressed to 10.0.0.9.
3. Since the destination is on another network, the packet must reach the router first — the Ethernet frame is addressed to the router’s MAC (e.g., ending in 4E, the interface the sending computer has access to; the router has a second MAC on its other interface).
4. The switch reads the frame header, sees it is addressed to 4E, and forwards it to the router.
5. The router de-encapsulates the frame, inspects the destination IP, looks it up in its routing table, sees it is on a directly connected network, and knows the destination MAC. It re-encapsulates the packet into a new frame addressed to the server’s MAC (e.g., A2) for the next switch to forward to the server.
6. The server receives the TCP SYN and responds with a SYN/ACK segment inside a packet destined for 192.168.100.17, re-encapsulated in a frame addressed to the router (e.g., MAC 77).
7. The router again de-encapsulates, reads the IP address, and re-encapsulates into a new frame addressed to the client’s MAC (e.g., 8F) at 192.168.100.17.
8. The client receives the SYN/ACK and replies with an ACK, repackaging and sending it along to the router, which forwards it to its final destination — the TCP connection is now established.
9. The browser’s HTTP GET request is sent as another TCP segment, following the same process to reach 10.0.0.9.
10. The web server responds with the requested page (e.g., index.html) inside an HTTP response with status 200, which is sent back along the same path.
11. The browser renders the page.

sequenceDiagram
    participant Client as Client (192.168.100.17)
    participant Switch1 as Local Switch
    participant Router as Router
    participant Switch2 as Remote Switch
    participant Server as Server (10.0.0.9)

    Client->>Switch1: Ethernet frame (dst MAC 4E) containing IP packet containing TCP SYN
    Switch1->>Router: Forward frame to router (port for MAC 4E)
    Router->>Router: De-encapsulate, check routing table, re-encapsulate
    Router->>Switch2: Ethernet frame (dst MAC A2) containing IP packet containing TCP SYN
    Switch2->>Server: Forward frame to server
    Server->>Switch2: Ethernet frame containing IP packet containing TCP SYN/ACK
    Switch2->>Router: Forward to router (dst MAC 77)
    Router->>Router: De-encapsulate, re-encapsulate
    Router->>Switch1: Ethernet frame (dst MAC 8F) containing IP packet containing TCP SYN/ACK
    Switch1->>Client: Forward to client
    Client->>Router: TCP ACK (handshake complete)
    Router->>Server: Forward ACK
    Note over Client,Server: TCP connection established
    Client->>Server: HTTP GET request (same path as above)
    Server->>Client: HTTP 200 OK with index.html

This walkthrough is simplified. In the real world, additional elements come into play: a domain name would normally be resolved via DNS rather than typing a raw IP address; encrypted traffic (HTTPS) would involve a TLS handshake; traffic crossing the public internet might involve Network Address Translation (NAT); and devices would need to use ARP to learn next-hop MAC addresses rather than already knowing them. Still, this illustrates how the layers of the TCP/IP model work together in practice.

Module 2: The Physical Layer

The physical layer is the base of network cables and devices that transmit data as bits and signals from one device to another. This module covers the different types of layer 1 components: copper network cables (using electricity to represent bits), fiber optic cables (using light through a glass core), and other layer 1 devices that manipulate or convert these physical signals.

Copper Network Cable Types

There are three main types of copper networking cables:

flowchart TB
    Copper["Copper Networking Cables"] --> TP["Twisted Pair<br/>(most common)"]
    Copper --> Coax["Coax<br/>(legacy/AV/ISP cable)"]
    Copper --> DAC["Direct Attach Cable (DAC)<br/>(rack/datacenter twinax)"]

Twisted Pair Cable Construction and Wiring Standards

A twisted pair cable includes four twisted pairs of wire — orange, green, blue, and brown. The twists reduce crosstalk in the cable. There are two main constructions:

• UTP (Unshielded Twisted Pair) — no metal shielding.
• STP (Shielded Twisted Pair) — includes a metal shielding layer around the pairs to help prevent electromagnetic interference (EMI).

Ethernet twisted pair cables terminate in RJ45 connectors, which have contacts for all eight wires (in contrast to the smaller RJ11 connector used on old phone lines, which has two or four wires).

The wiring layout follows one of two standards, EIA/TIA-568-A or EIA/TIA-568-B:

T-568B is the more common wiring scheme, at least in the US.

Cable Categories and Bandwidth

Twisted pair cables are grouped into categories, which determine maximum bandwidth and capabilities. Internal differences (number of twists, wire gauge, and for Cat 6/6A a plastic separator) drive these differences.

Cable distance limits are tied to how standard Ethernet networks are typically designed, not solely to the cable’s raw capability.

Structured Cabling: IDFs, Patch Panels, and Keystone Jacks

The standard environment feeds the network to clients from an Intermediate Distribution Frame (IDF) — a network closet containing switches. End users connect via a twisted pair cable. This is where the 100 m distance limit comes from: the idea is to run up to 90 m from the IDF, leaving 5 m on each side for vertical drops down walls and for patch cables at both ends.

• The cable running inside walls and ceilings is called premise or structured cable, and is essentially permanent.
• On the client side, premise cable terminates in a keystone jack mounted in a wall plate.
• On the IDF side, the cable plugs into a patch panel — a panel of jacks, either using 110 blocks (where cable is punched down directly) or slots that accept snap-in keystone jacks. Keystone jacks are usually easier to install and more convenient to repair, since they can be popped out and worked on away from the rest of the cabling.

flowchart LR
    Client["Client Device"] -->|Patch cable| WallPlate["Wall Plate<br/>(Keystone Jack)"]
    WallPlate -->|Premise/structured cable<br/>up to ~90 m| PatchPanel["Patch Panel<br/>(110 block or keystone slots)"]
    PatchPanel -->|Patch cable| Switch["Switch (in IDF)"]

Cable Construction Details and Jacket Ratings

Copper and insulation construction details matter for reliability and safety:

• Solid core wire — a single solid piece of copper. Used for standard/premise cable; easier to punch down, but more prone to breaking with excessive movement.
• Stranded wire — multiple small wires twisted together. More flexible and less susceptible to breaking from movement, and is recommended for patch cables.

Jacket insulation ratings are primarily about fire resistance:

Twisted pair cable being copper also allows delivering data and power together — a feature called Power over Ethernet (PoE).

Power over Ethernet

PoE can be used to power access points, security cameras, and even small computers such as a Raspberry Pi. There are several PoE tiers, each with a different maximum power output:

Beyond switch support for PoE, cable gauge matters — Cat 6A has a larger gauge than Cat 5e, so higher-power PoE variants pulling large amounts of current benefit from thicker cable to ensure power is delivered reliably.

Demo: Crimping an RJ45 Connector and Punching Down a Keystone Jack

Tools needed for crimping an RJ45 connector:

• Cat 6A unshielded twisted pair (UTP) cable
• RJ45 connector (pass-through style used in this demo)
• Cable stripper
• Wire cutters
• Crimper (rated for pass-through connectors)

Steps:

1. Use the cable stripper to score the jacket without nicking the internal wires, then remove the jacket to expose the wires.
2. Cut off the internal string/ripcord with wire cutters.
3. For Cat 6A cable, remove the internal plastic separator (the spline), which helps reduce crosstalk but is not needed for termination.
4. Untwist each of the four pairs (by hand, with a tool, or using the removed jacket piece as an untwisting aid).
5. Straighten the wires.
6. Organize the wires by color for the T-568B standard: White-Orange, Orange, White-Green, Blue, White-Blue, Green, White-Brown, Brown.
7. Cut the wires to length — as short as possible for standard connectors, or slightly longer for pass-through connectors that allow feeding wires through and trimming after crimping.
8. Insert the wires into the connector with the tab facing down and the jacket pushed in as far as possible, so the jacket clamp inside the connector can grip the jacket.
9. Crimp using a crimper rated for the connector type (pass-through crimpers have a blade on the back to trim excess wire).
10. Verify the cable using a cable tester to confirm correct wire order.

Steps for punching down a keystone jack:

1. Strip and straighten the cable as before.
2. Identify the color-coded side matching T-568B on the keystone jack (jacks print both A and B color codes).
3. Gently seat each wire into its slot without fully punching it down yet.
4. Note that the standard allows no more than 0.5 inch of untwisted wire at the termination point.
5. Use a punchdown tool (with the blade facing outward, away from the internal wires) to seat and trim each wire.
6. Snap a cap onto the jack to help retain the wires.
7. Snap the keystone jack into a wall plate in the correct orientation.

Factory-made patch cables are generally thinner and have less crosstalk than hand-crimped cables because manufacturing keeps the wires twisted closer to the connector. Hand-crimping is still useful in cases such as running cable through tight weatherproof glands (e.g., for security cameras or access points) where the connector must be attached after the cable is routed through the opening.

Troubleshooting Copper Cable Issues

Copper Cable Troubleshooting Tools

Fiber Optic Cable Construction

Twisted pair cables are common for endpoints, but linking network gear together or connecting high-bandwidth servers calls for fiber. Fiber networking uses glass fiber strands to transfer light. At each end, transceivers (optics) transmit and receive the light and present the data to networking devices.

A fiber optic cable is made up of:

flowchart TB
    Core["Core (glass, doped)<br/>8-62.5 microns — carries light"] --> Cladding["Cladding (glass)<br/>125 microns — contains light via lower refractive index"]
    Cladding --> Coating["Coating<br/>245 microns — protects glass"]
    Coating --> Buffer["Insulation/Buffer<br/>~900 microns — outer protection"]

Single Mode vs Multimode Fiber

The core size is determined by the fiber type:

• Single-mode fiber — uses a single beam (mode) of light down the fiber.
• Multimode fiber — uses multiple modes (beams) of light down the fiber.

Multimode fiber is subject to modal dispersion — light bouncing off the walls of the cable, taking longer to reach the destination, with dispersion increasing over distance. This limits multimode’s maximum distance compared to single-mode.

Multimode fiber has 5 common versions:

Different fiber technologies use different light wavelengths. Visible light spans roughly 400–750 nanometers. Multimode fiber typically operates at 850 nm; single-mode fiber typically operates around 1310–1550 nm (plus other wavelengths). If an optic’s specification lists its wavelength, that indicates whether it is multimode or single-mode. Because these are lasers capable of transmitting light for kilometers, never look directly into the end of a fiber cable or optic — some red light may be visible at multimode’s 850 nm wavelength, but single-mode light is entirely invisible, making it just as hazardous without a visible warning cue.

Fiber Connectors and Optical Transceivers

Common transceiver form factors:

A QSFP can also be split via a breakout cable to feed one QSFP28 (100 Gb) into four separate 25 Gb SFP28 connections. Optics are typically duplex (separate fibers for transmit and receive), though bidirectional (bi-di)/simplex optics exist that send and receive on the same fiber using different wavelengths for each direction.

Common connector types:

Connector ferrule (end) types, denoted by connector color (not jacket color):

APC and UPC ends should never be mixed — plugging an APC end into a UPC connector (or vice versa) can damage the ends.

Demo: Mechanically Splicing Fiber Optic Cable

Splicing repairs a broken fiber, either mechanically or via fusion splicing.

Tools needed for a mechanical splice:

• Three-hole cable stripper (marked for 900, 250, and 125 micron strip depths)
• Cleaver
• Isopropyl alcohol and dry wipes
• Mechanical splice components (inline splice, in this demo, versus end/connector splices)
• A razor blade (to cut internal Kevlar strength members, if wire cutters are insufficient)

Steps:

1. Strip, in stages, from the largest hole down to the smallest:
   • Strip to the 900-micron jacket first, in small increments to avoid breaking the glass.
   • Remove any internal Kevlar strength member.
   • Strip down to the 250-micron coating.
   • Strip down to the 125-micron cladding layer (only the protective coating, at 250 microns, is being removed here — never separate the cladding, at 125 microns, from the core).
2. Clean the bare fiber using isopropyl alcohol wipes: first a fully wet wipe, then a slightly drier wipe, then a final dry wipe.
3. Cleave the fiber using a fiber holder to hold it steady, then a cleaver that scores and breaks the glass (rather than cutting it), producing a cleaner end than a plain cut. Dispose of the resulting glass shard safely (e.g., in a dedicated sharps/glass container).
4. Splice: insert the bare, cleaved fiber ends into the mechanical splice component from each side until resistance is felt, indicating the fiber is fully seated, then press down to hold each end in place.
5. Engage the splice’s locking cam to permanently hold both fiber ends in alignment.

A mechanical splice is complete once both ends are seated and the cam is engaged. This is an affordable way to gain hands-on splicing experience and can be a practical way to make an emergency repair.

Demo: Fusion Splicing Fiber Optic Cable

Fusion splicing produces a lower-loss, more permanent splice than a mechanical splice, at the cost of requiring a more expensive fusion splicer.

Additional considerations:

• Premise fiber cables are typically larger cables containing many 900-micron fibers. In the field, these are more commonly spliced to pigtails — short lengths of fiber with pre-terminated connector ends — rather than spliced directly to patch cables.
• Before stripping, cleaning, and cleaving, slide a heat-shrink protection sleeve (with an internal metal reinforcement bar) onto the fiber.

Steps:

1. Strip to the 250-micron coating using the appropriate stripper hole, in small increments (fiber will snap occasionally, especially while learning the technique — this is normal).
2. Continue stripping down to the 125-micron cladding (again, only removing the 250-micron protective coating, not separating cladding from core).
3. Clean with isopropyl alcohol wipes (wet, then drier, then dry), same as the mechanical splice process.
4. Cleave using a fiber holder built into the fusion splicer kit (some cleavers include a built-in scrap receptacle for the cleaved-off shard).
5. Load both prepared fiber ends into the fusion splicer’s clamps, aligning them near the splicer’s electrodes:
   • Cladding-aligned splicers align fiber based on the 125-micron cladding (more affordable).
   • Core-aligned splicers align based on the actual core — more accurate, but more expensive.
6. Close the clamps and lid; the splicer performs a self-cleaning arc, then fuses (welds) the fiber ends together using the electrodes. A good splice reports a very low loss value (e.g., 0.03 dB).
7. Slide the heat-shrink protector sleeve over the newly fused splice point, then place it in the splicer’s built-in oven to shrink the sleeve and permanently protect the splice.
8. The protector sleeve is also designed to sit in a splice tray alongside potentially a dozen or more other protected splices, which is then housed in a patch panel or similar enclosure to keep cables organized.
9. Verify the repair using a fiber tester, confirming that transmit/receive power is comparable to before the fiber was broken.

Fusion splices offer significantly lower loss than mechanical splices, at a higher upfront equipment cost. Mechanical splice kits are reusable and a more affordable way to build and practice this skill.

Common Fiber Optic Issues and Attenuation

Attenuation is the weakening of a signal — light in fiber, radio waves in Wi-Fi, or electrical signals in copper. Some attenuation is inevitable and systems are designed to tolerate it, but excessive attenuation degrades performance and, beyond a certain point, breaks communication entirely. Attenuation is measured in decibels (dB).

Fiber Optic Troubleshooting Tools

Direct Attach Cables and Active Optical Cables

DACs and AOCs are all-in-one, high-performance cables with SFPs/QSFPs already attached at each end.

DAC (Direct Attach Cable / Direct Attach Copper) — directly attaches two devices via SFPs or QSFPs.

Both DAC types are copper, and therefore susceptible to EMI (passive DACs somewhat more so, since they lack signal processing).

AOC (Active Optical Cable) is the fiber equivalent of a DAC — a single cable with SFPs built directly into each end.

Other Physical Layer Devices

Module 3: The Data Link Layer

The data link layer (layer 2) is where data is sent over the local network via Ethernet frames to devices based on MAC addresses.

The 802.3 Ethernet Standard

For local networking, enterprise networks use a couple of different standards. This course focuses on IEEE 802.3 Ethernet, used for wired Ethernet over twisted pair or fiber (802.11, Wi-Fi, is a separate standard not covered here).

The 802.3 standard has variations based on cable type and speed, commonly expressed as a short name like 1000BASE-T:

• 1000 — 1000 megabit (1 gigabit)
• BASE — baseband (a single signal sent down the cable, in contrast to broadband, which sends many signals down the same cable)
• T — twisted pair

Equipment on both ends of a link must support a common standard — if a NIC supports 10GBASE-T but the switch only supports 2.5GBASE-T, the link negotiates down to 2.5 Gb. Cabling must also support the desired standard (e.g., 10GBASE-T requires Cat 6A to reach the full 100 m).

Anatomy of an Ethernet Frame

Beyond source and destination MAC addresses, an Ethernet frame contains:

flowchart LR
    Preamble["Preamble<br/>7 bytes<br/>(Layer 1: clock sync)"] --> SFD["SFD<br/>1 byte<br/>(Layer 1: frame start)"]
    SFD --> DstMAC["Destination MAC<br/>6 bytes"]
    DstMAC --> SrcMAC["Source MAC<br/>6 bytes"]
    SrcMAC --> EType["EtherType<br/>2 bytes"]
    EType --> VLAN["802.1Q Tag (optional)"]
    VLAN --> Data["Data / Payload"]
    Data --> FCS["Frame Check Sequence (CRC)<br/>Trailer"]

The preamble and SFD are typically considered layer 1 (pure bits, no addressing information), while the rest of the frame is layer 2.

Layer 2 Switches vs Hubs

Hubs and switches can look superficially similar (small boxes with network ports), but they work in fundamentally different ways:

Switches trace their lineage to the network bridge, originally developed by DEC in 1983 — a layer 2 device that learned MAC addresses but typically had only a few ports, used to bridge network segments. DEC released the LANBridge 100 in 1986; in 1990, Kalpana (later acquired by Cisco) introduced a 7-port EtherSwitch — essentially a bridge with more ports — from which switches grew larger and faster.

How Switches Learn MAC Addresses

A switch maintains a MAC address table mapping MAC addresses to switch ports. When a frame arrives, the switch reads the destination MAC, looks it up in the table, and forwards the frame out the associated port. The switch populates this table by reading the source MAC address of incoming frames — learning that a given address “lives” behind the port it arrived on.

If the destination MAC is not yet known (the switch has never seen a frame from that address), the switch floods the frame out all ports except the one it arrived on, with the expectation that once the destination replies, its port will be learned. When multiple switches are connected together, each switch associates the MAC addresses reachable through a neighboring switch with the port connecting to that switch.

flowchart TD
    Frame["Frame arrives on Port X"] --> Learn["Switch reads source MAC<br/>and records: MAC -> Port X"]
    Learn --> Lookup{"Is destination MAC<br/>known in table?"}
    Lookup -->|Yes| Forward["Forward frame out<br/>the associated port only"]
    Lookup -->|No| Flood["Flood frame out all ports<br/>except the port it arrived on"]

Switch Form Factors and Management Methods

Form factors:

Management types:

Managed switch access methods:

Switch Features Overview

Demo: Exploring a Network Switch CLI

This walkthrough uses a Cisco Catalyst 3850 switch, exploring both console (serial) and SSH access.

Console access via serial (PuTTY on Windows):

1. Connect to the switch’s console port (e.g., a mini-USB console port).
2. In PuTTY, set connection type to Serial.
3. Identify the COM port via Windows Device Manager → Ports (COM & LPT) (e.g., COM3).
4. Configure the serial connection at the switch’s baud rate (e.g., 9600), then select Open.
5. The switch starts in user exec mode (indicated by a > prompt).
6. Enter privileged mode:

enable

Then enter the enable password. The prompt changes to a #, indicating privileged exec mode.

SSH access:

ssh username@switch-ip-address

Depending on switch configuration, SSH may drop directly into privileged exec mode (prompt ending in #).

Exploring available commands:

?
show ?

Viewing interface status:

show ip interface brief

This lists all interfaces, their names, and whether they are up or down.

Disabling and re-enabling an interface:

configure terminal
interface gigabitethernet1/0/1
shutdown
exit
exit
show ip interface brief

The interface now shows as administratively down.

configure terminal
interface gigabitethernet1/0/1
no shutdown
exit
exit

In Cisco IOS-style CLIs, prefixing a command with no reverses it — here, no shutdown re-enables the interface.

Viewing the MAC address table:

show mac address-table

This shows MAC-to-port associations. A port showing multiple MACs typically indicates another switch is connected to that port, with those devices’ MACs learned behind it.

Saving configuration:

Changes made through the CLI take effect immediately and live in the running configuration, which is separate from the startup configuration loaded at boot. If a change breaks connectivity, rebooting the switch reverts to the last saved startup configuration. To persist changes:

write memory

Forgetting to run write memory means that a later reboot (e.g., after a power outage) reverts the switch to its last saved configuration, undoing any unsaved changes.

Viewing configurations:

show run
show start

show run displays the running configuration; show start displays the startup configuration.

Different switch vendors (Aruba, Juniper, Extreme, MikroTik, etc.) use different CLI syntax than Cisco IOS. Hands-on practice with real or lab equipment is valuable for building familiarity with the equipment used in the field.

MAC Addresses and the OUI

A MAC address is 48 bits long, represented as 6 pairs of hexadecimal digits. The first 24 bits (the first half) form the OUI (Organizationally Unique Identifier) — a number assigned by the IEEE to the NIC manufacturer. MAC address/OUI lookup tools can be used to identify the manufacturer associated with a given MAC address, which can help narrow down device types during troubleshooting. A manufacturer can be assigned multiple OUIs, giving over 16 million possible addresses within a single OUI — manufacturer-assigned MAC address reuse is essentially never a practical concern.

MAC Address Randomization and Rotation

Most devices can change their own MAC address, and since roughly 2018–2020, major operating systems support MAC address randomization and a related feature, MAC address rotation.

Why this matters: without randomization, a network operator (e.g., a retail store offering free Wi-Fi) could track a device’s OUI (revealing the device manufacturer/type), correlate visits to specific access points (revealing movement within a store), retain this data indefinitely, and even correlate visits across multiple locations or share data with other businesses. MAC address randomization mitigates this kind of tracking.

Using Apple iOS as an example (the feature is called Private Wi-Fi Address), typical modes include:

Most major operating systems implement similar variations of this concept. From an end-user privacy standpoint, randomization/rotation is beneficial, especially on public Wi-Fi. From a network operator/technician standpoint, MAC rotation can create operational side effects:

• Captive portal re-authentication — networks that remember a device’s MAC after portal login may force repeated re-authentication as the MAC rotates.
• Small DHCP pools running out faster than expected — more MAC addresses cycling through the network consume more DHCP leases.
• Reduced effectiveness of MAC-based device blocking — a device blocked by MAC address can bypass the block once its MAC rotates, and randomization can also obscure device type.

The Broadcast Address

The broadcast MAC address (FF:FF:FF:FF:FF:FF — all Fs) sends a frame to every device on a layer 2 network. When a switch sees this destination address, it forwards the frame out every port. Devices use broadcast when they don’t yet know the address of the device they want to reach — for example, when looking for a DHCP server, or when using the Address Resolution Protocol (ARP).

Address Resolution Protocol (ARP)

Since applications typically work with IP addresses and domain names (which resolve to IP addresses) rather than raw MAC addresses, a mechanism is needed for a computer to learn the MAC address associated with an IP address on its local network. This is the role of ARP.

ARP uses the broadcast address to send an ARP request (“Who has this IP? Tell me.”) to every device on the network. The device that owns that IP address replies with a unicast ARP reply (“My IP address is at this MAC address.”) sent only to the requester. All other devices ignore the request.

sequenceDiagram
    participant Requester
    participant AllHosts as All Hosts on LAN (broadcast)
    participant Owner as IP owner

    Requester->>AllHosts: ARP Request (broadcast) - Who has 192.168.1.49?
    Note over AllHosts: All hosts inspect the request;<br/>only the IP owner responds
    Owner-->>Requester: ARP Reply (unicast) - 192.168.1.49 is at MAC xx:xx:xx:xx:xx:xx

Captured in a packet analyzer such as Wireshark, an ARP request/reply exchange reveals fields including:

• Hardware type (the layer 2 protocol)
• Protocol type (the layer 3 protocol)
• Hardware size — 6 bytes (MAC address length)
• Protocol size — 4 bytes (IPv4 address length)
• Opcode — 1 for request, 2 for reply
• Sender/target MAC and IP addresses (in a request, the target MAC is all zeros since that’s the information being requested; in the reply, sender and target fields are populated and reversed relative to the request)

A resolved ARP entry is stored in the computer’s ARP table as a dynamic entry, avoiding the need to re-ARP for the same IP shortly after. Static entries can also exist (some added automatically by the OS, others configured manually). Client operating systems typically age out dynamic entries after a couple of minutes; some network equipment retains them for hours.

Viewing and managing the ARP table (Windows):

arp -a

Lists the current ARP table (dynamic and static entries — for example, a static entry mapping the broadcast IP to the broadcast MAC address).

Deleting a stale entry:

arp -d <ip-address>

Clearing all dynamic entries:

arp -d *

Other operating systems provide similar ARP table functionality with different command syntax.

Broadcast Storms and Loop Prevention

A broadcast frame is sent out every port of a switch except the one it was received on. When two switches are connected together, a broadcast entering one switch is forwarded to the other switch, which then forwards it out all of its ports — including back toward the first switch on any additional, unintended link between them. If two switches are accidentally connected by more than one cable (forming a loop), that broadcast keeps circulating indefinitely between the switches, since — unlike an IP packet — an Ethernet frame has no time-to-live field to force it to expire. This kind of network loop can flood the network with broadcast traffic and effectively halt communication.

flowchart LR
    SwitchA["Switch A"] <--> |Link 1| SwitchB["Switch B"]
    SwitchA <--> |Link 2 (accidental extra link)| SwitchB
    Note1["Broadcast entering Switch A<br/>is forwarded out both links to Switch B,<br/>which forwards it back out both links to Switch A,<br/>repeating indefinitely"]

LACP and EtherChannel can intentionally combine multiple links between two switches into a single logical link without causing a loop — but this must be configured on both sides before the multiple physical links are connected, since it’s typically an accidental, unconfigured extra connection that causes a loop in the first place. Spanning Tree Protocol (STP) is the dedicated protocol designed to detect and prevent this kind of accidental loop.

Multicast and the Internet Group Management Protocol (IGMP)

Traffic can be classified as:

• Unicast — traffic with a single destination.
• Broadcast — traffic sent to every device on the layer 2 network (using the broadcast MAC address, as with ARP).
• Multicast — traffic sent to a specific subscribed group of destinations, but not everyone.

Multicast is useful for largely one-way traffic, such as a video feed (e.g., over Network Device Interface, NDI). Sending that feed via unicast to multiple viewers means duplicating the stream once per viewer; sending it via broadcast floods every device on the network with traffic they may not want. Multicast lets interested devices subscribe, so the traffic reaches only those devices.

Multicast traffic uses a reserved IP address range, 224.0.0.0 through 239.255.255.255, and a MAC address range starting with 01:00:5E. Because this MAC prefix does not correspond to a device the switch has learned, without any additional configuration a switch treats it like a broadcast and floods it out every port — which defeats the purpose of multicast. IGMP (Internet Group Management Protocol) solves this with two components:

• IGMP querier — one device on the network responsible for discovering available multicast groups. It periodically sends IGMP queries asking devices to report which multicast groups they want to join.
• IGMP snooping — enabled on every switch, intercepting IGMP join messages and recording them in an IGMP membership report, so the switch knows which ports have devices interested in a given multicast group.

sequenceDiagram
    participant Source as Multicast Source
    participant Querier as IGMP Querier
    participant Switch as Switch (IGMP Snooping enabled)
    participant Receiver as Interested Receiver

    Querier->>Switch: Periodic IGMP Query (broadcast to network)
    Switch->>Receiver: Forward IGMP Query
    Receiver->>Switch: IGMP Join (wants to join multicast group)
    Switch->>Switch: Record port in IGMP membership report
    Source->>Switch: Multicast traffic
    Switch->>Receiver: Forward multicast traffic only to joined ports
    Note over Receiver,Switch: If Receiver sends IGMP Leave,<br/>switch removes the port from the membership report

If no device responds to an IGMP query, multicast traffic for that group goes nowhere. If a device sends a multicast leave request, the switch removes that port from the membership report.

Practical multicast use cases:

Summary

This course built a foundation for understanding how modern networks operate, moving from high-level models down to the physical wires and frames that carry every byte of traffic.

Key principles covered:

• Networking is organized into layered models — the seven-layer OSI model and the four- or five-layer TCP/IP model — giving a shared vocabulary and a top-down framework for understanding protocols and equipment.
• Application-layer protocols (HTTP, DNS, SMTP, FTP, and others) carry the data users actually care about; data encapsulation wraps that data in successive protocol headers (TCP/UDP segment or datagram, IP packet, Ethernet frame) as it moves down the stack, and de-encapsulation unwraps it in reverse.
• Transport protocols — TCP (reliable, connection-oriented, three-way handshake, sequence/acknowledgment numbers), UDP (fast, connectionless, minimal overhead), and QUIC (a modern hybrid with built-in TLS) — provide different reliability/performance trade-offs for different application needs.
• The network layer uses IP addresses and subnet masks to determine whether traffic stays on the local network or must be routed via a default gateway and routing tables (populated by protocols like BGP or OSPF).
• The physical layer encompasses copper twisted pair (categories, structured cabling, PoE), fiber optics (single-mode vs. multimode, connector/transceiver types, splicing techniques), and supporting devices (PoE injectors, media converters, repeaters).
• The data link layer uses Ethernet frames and MAC addresses, switched by layer 2 switches that learn MAC-to-port associations dynamically, with ARP resolving IP addresses to MAC addresses, and IGMP enabling efficient multicast delivery.
• Understanding these layers and protocols builds practical troubleshooting instincts — whether diagnosing a bad cable, a misconfigured switch port, a broadcast storm from an accidental loop, or multicast traffic being flooded due to missing IGMP snooping.

Quick Reference

Study Checklist

• Can explain the seven OSI layers and how they map to the four/five-layer TCP/IP model.
• Can describe HTTP request/response structure, including methods and status codes.
• Can explain data encapsulation and de-encapsulation through all four/five layers.
• Can compare TCP, UDP, and QUIC and identify appropriate use cases for each.
• Can explain the three-way TCP handshake and sequence/acknowledgment numbering.
• Can distinguish between local (layer 2) and routed (layer 3) traffic based on IP address and subnet mask.
• Can identify copper cable categories and their bandwidth/distance limits.
• Can describe structured cabling components: IDF, patch panel, keystone jack, premise cable.
• Can identify PoE tiers and their power outputs.
• Can list common copper and fiber troubleshooting tools and the issues each addresses.
• Can distinguish single-mode from multimode fiber and identify OM1–OM5 by color/specification.
• Can describe SFP/QSFP transceiver variants and connector/ferrule types.
• Can explain how a switch learns MAC addresses and builds its MAC address table.
• Can describe basic Cisco IOS-style CLI navigation (user/privileged/config modes, show commands, write memory).
• Can explain MAC address structure, the OUI, and the purpose/impact of MAC randomization and rotation.
• Can explain ARP request/reply behavior and how to inspect/manage a local ARP table.
• Can explain how broadcast loops occur and how LACP/EtherChannel and STP relate to preventing them.
• Can explain why IGMP querier and IGMP snooping are both required for efficient multicast delivery.

Search Terms

network · concepts · protocols · networking · fundamentals · systems · security · cable · layer · fiber · optic · ethernet · address · construction · copper · data · mac · physical · switch · troubleshooting · addresses · broadcast · issues · keystone