Every network fault maps to a specific layer. If the symptom is "web page times out" the root cause could be a dying physical cable (layer 1), a bad ARP entry (layer 2), a missing route (layer 3), or a blocked TCP port (layer 4). Pinpointing the layer before troubleshooting saves hours of random checks.
| Layer | PDU name | Typical device |
|---|---|---|
| 1 β Physical | Bits | Repeater / Hub |
| 2 β Data Link | Frame | Switch / Bridge |
| 3 β Network | Packet | Router |
| 4 β Transport | Segment (TCP) / Datagram (UDP) | Firewall / Load Balancer |
| 5 β Session | Data (message) | β |
| 6 β Presentation | Data (message) | β |
| 7 β Application | Data (message) | Application / Browser |
Symptom: Browser reports "Connection refused", yet ping 10.1.1.1 succeeds.
Root cause: ping uses ICMP at layer 3 β it reaches the host. "Connection refused" is a TCP RST at layer 4 β the application port is not listening. The OS itself is alive; the service died.
Fix: Test the port: nc -zv 10.1.1.1 443. If closed, start the web server or check process.
Layer 3 (Network). The router reads the destination IP address to choose the outgoing interface β a network-layer decision. Switches use MAC addresses (layer 2).
Application layer β more precisely the Presentation layer (OSI 6), which is bundled into the TCP/IP Application layer. Transport security operates above TCP port 443 but the encryption is a session/presentation function from the OSI perspective.
ARP is carried inside an Ethernet frame, making it a frame-level PDU. It operates at layer 2 (Data Link) β it resolves IP (L3) to MAC (L2), so it straddles layers but is encapsulated as a frame and never leaves the broadcast domain.
An IPv4 address is not just a number β it carries a network prefix and a host suffix. The boundary between the two, set by the subnet mask, controls:
Poor planning wastes addresses (too large a mask = unused space) or forces renumbering later (too small = run out of host IPs).
Every IPv4 address is a 32βbit integer displayed in dottedβdecimal:
192.168.1.10 β 11000000.10101000.00000001.00001010 <--- network portion (mask) ---> <------- host portion ------->
Classful addressing is obsolete β CIDR replaced it in 1993 β but the ranges still appear in routeβorigin policies and legacy discussions.
| Class | First octet | Default mask | CIDR | Original purpose |
|---|---|---|---|---|
| A | 1 β 126 | 255.0.0.0 | /8 | ~16 million hosts |
| B | 128 β 191 | 255.255.0.0 | /16 | ~65,000 hosts |
| C | 192 β 223 | 255.255.255.0 | /24 | 254 usable hosts |
| D | 224 β 239 | β | β | Multicast group addresses |
| E | 240 β 255 | β | β | Experimental / reserved |
Note: 127.0.0.0/8 is loopback β packets to any 127.x.x.x never leave the host.
Three blocks cannot be routed on the public Internet. Border routers drop traffic with a private source IP unless NAT is active:
| Range | CIDR | Scope |
|---|---|---|
| 10.0.0.0 β 10.255.255.255 | 10.0.0.0/8 | Enterprise / campus |
| 172.16.0.0 β 172.31.255.255 | 172.16.0.0/12 | Mid-size |
| 192.168.0.0 β 192.168.255.255 | 192.168.0.0/16 | SOHO / lab |
Other reserved: 169.254.0.0/16 (APIPA β Windows selfβassigns when DHCP fails). 100.64.0.0/10 (CarrierβGrade NAT, RFC 6598).
Every subnet has a broadcast address: all host bits set to 1. Sending to it reaches every host on that subnet.
Example: 10.10.0.0/16
Network: 00001010.00001010.00000000.00000000 = 10.10.0.0 Mask: 11111111.11111111.00000000.00000000 (16 bits fixed) Broadcast: 00001010.00001010.11111111.11111111 = 10.10.255.255 (flip host bits) -------------------- Usable hosts: 2^(32β16) β 2 = 65,536 β 2 = 65,534
Two types:
Limited broadcast (255.255.255.255) β never forwarded by a router.
Directed broadcast (10.10.255.255) β can be forwarded unless no ip directedβbroadcast is set, which is the default on modern IOS.
Class D addresses (224.0.0.0 β 239.255.255.255) send to a group, not a single host or all hosts. Routers use PIM to build distribution trees; hosts join groups with IGMP.
| Reserved address | Group |
|---|---|
| 224.0.0.1 | All hosts on subnet |
| 224.0.0.2 | All multicast routers |
| 224.0.0.5 / .6 | OSPF (all routers / DR-BDR) |
| 224.0.0.9 | EIGRP |
| 224.0.0.10 | HSRP version 2 |
No router forwards multicast by default β ip multicastβrouting must be enabled.
Symptom: Two hosts on the same switch cannot ping.
Check: One has 169.254.1.25 (APIPA β no DHCP), the other is 192.168.1.10. Different subnets, no router between them.
Fix: Static IP on same subnet, or restore DHCP server reachability.
Router# show ip interface brief Interface IP-Address OK? Method Status Protocol Gig0/0 192.168.1.1/24 YES manual up up Router# show ip interface gig0/0 Broadcast address is 255.255.255.255 Directed broadcast forwarding is disabled
/19 mask = 19 bits fixed β 13 host bits
172.20.0.0 = 10101100.00010100.00000000.00000000
broadcast = 10101100.00010100.00011111.11111111 (flip all host bits)
= 172.20.31.255Directed broadcast for the 10.0.0.0/8 network. The host sees 10.255.255.255 β all host bits are 1. The packet will reach all hosts on the 10.0.0.0/8 subnet if the intermediate routers permit directedβbroadcast forwarding (disabled by default).
No. 239.x.y.z is in the Administratively Scoped range (239.0.0.0/8) β it is never routed beyond an organization's boundary. Within the enterprise: IGMP (hosts tell the router they want the group) and PIM (routers build a distribution tree toward the source or the Rendezvous Point).
A /24 (255.255.255.0) gives 254 hosts. Most LANs need far fewer, so you subnet it to create multiple smaller networks. Every subnet consumes address space β the math must be exact or you run out of addresses or route table memory.
A /24 means 24 fixed network bits; the remaining 8 host bits can vary.
Mask /24 = 11111111.11111111.11111111.00000000
Split one /24 into four /26s (borrow 2 host bits):
Mask /26 = 11111111.11111111.11111111.11000000
^-- 2 borrowed bits = 2^(32-26) = 64 addresses per subnet
2 subnets worth? Actually 4 subnets (192,193,194,195 high octet slices):
192.168.0.0/26 (hosts .0 - .63, bcast .63)
192.168.0.64/26 (hosts .64 - .127, bcast .127)
192.168.0.128/26 (hosts .128 - .191, bcast .191)
192.168.0.192/26 (hosts .192 - .255, bcast .255)
Usable hosts = 2^(host bits) β 2 (subtract network & broadcast). So /26 β 64 β 2 = 62 usable hosts per subnet.
Given network 10.0.0.0/24, create 7 subnets for 7 VLANs. Each VLAN hosts 20 devices.
Step 1: need 20 hosts. 2^h β 2 β₯ 20 β h = 5 (30 hosts). 7 subnets needed.
Step 2: 2^3 = 8 β₯ 7 β borrow 3 bits. Mask = 32β5 = /27.
Step 3: block size = 2^5 = 32.
Subnet 1: 10.0.0.0/27 (hosts .1β.30, bcast .31)
Subnet 2: 10.0.0.32/27 (hosts .33β.62, bcast .63)
Subnet 3: 10.0.0.64/27 (hosts .65β.94, bcast .95)
Subnet 4: 10.0.0.96/27 (hosts .97β.126,bcast .127)
Subnet 5: 10.0.1.0/27 (hosts .1β.30)
Subnet 6: 10.0.1.32/27 (hosts .33β.62)
Subnet 7: 10.0.1.64/27 (hosts .65β.94)
Switch# show ip interface brief Switch# show running-config interface vlan 10 Switch# ping 10.0.0.1 source vlan 10
500 hosts β h where 2^h β 2 β₯ 500 β h = 9 (510 hosts). Mask = 32 β 9 = /23 /23 dotted = 255.255.254.0
Mask /27 β block 32. Network = 192.168.10.0. Broadcast = 192.168.10.0 + 31 = 192.168.10.31. Usable range 192.168.10.1 β 192.168.10.30.
/29 β borrow 5 bits β 2^5 = 32 subnets, each holding 6 hosts (2^3β2). Valid count (32 β₯ 5) but only 6 hosts per subnet β too small for most VLANs. The admin over-subnetted. A /28 would give 6 usable hosts; a /27 gives 14 hosts β check host needs first.
VLSM = allocate subnets of different sizes from the same block. Fixed subnetting (one mask) wastes addresses. VLSM is the backbone of an efficient RFC 1918 plan and of route summarization.
Allocate largest subnet first, then carve the remainder. Order by decreasing block size β otherwise you create fragmentation holes your next subnet can't use.
Block 10.0.0.0/24 must serve:
1) 100 hosts β /25 (block 128) β 10.0.0.0/25 β usable .1β.126, bcast .127 2) 50 hosts β /26 (block 64) β 10.0.0.128/26 β .129β.190 3) 20 hosts β /27 (block 32) β 10.0.0.192/27 β .193β.222 Remainder from .224 is two /29s (block 8): 4) P2P (2 h) β /30 (block 4) β 10.0.0.224/30 β .225β.226 remaining .228β.255 = six /30s available for future P2Ps loopbacks: use /32s from the tail: 10.0.0.253 - 255
Route summarization collapses many subnets into one shorter prefix. Rule: the block must align on a powerβofβtwo boundary matching the summary.
Summarize 10.0.0.0/25, 10.0.0.128/26, 10.0.0.192/27 β 10.0.0.0/25 covers .0β.127 β does NOT cover .128+ β Use 10.0.0.0/24 = whole block. Summary = 10.0.0.0/24.
Common mistake: summarizing 172.16.1.0/24 + 172.16.2.0/24 as 172.16.0.0/23 β valid only if 172.16.0.0/24 doesn't exist or is also summarized.
Router# show ip route
R 10.0.0.0/24 is subnetted, 4 subnets
10.0.0.0/25 is subnetted
10.0.0.128/26 is subnetted
S 10.0.0.0/24 [1/0] via 192.168.1.1 β static summary
Router# show ip protocol
Routing Protocol is "ospf 1"
Area 0 Summary routes:
10.0.0.0/24 (summary network)
A: 120 hosts β /25 block 128 β 192.168.10.0/25 (.1β.126, bcast .127) B: 60 hosts β /26 block 64 β 192.168.10.128/26 (.129β.190, bcast .191) C: 28 hosts β /27 block 32 β 192.168.10.192/27 (.193β.222, bcast .223) Remainder 192.168.10.224/27 is free reserve / /30s.
Cover 8 subnets (/24) β need 3 borrowed bits β /21. Verify alignment: 10.4.8.0 is divisible by 8 in the third octet (8 = 0b1000) β aligned. Summary = 10.4.8.0/21 (covers .8.0β.15.255).
Summarizing reduces the OSPF LSDB and SPF domain: one inter-area (typeβ3) LSA instead of three. Summarize at the ABR connecting this area to the backbone. The ABR advertises 172.16.0.0/22, hiding .0/.1/.2 specifics. The new .3 link is included in that same summary since 172.16.0.0/22 already spans .0β.3.
CIDR (Classless InterβDomain Routing) killed the rigid class system (A/B/C) in 1993. It lets you express any prefix length β e.g. /19 instead of just /8, /16, /24. Supernetting aggregates multiple smaller subnets into a single larger route, shrinking routing tables globally. Without CIDR, the Internet's BGP table would collapse under its own weight.
A CIDR block is network/length. Length = number of fixed bits (the mask).
10.0.0.0/8 β mask 255.0.0.0 (8 fixed + 24 host) 10.10.0.0/16 β mask 255.255.0.0 (16 fixed) 10.10.10.0/24 β mask 255.255.255.0 (24 fixed) 10.10.10.0/25 β mask 255.255.255.128 (25 fixed β 2 subnets of 126 hosts)
The shorter the prefix (smaller /N), the more hosts AND the broader the route β a /8 covers 16M hosts, a /30 covers only 2.
Supernetting = combine contiguous subnets into one shorter summary route. The summary must start on a binary boundary matching the aggregate block size.
Rule: the first address of the summary must be a multiple of the block size.
Four /24s from .0 through .3 β summary is 192.168.0.0/22. Verify alignment: block size = 2^(24β22) = 4 β 0 is divisible by 4 β aligned.
ISP advertises customer prefixes: 203.0.113.0/25, 203.0.113.128/26, 203.0.114.0/24.
1) 203.0.113.0/25 (covers .0 β .127)
2) 203.0.113.128/26 (covers .128 β .191)
3) 203.0.114.0/24 (covers .0 β .255 in 114 octet)
Combine 1+2 = 203.0.113.0/24 already perfect (covers .0β.255).
Now 203.0.113.0/24 + 203.0.114.0/24 β 203.0.112.0/22? No β 113 decimal: 0x71 β odd. Block size 2 β must start at even.
Better: 203.0.112.0/20 (16 subnets) would cover .112β.127 β too broad (leakage).
Correct: no tighter summary than /22? Let's check: 112/24 binary β 0x70 β even. 112+0 = 0x70, 112+1 = 0x71, 112+2 = 0x72, 112+3 = 0x73 = .115.
Does NOT cover 113/24 and 114/24? Actually .113/24 = 0x71, .114 = 0x72. Block size 4 with start 112 = 112, .113, .114, .115 β YES 203.0.112.0/22 covers .112β.115.
But we only have .113 & .114, not .112 & .115 β potential leakage. In BGP use aggregate-address 203.0.112.0 255.255.252.0 summary-only β accept leakage, it's still a valid route.
Symptom: Traffic to a newlyβadded subnet gets blackholed.
Root cause: The upstream router's summary 10.0.0.0/13 already covers the new subnet 10.6.0.0/16, but your edge router has no moreβspecific route pointing to the new location.
Fix: Ensure the edge router advertises 10.6.0.0/16 explicitly BEFORE the summary route takes effect, or use BGP unsuppressβmap to leak the new /16 through the summary filter.
172.16.0.0/22. Block size = 4. Starting address 172.16.0.0 is divisible by 4 in the 3rd octet β aligned. Covers .0.0β.3.255.
Yes. Block size = 2. Starting address 192.0.2.0 aligns on an even boundary (192.0.2.0 / 192.0.3.0). The /23 covers both.
Yes β the /16 covers both, so even after the /24 fails, the /16 remains in the table and traffic is forwarded (blackholed). Fix: use BGP conditional advertisements or unsuppressβmap to withdraw the /16 when none of the constituent /24s exist, or avoid summarization entirely when specific routes are critical.