Every network fault maps to a specific layer. If the symptom is "web page times out" the root cause could be a dying physical cable (layer 1), a bad ARP entry (layer 2), a missing route (layer 3), or a blocked TCP port (layer 4). Pinpointing the layer before troubleshooting saves hours of random checks.
| Layer | PDU name | Typical device |
|---|---|---|
| 1 — Physical | Bits | Repeater / Hub |
| 2 — Data Link | Frame | Switch / Bridge |
| 3 — Network | Packet | Router |
| 4 — Transport | Segment (TCP) / Datagram (UDP) | Firewall / Load Balancer |
| 5 — Session | Data (message) | — |
| 6 — Presentation | Data (message) | — |
| 7 — Application | Data (message) | Application / Browser |
Symptom: Browser reports "Connection refused", yet ping 10.1.1.1 succeeds.
Root cause: ping uses ICMP at layer 3 — it reaches the host. "Connection refused" is a TCP RST at layer 4 — the application port is not listening. The OS itself is alive; the service died.
Fix: Test the port: nc -zv 10.1.1.1 443. If closed, start the web server or check process.
Layer 3 (Network). The router reads the destination IP address to choose the outgoing interface — a network-layer decision. Switches use MAC addresses (layer 2).
Application layer — more precisely the Presentation layer (OSI 6), which is bundled into the TCP/IP Application layer. Transport security operates above TCP port 443 but the encryption is a session/presentation function from the OSI perspective.
ARP is carried inside an Ethernet frame, making it a frame-level PDU. It operates at layer 2 (Data Link) — it resolves IP (L3) to MAC (L2), so it straddles layers but is encapsulated as a frame and never leaves the broadcast domain.
An IPv4 address is not just a number — it carries a network prefix and a host suffix. The boundary between the two, set by the subnet mask, controls:
Poor planning wastes addresses (too large a mask = unused space) or forces renumbering later (too small = run out of host IPs).
Every IPv4 address is a 32‑bit integer displayed in dotted‑decimal:
192.168.1.10 → 11000000.10101000.00000001.00001010 <--- network portion (mask) ---> <------- host portion ------->
Classful addressing is obsolete — CIDR replaced it in 1993 — but the ranges still appear in route‑origin policies and legacy discussions.
| Class | First octet | Default mask | CIDR | Original purpose |
|---|---|---|---|---|
| A | 1 – 126 | 255.0.0.0 | /8 | ~16 million hosts |
| B | 128 – 191 | 255.255.0.0 | /16 | ~65,000 hosts |
| C | 192 – 223 | 255.255.255.0 | /24 | 254 usable hosts |
| D | 224 – 239 | — | — | Multicast group addresses |
| E | 240 – 255 | — | — | Experimental / reserved |
Note: 127.0.0.0/8 is loopback — packets to any 127.x.x.x never leave the host.
Three blocks cannot be routed on the public Internet. Border routers drop traffic with a private source IP unless NAT is active:
| Range | CIDR | Scope |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Enterprise / campus |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Mid-size |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | SOHO / lab |
Other reserved: 169.254.0.0/16 (APIPA — Windows self‑assigns when DHCP fails). 100.64.0.0/10 (Carrier‑Grade NAT, RFC 6598).
Every subnet has a broadcast address: all host bits set to 1. Sending to it reaches every host on that subnet.
Example: 10.10.0.0/16
Network: 00001010.00001010.00000000.00000000 = 10.10.0.0 Mask: 11111111.11111111.00000000.00000000 (16 bits fixed) Broadcast: 00001010.00001010.11111111.11111111 = 10.10.255.255 (flip host bits) -------------------- Usable hosts: 2^(32−16) − 2 = 65,536 − 2 = 65,534
Two types:
Limited broadcast (255.255.255.255) — never forwarded by a router.
Directed broadcast (10.10.255.255) — can be forwarded unless no ip directed‑broadcast is set, which is the default on modern IOS.
Class D addresses (224.0.0.0 – 239.255.255.255) send to a group, not a single host or all hosts. Routers use PIM to build distribution trees; hosts join groups with IGMP.
| Reserved address | Group |
|---|---|
| 224.0.0.1 | All hosts on subnet |
| 224.0.0.2 | All multicast routers |
| 224.0.0.5 / .6 | OSPF (all routers / DR-BDR) |
| 224.0.0.9 | EIGRP |
| 224.0.0.10 | HSRP version 2 |
No router forwards multicast by default — ip multicast‑routing must be enabled.
Symptom: Two hosts on the same switch cannot ping.
Check: One has 169.254.1.25 (APIPA — no DHCP), the other is 192.168.1.10. Different subnets, no router between them.
Fix: Static IP on same subnet, or restore DHCP server reachability.
Router# show ip interface brief Interface IP-Address OK? Method Status Protocol Gig0/0 192.168.1.1/24 YES manual up up Router# show ip interface gig0/0 Broadcast address is 255.255.255.255 Directed broadcast forwarding is disabled
/19 mask = 19 bits fixed → 13 host bits
172.20.0.0 = 10101100.00010100.00000000.00000000
broadcast = 10101100.00010100.00011111.11111111 (flip all host bits)
= 172.20.31.255Directed broadcast for the 10.0.0.0/8 network. The host sees 10.255.255.255 — all host bits are 1. The packet will reach all hosts on the 10.0.0.0/8 subnet if the intermediate routers permit directed‑broadcast forwarding (disabled by default).
No. 239.x.y.z is in the Administratively Scoped range (239.0.0.0/8) — it is never routed beyond an organization's boundary. Within the enterprise: IGMP (hosts tell the router they want the group) and PIM (routers build a distribution tree toward the source or the Rendezvous Point).
A /24 (255.255.255.0) gives 254 hosts. Most LANs need far fewer, so you subnet it to create multiple smaller networks. Every subnet consumes address space — the math must be exact or you run out of addresses or route table memory.
A /24 means 24 fixed network bits; the remaining 8 host bits can vary.
Mask /24 = 11111111.11111111.11111111.00000000
Split one /24 into four /26s (borrow 2 host bits):
Mask /26 = 11111111.11111111.11111111.11000000
^-- 2 borrowed bits = 2^(32-26) = 64 addresses per subnet
2 subnets worth? Actually 4 subnets (192,193,194,195 high octet slices):
192.168.0.0/26 (hosts .0 - .63, bcast .63)
192.168.0.64/26 (hosts .64 - .127, bcast .127)
192.168.0.128/26 (hosts .128 - .191, bcast .191)
192.168.0.192/26 (hosts .192 - .255, bcast .255)
Usable hosts = 2^(host bits) − 2 (subtract network & broadcast). So /26 → 64 − 2 = 62 usable hosts per subnet.
Given network 10.0.0.0/24, create 7 subnets for 7 VLANs. Each VLAN hosts 20 devices.
Step 1: need 20 hosts. 2^h − 2 ≥ 20 → h = 5 (30 hosts). 7 subnets needed.
Step 2: 2^3 = 8 ≥ 7 → borrow 3 bits. Mask = 32−5 = /27.
Step 3: block size = 2^5 = 32.
Subnet 1: 10.0.0.0/27 (hosts .1–.30, bcast .31)
Subnet 2: 10.0.0.32/27 (hosts .33–.62, bcast .63)
Subnet 3: 10.0.0.64/27 (hosts .65–.94, bcast .95)
Subnet 4: 10.0.0.96/27 (hosts .97–.126,bcast .127)
Subnet 5: 10.0.1.0/27 (hosts .1–.30)
Subnet 6: 10.0.1.32/27 (hosts .33–.62)
Subnet 7: 10.0.1.64/27 (hosts .65–.94)
Switch# show ip interface brief Switch# show running-config interface vlan 10 Switch# ping 10.0.0.1 source vlan 10
500 hosts → h where 2^h − 2 ≥ 500 → h = 9 (510 hosts). Mask = 32 − 9 = /23 /23 dotted = 255.255.254.0
Mask /27 → block 32. Network = 192.168.10.0. Broadcast = 192.168.10.0 + 31 = 192.168.10.31. Usable range 192.168.10.1 – 192.168.10.30.
/29 → borrow 5 bits → 2^5 = 32 subnets, each holding 6 hosts (2^3−2). Valid count (32 ≥ 5) but only 6 hosts per subnet — too small for most VLANs. The admin over-subnetted. A /28 would give 6 usable hosts; a /27 gives 14 hosts — check host needs first.
VLSM = allocate subnets of different sizes from the same block. Fixed subnetting (one mask) wastes addresses. VLSM is the backbone of an efficient RFC 1918 plan and of route summarization.
Allocate largest subnet first, then carve the remainder. Order by decreasing block size — otherwise you create fragmentation holes your next subnet can't use.
Block 10.0.0.0/24 must serve:
1) 100 hosts → /25 (block 128) — 10.0.0.0/25 → usable .1–.126, bcast .127 2) 50 hosts → /26 (block 64) — 10.0.0.128/26 → .129–.190 3) 20 hosts → /27 (block 32) — 10.0.0.192/27 → .193–.222 Remainder from .224 is two /29s (block 8): 4) P2P (2 h) → /30 (block 4) — 10.0.0.224/30 → .225–.226 remaining .228–.255 = six /30s available for future P2Ps loopbacks: use /32s from the tail: 10.0.0.253 - 255
Route summarization collapses many subnets into one shorter prefix. Rule: the block must align on a power‑of‑two boundary matching the summary.
Summarize 10.0.0.0/25, 10.0.0.128/26, 10.0.0.192/27 → 10.0.0.0/25 covers .0–.127 ❌ does NOT cover .128+ → Use 10.0.0.0/24 = whole block. Summary = 10.0.0.0/24.
Common mistake: summarizing 172.16.1.0/24 + 172.16.2.0/24 as 172.16.0.0/23 — valid only if 172.16.0.0/24 doesn't exist or is also summarized.
Router# show ip route
R 10.0.0.0/24 is subnetted, 4 subnets
10.0.0.0/25 is subnetted
10.0.0.128/26 is subnetted
S 10.0.0.0/24 [1/0] via 192.168.1.1 ← static summary
Router# show ip protocol
Routing Protocol is "ospf 1"
Area 0 Summary routes:
10.0.0.0/24 (summary network)
A: 120 hosts → /25 block 128 → 192.168.10.0/25 (.1–.126, bcast .127) B: 60 hosts → /26 block 64 → 192.168.10.128/26 (.129–.190, bcast .191) C: 28 hosts → /27 block 32 → 192.168.10.192/27 (.193–.222, bcast .223) Remainder 192.168.10.224/27 is free reserve / /30s.
Cover 8 subnets (/24) → need 3 borrowed bits → /21. Verify alignment: 10.4.8.0 is divisible by 8 in the third octet (8 = 0b1000) → aligned. Summary = 10.4.8.0/21 (covers .8.0–.15.255).
Summarizing reduces the OSPF LSDB and SPF domain: one inter-area (type‑3) LSA instead of three. Summarize at the ABR connecting this area to the backbone. The ABR advertises 172.16.0.0/22, hiding .0/.1/.2 specifics. The new .3 link is included in that same summary since 172.16.0.0/22 already spans .0–.3.
CIDR (Classless Inter‑Domain Routing) killed the rigid class system (A/B/C) in 1993. It lets you express any prefix length — e.g. /19 instead of just /8, /16, /24. Supernetting aggregates multiple smaller subnets into a single larger route, shrinking routing tables globally. Without CIDR, the Internet's BGP table would collapse under its own weight.
A CIDR block is network/length. Length = number of fixed bits (the mask).
10.0.0.0/8 → mask 255.0.0.0 (8 fixed + 24 host) 10.10.0.0/16 → mask 255.255.0.0 (16 fixed) 10.10.10.0/24 → mask 255.255.255.0 (24 fixed) 10.10.10.0/25 → mask 255.255.255.128 (25 fixed → 2 subnets of 126 hosts)
The shorter the prefix (smaller /N), the more hosts AND the broader the route — a /8 covers 16M hosts, a /30 covers only 2.
Supernetting = combine contiguous subnets into one shorter summary route. The summary must start on a binary boundary matching the aggregate block size.
Rule: the first address of the summary must be a multiple of the block size.
Four /24s from .0 through .3 → summary is 192.168.0.0/22. Verify alignment: block size = 2^(24−22) = 4 → 0 is divisible by 4 → aligned.
ISP advertises customer prefixes: 203.0.113.0/25, 203.0.113.128/26, 203.0.114.0/24.
1) 203.0.113.0/25 (covers .0 – .127)
2) 203.0.113.128/26 (covers .128 – .191)
3) 203.0.114.0/24 (covers .0 – .255 in 114 octet)
Combine 1+2 = 203.0.113.0/24 already perfect (covers .0–.255).
Now 203.0.113.0/24 + 203.0.114.0/24 → 203.0.112.0/22? No — 113 decimal: 0x71 → odd. Block size 2 → must start at even.
Better: 203.0.112.0/20 (16 subnets) would cover .112–.127 — too broad (leakage).
Correct: no tighter summary than /22? Let's check: 112/24 binary → 0x70 → even. 112+0 = 0x70, 112+1 = 0x71, 112+2 = 0x72, 112+3 = 0x73 = .115.
Does NOT cover 113/24 and 114/24? Actually .113/24 = 0x71, .114 = 0x72. Block size 4 with start 112 = 112, .113, .114, .115 → YES 203.0.112.0/22 covers .112–.115.
But we only have .113 & .114, not .112 & .115 — potential leakage. In BGP use aggregate-address 203.0.112.0 255.255.252.0 summary-only — accept leakage, it's still a valid route.
Symptom: Traffic to a newly‑added subnet gets blackholed.
Root cause: The upstream router's summary 10.0.0.0/13 already covers the new subnet 10.6.0.0/16, but your edge router has no more‑specific route pointing to the new location.
Fix: Ensure the edge router advertises 10.6.0.0/16 explicitly BEFORE the summary route takes effect, or use BGP unsuppress‑map to leak the new /16 through the summary filter.
172.16.0.0/22. Block size = 4. Starting address 172.16.0.0 is divisible by 4 in the 3rd octet → aligned. Covers .0.0–.3.255.
Yes. Block size = 2. Starting address 192.0.2.0 aligns on an even boundary (192.0.2.0 / 192.0.3.0). The /23 covers both.
Yes — the /16 covers both, so even after the /24 fails, the /16 remains in the table and traffic is forwarded (blackholed). Fix: use BGP conditional advertisements or unsuppress‑map to withdraw the /16 when none of the constituent /24s exist, or avoid summarization entirely when specific routes are critical.
IPv4 exhaustion is real — the last /8 blocks were allocated years ago. IPv6 gives 3.4 × 1038 addresses, enough for every atom on Earth. But IPv6 is not just "more addresses" — it changes how hosts configure themselves (SLAAC vs DHCP), how addresses are formed (EUI-64), and how neighbors are found (NDP replaces ARP). Every modern network has IPv6 traffic whether you plan it or not: Android and iOS prefer IPv6 when it exists.
Written as 8 groups of 4 hex digits, separated by colons:
2001:0db8:85a3:0000:0000:8a2e:0370:7334 Rules: 1. Leading zeros per hextet can be dropped → 0db8 → db8 2. One (and only one) double-colon :: compresses consecutive zero hextets 2001:0db8:85a3:0000:0000:8a2e:0370:7334 → 2001:db8:85a3::8a2e:370:7334 3. :: must appear only once — otherwise the address is ambiguous.
| Type | Prefix | Purpose / notes |
|---|---|---|
| Global unicast (GUA) | 2000::/3 | Routable on the Internet. Assigned by ISP/RIR. |
| Link-local | fe80::/10 | Automatically generated on every interface. Never routed. Used for neighbor discovery, OSPFv3, default gateway. |
| Unique local (ULA) | fc00::/7 | IPv6's answer to RFC 1918 — private, not routable on the Internet. |
| Multicast | ff00::/8 | Replaces IPv4 broadcast. No broadcast in IPv6. |
| Loopback | ::1/128 | Equivalent to 127.0.0.1. |
| Unspecified | ::/128 | Used as source during Duplicate Address Detection. |
Algorithm: split the 48-bit MAC in half, insert fffe in the middle, flip the U/L bit (7th bit of first octet) — the universal/local bit.
MAC: 00:1A:2B:3C:4D:5E Step 1: 001A:2B FF:FE 3C:4D:5E (insert FFFE) Step 2: flip U/L bit: 0x00 → 0x02 (bit 1 = 0→1) Result: 021A:2BFF:FE3C:4D5E → interface ID Full GUA: 2001:db8:1:10::21a:2bff:fe3c:4d5e/64
Host gets prefix from Router Advertisement (RA), builds interface ID itself, no DHCP needed:
DHCPv6 is optional (stateful) — RA can set M-flag ("get address from DHCPv6") or O-flag ("get other info like DNS from DHCPv6"). SLAAC itself does not provide DNS — you need RDNSS in the RA (RFC 8106) or DHCPv6.
! Enable IPv6 routing (needed for routing protocols, forwarding) Router(config)# ipv6 unicast-routing ! Static GUA on an interface Router(config)# interface gigabitethernet0/0 Router(config-if)# ipv6 address 2001:db8:1:10::1/64 Router(config-if)# ipv6 address fe80::1 link-local ! custom link-local Router(config-if)# no shutdown ! EUI-64 form — interface ID auto-derived from MAC Router(config-if)# ipv6 address 2001:db8:1:20::/64 eui-64 ! Default route via RA / gateway Router(config)# ipv6 route ::/0 2001:db8:1:1::1 ! Verification — ALWAYS use these Router# show ipv6 interface brief Router# show ipv6 route Router# ping ipv6 2001:db8:1:10::2 Router# show ipv6 neighbors
Healthy output sample:
Router# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::1
2001:DB8:1:10::1
GigabitEthernet0/1 [up/up]
FE80::2
2001:DB8:1:20::21A:2BFF:FE3C:4D5E
Symptom: Hosts on the same VLAN can't ping each other or the gateway, yet routers see the interface up.
Root cause: IPv6 has no ARP. Neighbor Discovery (NDP) — ICMPv6 types 135/136 (NS/NA) — does the job. If a switch port has ICMPv6 filter applied, or NDP rate-limiting is too aggressive, neighbor discovery fails and the neighbor cache stays empty.
Fix:
! On the switch — never block ICMPv6; permit NDP explicitly Switch(config)# ipv6 access-list PERMIT-NDP Switch(config-ipv6-acl)# permit icmp any any nd-na Switch(config-ipv6-acl)# permit icmp any any nd-ns Switch(config-ipv6-acl)# permit ipv6 any any ! Router-side check Router# show ipv6 neighbors Interface Age Link-layer Addr State Gi0/0 5 001a.2b3c.4d5e STALE Router# debug ipv6 icmp
00:11:22:33:44:55. What EUI-64 interface ID does it produce, and which bit changes?Insert fffe: 0211:22ff:fe33:4455. The U/L bit (bit 1 of first octet, 0x00 → 0x02) flips to mark the address as locally unique. If the U/L bit were not flipped, the address would claim universal uniqueness.
Link-local (fe80::/10). The RA's source address is the router's link-local address, so the host installs the default route toward fe80:: — no global address needed. OSPFv3 also peers over link-local.
1) RDNSS option in the RA (RFC 8106) — stateless, no DHCP. 2) Stateful DHCPv6 (M or O flag set) which delivers DNS. Without either, SLAAC hosts have addresses but no name resolution.