Every network fault maps to a specific layer. If the symptom is "web page times out" the root cause could be a dying physical cable (layer 1), a bad ARP entry (layer 2), a missing route (layer 3), or a blocked TCP port (layer 4). Pinpointing the layer before troubleshooting saves hours of random checks.
| Layer | PDU name | Typical device |
|---|---|---|
| 1 — Physical | Bits | Repeater / Hub |
| 2 — Data Link | Frame | Switch / Bridge |
| 3 — Network | Packet | Router |
| 4 — Transport | Segment (TCP) / Datagram (UDP) | Firewall / Load Balancer |
| 5 — Session | Data (message) | — |
| 6 — Presentation | Data (message) | — |
| 7 — Application | Data (message) | Application / Browser |
Symptom: Browser reports "Connection refused", yet ping 10.1.1.1 succeeds.
Root cause: ping uses ICMP at layer 3 — it reaches the host. "Connection refused" is a TCP RST at layer 4 — the application port is not listening. The OS itself is alive; the service died.
Fix: Test the port: nc -zv 10.1.1.1 443. If closed, start the web server or check process.
Layer 3 (Network). The router reads the destination IP address to choose the outgoing interface — a network-layer decision. Switches use MAC addresses (layer 2).
Application layer — more precisely the Presentation layer (OSI 6), which is bundled into the TCP/IP Application layer. Transport security operates above TCP port 443 but the encryption is a session/presentation function from the OSI perspective.
ARP is carried inside an Ethernet frame, making it a frame-level PDU. It operates at layer 2 (Data Link) — it resolves IP (L3) to MAC (L2), so it straddles layers but is encapsulated as a frame and never leaves the broadcast domain.
An IPv4 address is not just a number — it carries a network prefix and a host suffix. The boundary between the two, set by the subnet mask, controls:
Poor planning wastes addresses (too large a mask = unused space) or forces renumbering later (too small = run out of host IPs).
Every IPv4 address is a 32‑bit integer displayed in dotted‑decimal:
192.168.1.10 → 11000000.10101000.00000001.00001010 <--- network portion (mask) ---> <------- host portion ------->
Classful addressing is obsolete — CIDR replaced it in 1993 — but the ranges still appear in route‑origin policies and legacy discussions.
| Class | First octet | Default mask | CIDR | Original purpose |
|---|---|---|---|---|
| A | 1 – 126 | 255.0.0.0 | /8 | ~16 million hosts |
| B | 128 – 191 | 255.255.0.0 | /16 | ~65,000 hosts |
| C | 192 – 223 | 255.255.255.0 | /24 | 254 usable hosts |
| D | 224 – 239 | — | — | Multicast group addresses |
| E | 240 – 255 | — | — | Experimental / reserved |
Note: 127.0.0.0/8 is loopback — packets to any 127.x.x.x never leave the host.
Three blocks cannot be routed on the public Internet. Border routers drop traffic with a private source IP unless NAT is active:
| Range | CIDR | Scope |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Enterprise / campus |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Mid-size |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | SOHO / lab |
Other reserved: 169.254.0.0/16 (APIPA — Windows self‑assigns when DHCP fails). 100.64.0.0/10 (Carrier‑Grade NAT, RFC 6598).
Every subnet has a broadcast address: all host bits set to 1. Sending to it reaches every host on that subnet.
Example: 10.10.0.0/16
Network: 00001010.00001010.00000000.00000000 = 10.10.0.0 Mask: 11111111.11111111.00000000.00000000 (16 bits fixed) Broadcast: 00001010.00001010.11111111.11111111 = 10.10.255.255 (flip host bits) -------------------- Usable hosts: 2^(32−16) − 2 = 65,536 − 2 = 65,534
Two types:
Limited broadcast (255.255.255.255) — never forwarded by a router.
Directed broadcast (10.10.255.255) — can be forwarded unless no ip directed‑broadcast is set, which is the default on modern IOS.
Class D addresses (224.0.0.0 – 239.255.255.255) send to a group, not a single host or all hosts. Routers use PIM to build distribution trees; hosts join groups with IGMP.
| Reserved address | Group |
|---|---|
| 224.0.0.1 | All hosts on subnet |
| 224.0.0.2 | All multicast routers |
| 224.0.0.5 / .6 | OSPF (all routers / DR-BDR) |
| 224.0.0.9 | EIGRP |
| 224.0.0.10 | HSRP version 2 |
No router forwards multicast by default — ip multicast‑routing must be enabled.
Symptom: Two hosts on the same switch cannot ping.
Check: One has 169.254.1.25 (APIPA — no DHCP), the other is 192.168.1.10. Different subnets, no router between them.
Fix: Static IP on same subnet, or restore DHCP server reachability.
Router# show ip interface brief Interface IP-Address OK? Method Status Protocol Gig0/0 192.168.1.1/24 YES manual up up Router# show ip interface gig0/0 Broadcast address is 255.255.255.255 Directed broadcast forwarding is disabled
/19 mask = 19 bits fixed → 13 host bits
172.20.0.0 = 10101100.00010100.00000000.00000000
broadcast = 10101100.00010100.00011111.11111111 (flip all host bits)
= 172.20.31.255Directed broadcast for the 10.0.0.0/8 network. The host sees 10.255.255.255 — all host bits are 1. The packet will reach all hosts on the 10.0.0.0/8 subnet if the intermediate routers permit directed‑broadcast forwarding (disabled by default).
No. 239.x.y.z is in the Administratively Scoped range (239.0.0.0/8) — it is never routed beyond an organization's boundary. Within the enterprise: IGMP (hosts tell the router they want the group) and PIM (routers build a distribution tree toward the source or the Rendezvous Point).
A /24 (255.255.255.0) gives 254 hosts. Most LANs need far fewer, so you subnet it to create multiple smaller networks. Every subnet consumes address space — the math must be exact or you run out of addresses or route table memory.
A /24 means 24 fixed network bits; the remaining 8 host bits can vary.
Mask /24 = 11111111.11111111.11111111.00000000
Split one /24 into four /26s (borrow 2 host bits):
Mask /26 = 11111111.11111111.11111111.11000000
^-- 2 borrowed bits = 2^(32-26) = 64 addresses per subnet
2 subnets worth? Actually 4 subnets (192,193,194,195 high octet slices):
192.168.0.0/26 (hosts .0 - .63, bcast .63)
192.168.0.64/26 (hosts .64 - .127, bcast .127)
192.168.0.128/26 (hosts .128 - .191, bcast .191)
192.168.0.192/26 (hosts .192 - .255, bcast .255)
Usable hosts = 2^(host bits) − 2 (subtract network & broadcast). So /26 → 64 − 2 = 62 usable hosts per subnet.
Given network 10.0.0.0/24, create 7 subnets for 7 VLANs. Each VLAN hosts 20 devices.
Step 1: need 20 hosts. 2^h − 2 ≥ 20 → h = 5 (30 hosts). 7 subnets needed.
Step 2: 2^3 = 8 ≥ 7 → borrow 3 bits. Mask = 32−5 = /27.
Step 3: block size = 2^5 = 32.
Subnet 1: 10.0.0.0/27 (hosts .1–.30, bcast .31)
Subnet 2: 10.0.0.32/27 (hosts .33–.62, bcast .63)
Subnet 3: 10.0.0.64/27 (hosts .65–.94, bcast .95)
Subnet 4: 10.0.0.96/27 (hosts .97–.126,bcast .127)
Subnet 5: 10.0.1.0/27 (hosts .1–.30)
Subnet 6: 10.0.1.32/27 (hosts .33–.62)
Subnet 7: 10.0.1.64/27 (hosts .65–.94)
Switch# show ip interface brief Switch# show running-config interface vlan 10 Switch# ping 10.0.0.1 source vlan 10
500 hosts → h where 2^h − 2 ≥ 500 → h = 9 (510 hosts). Mask = 32 − 9 = /23 /23 dotted = 255.255.254.0
Mask /27 → block 32. Network = 192.168.10.0. Broadcast = 192.168.10.0 + 31 = 192.168.10.31. Usable range 192.168.10.1 – 192.168.10.30.
/29 → borrow 5 bits → 2^5 = 32 subnets, each holding 6 hosts (2^3−2). Valid count (32 ≥ 5) but only 6 hosts per subnet — too small for most VLANs. The admin over-subnetted. A /28 would give 6 usable hosts; a /27 gives 14 hosts — check host needs first.
VLSM = allocate subnets of different sizes from the same block. Fixed subnetting (one mask) wastes addresses. VLSM is the backbone of an efficient RFC 1918 plan and of route summarization.
Allocate largest subnet first, then carve the remainder. Order by decreasing block size — otherwise you create fragmentation holes your next subnet can't use.
Block 10.0.0.0/24 must serve:
1) 100 hosts → /25 (block 128) — 10.0.0.0/25 → usable .1–.126, bcast .127 2) 50 hosts → /26 (block 64) — 10.0.0.128/26 → .129–.190 3) 20 hosts → /27 (block 32) — 10.0.0.192/27 → .193–.222 Remainder from .224 is two /29s (block 8): 4) P2P (2 h) → /30 (block 4) — 10.0.0.224/30 → .225–.226 remaining .228–.255 = six /30s available for future P2Ps loopbacks: use /32s from the tail: 10.0.0.253 - 255
Route summarization collapses many subnets into one shorter prefix. Rule: the block must align on a power‑of‑two boundary matching the summary.
Summarize 10.0.0.0/25, 10.0.0.128/26, 10.0.0.192/27 → 10.0.0.0/25 covers .0–.127 ❌ does NOT cover .128+ → Use 10.0.0.0/24 = whole block. Summary = 10.0.0.0/24.
Common mistake: summarizing 172.16.1.0/24 + 172.16.2.0/24 as 172.16.0.0/23 — valid only if 172.16.0.0/24 doesn't exist or is also summarized.
Router# show ip route
R 10.0.0.0/24 is subnetted, 4 subnets
10.0.0.0/25 is subnetted
10.0.0.128/26 is subnetted
S 10.0.0.0/24 [1/0] via 192.168.1.1 ← static summary
Router# show ip protocol
Routing Protocol is "ospf 1"
Area 0 Summary routes:
10.0.0.0/24 (summary network)
A: 120 hosts → /25 block 128 → 192.168.10.0/25 (.1–.126, bcast .127) B: 60 hosts → /26 block 64 → 192.168.10.128/26 (.129–.190, bcast .191) C: 28 hosts → /27 block 32 → 192.168.10.192/27 (.193–.222, bcast .223) Remainder 192.168.10.224/27 is free reserve / /30s.
Cover 8 subnets (/24) → need 3 borrowed bits → /21. Verify alignment: 10.4.8.0 is divisible by 8 in the third octet (8 = 0b1000) → aligned. Summary = 10.4.8.0/21 (covers .8.0–.15.255).
Summarizing reduces the OSPF LSDB and SPF domain: one inter-area (type‑3) LSA instead of three. Summarize at the ABR connecting this area to the backbone. The ABR advertises 172.16.0.0/22, hiding .0/.1/.2 specifics. The new .3 link is included in that same summary since 172.16.0.0/22 already spans .0–.3.
Every network problem — slow link, unreachable host, dropped VoIP call — gets diagnosed by asking which layer broke. The OSI model is not theory; it is the troubleshooting map. If you cannot name the layer, you cannot isolate the fault. Encapsulation is the mechanism that makes layered communication actually work: each layer wraps the data from the layer above with its own header, so the receiving device can unwrap it in reverse order.
| Layer | Name | Unit of data (PDU) | What it does | Example |
|---|---|---|---|---|
| 7 | Application | Data | Interface between user apps and network | HTTP, DNS, SMTP |
| 6 | Presentation | Data | Formatting, encoding, encryption | JPEG, TLS handshake, ASCII |
| 5 | Session | Data | Establishes/manages/tears down sessions | NetBIOS, RPC |
| 4 | Transport | Segment (TCP) / Datagram (UDP) | End-to-end delivery, port numbers, reliability | TCP, UDP |
| 3 | Network | Packet | Logical addressing, routing between networks | IPv4, IPv6, routers |
| 2 | Data Link | Frame | Physical addressing (MAC), framing, error detection on the link | Ethernet, switches |
| 1 | Physical | Bits | Raw transmission of bits on the medium | Cable, fiber, voltage, radio |
Memory aid (top to bottom): All People Seem To Need Data Processing — 7, 6, 5, 4, 3, 2, 1. Devices live by layer: hosts use all 7, routers stop at layer 3, switches at layer 2, hubs/repeaters at layer 1.
When host A sends an HTTP request, the data does not jump straight onto the wire. Each layer encapsulates: it takes the PDU from the layer above, keeps it as the payload, and prepends its own header (layer 2 also appends a trailer). The receiving host de-encapsulates in reverse: strip layer 2 header, pass to layer 3, strip layer 3 header, pass to layer 4, and so on up to the application.
HTTP request GET /index.html from 10.1.1.10 to 10.2.2.20, port 80:
Frame on the wire for this example: 14 (Eth) + 20 (IP) + 20 (TCP) + HTTP payload. Minimum Ethernet frame is 64 bytes; smaller payloads get padded.
TCP/IP collapses OSI into 4 layers:
| TCP/IP layer | Maps to OSI | Key protocols |
|---|---|---|
| Application | 5–7 | HTTP, DNS, DHCP, SMTP, TLS |
| Transport | 4 | TCP, UDP |
| Internet | 3 | IPv4, IPv6, ICMP, ARP (ARP is often called L2.5 — it resolves L3 to L2) |
| Network Access (Link) | 1–2 | Ethernet, Wi-Fi, PPP, HDLC |
PDU names stay the same regardless of model: segment/datagram at transport, packet at network, frame at data link. Only the layer count differs between OSI (7) and TCP/IP (4).
No config creates the OSI model — it is inherent. But you operate layers on a Cisco device. Bring up an interface (L1+L2) and address it (L3):
interface GigabitEthernet0/0 description uplink-to-core ip address 192.168.1.1 255.255.255.0 no shutdown
Verify — the healthy output proves every layer:
R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.1.1 YES manual up up
Read the two last columns: Status = layer 1 (physical), Protocol = layer 2 (data link). Both up means L1+L2 healthy. show ip interface brief also proves L3 is configured. To see the full frame/packet logic in action, trace with extended ping and watch L1–L3 counters:
R1# show interfaces GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 00e0.8f99.0101 (bia 00e0.8f99.0101)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec
...
5 minute input rate 12000 bits/sec, 10 packets/sec
5 minute output rate 18000 bits/sec, 15 packets/sec
MTU 1500 = maximum L3 payload a frame can carry. Anything larger must fragment (L3) or be dropped — a classic MTU-mismatch failure mode you will meet in VPN lessons.
Symptom: serial link between two routers shows up, line protocol is down. Physical layer (clock, cable) is fine; the data link cannot agree on framing.
R1# show interfaces serial 0/0/0 Serial0/0/0 is up, line protocol is down
Cause: one end runs HDLC (Cisco default on serial), the other runs PPP — or one side has encapsulation ppp and the other never did.
Fix: make framing match on both ends, then watch the protocol come up:
R2(config)# interface serial 0/0/0 R2(config-if)# encapsulation ppp R2(config-if)# end R2# show interfaces serial 0/0/0 Serial0/0/0 is up, line protocol is up
Golden rule of troubleshooting: work bottom-up. Verify L1 (cable, admin down), then L2 (encapsulation, duplex), then L3 (IP, mask), then L4+ (ACLs, services). Never jump to the top — you waste hours hunting an application bug that is really a dead cable.
The router strips the layer 2 (Ethernet) header and FCS trailer, then looks at the layer 3 destination. After stripping, the PDU is a packet (layer 3). The router re-encapsulates it into a new frame with the next hop's MAC address before sending it out.
The segment (L4, 1000 bytes payload + 20 byte TCP header = 1020 bytes) is wrapped into an IP packet (1040 bytes with IPv4 header). The router must forward it out an interface with MTU 576, so it fragments the IP packet into smaller pieces (each ≤ 576 bytes, with the IP header repeated in every fragment and the More-Fragments bit set on all but the last). Each fragment is still a packet at L3. The destination host reassembles fragments back into the original packet before handing the payload to TCP.
Sender host: DNS query (Data, L7–5) → TCP/IP stack adds UDP header (Datagram) → IP header protocol=17 (Packet) → Ethernet header (Frame) → bits on wire. Switch(es): forward frame by MAC, no de-encapsulation beyond L2 inspection (frame stays a frame). Router: strips Ethernet (frame → packet), checks IP dst, re-encapsulates into new Ethernet frame for the next hop (packet → frame). Destination host: NIC strips Ethernet (frame → packet), IP stack sees protocol 17, passes to UDP (packet → datagram), UDP sees port 53, passes to DNS application (datagram → data). Device count: sender host, at least one router, receiver host — switches only relay at L2.
CIDR (Classless Inter‑Domain Routing) killed the rigid class system (A/B/C) in 1993. It lets you express any prefix length — e.g. /19 instead of just /8, /16, /24. Supernetting aggregates multiple smaller subnets into a single larger route, shrinking routing tables globally. Without CIDR, the Internet's BGP table would collapse under its own weight.
A CIDR block is network/length. Length = number of fixed bits (the mask).
10.0.0.0/8 → mask 255.0.0.0 (8 fixed + 24 host) 10.10.0.0/16 → mask 255.255.0.0 (16 fixed) 10.10.10.0/24 → mask 255.255.255.0 (24 fixed) 10.10.10.0/25 → mask 255.255.255.128 (25 fixed → 2 subnets of 126 hosts)
The shorter the prefix (smaller /N), the more hosts AND the broader the route — a /8 covers 16M hosts, a /30 covers only 2.
Supernetting = combine contiguous subnets into one shorter summary route. The summary must start on a binary boundary matching the aggregate block size.
Rule: the first address of the summary must be a multiple of the block size.
Four /24s from .0 through .3 → summary is 192.168.0.0/22. Verify alignment: block size = 2^(24−22) = 4 → 0 is divisible by 4 → aligned.
ISP advertises customer prefixes: 203.0.113.0/25, 203.0.113.128/26, 203.0.114.0/24.
1) 203.0.113.0/25 (covers .0 – .127)
2) 203.0.113.128/26 (covers .128 – .191)
3) 203.0.114.0/24 (covers .0 – .255 in 114 octet)
Combine 1+2 = 203.0.113.0/24 already perfect (covers .0–.255).
Now 203.0.113.0/24 + 203.0.114.0/24 → 203.0.112.0/22? No — 113 decimal: 0x71 → odd. Block size 2 → must start at even.
Better: 203.0.112.0/20 (16 subnets) would cover .112–.127 — too broad (leakage).
Correct: no tighter summary than /22? Let's check: 112/24 binary → 0x70 → even. 112+0 = 0x70, 112+1 = 0x71, 112+2 = 0x72, 112+3 = 0x73 = .115.
Does NOT cover 113/24 and 114/24? Actually .113/24 = 0x71, .114 = 0x72. Block size 4 with start 112 = 112, .113, .114, .115 → YES 203.0.112.0/22 covers .112–.115.
But we only have .113 & .114, not .112 & .115 — potential leakage. In BGP use aggregate-address 203.0.112.0 255.255.252.0 summary-only — accept leakage, it's still a valid route.
Symptom: Traffic to a newly‑added subnet gets blackholed.
Root cause: The upstream router's summary 10.0.0.0/13 already covers the new subnet 10.6.0.0/16, but your edge router has no more‑specific route pointing to the new location.
Fix: Ensure the edge router advertises 10.6.0.0/16 explicitly BEFORE the summary route takes effect, or use BGP unsuppress‑map to leak the new /16 through the summary filter.
172.16.0.0/22. Block size = 4. Starting address 172.16.0.0 is divisible by 4 in the 3rd octet → aligned. Covers .0.0–.3.255.
Yes. Block size = 2. Starting address 192.0.2.0 aligns on an even boundary (192.0.2.0 / 192.0.3.0). The /23 covers both.
Yes — the /16 covers both, so even after the /24 fails, the /16 remains in the table and traffic is forwarded (blackholed). Fix: use BGP conditional advertisements or unsuppress‑map to withdraw the /16 when none of the constituent /24s exist, or avoid summarization entirely when specific routes are critical.