What is actually written.

Bidirectional Forwarding Detection

Detects that a path has stopped forwarding in milliseconds, so routing protocols can stop inferring it from missed hellos seconds later.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Route redistribution between routing protocols

Moves routes from one protocol into another, discarding the metric and the loop prevention that made them trustworthy.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Ethernet framing, MAC learning and forwarding

Delivers a frame to a MAC address on a segment, and learns where every address lives by watching what arrives.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Spanning Tree Protocol (IEEE 802.1D)

Keeps a switched network free of loops by disabling just enough ports to leave one active path between any two bridges.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 5 platforms
• 6 failure modes
• 8 questions
• reviewed

Virtual LANs and 802.1Q tagging

Splits one physical switched network into several independent broadcast domains, and carries them over a shared link with a four-octet tag.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 5 platforms
• 6 failure modes
• 8 questions
• reviewed

Address Resolution Protocol

Finds the MAC address behind an IPv4 address on the local segment, by asking everyone and trusting whoever answers.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 4 platforms
• 5 failure modes
• 8 questions
• reviewed

Network Address Translation

Rewrites the IPv4 addresses — and usually the transport ports — at a realm boundary so many private hosts share fewer public addresses.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Differentiated Services

DSCP marks a class; the PHB on each hop is the treatment. The trust boundary is where marks become yours.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Internet Protocol Security

ESP (or AH) protects packets under SAs negotiated by IKEv2; the SPD decides what enters, the SAD holds the keys.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Neighbor Discovery Protocol

IPv6’s on-link discovery: NS/NA replace ARP, RS/RA find routers and prefixes, and DAD proves an address is unique — a rogue RA is an incident.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

QUIC

UDP-carried, always encrypted multiplexed transport: streams do not share TCP’s head-of-line block, and connection IDs survive path changes.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

BGP/MPLS IP VPN

VPN-IPv4 is an RD plus a prefix; import is a Route Target. They are unrelated — and the data plane needs a transport label as well as a VPN label.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

WireGuard

A small cryptographic VPN with static public keys, cryptokey routing, and one UDP-carried tunnel interface per peer list.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Dynamic Multipoint VPN

mGRE plus NHRP plus (usually) IPsec: spokes register with a hub, and Phase 3 builds on-demand spoke-to-spoke shortcuts from NHRP redirect and shortcut switching.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Hot Standby Router Protocol

Cisco’s first-hop group: one Active, one Standby, virtual MAC 0000.0c07.acXX, and a Hello on UDP/1985 so the Standby knows when to take over.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• reviewed

Virtual Router Redundancy Protocol

Several routers share a virtual IPv4 or IPv6 address; the highest priority owns it and advertises so backups can take over when silence means the master is gone.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Internet Group Management Protocol

Hosts report which multicast groups — and, in version 3, which sources — they want; snooping turns those reports into switch forwarding state.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Link Aggregation Control Protocol

A standard handshake that binds parallel links into one logical port — and refuses to forward on a member the far end has not agreed to.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

IPv4 prefixes, masks and longest-prefix match

Divides an address space by moving a boundary through the bits, and decides which route wins by how many of those bits a prefix pins down.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Static routes and floating static routes

Installs an operator-authored next hop for a prefix, and uses a worse preference only when a better route of the same length disappears.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• draft

IPv4 access control lists

Matches packet fields in order against permit and deny entries, then applies the first hit — with an implicit deny if nothing matched.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• draft

Switch port security and DHCP snooping basics

Limits which source MAC addresses may use an access port, and builds a DHCP binding table so untrusted ports cannot answer as servers.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• draft

Virtual routing and forwarding instances

Gives one router several independent routing tables, so overlapping address space can coexist and traffic cannot cross between tenants by accident.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Protocol Independent Multicast — Dense Mode

Floods every group to every router and waits to be told to stop. The opposite assumption to sparse mode, and it is wrong almost everywhere.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Source-Specific Multicast

The receiver names the source, so there is no rendezvous point, no shared tree and no source discovery problem to solve.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Multicast Source Discovery Protocol

Lets rendezvous points in separate domains tell each other which sources are active, so a receiver can join a source its own RP has never heard of.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Rendezvous point discovery: static, BSR, Auto-RP and Anycast-RP

Every router in a sparse-mode domain has to agree which rendezvous point serves which group. Four mechanisms answer that, and disagreement is silent.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Resource Reservation Protocol — Traffic Engineering extensions

Signals a label-switched path along a route you choose rather than the one the IGP would pick, and books bandwidth for it in the control plane.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Segment Routing over IPv6

Puts the segment list in an IPv6 extension header and makes every segment a routable address, so the path is carried by ordinary IPv6 forwarding.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Virtual Private LAN Service

Emulates one Ethernet segment across a provider network by meshing pseudowires between sites and learning MAC addresses from them.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Virtual eXtensible Local Area Network

Carries an Ethernet frame inside UDP so a layer-two segment can span a routed fabric, identified by a 24-bit VNI rather than a 12-bit VLAN tag.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Ethernet VPN

Advertises MAC addresses in BGP instead of discovering them by flooding, which is what makes all-active multihoming and predictable mobility possible.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Rapid Spanning Tree Protocol

Replaces spanning tree’s two timers with an explicit handshake, and names the backup path in advance so failover does not wait for information to expire.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Multiple Spanning Tree Protocol

Maps many VLANs onto a handful of spanning trees, and decides who shares a topology by hashing the mapping rather than by trusting the configuration to match.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Transmission Control Protocol

Turns a lossy packet network into an ordered byte stream, and decides how fast to send it using an algorithm that appears nowhere in the header.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Protocol Independent Multicast — Sparse Mode

Builds multicast trees only where receivers ask for them, meeting sources and receivers at a rendezvous point and then getting out of the way.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Enhanced Interior Gateway Routing Protocol

A distance-vector protocol that keeps a proven loop-free backup ready, so most failures are a switch rather than a recomputation — and asks the network only when it has none.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Transport Layer Security 1.3

Authenticates a server and encrypts a byte stream in one round trip — and hides less than people assume, because the parts a middlebox used to read had to stay readable.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Hypertext Transfer Protocol

One set of semantics — methods, status codes and fields — carried over three quite different transports, which is why "which HTTP version" changes performance and almost nothing else.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Dynamic Host Configuration Protocol

Lets a host with no address ask the network for one, along with the handful of parameters it needs to be useful.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 5 failure modes
• 8 questions
• reviewed

Domain Name System

A delegated, cached database that answers questions about names — and whose two most useful signals are the record type asked for and how long the answer may be remembered.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 6 failure modes
• 8 questions
• reviewed

HTTP reverse proxying and request forwarding

An intermediary the client cannot see, which routes by hostname and terminates TLS — and in doing so replaces every fact the application had about who is calling it.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 3 platforms
• 6 failure modes
• 8 questions
• reviewed

Open Shortest Path First Version 2

Each router floods a description of its links, then independently computes the same shortest-path tree — so the forwarding tables agree without exchanging routes.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 6 platforms
• 6 failure modes
• 8 questions
• reviewed

OSPF for IPv6

The same neighbor machine and SPF as OSPFv2, with addressing stripped out of the LSA so Instance IDs can map separate address families onto the same control plane.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Intermediate System to Intermediate System

A CLNS link-state protocol that carries IP as TLVs: areas are levels, the LAN elects a DIS that preempts, and the metric width is a configuration, not a constant.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 6 platforms
• 5 failure modes
• 8 questions
• reviewed

Border Gateway Protocol 4

A TCP session that exchanges path attributes, then picks one path with a total-order waterfall — not a shortest-path flood.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 6 platforms
• 5 failure modes
• 8 questions
• reviewed

Per-VLAN Spanning Tree Plus

One spanning-tree instance per VLAN — Cisco’s way to load-share uplinks where IEEE STP/RSTP would keep a single tree.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• reviewed

Routing Information Protocol Version 2

The clearest distance-vector lesson: hop count to 15, infinity at 16, split horizon, and poison reverse.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Bidirectional Protocol Independent Multicast

Many-to-many multicast on a shared tree only — no Register, no (S,G), no SPT switchover; the DF on each link is what keeps it loop-free.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• reviewed

Segment Routing MPLS

A prefix SID is a node label from the SRGB; an adjacency SID is one hop. TI-LFA is a repair stack — not RSVP-TE.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Network Time Protocol

Stratum, association modes, and the fact that time sync is soft state — bad time breaks certificates and logs.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Precision Time Protocol

Sub-microsecond timing with Announce election and Delay_Req/Resp — not a drop-in replacement for NTP on every campus.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• reviewed

Simple Network Management Protocol

A manager reads and changes typed MIB objects; agents send traps or informs. v3 adds USM authentication and privacy.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• draft

IP Flow Information Export (IPFIX) and NetFlow

An exporter meters conversations and sends templated records to a collector — traffic metadata, not a full packet capture.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• draft

Network Configuration Protocol

RPC operations over a secure session against configuration datastores — candidate, running, and optional startup — with locks and confirmed commit.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• draft

Model-driven streaming telemetry (YANG-Push)

Subscribe to YANG-modeled state with periodic SAMPLE or ON_CHANGE updates instead of polling every leaf with SNMP.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• draft

Software-Defined WAN overlay architecture

A controller plane distributes overlay policy and keys; site routers still need underlay IP reachability — not a single IETF SD-WAN protocol.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• draft

IEEE 802.11 association and roaming

Stations probe, authenticate, and associate; WPA2/3 completes a 4-way handshake. Roaming and CAPWAP (RFC 5415) separate air from AP–controller tunnels.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• draft

Link Layer Discovery Protocol

A standard TLV advertisement of chassis, port, and TTL — vendor-neutral neighbour discovery.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Cisco Discovery Protocol

Cisco’s proprietary neighbour advertisement — still required by some phones for voice VLAN.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• reviewed

Gateway Load Balancing Protocol

One virtual gateway address, several forwarding MAC addresses, and an ARP reply that chooses the forwarder.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• reviewed

Virtual Port Channel

Two Nexus peers present one LACP system downstream; peer-keepalive is the split-brain detector when the peer-link fails.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 1 platform
• 5 failure modes
• 8 questions
• reviewed

Label Distribution Protocol

UDP discovery on 646, then a TCP session that maps FECs to labels so the IGP’s path can be label-switched.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• reviewed

Remote Authentication Dial-In User Service

Central AAA carried as attributes over UDP, with authorization largely folded into the access response.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• draft

Terminal Access Controller Access-Control System Plus

Device-administration AAA that separates authentication, authorization, and accounting exchanges over TCP.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• draft

Port-Based Network Access Control

EAPoL to the authenticator; RADIUS behind it. MAB is a fallback, not 802.1X.

Several walkthroughs, packet anatomy, an interactive model, vendor configuration, a failure catalogue and misconceptions.

• 3 walkthroughs
• 2 platforms
• 5 failure modes
• 8 questions
• draft