Keentune

Networking curriculum

36 chapters
·
261 concepts
·
free
Everything the adaptive question bank can teach and test in Networking, from foundations through advanced practice. Work through it in order, or start practicing and let the questions find your level.
Start practicing Networking

New here? Read the Networking guide

A free 20-minute primer — the mental model, the mistakes beginners make, and what to practice first.

A. Layering, encapsulation and the standards process

•
The Internet model is link, internet, transport, application; OSI's seven layers are a teaching overlay.
•
Each layer prepends its own header and treats everything above it as opaque payload.
•
Reliability belongs at the endpoints; the network only has to try to forward.
•
IP may drop, duplicate, delay or reorder, and nothing below transport promises otherwise.
•
Be conservative in what you send, liberal in what you accept, and how that liberality ossifies protocols.
•
IP's protocol field selects the transport; the port selects the process.
•
The link's MTU limits what the layer above may hand it, never the reverse.
•
Internet-Draft, Proposed Standard, Internet Standard, and "obsoleted by".
•
RFC 2119 keywords are what make a requirement testable rather than advisory.
•
Ports, protocol numbers, RR types and TLS extensions are allocated centrally, not invented.

B. IPv4 addressing and the datagram header

•
A 32-bit address written as four decimal bytes; 2^32 total and far fewer usable.
•
The mask splits every address into a network prefix and a host part.
•
The all-zeros and all-ones host values in a subnet are not assignable.
•
10/8, 172.16/12 and 192.168/16 are never routed on the public Internet.
•
127/8 never leaves the host; 169.254/16 is what appears when DHCP fails.
•
Every router decrements TTL and discards at zero, which is the only thing bounding a loop.
•
It covers the header only, and must be recomputed at every hop because TTL changed.
•
Identification, flags and fragment offset, with reassembly only at the destination.
•
DF turns an oversized packet into an ICMP error instead of fragments.
•
6 is TCP, 17 UDP, 1 ICMP; the field names the next header, not the application.
•
The old ToS byte now carries a 6-bit DSCP class plus the two ECN bits.
•
IP options are legal, processed off the fast path, and widely dropped in transit.

C. Subnetting, prefixes and CIDR

•
/24 means the leading 24 bits are network and the rest identify hosts.
•
ANDing an address with its mask yields the network address it belongs to.
•
2^(32−n) addresses, minus the network and broadcast values.
•
Each extra prefix bit halves the subnet size and doubles the subnet count.
•
A/B/C classes are historical; CIDR replaced them and the class of an address means nothing today.
•
Different-sized subnets carved from one block, allocated largest-first to avoid stranding.
•
Advertising one shorter prefix instead of many longer ones is what keeps the global table finite.
•
A router forwards on the most specific matching route, never the first match.
•
0.0.0.0/0 matches everything and always loses to anything more specific.
•
A /30 wastes two addresses on a link with two ends; a /31 is legal there.
•
A /24 announced inside someone's /16 attracts that range's traffic, which is also how hijacks work.

D. IPv6 addressing, autoconfiguration and transition

•
Eight 16-bit groups, leading zeros dropped, and exactly one :: run compressed.
•
/64 is the standard LAN, with /48 or /56 delegated to a site.
•
2000::/3 is the currently routable global unicast space.
•
Every interface has one, it is mandatory, and it is never routed off the link.
•
The site-local ULA range, and why using it is not "IPv6 NAT".
•
IPv6 has no broadcast address; ff02::1 and ff02::2 do that work.
•
Neighbor discovery targets a derived multicast group so only the intended NIC is interrupted.
•
NS/NA replace ARP, and RS/RA replace the need to be told a default gateway.
•
A host builds its own address from the router-advertised prefix plus an interface identifier.
•
Temporary source addresses rotate so a stable interface ID cannot track a user.
•
DAD probes from the unspecified address before an address may be used.
•
A 40-byte header with no checksum; options moved into extension headers.
•
Only the source may fragment, which makes path-MTU discovery mandatory rather than an optimization.
•
Translating IPv6-only clients to IPv4 servers, with synthesized AAAA records pointing at the translator.

E. Ethernet, switching, VLANs and ARP

•
48 bits: a vendor OUI plus a device part, with the low bit of the first byte marking multicast.
•
Preamble, addresses, EtherType, payload and a CRC that detects errors but never corrects them.
•
0x0800 is IPv4, 0x86DD IPv6, 0x0806 ARP; the field says which stack gets the payload.
•
A switch learns source MACs per port and floods only unknown destinations.
•
A switch forwards broadcasts to every port; a router is what stops them.
•
CSMA/CD mattered on a shared hub; full-duplex switching retired collisions entirely.
•
STP blocks redundant ports because an Ethernet frame has no TTL to kill a loop.
•
An IEEE 802.1Q tag inserts a 12-bit VLAN ID and four bytes into the frame.
•
An access port carries one untagged VLAN; a trunk carries many tagged ones.
•
Untagged frames on a trunk land in whichever VLAN each end calls native, silently bridging two networks.
•
LACP bonds several links, and a per-flow hash decides which member carries a conversation.
•
A broadcast asks who owns an IPv4 address and the reply's MAC is cached with a timeout.
•
An unsolicited reply rewrites neighbors' caches, which is both how failover works and how spoofing works.

F. NAT, address sharing and traversal

•
Static NAT maps address to address; PAT multiplexes many hosts onto one address using ports.
•
The mapping is per-flow state, so a NAT is a stateful box and a router is not.
•
Unsolicited inbound traffic matches no entry and is dropped, which is filtering, not security by design.
•
A static inbound entry is what lets a server live behind NAT.
•
An inside host reaching another inside host via the shared public address, which many NATs get wrong.
•
Endpoint-independent versus address-and-port-dependent mapping, and why the strict kind breaks peer-to-peer.
•
A host learns its mapped address from an outside server, then both peers send outward to open the path.
•
100.64.0.0/10 is carrier-grade NAT space and must not be used as private addressing by a customer.
•
Protocols that carry addresses in their payload need an ALG or they fail behind NAT.

G. TCP connections and the state machine

•
TCP delivers an ordered byte stream, so the receiver never sees the sender's write boundaries.
•
A connection is identified by source IP, source port, destination IP and destination port together.
•
SYN, SYN-ACK, ACK exchanges and acknowledges an initial sequence number in each direction.
•
ISNs are randomized so old segments and blind spoofing cannot be injected into a new connection.
•
The half-open queue is a denial-of-service target, and SYN cookies remove the state that made it one.
•
Each direction is shut down independently with its own FIN and matching ACK.
•
One side can finish sending and keep reading, which is how request-then-read protocols signal end of input.
•
The side that closes first waits 2×MSL so a delayed segment cannot be mistaken for part of a new connection.
•
RST aborts immediately and discards buffered data, unlike an orderly FIN.
•
A full accept queue makes the kernel drop new SYNs, which the client sees as a timeout, not a refusal.
•
A SYN to a closed port draws an RST, which is a fast failure and diagnostically different from a silent drop.
•
The MSS advertised in the SYN is the largest segment each side is willing to receive, derived from its own MTU.
•
TCP keepalive defaults to hours, so idle connections die in middleboxes long before the stack notices.
•
Data may ride in the SYN under a cookie, at the cost of being replayable.

H. TCP reliability, flow control and congestion control

•
The ACK number names the next byte expected, implicitly acknowledging everything before it.
•
The advertised window is the receiver's free buffer; this is flow control and says nothing about the network.
•
The 16-bit window field caps at 64 KB, so long fat pipes need the scale option negotiated in the SYN.
•
The window in flight must cover bandwidth × RTT or the sender stalls waiting for ACKs.
•
The timeout is a smoothed RTT plus a variance term, with exponential backoff on repeated loss.
•
Three duplicate ACKs resend the missing segment without waiting for the retransmission timer.
•
SACK tells the sender exactly which blocks arrived, so it resends the hole and not the tail.
•
The congestion window grows exponentially from an initial window until loss or the slow-start threshold.
•
Additive increase and multiplicative decrease is what makes competing flows converge on a fair share.
•
Classic TCP infers congestion from drops, which misreads a lossy wireless link as a full one.
•
CUBIC grows on a cubic curve away from the last loss; BBR estimates bottleneck bandwidth and minimum RTT instead.
•
Oversized router queues delay the loss signal, converting congestion into latency rather than drops.
•
Marking a packet instead of dropping it, with L4S adding a low-latency queue and finer-grained feedback.
•
Nagle withholds a small write until the outstanding data is acknowledged while the peer withholds the ACK, adding tens of milliseconds.

I. UDP and datagram service

•
Source port, destination port, length and checksum, and nothing else.
•
No ordering, no retransmission, no connection; anything the application needs it must build.
•
The checksum is optional over IPv4 and mandatory over IPv6.
•
The checksum covers IP addresses, which is why a NAT must recompute it after translating.
•
One send is exactly one receive, unlike a TCP stream that may coalesce or split.
•
A small spoofed query drawing a large reply is what makes open UDP services reflection weapons.
•
DNS, real-time media and QUIC choose it to avoid a transport that stalls everything on one loss.

J. QUIC

•
QUIC rides on UDP so it can be deployed and updated in userspace instead of in kernels.
•
A lost packet stalls only the stream whose data it carried, not every stream on the connection.
•
The connection is keyed by connection ID, so it survives a change of IP address or port.
•
TLS 1.3 is part of the QUIC handshake rather than a layer negotiated above it.
•
A fresh connection costs one round trip; a resumed one can carry application data in the first flight.
•
Early data can be replayed by an attacker, so it must carry only idempotent requests.
•
Nearly the whole header is protected, which denies middleboxes the fields TCP let them ossify.
•
Packet numbers never repeat on retransmission, removing TCP's ambiguity about which copy was acknowledged.
•
Separate credit limits per stream and for the connection as a whole.
•
Before validating the client's address a server may send at most three times what it received.
•
Deliberately unknown values are exercised so extensibility does not rot.
•
A server that has lost the connection state proves it without needing a handshake.

K. Routing: forwarding, IGPs and BGP

•
The data plane looks up a forwarding table; the control plane is what builds it.
•
A hand-written route is predictable and never reconverges around a failure.
•
When two protocols offer the same prefix, trustworthiness decides before any metric does.
•
A metric compares paths inside one protocol; preference compares across protocols.
•
Advertise your own table to neighbors, or flood the topology and each run shortest-path.
•
The loop distance-vector protocols create, and what split horizon and route poisoning do about it.
•
Area 0 is the backbone and every other area must attach to it, which bounds flooding.
•
A link change floods a link-state advertisement and every router in the area recomputes SPF.
•
Cost is derived from bandwidth, and equal-cost paths share load rather than one winning.
•
An IGP optimizes paths inside one administrative domain; BGP glues autonomous systems together.
•
The AS path is both the loop-detection mechanism and a tiebreaker in path selection.
•
Local preference and MED encode business relationships, so BGP does not pick the shortest path.
•
One prefix originated from many sites, letting routing itself steer each client to a nearby instance.

L. DNS

•
Root, TLD, then the zone; each level only knows who to ask next.
•
One server holds the zone data, the other does the walking and the caching.
•
The resolver follows referrals hop by hop while the client asks exactly once.
•
The IPv4 and IPv6 address records, queried independently by a dual-stack client.
•
A CNAME cannot coexist with other records at a name, which is why a zone apex cannot be one.
•
Mail is delivered to the lowest preference number that answers, higher numbers being fallbacks.
•
SPF, DKIM and DMARC policies all live in TXT records at defined names.
•
Delegation needs NS records, plus glue A records when the nameserver lives inside the delegated zone.
•
The serial number drives zone transfers, and the SOA's last field sets the negative-cache TTL.
•
Nothing propagates; caches simply expire, and the TTL in force before the change governs how long that takes.
•
NXDOMAIN answers are cached too, which is why creating a record seems not to take effect.
•
A truncated answer sets TC and the client retries over TCP, while EDNS0 raises the acceptable UDP size instead.
•
RRSIG, DNSKEY and a DS record in the parent link a zone back to the signed root.
•
Signatures prove origin and integrity; the query and answer are still in cleartext.
•
Encrypting DNS transport over HTTPS, TLS or QUIC, and which observer each choice actually blinds.
•
Service parameters such as ALPN, port and ECH keys delivered in DNS before the first connection.

M. HTTP semantics and the three wire formats

•
Every request stands alone, so continuity is carried by cookies or tokens the client resends.
•
GET is safe, PUT and DELETE are idempotent, POST is neither, and retries depend on which.
•
1xx through 5xx, and what each class promises about whether retrying can help.
•
301, 302, 307 and 308 differ in permanence and in whether the method may change to GET.
•
Accept and Accept-Language select a representation, and Vary must name whatever was used.
•
One IP serves many sites, which is why HTTP/1.1 made Host mandatory and TLS needed SNI.
•
A response either declares its length up front or terminates itself with chunked framing.
•
Connection reuse pays off; pipelining failed because one slow response blocks the rest.
•
One response at a time per connection is why browsers opened six connections per origin.
•
One connection carrying interleaved streams, each with its own flow-control window.
•
Header table compression, and QPACK's redesign for QUIC's out-of-order delivery.
•
HTTP/2 removes application-level head-of-line blocking but a single TCP loss still stalls every stream.
•
HTTP/3 is the same semantics over QUIC, advertised by Alt-Svc or an HTTPS record.
•
Range and 206 Partial Content are what make resumable downloads and media seeking possible.
•
The browser asks with OPTIONS and the server's response headers, not the browser, decide what is allowed.
•
Domain and path define scope; Secure, HttpOnly and SameSite define exposure.

N. HTTP caching

•
Max-age or Expires decides how long a stored response is served without contacting the origin.
•
No-cache means revalidate before reuse; no-store means never write it down at all.
•
Whether a shared cache, as opposed to only the browser, may keep the response.
•
If-None-Match lets the origin answer 304 with no body when nothing changed.
•
One-second granularity, and the difference between byte-identical and semantically equivalent.
•
A cache keyed without Vary will hand a compressed or wrong-language variant to the next client.
•
Deliberately serving a stale copy while refreshing in the background hides origin latency.
•
Immutable content-hashed asset URLs beat short TTLs because the URL changes when the bytes do.

O. TLS 1.3 and the web PKI

•
Confidentiality, integrity and server authentication; it never provides authorization or availability.
•
TLS 1.3 completes in one round trip because the client guesses a key share in its first message.
•
A wrong group guess costs an extra round trip rather than failing the handshake.
•
1.3 removed RSA key transport, static Diffie-Hellman, RC4, CBC modes and compression outright.
•
Ephemeral keys mean stealing the server's private key later cannot decrypt captured traffic.
•
Leaf, intermediates and root, and the fact that the server must send the intermediates itself.
•
The client trusts roots it already holds; a root offered by the server is meaningless.
•
The subjectAltName, not the legacy common name, must match the name the client requested.
•
SNI reveals the hostname in cleartext, and Encrypted Client Hello hides it using a key published in DNS.
•
The application protocol is agreed inside the handshake, which is how h2 and h3 are selected without an extra round trip.
•
Pre-shared-key tickets skip the full handshake, and 0-RTT early data trades replay safety for latency.
•
CRLs and OCSP scale badly, stapling helps, and short-lived certificates largely replaced the problem.
•
Public append-only logs make a misissued certificate discoverable after the fact.
•
Automated domain validation and renewal is what makes 90-day certificate lifetimes practical.

P. Wireless and access networks

•
Wi-Fi avoids collisions rather than detecting them, because a radio cannot listen while it transmits.
•
Everyone on a channel shares airtime, so advertised throughput is per-channel, not per-client.
•
2.4 GHz reaches further with three clean channels; 5 and 6 GHz trade range for capacity.
•
A wider channel raises peak throughput and reduces how many non-overlapping channels exist.
•
Two clients that hear the access point but not each other collide, which RTS/CTS exists to prevent.
•
IEEE 802.11n added MIMO, ac beamforming, ax/Wi-Fi 6 OFDMA, and be/Wi-Fi 7 multi-link operation.
•
A distant client transmitting at a low rate occupies airtime that every other client loses.
•
WPA3's SAE handshake removes the offline dictionary attack that WPA2's four-way handshake capture allowed.

Q. Load balancing, proxies and the edge

•
Forwarding a connection by tuple versus terminating it and routing on the request itself.
•
Without active probing a balancer distributes traffic evenly onto dead backends.
•
Sticky sessions keep a user on one backend and directly undermine even distribution and draining.
•
Where the private key lives determines whether the balancer can route on layer 7 at all.
•
X-Forwarded-For and the PROXY protocol recover the client address, and are trustworthy only from known proxies.
•
Resolver caching and client-side pinning make DNS a coarse, slow-reacting balancer.
•
The routing system picks the site, or the resolver's location does, with different failure modes.
•
What is included in the key decides the hit ratio, and an unstripped cookie can collapse it to zero.
•
Coalescing concurrent misses for the same object so the origin sees one request, not a stampede.
•
One acts for the client and is configured by it; the other acts for the server and is invisible.

R. Diagnostics, MTU and operations

•
Ping measures reachability and round-trip time, and a filtered echo is not evidence of an outage.
•
Incrementing the TTL and reading the time-exceeded message each hop returns.
•
You observe the forward path plus each hop's return path, so a mid-path anomaly may be the reverse direction.
•
Host, network, port and administratively-prohibited point at very different faults.
•
The DF bit plus ICMP fragmentation-needed messages find the smallest link on the path.
•
A firewall dropping ICMP makes small packets work and large transfers hang, which looks like an application bug.
•
Rewriting the advertised MSS on a tunnel endpoint is the standard workaround for a broken PMTUD path.
•
Every encapsulation header eats payload, pushing the usable size below the familiar 1500 bytes.
•
Querying a chosen resolver directly, and reading authority and additional sections rather than just the answer.
•
Capture filters, and what a retransmission, a zero window and a reset each look like on the wire.
•
Listening sockets, connection states, and a send or accept queue that never drains.
•
Adding bandwidth never reduces round-trip time, and which of the two dominates depends on transfer size.

S. Dual-stack connection establishment

•
Race IPv6 and IPv4 attempts with a short IPv6 head start so a broken address family does not impose its full timeout.

T. Multipath TCP

•
Expose one reliable byte stream to the application while several TCP subflows use different paths for resilience or aggregate capacity.

U. IPv6 segment routing

•
Encode the ordered segment identifiers in the IPv6 Segment Routing Header so each active segment steers the packet to the next waypoint.

V. SPF sender authorization

•
A domain authorizes which hosts may use it in SMTP identities; passing SPF authenticates that authorization, not the visible author.
•
SPF evaluates the SMTP MAIL FROM or HELO identity, so it does not by itself protect the human-visible From header.
•
Forwarding replaces the connecting host with one the original domain usually did not authorize, so an otherwise legitimate message can fail SPF.
•
Evaluation permits at most ten DNS-querying terms so a hostile or tangled policy cannot create unbounded resolver work.

W. DKIM message signatures

•
A signer claims responsibility by signing selected headers and body content, with the verifying public key retrieved from the signing domain.
•
A relay can change the transport path without breaking DKIM so long as it does not alter the signed content.
•
The selector names a particular DNS public-key record, allowing concurrent keys and controlled replacement of a compromised or aging key.

X. DMARC alignment, policy and reporting

•
SPF authorization, DKIM public keys and DMARC policy are discovered through domain-controlled DNS records.
•
An authenticated SPF or DKIM domain must align with the RFC 5322 From domain that the recipient actually sees.
•
DMARC passes when at least one of SPF or DKIM both passes and aligns; it does not require both mechanisms to pass.
•
None requests monitoring, quarantine requests suspicious handling, and reject requests refusal after authentication failure.
•
The sp tag can give subdomains a disposition policy different from the organizational domain's p policy.
•
Aggregate feedback groups authentication results by source so an owner can find legitimate senders and domain abuse before tightening policy.
•
A receiver evaluates SPF and DKIM, tests identifier alignment, and then consults the published disposition policy.
•
The combined mechanisms make unauthorized use of a trusted visible sender domain detectable; they are not a general spam verdict.
•
Sender-domain authentication and message integrity do not provide transport or end-to-end confidentiality.

Y. Network Time Protocol

•
Primary servers are stratum 1 and each downstream server has a number one greater; error generally grows with stratum and path delay.
•
A reference clock is the external time source conventionally described as stratum 0, while the NTP server directly attached to it operates at stratum 1.
•
fast-LAN clients can stay within hundreds of microseconds while long polls and public-network delay variation widen error into milliseconds.
•
The discipline loop corrects both time offset and oscillator-frequency error, slewing small corrections and stepping only beyond an implementation threshold.
•
NTP exchanges time over its IANA-assigned UDP port 123; transport retries would add delay rather than improve a measurement.
•
Client-send, server-receive, server-send and client-receive timestamps yield the round-trip delay and estimated clock offset.
•
Unequal forward and reverse delay biases the offset estimate because the four-timestamp calculation cannot tell where the round trip was spent.
•
Selection discards inconsistent candidates as falsetickers, then combines the surviving truechimers instead of trusting one upstream source.
•
Variable packet delay makes samples noisy, so the clock filter and system processes rank and combine measurements rather than accepting the latest one blindly.

Z. WebSocket

•
One persistent TCP connection carries independent client-to-server and server-to-client messages.
•
An HTTP Upgrade request and 101 Switching Protocols response establish the channel before WebSocket data transfer begins.
•
After the handshake, lightweight WebSocket frames carry text or binary messages instead of a fresh HTTP request and response for each message.
•
The persistent two-way channel avoids the repeated HTTP exchanges that polling-based interactive applications require.

AA. Long polling and server-push HTTP

•
The server holds a request until an event or timeout, returns a complete response, and the client immediately opens the next request.
•
Server-Sent Events carry text event-stream data from a server to a web client over an HTTP streaming response.

AB. HTTP/3 endpoint fallback

•
When UDP is blocked and a QUIC connection cannot be established, a client falls back to a TCP-based HTTP version.

AC. QUIC loss recovery and congestion control

•
QUIC exposes generic congestion signals, and a sender can unilaterally select a conforming algorithm such as CUBIC instead of the specified NewReno-like controller.

AD. BGP path attributes and sessions

•
Higher LOCAL_PREF is preferred inside an AS and expresses the operator's policy before later path comparisons.
•
A neighboring AS uses the lower MED as a hint for which of several entry or exit points to prefer.
•
iBGP connects peers in the same autonomous system, while eBGP connects peers in different autonomous systems.
•
An external advertisement prepends the local ASN, and configuration may deliberately include it more than once to lengthen that path.

AE. BGP communities

•
A route carries group labels that peers can use to accept, prefer or distribute it according to local policy.

AF. BGP prefix filtering

•
Inbound and outbound allowlists constrain a peer or customer to expected prefixes and reject invalid announcements.

AG. RPKI origin validation

•
Signed route-origin data lets a router check whether an ASN is authorized to originate a prefix.
•
Origin validation classifies a route as Valid, Invalid or NotFound before local policy decides how to treat it.
•
Announcing a prefix from an unauthorized origin can divert traffic, and RPKI origin validation exposes that mismatch.

AH. BGP route leaks

•
A learned route is propagated beyond the scope allowed by the participants' import, export or business-relationship policies.

AI. Autonomous-system identity

•
A globally unique ASN identifies a group of prefixes presented to other networks under one clear routing policy.

AJ. Longest-prefix forwarding

•
Among matching routes, forwarding selects the route with the most destination-prefix bits, so a more-specific announcement wins over an aggregate.
Keentune is not affiliated with or endorsed by the organizations whose documentation informs these maps.
Start practicing Networking
All about Networking practice
Browse all free study guides
Also on your phone
App StoreGoogle Play
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.
© 2026 SportaApp LLC