Network Cheatsheet

[ 01 ]// what a network actually is

A network is just devices connected so they can exchange data. Each device (a host) splits its data into small packets and hands them off to be relayed, hop by hop, until they reach the destination — like posting thousands of tiny numbered postcards that get reassembled at the other end.

Switch

Connects devices within one local network (a LAN) and forwards frames by MAC address. Think: the wiring inside your house.

Router

Connects different networks together and decides where packets go next by IP address. Your home router joins your LAN to the internet (a WAN).

Packet

A small chunk of data wrapped in headers (who it's from, who it's for, what kind). Big transfers are thousands of packets, reassembled in order.

Protocol

An agreed set of rules so two machines understand each other — HTTP, TCP, IP, DNS. The OSI model (below) stacks them into layers.

The OSI and TCP/IP models below are maps of these layers — each layer only worries about its own job and hands the rest down. A web request rides Application → Transport → Internet → Link on the way out, and back up the stack on the way in.

[ 02 ]// IP & MAC addresses

Every device needs identities at two levels. A MAC address is burned into the network card (e.g. 02:42:0a:00:00:05) and identifies it on the local link. An IP address is assigned by the network and is used to route between networks. ARP is the protocol that maps "I know the IP, what's the MAC?" on a LAN.

Type	Example	Range / note
IPv4	192.168.1.50	32 bits, ~4.3 billion addresses — now exhausted
IPv6	2001:db8::7334	128 bits, effectively unlimited
Private (LAN)	10.x · 172.16–31.x · 192.168.x	Not routable on the internet; reused everywhere behind NAT
Loopback	127.0.0.1	"localhost" — this machine
MAC	02:42:0a:00:00:05	48 bits; first half identifies the vendor (OUI)

[ 03 ]// the journey of a packet

What happens when you type https://example.com and hit enter:

DNS lookup — your machine asks a DNS resolver to turn example.com into an IP address (see DNS below).
Routing decision — is the IP on my LAN or elsewhere? If elsewhere, send it to the default gateway (your router).
ARP — to hand the packet to the router, your machine needs the router's MAC; ARP resolves it.
Hop by hop — each router along the path reads the destination IP and forwards toward it, decrementing the packet's TTL.
Ports & TCP — the packet arrives at the server's IP on port 443; a TCP connection + TLS handshake set up the secure channel.
Reassembly — packets arrive (maybe out of order), TCP reorders them, and the browser renders the page.

traceroute / tracert shows you these hops live; ping uses ICMP to test if a host is reachable and how long the round-trip takes.

[ 04 ]// TCP vs UDP & the 3-way handshake

TCP — reliable

Connection-oriented. Guarantees every byte arrives, in order, with retransmission. Used for web, email, file transfer, SSH. Slower setup, rock-solid delivery.

UDP — fast

Connectionless. Fire-and-forget, no guarantees, no handshake. Used for DNS, video calls, games, streaming — where speed beats perfection.

Before TCP sends data it sets up a connection with a 3-way handshake. Watch it:

Client

Server

SYN →Client → Server. "I want to talk, my sequence number is x."

← SYN/ACKServer → Client. "OK, I acknowledge x; my sequence number is y."

ACK →Client → Server. "Acknowledged y. Connection established." Data flows.

A SYN flood attack abuses this: the attacker sends thousands of SYNs but never the final ACK, leaving half-open connections that exhaust the server — a classic DoS.

[ 05 ]// subnetting, explained

An IP address has two parts: the network (which network you're on) and the host (which device). The subnet mask / CIDR prefix draws the line between them.

A /24 means the first 24 bits are the network, leaving 8 bits for hosts → 2⁸ = 256 addresses, minus the network address and broadcast address = 254 usable hosts. Smaller prefixes = bigger networks; larger prefixes = smaller. The network address is the first (all host-bits 0); the broadcast is the last (all host-bits 1) and reaches every host at once.

Why split networks? Security (isolate departments), performance (smaller broadcast domains), and tidy address management.
Usable hosts = 2^(host bits) − 2 (network + broadcast). A /30 gives just 2 — perfect for a router-to-router link.
Try it: the calculator below turns any IP + CIDR into network, broadcast, range and mask.

[ 06 ]// the services that glue it together

DNS — the phonebook

Translates human names (example.com) into IP addresses. Hierarchical: root → .com → example.com. Poisoning or spoofing it sends victims to attacker servers.

DHCP — auto-config

When you join a network, DHCP hands your device an IP, subnet mask, gateway and DNS server automatically. A rogue DHCP server can hijack clients.

NAT — sharing one IP

Your router rewrites private LAN addresses to its one public IP and back. It's why dozens of home devices share a single internet address (and gives a little inbound protection).

[ 07 ]// how networks get attacked

Attack	What it does	Defense
Sniffing	Reading traffic on the wire (easy on open Wi-Fi / hubs)	Encryption (TLS, VPN)
ARP spoofing / MITM	Faking ARP replies to sit between victim and gateway	Dynamic ARP inspection, static ARP, encryption
DNS spoofing	Forging DNS answers to redirect victims	DNSSEC, DoH/DoT
Port scanning	Probing which ports/services are open (recon)	Firewalls, rate-limiting, IDS
(D)DoS	Flooding a target so it can't serve real users	Filtering, rate limits, scrubbing services

See these in motion: read a real capture in the Networking Lab, and scan ports safely against your own VM lab.

[ 08 ]// the tools pros actually use

A small kit covers most networking work. Learn these and you can see, map and test almost any network:

Wireshark

The packet analyzer — capture and dissect every frame on the wire. Must-know. CLI sibling: tshark.

nmap

The network scanner — host discovery, port scanning, service & OS detection. Must-know. GUI: Zenmap.

tcpdump

Lightweight CLI packet capture — perfect on servers with no GUI.

netcat (nc)

The "TCP/IP swiss-army knife" — manual connections, listeners, quick transfers and banner grabbing.

dig / nslookup

Query DNS by hand — resolve names, inspect records, debug resolution.

ping · traceroute · iperf3

Test reachability & latency, map the hops to a host, and measure real throughput.

Start with two: Wireshark to see traffic and nmap to map a network. Practice both safely against your own VM lab.

[ 09 ]// interactive reference

Now the hands-on part — a live subnet calculator, the OSI/TCP-IP models, a searchable port table and a CIDR chart.

Networking.

Switch

Router

Packet

Protocol

TCP — reliable

UDP — fast

DNS — the phonebook

DHCP — auto-config

NAT — sharing one IP

Wireshark

nmap

tcpdump

netcat (nc)

dig / nslookup

ping · traceroute · iperf3