Day objective — design an IP addressing plan with VLSM, understand longest-prefix-match forwarding, and bring up single-area OSPF across a 3-router network. Pick a sub-topic on the left — it opens here as its own panel.
TCP/IP Model & Encapsulation
The four-layer TCP/IP model is the operating map of every network you will touch this week. Each layer hands a PDU to the one below, which wraps it in its own header — encapsulation — until bits hit the wire.
Why this matters in three hours — every OSPF Hello you capture in today's lab is a live instance of this diagram: an OSPF message riding directly inside an IP header (source = your VLSM plan), wrapped in an Ethernet frame to 01:00:5e:00:00:05 (the L2 multicast MAC for 224.0.0.5). If you can't read this stack, you can't read the Wireshark capture in Lab 1 step 8.
FCS → EtherType → Protocol → port. OSPF reveals the "no transport" path.| Layer | PDU name | Header added (min) | Demux key the receiver reads | In today's OSPF capture |
|---|---|---|---|---|
| Application | data | app-defined | — | OSPF Hello / DBD / LSU message |
| Transport | segment (TCP) · datagram (UDP) | 20 B TCP · 8 B UDP | Destination port | skipped entirely — OSPF uses no transport layer |
| Internet | packet | 20 B IPv4 (no options) | Protocol field: 6=TCP · 17=UDP · 89=OSPF · 1=ICMP | Protocol 89, dst 224.0.0.5, TTL 1 |
| Network Access | frame | 14 B header + 4 B FCS trailer | EtherType: 0x0800=IPv4 · 0x86DD=IPv6 · 0x8100=802.1Q tag | dst MAC 01:00:5e:00:00:05 |
| Wire | bits | 8 B preamble+SFD, 12 B IFG (never captured) | — | invisible to Wireshark |
Ethernet II costs 14 B of header (6 dst MAC + 6 src MAC + 2 EtherType) plus a 4 B FCS trailer — 18 B of frame overhead total, but never call it an "18 B header". Stack it up:
Zero application bytes anywhere in that bar — 84 B of pure protocol machinery. PRE/IFG never appear in Wireshark; PAD exists because the minimum Ethernet payload is 46 B.
Same math drives throughput engineering: on a 1500 B MTU, MSS = 1500 − 40 = 1460 B, so max TCP efficiency = 1460 ÷ 1538 wire-bytes ≈ 94.9% — before a single retransmission. Every "why is my iperf below line rate?" ticket starts here.
Footnote for the "IP addresses stay constant" rule: that holds for unicast forwarding without NAT — true everywhere inside your Lab 1 OSPF domain, not guaranteed once traffic crosses an Internet edge.
ospf. Skipping TCP means OSPF must supply its own reliability: DBD sequence numbers, LSR retransmission and explicit LSAck packets replace TCP's ACK machinery. Compare: RIP=UDP 520, BGP=TCP 179, OSPF=neither.- Layered model vs OSI — TCP/IP collapses OSI 5–7 into Application and OSI 1–2 into Network Access; the middle layers map one-to-one
- Encapsulation — each layer adds its own header (Ethernet also appends the FCS trailer); the receiver strips them in reverse (de-encapsulation), demuxing on EtherType → Protocol → port
- PDU names — data →
segment/datagram→packet→frame→ bits (the #1 interview micro-question) - Header cost — 20 B IP + 20 B TCP + 14 B Eth header + 4 B FCS = 58 B before one byte of data; 46 B minimum payload padding and 20 B of preamble/IFG raise the true wire cost
- Not everything uses transport — OSPF (proto 89) and ICMP (proto 1) live directly on IP; port-based thinking fails for both
Layer 2 vs Layer 3
Switching moves frames inside a broadcast domain using MAC addresses; routing moves packets between networks using IP. ARP and the default gateway are the glue where the two meet.
Destination on another subnet?
Host A ANDs its own mask with the destination IP: 172.16.40.7 ∉ 10.0.1.0/24 → send to default gateway, not directly.
ARP request (broadcast)
Who has 10.0.1.1? Tell 10.0.1.11 — an L2 broadcast to ff:ff:ff:ff:ff:ff; every host in the domain receives it.
ARP reply (unicast)
The router answers with its MAC. Host A caches it (ARP table) and now frames to the gateway MAC carry packets to the remote IP.
Router rewrites, IP survives
At each hop the Ethernet header is replaced and TTL decrements — but source/destination IP stay constant end-to-end. That asymmetry is the essence of L2 vs L3. (Assumes no NAT hop — always true inside your Lab 1 OSPF domain.)
| Property | Layer 2 — switching | Layer 3 — routing |
|---|---|---|
| Address | MAC 48-bit, flat, burned-in | IP 32/128-bit, hierarchical, assigned |
| Forwarding table | MAC table (learned by source) | Routing table (connected · static · dynamic) |
| Lookup rule | Exact match on destination MAC | Longest-prefix match on destination IP |
| Unknown destination | Flood out all ports | Drop (unless default route exists) |
| Scope | One broadcast domain / VLAN | Between networks, global |
| Loop control | STP (or fabric tech) | TTL + routing-protocol logic |
| MEF service analog | E-Line · E-LAN · E-Tree (Day 3) | IP-VPN / L3 services · SD-WAN (Days 3–4) |
| VLAN | MAC address | Port |
|---|---|---|
| 10 | aa:bb:cc:00:00:11 · Host A | Gi0/1 |
| 10 | aa:bb:cc:00:00:12 · Host B | Gi0/2 |
| 10 | 11:22:33:00:00:01 · Gateway | Gi0/24 |
| Prefix | Next-hop | Iface | Proto |
|---|---|---|---|
| 0.0.0.0/0 | 203.0.113.1 | Gi0/0 | Static |
| 10.0.1.0/24 | — | Vlan10 | Connected |
| 172.16.0.0/16 | 10.0.2.2 | Gi0/1 | OSPF |
| 172.16.40.0/24 | 10.0.2.6 | Gi0/2 | OSPF |
| 172.16.40.0/28 | 10.0.2.10 | Gi0/3 | OSPF |
- MAC addressing & switching — switches learn source MACs per port and forward on exact destination match▶ replay the full animation ↑
- IP addressing & routing — routers strip L2, look up the destination IP, re-encapsulate on the egress link▶ replay the full animation ↑
- ARP — resolves next-hop IP → MAC inside a subnet; gratuitous ARP announces changes▶ replay the full animation ↑
- Default gateway — the router a host uses for every off-subnet destination▶ replay the full animation ↑
IPv4 Addressing, Subnetting & VLSM
An IPv4 address is 32 bits split by the mask into network and host. CIDR made the split arbitrary; VLSM lets each subnet take exactly the size it needs — the skill Lab 1 grades you on.
Pink = network bits, grey = host bits. Slide toward /32 and the host space collapses to a single address; slide toward /8 and one network swallows 16 million hosts.
| Class | First octet | Default mask | Note |
|---|---|---|---|
A | 1–126 | /8 | 127/8 = loopback |
B | 128–191 | /16 | |
C | 192–223 | /24 | |
D | 224–239 | — | multicast (OSPF uses 224.0.0.5/6) |
E | 240–255 | — | experimental |
| Block | Range | Size |
|---|---|---|
10.0.0.0/8 | 10.0.0.0 – 10.255.255.255 | 16,777,216 |
172.16.0.0/12 | 172.16.0.0 – 172.31.255.255 | 1,048,576 |
192.168.0.0/16 | 192.168.0.0 – 192.168.255.255 | 65,536 |
| Private space never routes on the public Internet — NAT translates at the edge. Public = everything else, allocated via RIRs. | ||
192.168.10.0/24
Each borrowed bit doubles the number of subnets and halves the hosts in each — the exact trade-off you balance when you design a plan. VLSM (below) just applies a different prefix to each branch instead of one uniform split.
Two /30 point-to-point links (HQ↔B1, HQ↔B2) are added automatically — exactly the Lab 1 topology. Allocation is largest-first so every subnet lands on its natural boundary.
- CIDR notation — RFC 4632 killed classes:
/26means "26 network bits", routing aggregates on any boundary - Subnetting a block — borrowing host bits doubles subnets and halves hosts per subnet each time
- VLSM — different masks inside one block; allocate largest requirement first to avoid overlap
- Efficient plan design — reserve growth headroom, keep p2p links in /30 (or /31, RFC 3021), summarize per site
IPv6 Essentials
128-bit addresses written as eight hextets, a fixed /64 host boundary in practice, and no broadcast at all — IPv6 is not "IPv4 with more digits", it changes the neighbor-discovery and planning model.
| Prefix | Type | Scope / use |
|---|---|---|
2000::/3 | Global Unicast (GUA) | Internet-routable — the IPv6 "public" space |
fe80::/10 | Link-Local | Auto-configured on every interface; next-hops and OSPFv3/ND run over it; never routed |
fc00::/7 | Unique Local (ULA) | Private-like space (in practice fd00::/8) |
ff00::/8 | Multicast | Replaces broadcast entirely (e.g. ff02::1 all-nodes, ff02::5 OSPFv3) |
::1/128 | Loopback | Same role as 127.0.0.1 |
- Address format — 8 × 16-bit hextets, hex,
::compression once per address - Prefix lengths — sites get /48s, LANs are /64s, p2p links commonly /127 (RFC 6164)
- Link-local vs Global Unicast — every interface always has an fe80:: address; GUAs come from RA/SLAAC, DHCPv6, or static
- Migration rationale — IPv4 exhaustion (RIR pools empty), NAT complexity/cost, end-to-end addressing for IoT/5G scale; dual-stack is the dominant transition strategy
Transport & WAN Context
TCP and UDP decide how traffic behaves end-to-end — which is exactly what SD-WAN application policies (Day 4) match on. Ports + IPs form the socket 5-tuple that classifies every flow.
| Property | TCP | UDP |
|---|---|---|
| Connection | 3-way handshake (SYN → SYN/ACK → ACK) | None — fire and forget |
| Reliability | Sequencing, ACKs, retransmission | None (application's job) |
| Ordering | Guaranteed in-order delivery | No ordering |
| Flow / congestion control | Sliding window · AIMD congestion control | None — constant rate possible |
| Header | 20 B minimum | 8 B fixed |
| Typical traffic | Web/API (HTTP), file transfer, email | Voice/video (RTP), DNS, QUIC underlay |
| SD-WAN policy meaning | Throughput-sensitive → prefer high-CIR path | Latency/jitter-sensitive → prefer low-delay path |
Well-known ports (0–1023) identify services: 80/443 HTTP/HTTPS, 53 DNS, 22 SSH, 179 BGP. Registered (1024–49151) and ephemeral (49152–65535) complete the space. Everything from firewall rules to MEF 70.1 application flows is ultimately a predicate over this 5-tuple (plus, in SD-WAN, application identity).
- TCP vs UDP — reliability vs immediacy; know the handshake and why voice never uses TCP
- Ports and sockets — the 5-tuple uniquely names a conversation; NAT rewrites parts of it
- WANs — sites interconnected over provider services: leased line → MPLS VPN → Carrier Ethernet → broadband/LTE/5G underlays
- Next Generation Networks — the shift this course tracks: hardware-defined, manually-provisioned WANs → software-driven, API-ordered NaaS (Days 2–4)
How Routing Works
A router is a database machine: the RIB holds every candidate route, administrative distance arbitrates between sources, metric arbitrates within a source, and longest-prefix match arbitrates at forwarding time.
The FIB below is a typical enterprise table. The most-specific (longest) matching prefix always wins — regardless of the order the routes were learned, their protocol, or their metric.
| Route source | AD | Trust logic |
|---|---|---|
| Connected | 0 | It's my own interface |
| Static | 1 | An engineer said so |
| eBGP | 20 | External policy routing |
| OSPF | 110 | Link-state, full topology view |
| IS-IS | 115 | Link-state (carrier IGP) |
| RIP | 120 | Legacy distance-vector |
| iBGP | 200 | Internal BGP, least preferred |
Which routes match? (LPM)
All prefixes containing the destination — the longest one is used for forwarding.
Same prefix from two protocols?
Lower AD wins the RIB slot (static /24 beats OSPF /24).
Same prefix, same protocol?
Lower metric wins; equal metrics → ECMP load-sharing.
- Routing tables — RIB (all candidates) vs FIB (winners, programmed into forwarding)
- Longest-prefix match — /26 beats /24 beats /8 beats /0, always
- Connected vs learned routes — connected appear when an interface gets an IP + comes up; learned arrive via static config or protocols
- AD and metrics — AD compares protocols, metric compares paths within one protocol
Static & Dynamic Routing
Static routes are deterministic and silent; dynamic protocols discover, converge and heal. Real networks blend both — statics at the edge, an IGP in the core, BGP between domains.
| Use case | Static ✓ | Why / limit |
|---|---|---|
| Stub site with one uplink | ideal | One default route; nothing to converge |
| Deterministic security path | ideal | No protocol chatter to attack or leak |
| Provider handoff (L3 UNI) | common | Static or BGP at the MEF IP UNI (Day 3/4) |
| Meshed multi-site core | breaks | n(n−1)/2 links × manual routes = unmaintainable; no failover |
| Any topology that changes | breaks | Static routes don't know the link died |
| Protocol | Family | Algorithm | Metric | Where it lives |
|---|---|---|---|---|
RIP | Distance-vector | Bellman-Ford — "routing by rumor" | Hop count (max 15) | Legacy / tiny networks |
OSPF | Link-state | Dijkstra SPF on a shared map (LSDB) | Cost (bandwidth-derived) | Enterprise IGP — this course |
IS-IS | Link-state | Dijkstra SPF (CLNS heritage) | Configured metric | Carrier / ISP cores |
BGP | Path-vector | Policy over AS-path | Attributes (LOCAL_PREF, AS-path…) | Between providers — the MEF inter-provider context |
- Static routes — explicit next-hop or exit interface; AD 1; floating statics as backup with raised AD▶ see the convergence race ↑
-
Default routes —
0.0.0.0/0, the shortest possible prefix: matches everything, loses to everything more specific▶ replay a routing demo ↑ - Distance-vector vs link-state — neighbors' conclusions vs a full shared topology map▶ watch both mechanisms ↑
- RIP, OSPF, IS-IS, BGP overview — know each family's algorithm, metric and habitat for the exam▶ open the family explorer ↑
OSPF Deep-Dive
OSPFv2 (RFC 2328) floods link-state advertisements so every router computes shortest paths on an identical map. You will watch every step of this happen in Wireshark during Lab 1.
Down → Init
Hellos to 224.0.0.5 (IP protocol 89) every 10 s on broadcast media; dead interval 40 s. A router that sees a Hello enters Init.
2-Way — and DR/BDR election
Both routers see themselves in each other's Hello. On a LAN the highest priority (tie-break: highest router-ID) becomes DR; the DR pairs with everyone, others stay 2-Way with each other. Hello fields must match: area, timers, subnet, authentication.
ExStart → Exchange
Master/slave negotiation, then Database Description packets summarize each LSDB.
Loading → Full
Missing LSAs requested (LSR) and flooded (LSU, acknowledged by LSAck). At Full, both LSDBs are identical — adjacency complete.
SPF run
Every router runs Dijkstra over the LSDB, taking itself as root → shortest-path tree → routes installed with AD 110.
| LSA | Name | Scope |
|---|---|---|
1 | Router LSA | Every router, intra-area |
2 | Network LSA | From the DR, intra-area |
3 | Summary LSA | ABR advertises inter-area prefixes |
4 | ASBR-Summary | Where the ASBR is |
5 | AS-External | Redistributed (e.g. default) routes |
7 | NSSA-External | LSA-5 stand-in inside an NSSA |
- Areas — area 0 is the backbone; ABRs summarize between areas; this course deploys single-area (area 0)▶ open the LSA explorer ↑
- Neighbors and adjacencies — Hello matching rules, DR/BDR on LANs, the 7-state FSM to Full▶ run the DR/BDR election ↑
- LSAs and SPF — typed advertisements build the LSDB; Dijkstra computes the tree; partial/incremental SPF limits churn▶ open the LSA explorer ↑
- Single-area deployment — router-id, network statements, passive interfaces on LANs, consistent reference bandwidth▶ tune the cost engine ↑
auto-cost reference-bandwidth (identically on every router) before trusting any path decision. Verify in the calculator above.Routing into MEF Services & Troubleshooting
In a Layer 3 connectivity service the provider's network is your WAN router. Where your routes meet theirs — and how you prove reachability when they don't — closes Day 1.
| Tool | Mechanism | Proves | Silent failure mode |
|---|---|---|---|
ping | ICMP Echo Request/Reply | Bidirectional L3 reachability + RTT | ICMP filtered ≠ host down |
traceroute | TTL 1,2,3… → ICMP Time-Exceeded per hop (UDP high ports on Linux, ICMP on Windows) | The forward path, hop by hop | Asymmetric return path stays invisible; * * * may be rate-limiting |
show ip route / ip route get | RIB/FIB query | What the router will actually do with a destination | A route can exist while the return route doesn't — always check both ends |
- IP routing in L3 connectivity services — the provider participates in routing; you exchange routes (static or BGP) at the IP UNI
- Inter-provider handover — off-net sites reached through a partner provider across an ENNI; automated ordering is LSO Sonata's job
- Ping / traceroute — know the ICMP mechanics, not just the commands
- Routing-table inspection — most "network down" tickets are a missing return route
Lab 1 · Subnet an Addressing Plan and Route a Multi-Router Network
Goal — design an IP addressing plan and build Layer 3 reachability across an emulated multi-router topology. Everything from panels 1.1–1.9 gets exercised here.
Lab activities
⚗- 1Build the 3-router topology in GNS3 / Containerlab with FRRouting nodes
- 2Design & apply the VLSM plan for HQ, Branch 1, Branch 2 (use the designer in panel 1.3 — 100/50/20 hosts from 192.168.10.0/24)
- 3Configure static routes (HQ→branch LANs, branch defaults→HQ)
- 4Verify connectivity with ping and traceroute from every LAN
- 5Replace statics with single-area OSPF (router-ids, network statements, area 0)
- 6Observe adjacency formation — watch the FSM reach Full/DR
- 7Verify route population:
show ip route ospf, note [110/metric] - 8Capture & inspect OSPF Hello and LSA exchanges in Wireshark (filter:
ospf) — identify Hello timers, DBD, LSU/LSAck
show ip ospf neighbor shows Full on both p2p links; your capture contains at least one full DBD exchange; removing a static route changes nothing (OSPF owns the paths now).