📡 Networking Midterm — Intensive Study Guide (33 Question Type Variants)

The switch always learns from the SOURCE address. Since it has no entry for Host C yet, it must fail-open by flooding.

The switch has a valid table entry for Host A and can make a targeted forwarding decision, preserving bandwidth on all other segments.

Switches always learn from the SOURCE MAC field of frames they receive. The destination is looked up for forwarding, not for learning.

If a laptop moves from Port 1 to Port 5, the old Port 1 entry must expire so the switch can relearn the new location. Otherwise, frames would be black-holed to the dead port.

After events i–iii, all three hosts are in the table. Events iv–v can both be selectively forwarded with zero flooding.

Signal attenuation over copper degrades beyond 100m. For 2 miles, single-mode fiber optic cable is required — it uses light pulses immune to electrical attenuation limits.

In classic Ethernet, total propagation delay across too many repeaters causes late collisions. A single collision domain cannot exceed a defined physical diameter.

A Hub is Layer 1 — it electrically repeats signals everywhere (1 collision domain). A Switch is Layer 2 — it buffers frames per port, creating isolated collision domains. With full-duplex, collisions are eliminated entirely.

This is a fundamental constant. Beyond 100m, signal integrity cannot be guaranteed for reliable collision detection or data recovery.

This hierarchy is fundamental: each higher-layer device adds more isolation and intelligence.

Store-and-Forward buffers the entire frame into memory, then checks the Frame Check Sequence (FCS/CRC) at the end. If the CRC fails, the frame is silently dropped.

Cut-Through starts forwarding after reading only the first 6 bytes (Destination MAC), without waiting for the full payload. This shaves microseconds critical to financial trading.

Fragment-Free buffers exactly 64 bytes (the minimum legal Ethernet frame size). Any frame shorter than 64 bytes is assumed to be a collision fragment and is dropped.

Cut-Through reads 6 bytes, Fragment-Free reads 64 bytes, Store-and-Forward reads the entire frame. More buffering = more delay.

Cut-Through starts forwarding before the CRC at the end of the frame has even arrived. It cannot detect corruption, which is the fundamental trade-off for its speed advantage.

Like water through a pipe, end-to-end throughput is limited by the narrowest section. The 100 Mbps link constrains the entire flow.

Processing = inspecting headers. Queuing = waiting in buffers. Transmission = pushing bits onto the wire (depends on bandwidth + packet size). Propagation = signal travel time (depends on distance + speed of light).

Transmission Delay = Packet Size / Link Bandwidth = 1000 bits / 10,000,000 bits/sec = 0.0001 seconds = 100 μs.

Transmission depends on packet size and link speed. Propagation depends on physical distance and the speed of light/electricity in the medium. Doubling the link speed halves transmission delay but has zero effect on propagation delay.

Propagation delay depends only on physical distance and the speed of light in the medium. A faster link reduces transmission delay, not propagation delay.

TCP/IP treats encryption (Presentation) and connection management (Session) as the responsibility of the application itself, rather than separate protocol layers.

The Network Access layer in TCP/IP covers both the Physical and Data Link functions of the OSI model.

Each layer wraps the previous PDU with its own header: Transport adds ports (Segment), Network adds IPs (Packet), Data Link adds MACs (Frame).

This encapsulation process wraps higher-layer data inside lower-layer envelopes. The receiver reverses the process (de-encapsulation) layer by layer.

OSI is the theoretical reference model (7 layers). TCP/IP is the practical implementation (4 layers) that actually runs the internet. OSI has more layers because it over-specifies boundaries that real protocols don't separate.

DNS needs fast, single-packet query-response exchanges. TCP Port 53 is reserved for bulk zone transfers between DNS servers.

Memorize these port numbers — they appear frequently on networking exams.

SMTP initiates transmission proactively. IMAP waits for the client to request messages. POP3 (Port 110) is a simpler pull protocol that downloads-and-deletes.

A persistent connection allows pipelining multiple requests over a single TCP socket, dramatically reducing page load time.

Standard DNS queries use UDP for speed and simplicity. The response typically fits in a single packet. TCP is used only for zone transfers or oversized responses.

Before transmitting, a host checks the electrical voltage on the wire. If another signal is detected, it defers. If quiet, it attempts to transmit.

The JAM amplifies the collision to ensure every device on the segment recognizes that a collision occurred and discards the corrupted fragments.

After collision n, the host picks a random number from [0, 2^n − 1]. For n=1: [0,1]. n=2: [0,3]. n=3: [0,7]. n=4: [0,15]. This Binary Exponential Backoff progressively spreads out retransmission attempts.

If a frame is shorter than 64 bytes, the sender could finish transmitting before the collision signal propagates back from the far end of the network. This is why Ethernet pads small payloads.

Full-duplex links use separate transmit and receive wire pairs, making simultaneous bidirectional communication collision-free. CSMA/CD is disabled entirely.

EtherType 0x0800 = IPv4. 0x0806 = ARP. 0x86DD = IPv6. This field acts as the Layer 2 demultiplexer.

The Preamble is 7 bytes of alternating 1-0 patterns. The Start Frame Delimiter (SFD) is 1 byte ending in '11', signaling that the next bit is the start of the actual frame.

This two-part structure (OUI + device ID) guarantees globally unique addresses. Example: AA:BB:CC:11:22:33 where AA:BB:CC identifies the manufacturer.

The 64-byte minimum ensures collision detection works. The 1518-byte maximum was chosen to limit the time any single station can monopolize the shared medium.

The FCS is a 4-byte CRC located in the TRAILER, after the payload. It must come last because it is a checksum calculated over the entire header + payload.

STP always elects the switch with the smallest Bridge ID as the root. Lower ID = higher priority. All other switches calculate their shortest path back to this root.

BPDUs are sent to multicast address 01:80:c2:00:00:00. They are processed by switches only, never forwarded to end devices. Switches use BPDUs to converge on a loop-free topology.

STP tie-breaking order: (1) shortest path cost, (2) lowest neighbor switch ID, (3) lowest port number. Since costs are equal, the lower switch ID wins.

The root port faces 'upward' toward the root. Designated ports face 'downward' providing service to other switches or hosts. Any port not selected by these rules is BLOCKED.

If the network partitions, each disconnected piece independently elects its own root and builds its own separate spanning tree. There is no communication between the two halves.

Each VLAN creates its own isolated broadcast domain. A broadcast from a host in VLAN 10 is only seen by other hosts in VLAN 10. Traffic between VLANs requires a router.

VLANs provide logical isolation without requiring separate physical switches. HR broadcast traffic never reaches Engineering ports, and vice versa.

VLANs are separate broadcast domains. Just like hosts on different physical LANs, inter-VLAN communication requires routing — a Layer 3 function.

VLANs do NOT eliminate IP addresses (D is wrong). They increase the count of broadcast domains while reducing the size of each, group users logically, and provide security isolation.

VLAN port assignments are purely software-configured and can be changed dynamically. This is one of the key advantages — flexibility without physical rewiring.

SDN's core innovation is centralizing the control plane in a software controller ('the brain'). Switches in the infrastructure layer simply execute the forwarding rules they receive.

This three-layer separation is what gives SDN its flexibility. Applications can dynamically change network behavior through the controller API.

The multi-table approach is more efficient than single-table because it separates destination lookup (T0) from source learning (T1). Once rules are installed, subsequent packets are handled entirely by the switch without involving the controller.

OpenFlow provides the 'secure channel' through which the controller installs, modifies, and deletes flow table entries on switches.

SDN still requires physical switches (C is wrong). The switches just become simpler 'dumb' forwarders while the intelligence is centralized in software.

Max Rate = 1 MHz × log₂(1 + 63) = 1 MHz × log₂(64) = 1 MHz × 6 = 6 Mbps. The Shannon-Hartley theorem sets the absolute upper bound on error-free communication.

log₂(1+127) = log₂(128) = 7. The logarithmic relationship means doubling SNR yields diminishing returns — just +1 Mbps in this case. Increasing channel width is more effective.

In wired Ethernet, voltage levels are comparable and collisions are easily detected. In wireless, the transmitter's own signal is millions of times stronger than any remote signal, making detection impossible.

This is the Hidden Node Problem. It is solved by the RTS/CTS protocol: A sends RTS to B, B replies CTS heard by everyone in range (including C), and C defers.

FM stations are spaced 200 kHz apart in the frequency spectrum. This is why adjacent stations don't interfere with each other.

Since wireless radios cannot detect collisions in progress, Wi-Fi uses Collision AVOIDANCE (careful timing, backoff, ACK confirmation) instead of Collision DETECTION.

This is fundamentally different from wired Ethernet which detects collisions electrically. Wi-Fi must wait for positive confirmation of receipt.

SIFS < DIFS guarantees that ACK/CTS responses always win priority over new transmissions. This prevents new senders from colliding with acknowledgments.

Wi-Fi backoff starts at 0–31 (first attempt). After collision 1: 0–63. Collision 2: 0–127. Collision 3: 0–255. It keeps doubling up to a maximum of 1024.

After 7 failures, the device gives up on that specific packet, resets its backoff counter, and starts fresh. The higher-layer protocol (e.g., TCP) would handle retransmission.

The CTS message contains a duration field telling ALL nearby nodes how long to wait, even if they never heard the original RTS.

The RTS/CTS exchange happens BEFORE the actual data. This is overhead, which is why RTS/CTS is often disabled for short packets and only used for large transmissions.

RTS/CTS adds overhead (extra round-trip). For small packets, the overhead exceeds the cost of simply retransmitting after a collision. For large packets, avoiding a collision saves significant time.

Most deployments disable RTS/CTS by default because the overhead is not worth it for typical web traffic. It becomes valuable in environments with many hidden nodes.

Nearby stations set their NAV timer based on the CTS duration. They will not attempt to transmit until the NAV timer expires, even if the channel sounds idle.

Rate scaling must consider this trade-off: a higher bit rate with moderate loss can deliver more effective throughput than a lower bit rate with no loss.

ARF uses asymmetric thresholds: quick to downshift (2 failures) but slow to upshift (10 successes). This conservative approach prioritizes reliability over speed.

If the sender doesn't receive an ACK within the expected time window after SIFS, the frame is considered lost — either corrupted or collided.

RBAR requires receiver feedback (more overhead). CARA improves on ARF by distinguishing between collisions (don't change rate) and noise (do change rate).

802.11g supports 8 rate levels: 6, 9, 12, 18, 24, 36, 48, 54 Mbps. Each uses different modulation and coding schemes.

/24 means the first 24 bits are the network prefix. The remaining 8 bits give 256 addresses. Subtract 2 (network address and broadcast) = 254 usable.

/26 means 26 network bits, leaving 6 host bits. 2⁶ = 64 total addresses. The first (10.0.0.0) is the network address and the last (10.0.0.63) is the broadcast.

/20 means 20 bits of 1s: 11111111.11111111.11110000.00000000 = 255.255.240.0. The third octet has only the top 4 bits set (128+64+32+16 = 240).

IP AND Mask = Network Address. If both hosts produce the same network address, they are on the same subnet and can communicate directly at Layer 2.

Classful addressing was replaced by CIDR (Classless Inter-Domain Routing) in 1993 to reduce routing table size and allow flexible, variable-length subnet masks.

MIMO's key innovation is spatial multiplexing — multiple data streams on the same frequency, differentiated by spatial paths (multipath reflections). This multiplies throughput without needing more spectrum.

SIMO and MISO provide diversity (reliability) but not multiplexing. Only full MIMO provides N× throughput gain.

MIMO leverages multipath reflections to distinguish spatial streams. In clear open space with only line-of-sight paths, the streams cannot be separated. Indoor environments with many reflecting surfaces are ideal.

The receiver uses linear algebra to separate the mixed streams, exploiting the different attenuation paths. More antennas = more equations = more streams that can be separated.

SIMO provides receive diversity — it doesn't multiply throughput, but it improves reliability by selecting the antenna with the best signal quality.

Infrastructure mode routes ALL traffic through the AP, even between two devices sitting next to each other. This creates a two-step forwarding inefficiency.

In an ESS (Extended Service Set), the device is 'sticky' — it holds onto the original AP as long as possible before switching to avoid unnecessary handoffs.

The SSID is the network name you see when scanning for Wi-Fi. A single AP can even support multiple SSIDs with different security policies.

By monitoring probe requests, a tracker can identify a specific device and log its movement through space. MAC address randomization partially mitigates this.

Standard Ad Hoc mode provides only direct peer-to-peer connectivity without internet. MANETs (Mobile Ad Hoc Networks) can theoretically relay traffic via multi-hop, but standard Ad Hoc does not.

Step 1: AP provides its random nonce. Step 2: Station provides its nonce + proof of key knowledge (MIC). Step 3: Both derive PTK from shared master key + both nonces; AP delivers the group key (GTK). Step 4: Station confirms.

WPA2 replaced the broken WEP/RC4 encryption with AES (Advanced Encryption Standard) using CCMP (Counter Mode with CBC-MAC Protocol). This provides both confidentiality and integrity.

Reusing a keystream with different plaintext allows the attacker to XOR the two ciphertexts and recover the key. KRACK is a protocol-level flaw, not a flaw in AES itself.

Enterprise mode is essential for organizations because you can revoke a single employee's access without changing the password for everyone else.

PTK is unique per device-AP pair (derived from both nonces + master key). GTK is shared among all connected devices for group communications.

The key insight is that contention-based access (CSMA/CA) breaks down over long distances because RTT becomes too large for collision avoidance timing to work.

Wi-Fi's CSMA/CA timing was designed for ~100m ranges (RTT < 1 µs). At cellular distances, the propagation delay alone exceeds the protocol's timing parameters.

These are the official ITU benchmarks. Early LTE and WiMAX deployments marketed themselves as '4G' before meeting these targets.

Without ranging, signals from distant subscribers would arrive late and overlap with the next time slot, causing interference.

WiMAX prioritizes subscriber-to-base QoS. LTE emphasizes end-to-end QoS. LTE's approach is more comprehensive, covering the entire path from device to destination.

From the office network's perspective, the remote worker's packets originate from 10.1.1.50 — she appears to be a local device. The internet is simply a transport pipe.

Token Ring's complexity (token management, ring recovery) made it expensive. Ethernet's 'good enough' approach with simple collision handling won on cost and scalability.

The token is a special control frame circulating around the ring. This ensures contention-free access — no collisions are ever possible — but adds latency waiting for the token.

Carrier Ethernet uses reserved communication lines — there is no contention. It provides reliability, standardized QoS, and scalability beyond 10 Gbps over distances far exceeding traditional copper Ethernet's 100m limit.

A VPN does NOT increase bandwidth (D). It adds encryption overhead that may slightly DECREASE throughput. Its value is in security, privacy, and virtual network access.

GEO satellites stay fixed relative to Earth (one covers 1/3 of the globe). LEO satellites orbit rapidly and must be replaced frequently, but offer dramatically lower latency.

With ~1,000 ms RTT, GEO satellite internet makes real-time interactive applications (gaming, VoIP, VPN handshakes) nearly unusable. It works for bulk downloads using accelerator techniques.

The theoretical minimum is ~477 ms, but real-world processing adds overhead, pushing typical RTT to ~1,000 ms. The speed of light is the fundamental bottleneck.

The dish focuses the weak signal from space into the receiver. The small transmitter power is sufficient because the satellite has a large, sensitive antenna.

SpaceX's Starlink has ~7,000 satellites for this reason. GEO only needs 3 for global coverage, but at the cost of high latency.

The Internet (IP) uses datagrams. Telephone networks and ATM use virtual circuits. The trade-off is QoS guarantees vs resilience and simplicity.

This is why the Internet chose datagrams — resilience to failures was a core design requirement (ARPANET military origins).

Each router remaps the VCI: incoming (VCI_in, port_in) → outgoing (VCI_out, port_out). This allows efficient locally-scoped numbering rather than requiring globally unique IDs.

Voice traffic is very sensitive to jitter. Small, fixed-size cells ensure predictable, low-latency forwarding — a key QoS advantage of virtual circuits.

The Internet uses datagram (connectionless) forwarding via IP. Each packet is independently routed. MPLS (Multi-Protocol Label Switching) adds some VC-like features within carrier networks, but end-to-end IP is datagram-based.

The Protocol field acts as a demultiplexer (like EtherType at Layer 2). The TTL field is critical for preventing routing loops from consuming bandwidth forever.

IP is stateless and connectionless. If a router is congested, it simply drops packets. Reliable delivery is the job of upper-layer protocols like TCP.

TTL is a safety valve. A typical initial TTL is 64 or 128. Even in a loop, the packet is destroyed after at most that many hops.

This works because IP does not verify source addresses. The local router accepts the spoofed packet and forwards it. This is a classic amplification DDoS attack.

These three tasks enable any device on Earth to send a packet to any other device, regardless of the underlying link-layer technology.

Each fragment gets its own IP header (20 bytes overhead). The payload is split so each fragment fits within the 1000-byte MTU. The More Fragments flag is set on all fragments except the last.

Intermediate routers do NOT reassemble fragments — they may need to fragment further if they encounter an even smaller MTU. Only the destination has all fragments and performs reassembly using the ID, Flags, and Offset fields.

ID groups fragments from the same original packet. MF flag indicates more fragments follow. Fragment Offset tells the destination where each fragment's data fits in the original payload.

Any router along the path can fragment a packet if the next-hop link has a smaller MTU than the packet size. However, if the Don't Fragment (DF) flag is set, the router drops the packet and sends an ICMP error instead.

These options are rarely used in practice due to security concerns and processing overhead, but they exist in the specification (up to 10 option words available).

Private addresses are used inside organizations and translated to public IPs by NAT. The loopback address lets a host communicate with itself for testing.

IP addresses are assigned to INTERFACES, not hosts. A multi-homed server has one IP per network card. A router typically has many interfaces, each with its own IP on a different subnet.

The loopback interface is an abstract, software-only interface. Packets sent to 127.0.0.1 never leave the host — they are immediately looped back to the receiving socket. Essential for local development and testing.

Private addresses (10.x, 172.16-31.x, 192.168.x) are not routable on the public internet. A NAT device must translate them to a public IP before they leave the local network.

The network address identifies the subnet itself. The broadcast address reaches all hosts on the subnet. Neither can be assigned to a device.

Both A (/16) and E (/19) match the destination. /19 is more specific (19 bits match vs 16), so E wins. This is the Longest Prefix Match rule — always choose the most specific route.

The router first checks if D is on a directly-connected subnet (local delivery). If no interface matches, it consults the forwarding table for next-hop entries and uses longest prefix match.

To verify a match, convert both addresses to binary and compare the first k bits (where k is the prefix length).

The default route (prefix length 0) matches everything — it is the 'catch-all'. It is always the shortest prefix, so any more specific match will win over it.

Longest Prefix Match — the most specific (longest) matching prefix is always chosen. A /24 match wins over a /16 match because it is more specific.

Each /24 has 8 host bits = 256 addresses − 2 reserved = 254 usable hosts. The /16 block contains 256 possible /24 subnets (from 147.126.0.0/24 through 147.126.255.0/24).

This hierarchical approach means external routers only need ONE entry for the entire /16 block. Internal subnet structure is invisible to the outside world.

VLSM allows subnets of different sizes within the same address space. A /20 provides 4094 hosts (for a large department) while /24s provide 254 hosts each (for smaller groups). The real lecture example includes both /24 and /20 subnets under 147.126.0.0/16.

Each subnet is its own broadcast domain. External routers only see the aggregate /16 prefix, not the internal subnet structure. This reduces routing table size across the internet.

Hierarchical routing hides internal subnets. External routers only know how to reach the organization's aggregate prefix (e.g., /16). The internal /24 or /20 divisions are invisible outside.

Remember 'DORA': Discover → Offer → Request → ACK. Discover and Offer are technically optional (client can skip directly to Request if it knows the server), but the full sequence is the standard.

APIPA (Automatic Private IP Addressing) assigns 169.254.x.x as a fallback. These addresses allow local subnet communication only — no internet routing is possible.

A new device has no IP address, no subnet mask, and no knowledge of the DHCP server's location. Broadcasting (to 255.255.255.255) ensures the Discover reaches any DHCP server on the local subnet.

ICANN (via IANA) manages the global pool. The 5 RIRs (ARIN, APNIC, RIPE, LACNIC, AFRINIC) distribute to ISPs in their regions.

IPv4 exhaustion is the primary driver for IPv6 adoption and the widespread use of NAT. Only AFRINIC had remaining free IPv4 space as of 2017.

When two internal hosts use the same source port, NAT must remap one to a different external port. The forwarding table tracks which internal host corresponds to each external port.

The NAT table maps each pair back to the original . This is why NAT uses port remapping as the key multiplexing mechanism.

NAT acts as a natural firewall. Unsolicited inbound connections are dropped because they don't match any entry in the NAT forwarding table. Only responses to internally-initiated connections are forwarded.

The NAT table must maintain a unique external for every active internal connection. Port remapping is only needed when internal connections would create duplicates.

By allowing entire networks to share a single public IPv4 address, NAT dramatically reduced the consumption rate of public IPv4 addresses. Without NAT, IPv4 would have been exhausted much earlier.

ARP bridges the gap between Layer 3 (IP) and Layer 2 (MAC). Without ARP, hosts would have no way to create Ethernet frames for IP packets destined for local hosts.

ARP uses Layer 2 broadcast, which does not cross router boundaries. For hosts on different subnets, the sender must ARP for its default gateway's MAC address instead.

A sends the packet to the router's MAC address, but with Host C's IP as the destination. The router then re-ARPs on the destination subnet to find Host C's MAC.

ARP cache entries have a timeout (typically 1-20 minutes depending on the OS). Entries must expire so that IP-to-MAC mappings can update when devices move or change.

DNS is Layer 7 (Application), global scope. ARP is Layer 2/3 boundary, local subnet scope only. DNS uses UDP/TCP; ARP uses raw Ethernet frames.

Modern LANs almost universally use Star topology with Ethernet switches at the center. Mesh is reserved for WANs and critical backbone connections.

The central device is the single point of failure in Star topology. This is mitigated by using redundant switches, stacking, or a partial mesh at the core.

Star topology with an Ethernet switch at the center provides easy management, simple troubleshooting (each host has its own cable), and supports full-duplex per-port connections.

Full mesh grows quadratically. For 100 devices, you'd need 4,950 links — impractical for LANs but valuable for small groups of critical routers.

Bus topology (shared coaxial cable) is obsolete. A break anywhere in the cable disrupts the entire network. Star topology replaced it because faults are isolated to individual links.

This question integrates DNS, TCP, HTTP, IP, ARP, NAT, CSMA/CA or CSMA/CD, MAC learning, and routing — virtually every midterm topic.

Each layer encapsulates the previous layer's PDU inside its own header. The receiver reverses this process, stripping each header to extract the next layer's data.

This is a classic Layer 7 (Application/DNS) problem. The ability to ping an IP proves Layers 1-3 are functional. The failure of name resolution isolates the issue to DNS.

Pinging the gateway confirms local network connectivity. The failure to reach external IPs points to a problem at or beyond the gateway — WAN link, ISP, or routing configuration.

If even the local gateway is unreachable, the problem is at the lowest layers. Check: cable connected? Wi-Fi associated? NIC enabled? Link light on? This bottom-up troubleshooting approach is the standard methodology.