Understanding IP addressing is only the beginning of networking.
Once a packet reaches its destination network, applications still need protocols to communicate.
This part covers the major protocols and services that every Network Engineer and System Administrator should understand:
- TCP
- UDP
- Ports
- Sockets
- TCP three-way handshake
- TCP connection termination
- TCP retransmission
- Flow and congestion control
- DNS
- DHCP
- HTTP and HTTPS
- SSH
- SMTP
- SNMP
- NTP
- Common protocol troubleshooting
These concepts form the foundation for later CCNA, CCNP and enterprise troubleshooting topics.
TCP Fundamentals
1. What is TCP?
TCP stands for Transmission Control Protocol.
It is a:
- Connection-oriented
- Reliable
- Transport-layer
protocol.
TCP provides mechanisms for:
- Reliable delivery
- Sequencing
- Acknowledgements
- Retransmission
- Flow control
- Congestion control
- Ordered delivery
TCP is commonly used by applications where reliable, ordered delivery is important.
Examples include:
- HTTPS
- SSH
- SMTP
- IMAP
- Microsoft application protocols
- Many database connections
2. What is UDP?
UDP stands for User Datagram Protocol.
It is a connectionless transport-layer protocol with minimal overhead.
UDP does not provide TCP-style:
- Connection establishment
- Guaranteed delivery
- Sequencing
- Retransmission
- Flow control
UDP is useful when low overhead, simplicity, multicast, broadcast, or application-controlled reliability is desirable.
Examples include:
- DNS queries
- DHCP
- NTP
- SNMP
- Voice/video applications
- Some modern transport protocols such as QUIC, which runs over UDP
3. What is the difference between TCP and UDP?
| TCP | UDP |
|---|---|
| Connection-oriented | Connectionless |
| Reliable delivery mechanisms | No TCP-style reliability |
| Ordered byte stream | Datagram-based |
| Acknowledgements | No TCP-style acknowledgements |
| Retransmission | No TCP-style retransmission |
| Flow control | No TCP-style flow control |
| Congestion control | TCP congestion control |
| More protocol overhead | Lower protocol overhead |
Do not say:
“TCP is always faster than UDP.”
or:
“UDP is always faster than TCP.”
The appropriate protocol depends on the application and network conditions.
TCP Three-Way Handshake
4. What is the TCP three-way handshake?
TCP uses a three-step process to establish a connection.
Simplified sequence:
Client Server
| |
| ---- SYN ------------> |
| <--- SYN + ACK -------- |
| ---- ACK ------------> |
| |
Connection established
The three steps are:
- SYN
- SYN-ACK
- ACK
5. What is a SYN packet?
SYN is a TCP flag used to initiate a TCP connection.
The client sends a SYN to request establishment of a TCP session.
Example:
Client → Server
SYN
6. What is SYN-ACK?
SYN-ACK is the server’s response to the client’s SYN.
It indicates that the server received the connection request and is also synchronizing its TCP sequence information.
Client → Server
SYN
Server → Client
SYN + ACK
7. What is the final ACK?
The client sends an ACK after receiving the server’s SYN-ACK.
Client → Server
ACK
The TCP connection is then established.
TCP Sequence Numbers and Acknowledgements
8. Why does TCP use sequence numbers?
TCP uses sequence numbers to track the position of data in the byte stream.
They allow TCP to:
- Maintain ordering
- Detect missing data
- Identify retransmissions
- Reassemble data correctly
9. What is a TCP acknowledgement?
An acknowledgement informs the sender about data that has been received.
If expected data does not arrive, TCP can detect the problem and initiate retransmission according to its reliability mechanisms.
10. What happens when a TCP segment is lost?
TCP can detect loss through mechanisms such as:
- Retransmission timeout
- Duplicate acknowledgements
- Fast retransmission
The sender can retransmit the missing data.
This is one of the reasons TCP is considered reliable.
TCP Connection Termination
11. How is a TCP connection normally terminated?
TCP normally uses a connection termination process involving FIN and ACK messages.
Simplified:
Client Server
| |
| -------- FIN ---------> |
| <------- ACK ---------- |
| <------- FIN ---------- |
| -------- ACK ---------> |
The exact exchange can vary depending on which side closes first and application behavior.
12. What is a TCP FIN?
FIN indicates that a TCP endpoint has finished sending data in that direction.
It is used during graceful TCP connection termination.
13. What is a TCP RST?
RST stands for Reset.
A TCP RST can indicate that a connection is being aborted or that a segment was received for a connection that cannot be accepted in its current state.
For example, connecting to a closed TCP port commonly results in a TCP reset.
TCP Flow and Congestion Control
14. What is TCP flow control?
Flow control prevents a fast sender from overwhelming a slower receiver.
TCP uses the receiver’s advertised window to communicate how much additional data it can accept.
15. What is TCP congestion control?
Congestion control attempts to prevent the sender from overwhelming the network.
TCP dynamically adjusts transmission behavior based on network conditions and observed congestion.
This is different from flow control.
Flow control
Protects the receiver.
Congestion control
Protects the network.
This distinction is frequently asked in interviews.
UDP
16. Why would an application use UDP instead of TCP?
An application may prefer UDP when it needs:
- Lower protocol overhead
- No connection establishment
- Application-controlled reliability
- Multicast or broadcast
- Low-latency communication
The application can implement its own reliability or tolerate some packet loss when appropriate.
17. Does UDP guarantee packet delivery?
No.
UDP does not provide TCP-style guarantees for:
- Delivery
- Ordering
- Retransmission
If an application needs reliability, it must provide appropriate mechanisms itself or use another protocol.
Ports
18. What is a port number?
A port number identifies a transport-layer endpoint associated with an application or service.
TCP and UDP each have their own port number spaces.
Port numbers range from:
0–65535
19. What are well-known ports?
Ports:
0–1023
are commonly referred to as well-known ports.
Examples:
TCP 22 → SSH
TCP 25 → SMTP
TCP 80 → HTTP
TCP 443 → HTTPS
UDP 53 → DNS
UDP 67 → DHCP Server
UDP 68 → DHCP Client
UDP 123 → NTP
UDP 161 → SNMP
Port assignments and real-world usage can vary, so do not assume that a service is impossible on another port.
20. What are registered ports?
The range:
1024–49151
is commonly known as the registered port range.
Applications and vendors can register service ports with IANA.
21. What are dynamic/private ports?
The range:
49152–65535
is commonly used for dynamic/ephemeral ports.
The exact local port selection behavior depends on the operating system.
22. What is an ephemeral port?
An ephemeral port is a temporary source port typically selected by an operating system for client-side connections.
For example:
Client:
192.168.1.20:51542
Server:
192.168.1.50:443
Here:
51542
can be an ephemeral client-side source port.
Sockets
23. What is a socket?
A socket represents a communication endpoint.
For TCP communication, a connection is identified using information including:
Source IP
Source TCP port
Destination IP
Destination TCP port
Protocol
For example:
192.168.1.20:51542
↓
192.168.1.50:443
24. What is the difference between a port and a socket?
A port identifies a transport-layer endpoint number.
A socket represents a communication endpoint using an address and port together with the relevant transport protocol.
For example:
TCP socket:
192.168.1.20:51542
DNS
25. What is DNS?
DNS stands for Domain Name System.
It translates names into information such as IP addresses.
For example:
www.example.com
↓
IP address
DNS is fundamental to almost every modern enterprise network.
26. Why is DNS important?
Without DNS, users and applications would frequently need to use IP addresses directly.
DNS provides name-based access to services such as:
- Websites
- Mail servers
- Internal applications
- Active Directory
- Cloud services
Active Directory is particularly dependent on correct DNS operation.
27. What port does DNS use?
DNS commonly uses:
UDP 53
TCP 53
UDP is commonly used for normal DNS queries.
TCP can be used for situations such as:
- Large responses
- Zone transfers
- DNS operations requiring TCP
Modern DNS can also use other transport mechanisms, such as DNS over TLS or DNS over HTTPS, depending on the resolver and deployment.
28. What is a DNS resolver?
A DNS resolver is responsible for obtaining DNS answers on behalf of a client.
The client commonly sends its query to a configured recursive resolver.
The resolver may then query other DNS servers as necessary.
29. What is recursive DNS resolution?
In recursive resolution, the resolver takes responsibility for obtaining the final answer for the client.
Simplified:
Client
|
v
Recursive Resolver
|
+--> Root
|
+--> TLD
|
+--> Authoritative DNS
|
v
Answer
30. What is an authoritative DNS server?
An authoritative DNS server hosts DNS records for zones for which it is authoritative.
For example:
example.com
may be hosted on authoritative name servers that provide the official DNS data for that zone.
31. What is a DNS zone?
A DNS zone is an administrative portion of the DNS namespace for which a DNS server is authoritative.
For example:
example.com
can be configured as a DNS zone.
A zone can contain records such as:
- A
- AAAA
- CNAME
- MX
- NS
- PTR
- TXT
- SRV
DNS Record Types
32. What is an A record?
An A record maps a hostname to an IPv4 address.
Example:
server.example.com
↓
192.168.10.20
33. What is an AAAA record?
An AAAA record maps a hostname to an IPv6 address.
Example:
server.example.com
↓
2001:db8:10::20
34. What is a CNAME record?
CNAME stands for Canonical Name.
It creates an alias from one DNS name to another DNS name.
Example:
portal.example.com
↓
web01.example.com
A CNAME points to another DNS name rather than directly to an IP address.
35. What is an MX record?
MX stands for Mail Exchange.
It identifies mail servers responsible for receiving email for a domain.
Example:
example.com
↓
MX
↓
mail.example.com
MX records contain a preference value used to establish mail-server preference.
36. What is a PTR record?
A PTR record is used for reverse DNS.
It maps an IP address to a hostname.
For example:
192.168.10.20
↓
server.example.com
Reverse DNS commonly uses:
in-addr.arpa
for IPv4 and:
ip6.arpa
for IPv6.
37. What is an NS record?
An NS record identifies authoritative name servers for a DNS zone.
Example:
example.com
↓
ns1.example.com
ns2.example.com
38. What is an SRV record?
An SRV record identifies services and the hosts/ports where those services are available.
SRV records are particularly important in environments such as:
- Active Directory
- SIP
- Other service-discovery scenarios
For example, Active Directory uses SRV records to help clients locate domain controllers and related services.
39. What is a TXT record?
A TXT record stores text associated with a DNS name.
It is commonly used for:
- Domain verification
- SPF-related information
- DKIM-related information
- DMARC-related information
- Other application-specific data
DNS Troubleshooting
40. A user can ping an IP address but cannot access the server by hostname. What should you check?
This strongly suggests investigating DNS/name resolution.
Check:
1. DNS server configuration
2. DNS server reachability
3. DNS record
4. Client DNS cache
5. Search suffix
6. Split DNS configuration
7. Firewall
8. DNS zone
9. Authoritative server
On Windows:
ipconfig /all
nslookup server.example.com
ipconfig /displaydns
To clear the Windows DNS client cache:
ipconfig /flushdns
Do not automatically assume that DNS is the only possible cause; applications can also have their own name-resolution behavior.
41. What is DNS caching?
DNS caching stores previously obtained DNS responses for a period defined by the record’s TTL and resolver behavior.
Caching reduces:
- DNS query traffic
- Resolution latency
- Load on DNS infrastructure
42. What is TTL in DNS?
TTL stands for Time To Live.
For DNS records, TTL specifies how long a resolver may cache the response before it should query again.
For example:
TTL = 3600 seconds
means one hour.
Changing a DNS record does not necessarily make every client see the change immediately because cached responses can remain valid until their TTL expires.
DHCP
43. What is DHCP?
DHCP stands for Dynamic Host Configuration Protocol.
It automatically provides network configuration to clients.
Typical information includes:
- IP address
- Subnet mask
- Default gateway
- DNS servers
- Lease duration
- Other DHCP options
44. What is the DHCP DORA process?
DORA stands for:
D → Discover
O → Offer
R → Request
A → Acknowledge
Simplified:
Client DHCP Server
| |
| ---- DHCP Discover --------> |
| <---- DHCP Offer ----------- |
| ---- DHCP Request ---------> |
| <---- DHCP ACK ------------- |
45. Why does DHCP initially use broadcast?
A client that does not yet have an IP configuration may not know the DHCP server’s address.
Therefore, the initial DHCP discovery uses broadcast at the local network level.
Routers do not normally forward broadcasts between subnets.
That is why DHCP relay is required when the DHCP server is on another subnet.
46. What is a DHCP relay?
A DHCP relay forwards DHCP client requests between different IP networks.
For example:
Client VLAN
|
v
Router / L3 Switch
|
| DHCP Relay
v
DHCP Server
The relay allows a centralized DHCP server to serve multiple subnets.
47. What is DHCP scope?
A DHCP scope defines the address range and configuration options that a DHCP server can provide to clients for a particular subnet.
A scope can contain:
- Address pool
- Exclusions
- Reservations
- Lease duration
- Gateway option
- DNS server option
- Other DHCP options
48. What is a DHCP reservation?
A reservation associates a specific client identifier, commonly a MAC address in traditional DHCP deployments, with a particular IP address.
Example:
Server MAC
↓
192.168.10.50
The client continues receiving the same address from DHCP as long as the reservation and client identification remain applicable.
HTTP and HTTPS
49. What is HTTP?
HTTP stands for Hypertext Transfer Protocol.
It is an application-layer protocol used for communication between clients and web servers.
The traditional default port is:
TCP 80
50. What is HTTPS?
HTTPS is HTTP protected by TLS.
The traditional default port is:
TCP 443
TLS provides security properties such as:
- Encryption
- Integrity
- Server authentication through certificates
Depending on the protocol/version, HTTP can also be transported over other mechanisms, but TCP 443 remains the standard HTTPS port in traditional HTTP deployments.
51. What is the difference between HTTP and HTTPS?
| HTTP | HTTPS |
|---|---|
| HTTP without TLS | HTTP protected by TLS |
| Traditionally TCP 80 | Traditionally TCP 443 |
| Traffic not protected by TLS | Encryption/integrity provided by TLS |
| No TLS server certificate | TLS certificate normally used |
52. What does a browser do when connecting to an HTTPS website?
At a high level:
DNS resolution
↓
TCP connection
↓
TLS handshake
↓
HTTP request
↓
HTTP response
For HTTP/3, QUIC is used instead of TCP, so the transport sequence differs.
SSH
53. What is SSH?
SSH stands for Secure Shell.
It provides secure remote access and other secure communication functions.
The traditional default port is:
TCP 22
SSH provides:
- Encryption
- Authentication
- Integrity protection
- Secure remote administration
- Secure file transfer mechanisms such as SFTP
54. What is SFTP?
SFTP stands for SSH File Transfer Protocol.
It operates through SSH and commonly uses:
TCP 22
Do not confuse SFTP with FTP over TLS.
SMTP
55. What is SMTP?
SMTP stands for Simple Mail Transfer Protocol.
It is used for sending and relaying email.
Common ports include:
TCP 25
TCP 587
TCP 465
Their exact roles depend on the mail architecture and security configuration.
56. What is the difference between SMTP port 25 and 587?
TCP 25
Traditionally used for:
- Server-to-server SMTP
- Mail relay between mail systems
TCP 587
Commonly used for:
- Message submission
- Authenticated client submission
The exact configuration depends on the mail platform.
SNMP
57. What is SNMP?
SNMP stands for Simple Network Management Protocol.
It is used for monitoring and managing network devices.
It can provide information such as:
- Interface status
- Traffic counters
- CPU utilization
- Memory usage
- Device health
58. What are common SNMP ports?
SNMP commonly uses:
UDP 161
for queries and management operations.
SNMP traps commonly use:
UDP 162
59. What is the difference between SNMP polling and traps?
Polling
The monitoring system periodically queries the device.
NMS → Device
"Give me interface statistics."
Trap
The device sends an asynchronous notification to the monitoring system.
Device → NMS
"An event occurred."
Traps can reduce the need to wait for the next polling interval for certain events.
60. What is the difference between SNMPv2c and SNMPv3?
SNMPv2c uses community strings and does not provide the security capabilities of SNMPv3.
SNMPv3 supports security features such as:
- Authentication
- Integrity
- Encryption, depending on the configured security level
For enterprise environments, SNMPv3 is generally preferred when supported because it provides substantially stronger security than community-string-based SNMPv1/v2c.
NTP
61. What is NTP?
NTP stands for Network Time Protocol.
It synchronizes system clocks across networked devices.
The commonly used port is:
UDP 123
62. Why is NTP important in enterprise networks?
Accurate time is critical for:
- Active Directory
- Kerberos authentication
- Log correlation
- Security investigations
- Certificates
- Distributed applications
- Monitoring
- Database systems
Incorrect time can cause authentication and troubleshooting problems.
63. What can happen if Active Directory systems have incorrect time?
Kerberos authentication is time-sensitive.
Significant clock differences can cause:
- Authentication failures
- Kerberos errors
- Domain-related problems
- Inconsistent event logs
Therefore, reliable time synchronization is an important part of Active Directory infrastructure.
Protocol Troubleshooting
64. A server responds to ping, but HTTPS does not work. Is the server reachable?
The server is reachable at the ICMP level, but that does not prove that HTTPS is working.
You should test the required service separately.
For example:
Test-NetConnection server.example.com -Port 443
Possible causes include:
- Service stopped
- Firewall blocking TCP 443
- Incorrect listener
- TLS/certificate problem
- Application failure
- Load balancer issue
65. A server’s port 443 is open, but the website still does not load. What should you check?
An open TCP port only proves that something accepted the TCP connection.
Continue troubleshooting:
TCP connectivity
↓
TLS handshake
↓
Certificate
↓
HTTP request
↓
HTTP response
↓
Application
Check:
- TLS version/ciphers
- Certificate validity
- Hostname/SNI
- Web server configuration
- Reverse proxy
- Application health
- HTTP response codes
66. DNS is working, but an application still cannot connect. What should you investigate?
Separate the problem into layers:
DNS
↓
IP connectivity
↓
TCP/UDP port
↓
TLS if applicable
↓
Authentication
↓
Application
Successful DNS resolution does not prove that the application itself is healthy.
67. A client can connect to a server using its IP address but not its hostname. What is the first major area to investigate?
Investigate name resolution.
Check:
nslookup server.example.com
and:
ipconfig /all
Verify:
- DNS server
- DNS record
- Search suffix
- DNS cache
- Split DNS
- Authoritative DNS
68. A client cannot obtain a DHCP address. What should you check?
Use a structured approach:
Client NIC
↓
Switch port
↓
VLAN
↓
DHCP broadcast
↓
DHCP relay
↓
DHCP server
↓
Scope
↓
DHCP response
Check:
- VLAN assignment
- DHCP scope
- Available addresses
- Relay/helper configuration
- Firewall/ACL
- DHCP server health
- Client logs
Windows Troubleshooting Commands
69. How do you check the DNS configuration on Windows?
ipconfig /all
70. How do you test DNS resolution on Windows?
nslookup example.com
You can also use:
Resolve-DnsName example.com
71. How do you test whether TCP port 443 is reachable?
Test-NetConnection example.com -Port 443
72. How do you view active TCP connections on Windows?
netstat -ano
PowerShell can also be used:
Get-NetTCPConnection
73. How do you identify the process using a TCP connection?
With netstat -ano, note the PID:
netstat -ano
Then identify the process:
tasklist /FI "PID eq <PID>"
Linux Troubleshooting Commands
74. How do you test DNS resolution on Linux?
dig example.com
or:
nslookup example.com
75. How do you test a TCP port on Linux?
Depending on installed tools:
nc -vz server.example.com 443
or:
curl -v https://server.example.com
curl is particularly useful when testing HTTP/HTTPS because it can show application-layer behavior in addition to connectivity.
76. How do you view listening ports on Linux?
A common command is:
ss -lntup
This can help identify listening TCP/UDP sockets and associated processes when permissions allow.
Real-World Scenario 1
77. A user says, “The Internet is down,” but you discover that only websites fail while ping to public IP addresses works. What do you investigate?
Start by separating the problem into layers.
If:
ping 8.8.8.8
works but:
ping google.com
fails because the name cannot be resolved, investigate DNS.
Then test:
DNS
↓
TCP 443
↓
TLS
↓
HTTP
Possible causes include:
- DNS failure
- Proxy issue
- Firewall
- TLS inspection
- Browser configuration
- Application problem
Do not conclude that “Internet connectivity is working” solely because one ping succeeds.
Real-World Scenario 2
78. A Windows server has an IP address but cannot access domain resources by hostname. What would you check?
Check:
- DNS server configuration
- DNS resolution
- Domain DNS records
- Search suffix
- Connectivity to domain controllers
- SRV records
- Firewall
- Time synchronization
- Active Directory health
For example:
nslookup _ldap._tcp.dc._msdcs.example.com
The exact domain name should be replaced with the organization’s domain.
Real-World Scenario 3
79. A DHCP client receives a 169.254.x.x address. What is your troubleshooting sequence?
Start from the client and move toward the DHCP server:
Client
↓
NIC
↓
Switch port
↓
Correct VLAN?
↓
DHCP broadcast
↓
Relay/helper
↓
DHCP server
↓
Scope
Check:
ipconfig /all
Then verify the switch port, VLAN and DHCP infrastructure.
Real-World Scenario 4
80. TCP 443 is reachable, but the browser reports a certificate error. Is this a network connectivity problem?
Not necessarily.
TCP connectivity has already been established.
The problem may be at the TLS/application layer.
Investigate:
- Certificate expiration
- Certificate chain
- Hostname/SAN mismatch
- Trust store
- TLS configuration
- Reverse proxy/load balancer
- Server certificate binding
This illustrates why troubleshooting should proceed layer by layer.
Real-World Scenario 5
81. A monitoring system cannot collect SNMP data from a switch. What should you check?
Check:
1. Switch IP connectivity
2. SNMP configuration
3. SNMP version
4. Credentials/community string
5. UDP 161
6. ACL/firewall
7. SNMP view
8. Source IP restrictions
9. Device CPU/load
10. Monitoring-server configuration
If using SNMPv3, verify the configured authentication and privacy parameters.
Real-World Scenario 6
82. Users intermittently fail Kerberos authentication. What network-related issue should you investigate?
Check time synchronization.
Verify:
Client time
↓
Domain Controller time
↓
Authoritative time source
Also investigate:
- NTP configuration
- Network connectivity to time sources
- DNS
- Domain controller health
Incorrect time can cause Kerberos authentication problems.
Common Port Reference
| Protocol / Service | Port | Transport |
|---|---|---|
| FTP Control | 21 | TCP |
| SSH | 22 | TCP |
| Telnet | 23 | TCP |
| SMTP | 25 | TCP |
| DNS | 53 | UDP/TCP |
| DHCP Server | 67 | UDP |
| DHCP Client | 68 | UDP |
| HTTP | 80 | TCP |
| POP3 | 110 | TCP |
| NTP | 123 | UDP |
| IMAP | 143 | TCP |
| SNMP | 161 | UDP |
| SNMP Trap | 162 | UDP |
| LDAP | 389 | TCP/UDP |
| HTTPS | 443 | TCP |
| LDAPS | 636 | TCP |
| SMB | 445 | TCP |
| RDP | 3389 | TCP |
Port usage can vary by application and configuration, so treat this table as a common/default reference rather than an absolute rule.
Quick Revision
TCP
Connection-oriented
Reliable
Ordered
Acknowledgements
Retransmission
Flow control
Congestion control
UDP
Connectionless
Low overhead
No TCP-style reliability
No TCP-style ordering
TCP Handshake
SYN
↓
SYN-ACK
↓
ACK
DNS
Name
↓
DNS Resolver
↓
DNS Response
↓
IP Address
Common port:
UDP/TCP 53
DHCP
Discover
Offer
Request
ACK
HTTP/HTTPS
HTTP → TCP 80
HTTPS → TCP 443
SSH
TCP 22
SMTP
TCP 25
TCP 587
TCP 465
SNMP
UDP 161 → Queries
UDP 162 → Traps
NTP
UDP 123
Exam Answer Summary
What is the difference between TCP and UDP?
TCP is a connection-oriented transport protocol that provides reliable, ordered delivery with mechanisms such as acknowledgements, retransmission, flow control and congestion control. UDP is connectionless and provides lower-overhead datagram delivery without TCP’s reliability mechanisms.
What is the TCP three-way handshake?
TCP establishes a connection using SYN, SYN-ACK and ACK.
What is DNS?
DNS is the Domain Name System used to resolve names into information such as IP addresses and service records.
What is DHCP DORA?
DORA stands for Discover, Offer, Request and Acknowledge, representing the common DHCP address-assignment exchange.
What is a DHCP relay?
A DHCP relay forwards DHCP client requests between different IP networks so that a centralized DHCP server can provide configuration to clients on remote subnets.
What is the difference between HTTP and HTTPS?
HTTPS is HTTP protected by TLS, providing encryption, integrity and server authentication through certificates. Traditional HTTP uses TCP 80, while traditional HTTPS uses TCP 443.
What is SNMP used for?
SNMP is used to monitor and manage network devices, including collecting interface statistics and device health information.
Why is NTP important?
NTP synchronizes system clocks. Accurate time is particularly important for authentication systems such as Kerberos, security logs and distributed applications.
Senior Interview Tip
Do not troubleshoot network applications by randomly running ping.
Instead, isolate the failure:
1. DNS
↓
2. IP connectivity
↓
3. TCP/UDP port
↓
4. TLS, if applicable
↓
5. Authentication
↓
6. Application
For example, if a user says:
“The website is not working.”
A senior engineer should ask:
Does DNS resolve?
↓
Can the destination IP be reached?
↓
Is TCP 443 reachable?
↓
Does TLS establish?
↓
What HTTP status is returned?
↓
Is the application healthy?
This approach prevents wasting time troubleshooting the wrong layer.
What Comes Next?
Part 6 — Networking Fundamentals: Ethernet Switching, MAC Address Tables, VLANs, Access Ports, Trunks & 802.1Q
The next part moves into the core CCNA switching foundation, including:
- Layer 2 switching
- MAC address learning
- MAC address tables
- Unknown unicast
- Broadcast forwarding
- Collision domains
- Broadcast domains
- VLANs
- Access ports
- Trunk ports
- 802.1Q tagging
- Native VLAN
- VLAN troubleshooting
- Basic Cisco switch commands
- Real-world switching scenarios