Network terms, explained

802.11k helps clients find nearby access points, 802.11v lets the network suggest a better one, and 802.11r speeds up re-authentication when a client moves.

In practice: Together they help calls and video stay up as users walk between access points.

Makes a device prove who it is before a switch port or Wi-Fi network lets it on. The switch or access point passes the credentials to a RADIUS server, which approves or rejects the device.

In practice: Usually paired with a NAC platform that places each user or device into the right VLAN or policy.

An ordered list of permit and deny rules that filter traffic by address, protocol and port. Rules are checked from the top, and the first match wins.

In practice: Cisco-style ACLs use wildcard masks, the inverse of a subnet mask: 0.0.0.255 matches a /24.

A lightweight hello protocol that detects a failed link or neighbour in milliseconds and tells routing protocols such as BGP and OSPF to reroute.

In practice: Enable it where routing protocol timers alone would take many seconds to notice a failure.

The routing protocol that connects separate networks, called autonomous systems, across the internet. BGP chooses paths using policy and attributes such as AS path, local preference and MED, rather than link speed.

In practice: Used between edge routers and ISPs, on cloud private connections, and inside large data centre and SD-WAN fabrics. It runs over TCP port 179.

NAT run by an ISP so that many customers share one public IPv4 address. The range 100.64.0.0/10 is reserved for it (RFC 6598).

In practice: If your router’s WAN address is in 100.64.0.0/10, you are behind CGNAT and inbound connections will not reach you. Compare it with your public IP.

Writes a network as an address plus a prefix length, such as 10.20.0.0/22. The prefix length is the number of bits that identify the network.

In practice: A /24 holds 256 addresses and a /30 holds 4. Check any address with the IP subnet calculator, or plan a whole block with the subnet planner.

Automatically gives a device its IP address, default gateway and DNS servers when it joins the network.

In practice: When the DHCP server sits on another subnet, the gateway forwards requests to it using a DHCP relay, often called an IP helper.

Translates names such as example.com into IP addresses and other records: A and AAAA for addresses, MX for mail, CNAME for aliases and TXT for verification and email policy.

In practice: Check any domain’s records with the DNS lookup.

Lets a router use several equal-cost paths to the same destination at once, spreading traffic across them.

In practice: Traffic is usually balanced per flow, so packets in one session stay on one path and arrive in order.

A simple tunnelling protocol that wraps one packet inside another, so a tunnel can carry routing protocols and multicast. GRE has no encryption of its own.

In practice: Often run inside IPsec when dynamic routing is needed across a VPN.

Describes the overall solution: requirements, topology, security zones, resilience and key design decisions, without device-level detail.

In practice: Usually signed off by the client before the low-level design starts. See the HLD template pack.

The operating system on many Cisco routers and switches, known for its command-line interface. Current variants include IOS XE and IOS XR. Not to be confused with Apple’s iOS.

In practice: Its CLI style is widely copied by other vendors, so many engineers learn it first.

A set of protocols that encrypts and authenticates IP traffic. IKE negotiates the keys, and ESP encrypts the packets.

In practice: Used for site-to-site VPNs between firewalls and to cloud VPN gateways. The extra headers mean tunnels often need a lower MTU or MSS clamping.

The successor to IPv4, with 128-bit addresses written in hexadecimal, such as 2001:db8::1.

In practice: A site typically receives a /48 and uses a /64 for each subnet.

Bundles several physical links into one logical link for more bandwidth and resilience. Defined in IEEE 802.3ad, now 802.1AX.

In practice: Used for switch uplinks and server connections. Multi-chassis versions let one bundle span two switches.

The build detail behind a design: IP plan, VLANs, port maps, device settings and cabling. An engineer should be able to implement from it.

In practice: See the LLD and IP plan pack.

Step-by-step instructions for a change, including pre-checks, implementation steps, timings, validation tests and the rollback plan.

In practice: Usually submitted with the change request for approval before a maintenance window.

A forwarding method in which packets carry short labels and routers forward on the label instead of looking up the full IP address. Carriers use it to build private WAN services that keep each customer’s traffic separate.

In practice: Many enterprises connect sites over a carrier MPLS WAN, now often alongside or replaced by SD-WAN.

The largest packet a link can carry without breaking it up. Standard Ethernet MTU is 1,500 bytes.

In practice: Tunnels such as IPsec, GRE and VXLAN add headers, so an MTU mismatch can cause slow or failing connections. Data centres often use jumbo frames of about 9,000 bytes.

Checks who and what is connecting, then grants the right access: full, restricted, guest or blocked. Uses 802.1X, MAC authentication and device profiling.

In practice: Common in campus networks to keep unknown devices off corporate VLANs.

Rewrites IP addresses as packets pass through a router or firewall. Most often, many private addresses share one public address, with port numbers telling the sessions apart. This form is called PAT or NAT overload.

In practice: Lets private ranges reach the internet and publishes internal servers on public addresses.

A stateful firewall that also identifies applications and users and inspects traffic for threats. Policy is written by application and user, not only by port.

In practice: Threat prevention and TLS decryption lower throughput, so size firewalls on those figures rather than raw firewall throughput.

Keeps device clocks synchronised with accurate time sources.

In practice: Correct time matters for log correlation, certificates and authentication, which can fail when clocks drift.

A link-state routing protocol used inside an organisation. Each router builds a map of the network and calculates the lowest-cost path to every destination.

In practice: Larger networks are split into areas, with area 0 as the backbone.

Delivers power to devices over the network cable. 802.3af supplies up to 15.4 W per port, 802.3at up to 30 W and 802.3bt up to 90 W.

In practice: Check that the switch’s total PoE budget covers every access point, camera and phone it powers.

Classifies traffic and gives sensitive applications, such as voice and video, priority when links are congested.

In practice: Packets are usually marked with DSCP values; voice is commonly marked EF (DSCP 46). QoS only helps where there is congestion and every hop honours the markings.

Reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private networks. These addresses are not routed on the public internet.

In practice: Plan them carefully across sites and cloud networks to avoid overlaps that make later connections difficult.

Combines SD-WAN with cloud-delivered security, such as a secure web gateway, CASB, ZTNA and firewall as a service, so policy follows users wherever they connect.

In practice: Often adopted in stages: cloud web security first, then ZTNA, then SD-WAN integration.

Manages several WAN links, such as internet, MPLS and 4G or 5G, from a central controller and steers each application over the best path based on measured latency, loss and jitter.

In practice: Lets branches use lower-cost internet links with automatic failover and application-aware routing.

Sets up, changes and ends voice and video calls. It uses port 5060 over UDP or TCP, or 5061 with TLS.

In practice: SIP carries the signalling only; the audio itself travels separately over RTP.

The name of a Wi-Fi network. One access point can broadcast several SSIDs, each mapped to its own VLAN or policy.

In practice: Keep the number of SSIDs low, as each one adds beacon traffic that uses airtime.

Prevents layer 2 loops by blocking redundant switch links until they are needed. Modern variants include RSTP and MSTP.

In practice: Set the root bridge deliberately and enable BPDU guard on access ports.

Splits one physical switch network into separate layer 2 broadcast domains. Trunk links carry many VLANs using 802.1Q tags.

In practice: Typical designs use separate VLANs for users, voice, wireless, printers and management, each with its own subnet.

Carries phone calls as data packets. Signalling, usually SIP, sets up the call, and RTP carries the audio.

In practice: Voice is sensitive to delay, jitter and loss. Common targets are under 150 ms one-way delay, under 30 ms jitter and under 1% packet loss.

Creates separate routing tables on one router, so different networks stay apart even when their addresses overlap.

In practice: Used to separate management, guest or tenant traffic, and as the basis of MPLS VPNs.

Lets two or more routers share a virtual gateway address, so hosts keep working if one router fails. HSRP is Cisco’s equivalent.

In practice: Each redundant subnet uses three addresses: the virtual IP plus one for each router.

Carries layer 2 networks inside UDP packets across a layer 3 network. It supports about 16 million segments, compared with 4,094 usable VLANs.

In practice: Used in data centre fabrics and campus overlays, often with EVPN as the control plane.

Shows who registered a domain, IP range or AS number. RDAP is the modern, structured replacement for WHOIS.

In practice: Try the WHOIS lookup.

The current Wi-Fi security standard. WPA3-Personal uses SAE in place of the older pre-shared key handshake, and WPA3-Enterprise uses 802.1X.

In practice: Older clients may only support WPA2, so many networks run a transition mode during migration.

Gives users access to specific applications instead of the whole network, checking identity and device posture on every connection.

In practice: Often replaces traditional remote-access VPN.