Complete exam-focused notes based on syllabus analysis and PYQ patterns (2023-24 & 2024-25)
The Open Systems Interconnection model is a conceptual framework developed by ISO that divides network communication into 7 distinct layers. Each layer has specific responsibilities and communicates with the layers directly above and below it. The key principle is encapsulation — data is wrapped with headers at each layer on the sending side and unwrapped (de-encapsulated) at each layer on the receiving side.
| Feature | OSI Model | TCP/IP Model |
|---|---|---|
| Layers | 7 | 4 |
| Developed by | ISO (1984) | DARPA (1970s) |
| Type | Reference model (theoretical) | Implementation model (practical) |
| Protocol | Protocol independent | Protocol specific (TCP/IP suite) |
| Application layer | 3 separate layers (5,6,7) | Single Application layer |
| Usage | Troubleshooting, teaching | Internet (real-world) |
CRC is a powerful error detection technique. The sender appends a checksum (remainder) to the data. The receiver performs the same division — if remainder ≠ 0, an error occurred. The "generator polynomial" acts as the divisor. Division uses XOR, not regular subtraction.
| Protocol | Window Size | On Error | Efficiency |
|---|---|---|---|
| Stop & Wait | 1 | Retransmit 1 frame | Low — sender idle waiting for ACK |
| Go-Back-N | Up to 2ⁿ⁻¹ | Retransmit from error frame onward | Better — W/(1+2a) |
| Selective Repeat | Up to 2ⁿ⁻¹ | Retransmit only lost frame | Best — most efficient |
A bridge connects two LAN segments at the Data Link layer. It maintains a forwarding table (MAC address → port mapping). When a frame arrives, it reads the source MAC and records it. Then checks the destination MAC: if found → forward to correct port (filtering); if not found → flood (broadcast to all ports). This self-learning process eliminates the need for manual configuration.
Subnetting divides a large IP address block into smaller sub-networks. Borrowing bits from the host part increases the network prefix. Each borrowed bit doubles the number of subnets (halves hosts per subnet). CIDR (Classless Inter-Domain Routing) allows arbitrary prefix lengths like /26 instead of strict class boundaries.
Each router maintains a routing table (distance vector) listing the best known distance to every other router and the next hop. Periodically, routers share their tables with neighbours. On receiving a neighbour's table, update own table: new_cost = cost_to_neighbour + neighbour's_cost_to_dest. Pick the minimum. Used by RIP protocol.
| Feature | Leaky Bucket | Token Bucket |
|---|---|---|
| Output rate | Constant (fixed rate) | Variable (bursty allowed up to token count) |
| Burst traffic | Not allowed — excess dropped | Allowed if tokens available |
| Use case | Strict rate limiting (VoIP) | Flexible rate with burst (most networks) |
| Token concept | No tokens | Tokens generated at rate r; bucket capacity b |
| Max burst | None | b (bucket size = max burst size) |
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented (3-way handshake) | Connectionless |
| Reliability | Reliable — ACK, retransmission | Unreliable — no guarantee |
| Ordering | In-order delivery guaranteed | No ordering |
| Speed | Slower (overhead) | Faster (low overhead) |
| Use case | HTTP, FTP, SMTP, SSH | DNS, DHCP, VoIP, Video streaming, Gaming |
| Header size | 20–60 bytes | 8 bytes (fixed) |
DNS is the Internet's "phone book" — it translates human-readable domain names (www.google.com) to IP addresses (142.250.82.46). DNS is hierarchical and distributed. The hierarchy: Root → TLD (.com, .in) → Second-level (google) → Subdomain (www). Resolution is recursive (client asks resolver, resolver asks root, then TLD, then authoritative server) or iterative.
Each user has a key pair: Public key (shared with everyone) and Private key (kept secret). What is encrypted with the public key can only be decrypted by the corresponding private key, and vice versa. Eliminates the key distribution problem of symmetric cryptography.
Advantages: No shared secret needed, digital signatures possible, scalable for N users.
Disadvantages: Computationally expensive, vulnerable to man-in-the-middle without PKI, key management required.
| Protocol | Port | Transport | Purpose | Key Feature |
|---|---|---|---|---|
| HTTP | 80 | TCP | Web pages transfer | Stateless; uses GET, POST, PUT methods |
| HTTPS | 443 | TCP | Secure web | HTTP over SSL/TLS encryption |
| FTP | 21 (ctrl), 20 (data) | TCP | File transfer | Two connections: control + data channel |
| SMTP | 25 | TCP | Send email | Push protocol; uses MIME for multimedia |
| POP3 | 110 | TCP | Receive email | Downloads and deletes from server |
| IMAP4 | 143 | TCP | Receive email | Keeps mail on server; supports folders |
| DNS | 53 | UDP (mainly) | Name resolution | Hierarchical distributed database |
| DHCP | 67/68 | UDP | IP auto-assignment | DORA process (Discover-Offer-Request-ACK) |
| Telnet | 23 | TCP | Remote login | Unencrypted — use SSH instead |
| SNMP | 161/162 | UDP | Network management | Manager-Agent model, MIB database |
| Medium | Max Bandwidth | Max Distance | Attenuation | Cost | Use Case |
|---|---|---|---|---|---|
| UTP | 1–10 Gbps | 100 m | High | Low | LAN, telephone |
| Coaxial | 10 Gbps | 500 m | Medium | Medium | Cable TV, old LAN |
| Single-mode Fiber | 100+ Gbps | 100+ km | Very Low | High | WAN, backbone, ISP |
| Multi-mode Fiber | 10 Gbps | 2 km | Low | Medium-High | Campus LAN, data centers |
| Radio (WiFi) | 9.6 Gbps | ~100 m indoors | High (obstacles) | Low | WLAN, mobile |
| Microwave | Gbps | ~50 km (LOS) | Medium | Medium | Backhaul, point-to-point |
| Satellite | Mbps | Global | High | High | Remote areas, GPS |
| Encoding | 1 represented as | 0 represented as | Advantage | Disadvantage |
|---|---|---|---|---|
| NRZ-L | High voltage | Low voltage | Simple | DC component, sync issues on long same-bit runs |
| NRZ-I | Transition at bit start | No transition | No baseline wander from 1-strings | Long 0 strings lose sync |
| Manchester | Low→High mid-bit | High→Low mid-bit | Self-clocking (sync always present) | Requires double bandwidth |
| Diff. Manchester | No transition at bit start | Transition at bit start | Noise resistant, polarity independent | Complex decoding |
| AMI (Bipolar) | Alternating +V and −V | Zero voltage | No DC component, error detection if lone zero | Long 0-strings lose sync |
| 4B/5B | Every 4 data bits mapped to 5-bit code (no more than 1 leading 0 or 2 trailing 0s) | Guarantees transitions for sync | 20% overhead | |
| Feature | CSMA/CD (802.3 Ethernet) | CSMA/CA (802.11 WiFi) |
|---|---|---|
| Full form | Carrier Sense Multiple Access / Collision Detection | Carrier Sense Multiple Access / Collision Avoidance |
| Medium | Wired (can measure signal on wire) | Wireless (cannot detect collision — half-duplex, own signal drowns received) |
| Collision handling | Detect collision while transmitting, send JAM signal, back off | Avoid collision before it happens using backoff + optional RTS/CTS |
| DIFS/SIFS | Not used | DIFS = wait before transmit; SIFS = short wait before ACK |
| RTS/CTS | Not used | Optional: Request To Send → Clear To Send (solves hidden node problem) |
| ACK | No explicit ACK (collision = retransmit) | Every frame must be ACKed; no ACK → retransmit |
| Efficiency | High when load is low | Lower due to overhead of avoidance mechanisms |
| Min frame size | 64 bytes (ensures collision detected in time) | No similar constraint (no collision detection) |
| Standard | Technology | Speed | Medium | Use Case |
|---|---|---|---|---|
| IEEE 802.3 | Ethernet (CSMA/CD) | 10 Mbps to 400 Gbps | Twisted pair, fiber, coax | Wired LAN — universally used |
| IEEE 802.3u | Fast Ethernet | 100 Mbps | Cat5 UTP or fiber | 100Base-TX, office LAN |
| IEEE 802.3ab | Gigabit Ethernet | 1 Gbps | Cat5e/Cat6 UTP | 1000Base-T, enterprise LAN |
| IEEE 802.11b/g/n | Wi-Fi 1/2/4 | 11/54/600 Mbps | 2.4 GHz radio | Home and office WiFi |
| IEEE 802.11ac | Wi-Fi 5 | Up to 3.5 Gbps | 5 GHz radio | High-speed WLAN |
| IEEE 802.15.1 | Bluetooth | 1–3 Mbps | 2.4 GHz, 10m range | WPAN: peripherals, headsets |
| IEEE 802.15.4 | Zigbee | 250 Kbps | 2.4 GHz, low power | IoT sensors, smart home |
| IEEE 802.16 | WiMAX | Up to 1 Gbps | 2–66 GHz radio | WMAN: city-wide broadband |
| IEEE 802.1D | STP (Spanning Tree) | — | — | Loop prevention in switched LANs |
| IEEE 802.1Q | VLAN Tagging | — | — | Virtual LANs on shared switches |
In networks with multiple bridges/switches, there can be multiple paths between nodes. This creates broadcast storms: a broadcast frame loops endlessly causing network meltdown. STP prevents this by building a logical loop-free tree while maintaining physical redundancy.
| Class | First Octet Range | Default Mask | Network Bits | Host Bits | Max Hosts | Use |
|---|---|---|---|---|---|---|
| A | 1 – 126 | 255.0.0.0 (/8) | 8 | 24 | 16,777,214 | Very large orgs, ISPs |
| B | 128 – 191 | 255.255.0.0 (/16) | 16 | 16 | 65,534 | Medium-large orgs |
| C | 192 – 223 | 255.255.255.0 (/24) | 24 | 8 | 254 | Small orgs, home networks |
| D | 224 – 239 | N/A | — | — | — | Multicast groups |
| E | 240 – 255 | N/A | — | — | — | Research/reserved |
| Feature | RIP v2 | OSPF | BGP-4 |
|---|---|---|---|
| Type | IGP (intradomain) | IGP (intradomain) | EGP (interdomain) |
| Algorithm | Distance Vector (Bellman-Ford) | Link State (Dijkstra SPF) | Path Vector |
| Metric | Hop count (max 15; 16 = ∞) | Cost = 10⁸/bandwidth | Path attributes (AS-PATH, LOCAL-PREF, MED) |
| Convergence | Slow (minutes) | Fast (seconds) | Slow (policy-driven) |
| Transport | UDP port 520 | Directly over IP (Protocol 89) | TCP port 179 |
| Update trigger | Every 30 seconds (full table) | On topology change (LSA flooding) | On change (incremental updates) |
| Scale | Small networks (<15 hops) | Large enterprise (areas/hierarchy) | Internet-scale (entire global routing) |
| Features | Simple, easy config | Areas, DR/BDR, VLSM, auth | Policy-based, multi-homing, confederations |
| Loop prevention | Split horizon, poison reverse | SPF guarantees loop-free tree | AS-PATH attribute (own AS = discard) |
A VPN creates an encrypted tunnel through a public network (Internet). The private IP packet is encapsulated inside a public packet — this is tunneling. The VPN gateway at the receiving end decapsulates and decrypts. From the application's perspective, the remote device appears to be on the local private network.
| VPN Type | Description | Protocol | Use Case |
|---|---|---|---|
| Site-to-Site | Connects two entire LANs. Gateways handle encryption transparently. | IPSec (Tunnel mode) | Branch office connectivity |
| Remote Access | Individual user connects to corporate network from home. | SSL/TLS, IPSec, OpenVPN | Work from home, travel |
| MPLS VPN | Service provider creates virtual circuits using labels. | MPLS + BGP | Enterprise WAN, ISP services |
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented (3-way handshake required) | Connectionless (no setup) |
| Reliability | Guaranteed delivery via ACK + retransmission | Best-effort, no guarantee |
| Ordering | Sequence numbers ensure in-order delivery | Packets may arrive out of order |
| Error control | Checksum + ACK + retransmit | Checksum only (optional) |
| Flow control | Sliding window (receiver advertises buffer) | None |
| Congestion control | Slow start, AIMD, fast retransmit | None (can overwhelm network) |
| Header size | 20–60 bytes (variable due to options) | 8 bytes (fixed) |
| Speed | Slower (overhead, wait for ACKs) | Very fast (fire and forget) |
| Suitable for | HTTP, HTTPS, FTP, SMTP, SSH — anything requiring reliability | DNS, DHCP, VoIP, video streaming, online gaming, SNMP |
TCP's congestion control follows AIMD: increase window additively when no congestion (add 1 MSS per RTT in Congestion Avoidance), decrease window multiplicatively when congestion detected (halve cwnd on 3 dup ACKs; reset to 1 on timeout). This creates the characteristic "sawtooth" pattern of TCP throughput over time.
| Phase | Trigger | cwnd behavior | Growth |
|---|---|---|---|
| Slow Start | Connection start or timeout recovery | Doubles every RTT (cwnd += 1 per ACK) | Exponential |
| Congestion Avoidance | cwnd ≥ ssthresh | Increases by 1 MSS per RTT (cwnd += MSS²/cwnd per ACK) | Linear (additive) |
| Timeout event | Timer expires (severe congestion) | ssthresh = cwnd/2; cwnd = 1 MSS; restart Slow Start | Drastic reset |
| 3 Dup ACKs (Fast Retransmit) | 3 same ACKs received (mild congestion) | ssthresh = cwnd/2; cwnd = ssthresh (TCP Reno: Fast Recovery) | Multiplicative decrease |
| Fast Recovery (TCP Reno) | After 3 dup ACKs | Skip Slow Start; enter Congestion Avoidance at new ssthresh | Linear from ssthresh |
| Range | Category | Examples |
|---|---|---|
| 0 – 1023 | Well-Known Ports (assigned by IANA, require root/admin) | 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 80 HTTP, 110 POP3, 143 IMAP, 161/162 SNMP, 443 HTTPS |
| 1024 – 49151 | Registered Ports (registered with IANA, apps can request) | 1433 MS SQL Server, 3306 MySQL, 3389 RDP, 5432 PostgreSQL, 8080 HTTP alternate, 27017 MongoDB |
| 49152 – 65535 | Dynamic/Ephemeral Ports (assigned temporarily to clients) | Automatically assigned by OS to client-side of connections; released after connection closes |
| HTTP Method | Purpose | Idempotent? | Has Body? | Safe? |
|---|---|---|---|---|
| GET | Retrieve resource | Yes | No | Yes (no side effects) |
| POST | Submit data (form, create resource) | No | Yes | No |
| PUT | Create or replace resource entirely | Yes | Yes | No |
| PATCH | Partially update resource | No | Yes | No |
| DELETE | Remove resource | Yes | No | No |
| HEAD | Same as GET but no body returned (check headers) | Yes | No | Yes |
| OPTIONS | Query allowed methods for a resource | Yes | No | Yes |
| SNMP PDU | Direction | Purpose |
|---|---|---|
| GetRequest | Manager → Agent | Request value of one or more MIB variables |
| GetNextRequest | Manager → Agent | Get next OID in MIB tree (used for table traversal) |
| GetBulkRequest | Manager → Agent | Retrieve large blocks of MIB data efficiently (SNMPv2c+) |
| SetRequest | Manager → Agent | Set value of a MIB variable (configure device) |
| GetResponse | Agent → Manager | Reply to Get/Set requests with values or error status |
| Trap | Agent → Manager | Unsolicited notification of important event (cold start, link down, auth failure) |
| InformRequest | Agent → Manager | Like Trap but requires acknowledgment (SNMPv2c+) |
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| DES | 56 bits | 64 bits | Broken (1999) | Only 2⁵⁶ keys — brute-forced in <24h today |
| 3DES (Triple DES) | 112 or 168 bits | 64 bits | Deprecated | Apply DES 3 times: encrypt-decrypt-encrypt. Slow. |
| AES | 128, 192, or 256 bits | 128 bits | Current standard | Rijndael algorithm. Fast in hardware & software. Used in WPA2, TLS, disk encryption. |
| RC4 | Variable (40–2048 bits) | Stream cipher | Deprecated | Was used in WEP WiFi (broken) and SSL/TLS (deprecated). |
| ChaCha20 | 256 bits | Stream cipher | Modern/active | Used in TLS 1.3, WireGuard VPN. Fast on mobile CPUs without AES hardware acceleration. |