Computer Networking: OSI, TCP/IP, IPv4/IPv6 and Subnetting

Physical media carry signals representing bits: electrical, optical or radio. Ethernet variants and wireless standards use different encoding and modulation. Do not assume every modern link uses Manchester encoding or that a medium directly identifies a device.

Baseband and broadband describe signalling arrangements in context; marketing use of “broadband” is broader. Multiplexing and channelisation do not make every channel’s physical measurements available in an ordinary packet capture.

Link rate is a nominal capacity. Throughput measures achieved transfer under the chosen definition, while application goodput excludes relevant overhead and retransmitted data. Use explicit measurement boundaries when estimating a transfer.

One byte equals eight bits, so a hypothetical 1 Gb/s rate corresponds to 125 MB/s before overhead using decimal units. Capture loss, retransmissions, compression and encryption can complicate comparison with a file’s stored size.

Latency is delay; round-trip time measures an outward-and-return interval. Jitter describes delay variation under a stated metric, not universally the standard deviation of ping times. Report measured conditions instead of generic city or network-type timings.

The OSI layers organise functions, while real protocols do not always map neatly to one layer. Wireshark dissects recognised structures and encapsulations rather than requiring a seven-header layout.

Encapsulation places one protocol’s data within another. A conventional HTTPS exchange might use HTTP over TLS over TCP over IP over Ethernet, but HTTP/3 uses QUIC over UDP and tunnels add different layers.

For a remote IPv6 destination, a host needs an appropriate routable source; its link-local address is not a global Internet source. DNS resolution and the HTTPS connection are separate exchanges and can involve different servers.

At an ordinary routed Ethernet boundary, new link frames use next-hop link identities. NAT can translate IP addresses and ports; proxies can terminate one connection and originate another. Tunnels add their own inner and outer views.

SNI may be visible in some TLS handshakes, but Encrypted Client Hello can protect the inner name. Capturing encrypted traffic does not expose every URL or content field. Describe exactly what the observed handshake reveals.

A common four-layer Internet model groups link, internet, transport and application functions. ARP supports IPv4 neighbour resolution on applicable links; IPv6 neighbour discovery uses ICMPv6. Model placement is less important than understanding the actual fields and scope.

TCP offers a reliable ordered byte stream under its protocol conditions, while UDP provides datagrams without that TCP delivery machinery. QUIC is a distinct UDP-based transport with integrated cryptographic protection; it is not simply a visible TCP conversation on another port.

In a simple TCP handshake, SYN consumes one sequence number, SYN-ACK acknowledges it and the final ACK acknowledges the peer’s SYN. Retransmissions, simultaneous opens and incomplete capture require additional interpretation.

A SYN without a captured response can reflect filtering, loss, an offline destination or observation limits. RST packets have several legitimate causes. Neither pattern alone proves tampering or an application crash.

Common ports help triage but do not establish the application. TCP/443 traffic without an observed ClientHello can be a partial capture or another authorised service. A capture may start after a handshake.

With Ethernet carrying IPv4 and TCP without options, the conventional headers are 14, 20 and 20 bytes respectively. At IP MTU 1500, the corresponding maximum TCP data is 1460 bytes before other constraints. VLANs, IPv6, options, tunnels and offload need separate treatment.

IPv4 has 32-bit addresses. CIDR /n identifies n prefix bits and 32 − n remaining bits, giving 2^(32 − n) total addresses. Historical classes do not determine modern subnet boundaries.

For a conventional broadcast /24 subnet, 256 total addresses ordinarily provide 254 host addresses after the network and broadcast endpoints. A /31 point-to-point link and a /32 host route use different conventions.

Private IPv4 ranges are not globally unique and can be routed internally or across controlled tunnels. NAT is not the only way two private networks communicate. Consult current special-purpose registries for loopback, link-local, documentation and shared address space.

100.64.0.0/10 is shared address space associated with carrier-grade NAT and is distinct from RFC 1918 private space. Public address attribution can require protocol, source port, precise timestamp/timezone and destination context under the provider’s actual mapping records.

Aggregation needs alignment: 203.0.112.0/24 and 203.0.113.0/24 combine into 203.0.112.0/23. The adjacent-looking 203.0.113.0/24 and 203.0.114.0/24 do not form one aligned /23. A prefix request does not inherently identify one subscriber.

IPv6 addresses have 128 bits. Zero compression can use :: once; for example, 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. The 2001:db8::/32 range is reserved for documentation.

Link-local, unique-local, multicast, loopback and globally routable addresses have different scopes. An address beginning fe80 is not a usable remote Internet identity. IPv6 avoids IPv4-style broadcast but still uses multicast and neighbour discovery.

SLAAC uses router-advertised prefix information and interface identifier rules where applicable. Stable opaque identifiers and temporary addresses reduce direct hardware linkage; temporary address lifetimes are not a universal fixed 24-hour rotation.

A modified EUI-64 pattern can sometimes suggest an underlying 48-bit identifier, but a matching bit pattern does not authenticate hardware. Address assignment can be manual, virtualised, changed or spoofed. Capture age does not alone determine the method.

Correlate actual prefix delegation, address assignment, DHCPv6 where used, neighbour records and endpoint evidence. A carrier does not necessarily have the customer LAN’s neighbour table, and a delegated prefix is not automatically an individual device.

Dual-stack, NAT64, proxies and tunnels can create different IPv4/IPv6 observations. Request fields appropriate to the documented service and time interval. Retention and legal access requirements vary by jurisdiction.

Common Ethernet MAC identifiers contain 48 bits, including individual/group and universal/local administration bits. Registered prefix lookup can suggest an assignee for a universally administered address, but not necessarily the final device manufacturer or user.

Locally administered addresses can be used by privacy features, virtual machines and manual configuration. Their presence does not by itself prove randomisation. Privacy address behaviour varies by network, device and settings.

A switch learns forwarding information within its relevant domain. Known unicast, unknown unicast, broadcast and multicast have different forwarding behaviour. A router forwards between networks under its routing and policy configuration.

An ordinary endpoint capture does not see every switched conversation. A tap observes its actual physical link; SPAN mirrors configured traffic with potential loss or omissions. Choose collection placement for the question.

Bridges, access points, firewalls and load balancers can combine functions. A load balancer need not terminate TLS merely because it uses application-level information. Record actual architecture and logs.

Longest-prefix matching normally selects the most specific applicable route, subject to routing and policy context. A default route covers otherwise unmatched destinations; BGP route information alone is not a complete historical packet path.

LAN, WAN, PAN and other scope labels help describe an environment, but do not establish protocol, authority or data retention. Physical topology and logical paths can differ, especially with VLANs, overlays and VPNs.

Star, mesh, ring and hierarchical designs affect collection points and failure behaviour. Client-server and peer-to-peer applications can both leave endpoint, network and service records; absence of a central service does not make attribution impossible.

Wi-Fi generations describe capabilities whose actual use depends on both endpoints, access points, configuration and regional spectrum rules. Wi-Fi 6E extends 802.11ax operation into permitted 6 GHz spectrum; available channels are not identical worldwide.

Wi-Fi 7 introduces capabilities including multi-link operation and wider channels where supported. Capture needs compatible radios, drivers and tooling for the actual channels and links. A software version alone does not guarantee full capture.

Preserve source clocks, capture interface, link type, snap length, loss statistics, filters and network map. Traffic visibility, encryption and sampling limits must travel with the findings rather than disappear when records are exported.