Computer Networks — Cheat Sheet¶

[!TIP] This cheat sheet is a reference for after you've learned the material — not a shortcut to avoid learning it. If you're looking something up here before truly understanding it, go back to the relevant module first. A cheat sheet only helps people who already know what they're looking for.

Quick Navigation¶

• OSI Layers Quick Reference
• Common Port Numbers
• Subnetting Cheat Sheet
• TCP State Machine Summary
• DNS Record Types
• Key Command Reference
• Decision Guides
• Gotchas & Pitfalls

OSI Layers Quick Reference¶

Memory aid: "Please Do Not Throw Sausage Pizza Away" (Physical, Data Link, Network, Transport, Session, Presentation, Application)

TCP/IP 4-Layer Mapping:

Common Port Numbers¶

Subnetting Cheat Sheet¶

IPv4 CIDR Quick Reference¶

Formula: Usable hosts = 2^(32 - prefix) - 2

Private IPv4 Address Ranges (RFC 1918)¶

IPv6 Quick Reference¶

TCP State Machine Summary¶

CLOSED → (SYN sent) → SYN_SENT → (SYN-ACK received, ACK sent) → ESTABLISHED
                                                                        │
LISTEN → (SYN received, SYN-ACK sent) → SYN_RCVD → (ACK received) → ESTABLISHED
                                                                        │
                                                           (FIN sent) → FIN_WAIT_1
                                                           (FIN received) → CLOSE_WAIT
                                                                        │
                                                           (ACK received) → FIN_WAIT_2
                                                           (FIN sent, ACK received) → LAST_ACK
                                                                        │
                                                           (FIN received, ACK sent) → TIME_WAIT → CLOSED

3-Way Handshake:

Client          Server
  │──── SYN ────►│   (Client ISN: x)
  │◄── SYN-ACK ──│   (Server ISN: y, ACK: x+1)
  │──── ACK ────►│   (ACK: y+1)
  │   ESTABLISHED│

4-Way Teardown:

Active Closer   Passive Closer
  │──── FIN ────►│
  │◄──── ACK ────│
  │◄──── FIN ────│
  │──── ACK ────►│
  │  TIME_WAIT   │  (waits 2×MSL before CLOSED)

DNS Record Types¶

Key Command Reference¶

Decision Guides¶

Which transport protocol should I use?¶

Need to choose TCP vs UDP?
│
├── Need guaranteed delivery and ordering?
│   └── YES → Use TCP
│       (HTTP, HTTPS, SSH, database connections, file transfer)
│
├── Can tolerate packet loss? Is low latency critical?
│   └── YES → Consider UDP
│       (DNS queries, NTP, VoIP, live video streaming, games)
│
├── Are you implementing a request-response in a single packet?
│   └── YES → UDP is simpler (DNS, SNMP)
│
└── Not sure? → Default to TCP unless you have a specific reason not to

Which IP address range for a new network?¶

Designing a new private network?
│
├── Huge enterprise (>65k hosts)?
│   └── Use 10.0.0.0/8 with careful subnetting
│
├── Medium enterprise (1k–64k hosts)?
│   └── Use 172.16.0.0/12 or a large block from 10.0.0.0/8
│
├── Home / small office (<254 hosts per segment)?
│   └── Use 192.168.0.0/16 with /24 subnets
│
└── Need to avoid conflicts with RFC 1918 (e.g., VPNs)?
    └── Use 100.64.0.0/10 (CGNAT range, RFC 6598) or coordinate with your ISP

Gotchas & Pitfalls¶

[!WARNING] Forgetting that subnet masks affect routing, not just addressing A common mistake is assigning an IP with the wrong prefix length. If your server is 10.0.1.5/24 but the router has 10.0.1.5/16, they have different views of what's local vs. what needs a gateway.

Wrong: ip addr add 10.0.1.5/16 dev eth0 (when all other hosts are /24) Right: ip addr add 10.0.1.5/24 dev eth0

[!WARNING] Assuming TCP delivers message boundaries TCP is a byte stream, not a message protocol. send("hello") on one side does NOT guarantee recv() on the other side returns exactly "hello". TCP may split or merge writes arbitrarily.

Wrong: Assuming one send() = one recv() Right: Prefix messages with their length, or use a delimiter, and read in a loop until you have a complete message.

[!WARNING] Confusing NAT with a firewall NAT (Network Address Translation) is not a security mechanism — it's an address translation mechanism. A NAT device that happens to block unsolicited inbound connections provides some protection, but this is a side effect, not the purpose. Use explicit firewall rules for security.

Other things to watch out for:

• TTL expires on traceroute — traceroute works by sending packets with TTL=1, 2, 3… Each router decrements TTL and sends ICMP Time Exceeded when it hits 0. Some routers rate-limit ICMP, causing *** hops that don't indicate a real outage.
• TIME_WAIT sockets — After a TCP connection closes, the active closer stays in TIME_WAIT for 2×MSL (typically 60–120 seconds). Under high connection rates, this can exhaust ephemeral ports. Use SO_REUSEADDR on servers.
• BGP is trust-based — BGP announcements are not authenticated by default. A misconfigured (or malicious) router can announce someone else's IP prefixes, causing traffic to be misdirected. This is called BGP hijacking.
• DNS is not encrypted by default — Plain DNS queries over UDP are visible to anyone between you and the resolver. DNS over HTTPS (DoH) and DNS over TLS (DoT) address this.

Module Cross-References¶

Last updated: 2026-06-09