Chapter 1

Networking Fundamentals

CompTIA Network+ (N10-009) Study GuideBased on the CompTIA Network+ N10-009 exam objectives

Every network administrator, every network engineer, every IT technician who has ever untangled a network problem starts from the same place: the fundamentals. The models that describe how data moves, the protocols that carry it, the ports it passes through, and the shapes networks take when they are built. The CompTIA Network+ N10-009 exam devotes a significant share of its questions to these concepts — not because CompTIA enjoys asking you to recite lists from memory, but because everything else in networking rests on them. Subnetting, routing, VLANs, troubleshooting, security — all of it assumes you already speak this language.

This chapter builds that language from the ground up. We will not just memorize the seven layers of the OSI model; we will understand why each layer exists, what problem it solves, and what happens in the real world when something breaks at each one. We will compare the models, watch data get wrapped and unwrapped as it travels, learn the ports and protocols that make the internet work, and look at how networks are physically and logically shaped.

The OSI Model: A Map of How Networks Talk

Imagine trying to build a global postal system. Letters have to be written, sealed, addressed, sorted, shipped across oceans, delivered to the right street, and read by the right person — and every country involved has its own customs. If everyone tried to solve all of those problems at once, nothing would work. The sensible approach is to divide the job into layers: one layer handles writing, another handles addressing, another handles transport. Each layer has a job, and each layer only talks to the layers directly above and below it.

That is exactly what the OSI (Open Systems Interconnection) model does for networking. Developed by the ISO in the 1980s, it divides network communication into seven distinct layers, each responsible for a specific part of moving data from one device to another. The model itself is not a product you buy or software you install — it is a conceptual framework. But it is the framework the entire networking industry uses to describe problems, assign responsibilities, and troubleshoot.

The seven layers, from top (closest to the user) to bottom (closest to the physical wire), are: Application, Presentation, Session, Transport, Network, Data Link, and Physical. A common mnemonic for remembering them top-down is "All People Seem To Need Data Processing." Bottom-up (Physical to Application) it becomes "Please Do Not Throw Sausage Pizza Away." Pick whichever sticks in your brain — you will need to recite these layers on the exam in both directions.

Layer 7: Application

The Application layer is the one users actually interact with — not in the sense that it is the application (your web browser is not the Application layer), but in the sense that it provides the network services applications use to communicate. When you type a web address and hit Enter, your browser speaks HTTP to a web server through services provided at this layer. When you check your email, your mail client speaks SMTP, POP3, or IMAP. When you resolve a website name to an address, that is DNS — also an Application-layer protocol.

The key insight is that the Application layer is where network protocols that humans use directly live. It is the boundary between software and the network. Firewalls that inspect the content of traffic (not just addresses and ports) operate at this layer — they are called application-layer or Layer 7 firewalls. Proxies, which intercept and forward requests on behalf of clients, also work here.

Layer 6: Presentation

The Presentation layer is the network's translator and formatter. Its job is to make sure data is presented in a way the receiving system can understand, regardless of differences in how the two systems represent information internally. This includes data formatting (converting between formats like ASCII and EBCDIC, or JPEG and GIF), encryption and decryption (SSL/TLS operates here — it encrypts data before it goes down the stack), and compression (shrinking data to move it faster).

Think of it this way: if two people want to have a conversation but one speaks only French and the other only Japanese, they need a translator. The Presentation layer is that translator. It does not care about the meaning of the conversation (that is the Application layer's concern) — it only cares that the data is in a mutually intelligible form.

Layer 5: Session

The Session layer manages conversations between devices — the sessions themselves. It establishes, maintains, and terminates connections. When you log into a server, the Session layer is responsible for keeping track of that session: who you are, that you are authenticated, that the conversation is still active. It handles dialog control (deciding whose turn it is to talk, like a walkie-talkie protocol) and synchronization (placing checkpoints in long data transfers so that if the connection drops, the transfer can resume from the last checkpoint rather than starting over).

A practical example: when you download a large file and the connection drops at 90%, a session-aware protocol can resume from where it left off. That recovery ability is a Session-layer function. NetBIOS and RPC (Remote Procedure Call) are classic examples of Session-layer protocols.

Layer 4: Transport

The Transport layer is one of the two layers the exam tests most heavily, and for good reason — this is where the two great transport protocols, TCP and UDP, live. The Transport layer's job is end-to-end delivery: getting data from the sending application to the receiving application reliably (or quickly, depending on which protocol you choose), breaking large messages into smaller pieces called segments, and reassembling them in the correct order on the other end.

TCP (Transmission Control Protocol) is the reliable one. It establishes a connection with a three-way handshake (SYN, SYN-ACK, ACK), numbers every segment so they can be reassembled in order, acknowledges receipt, retransmits lost segments, and manages flow so a fast sender does not overwhelm a slow receiver. UDP (User Datagram Protocol) is the fast one. It skips the handshake, skips the acknowledgments, skips the retransmission — it just sends datagrams and hopes they arrive. We will compare TCP and UDP in detail later in this chapter, because the exam tests that comparison relentlessly.

The Transport layer also introduces port numbers — the addressing scheme that lets a single device run many network conversations at once. Your computer can browse the web, check email, and stream video simultaneously because each conversation uses a different port number. Ports 0–1023 are the well-known ports reserved for common services (HTTP is 80, HTTPS is 443, DNS is 53), ports 1024–49151 are registered ports, and 49152–65535 are dynamic or private ports used for the client side of connections.

Layer 3: Network

The Network layer is where routing happens — the other most-tested layer on the exam. Its job is logical addressing and path determination: figuring out how to get a packet from the source network to the destination network, even when those networks are on opposite sides of the planet. The Network layer introduces IP addresses (the logical addresses that identify devices across networks) and routers (the devices that read those addresses and forward packets toward their destination).

At this layer, data is called a packet (or datagram). The Network layer adds the source and destination IP addresses to each packet. It does not care whether the packet arrives — that is the Transport layer's job. It only cares about which direction to send it. The protocols that live here include IP (IPv4 and IPv6), ICMP (the protocol behind ping and traceroute), and the routing protocols that routers use to share information about network paths: RIP, OSPF, EIGRP, and BGP.

Here is the mental model that separates people who pass from people who struggle: the Network layer answers the question "which network is this going to?" while the Data Link layer (below it) answers "which device on this network is this going to?" Routers work at Layer 3 because they move packets between networks. Switches work at Layer 2 because they move frames within a network.

Layer 2: Data Link

The Data Link layer handles physical addressing and local delivery — getting data from one device to another on the same network segment. While the Network layer uses IP addresses (logical, changeable, hierarchical), the Data Link layer uses MAC addresses (physical, burned into the network interface card, flat). Every network interface has a unique 48-bit MAC address, usually written as six pairs of hexadecimal digits like A4:5E:60:C3:21:9F.

At this layer, data is called a frame. The Data Link layer wraps the Network-layer packet in a frame that includes the source and destination MAC addresses, plus a frame check sequence (FCS) for error detection. Switches operate at Layer 2: they learn which MAC addresses are on which ports and forward frames only to the correct port, which is what makes a switch smarter than a hub (a hub just repeats everything to everyone).

The Data Link layer is divided into two sublayers: LLC (Logical Link Control), which handles flow control and error checking and talks upward to the Network layer, and MAC (Media Access Control), which handles physical addressing and talks downward to the Physical layer. The exam occasionally asks about these sublayers, so know that LLC is the upper half and MAC is the lower half of Layer 2.

Layer 1: Physical

The Physical layer is the foundation — the actual bits on the wire (or in the air). It defines the electrical, optical, and radio characteristics of the network: voltage levels, cable types, connector types, pin layouts, data rates, and how bits are encoded into signals. Hubs and repeaters operate at Layer 1 — they do not read addresses at all, they simply regenerate and repeat the signal. Network interface cards (NICs) have Physical-layer components (the transceiver that converts bits to signals) even though the NIC as a whole spans Layers 1 and 2.

This is also the layer of Ethernet standards (10BASE-T, 100BASE-TX, 1000BASE-T), fiber optic specifications, and wireless radio frequencies. When a cable is cut, a connector is loose, or there is electromagnetic interference, the problem is at Layer 1 — and experienced troubleshooters always check Layer 1 first, because no amount of software configuration fixes a broken wire.

The TCP/IP Model: The One That Actually Runs the Internet

Here is a secret that surprises many students: the OSI model, for all its elegance, is not what the internet actually uses. The internet runs on the TCP/IP model — a simpler, older framework with only four layers. The OSI model was designed by committee as an ideal standard; the TCP/IP model grew organically out of the ARPANET research project and won by being practical and already deployed.

The four TCP/IP layers are:

1. Application — combines OSI Layers 5, 6, and 7 (Session, Presentation, Application). Everything from HTTP to DNS to the session and encryption functions lives here.
2. Transport — matches OSI Layer 4 exactly. TCP and UDP, ports, segmentation.
3. Internet — matches OSI Layer 3. IP addressing and routing. (Called "Internet" rather than "Network" to avoid confusion with the idea of a physical network.)
4. Network Access (sometimes called Link or Network Interface) — combines OSI Layers 1 and 2. Everything about getting frames across a single physical link: Ethernet, MAC addresses, cabling.

Why does the exam test both models? Because the OSI model's seven layers give you precise vocabulary for troubleshooting ("the problem is at Layer 3, not Layer 2"), while the TCP/IP model's four layers describe how real protocols are actually organized. You need to be able to map between them. The most common exam question on this topic shows you a protocol or function and asks which TCP/IP layer it belongs to — and the trap is that the answer choices mix OSI and TCP/IP terminology.

Encapsulation and Decapsulation: How Data Gets Wrapped for Travel

Now that you understand the layers, here is the beautiful part: watch what happens to a piece of data as it travels down through the layers on the sending device and back up through them on the receiving device. This process is called encapsulation (wrapping, on the way down) and decapsulation (unwrapping, on the way up).

Imagine you are sending a fragile gift. You put the gift in a box (one layer of wrapping), then put that box inside a shipping carton with padding (another layer), then slap a shipping label on the carton (another layer). At each step, a different handler adds the information it needs: the gift box has a card, the carton has cushioning, the label has the address. On arrival, each layer is removed in reverse order by the appropriate handler.

Data works the same way:

1. Application, Presentation, Session (Layers 7–5): Your email message is created, formatted, encrypted, and a session is established. The data is still just data at this point.
2. Transport (Layer 4): The data is broken into segments. Each segment gets a TCP (or UDP) header containing the source and destination port numbers and sequence numbers.
3. Network (Layer 3): Each segment is wrapped in a packet. An IP header is added with the source and destination IP addresses.
4. Data Link (Layer 2): Each packet is wrapped in a frame. A header with source and destination MAC addresses is added, plus a trailer with error-checking information.
5. Physical (Layer 1): The frame is converted into bits — electrical signals, light pulses, or radio waves — and transmitted.

On the receiving end, the process reverses: bits become frames (Physical to Data Link), the frame header is stripped to reveal the packet (decapsulation at Layer 2), the packet header is stripped to reveal the segment (Layer 3), the segment is reassembled and the port numbers read (Layer 4), and finally the application receives the data (Layers 5–7).

Notice the pattern in the terminology: data → segment → packet → frame → bits. Each layer adds its own header (and the Data Link layer adds a trailer too). Each header contains exactly the addressing information that layer needs: ports at Layer 4, IP addresses at Layer 3, MAC addresses at Layer 2.

Common Ports and Protocols: The Language of Services

Every network service listens on a port number, and the exam expects you to know the important ones. These are not arbitrary — they are the well-known ports (0–1023) assigned by IANA, and they appear in scenario questions constantly. ("A user cannot reach a secure website — which port should you check?" Answer: 443.)

Learn these as pairs — protocol, port, and what it does:

Web and file transfer:

• HTTP — port 80 (TCP). The protocol of the unencrypted web. Every http:// address uses it.
• HTTPS — port 443 (TCP). HTTP wrapped in TLS encryption. Every https:// address uses it. This is the port that matters most in the modern web.
• FTP — ports 20 and 21 (TCP). File Transfer Protocol. Port 21 is the control connection (commands), port 20 is the data connection (the actual files) in active mode.
• SFTP — port 22 (TCP). SSH File Transfer Protocol — file transfer tunneled through SSH. Not the same as FTPS.
• FTPS — ports 989/990 (TCP). FTP with TLS/SSL encryption. Different from SFTP despite the similar name — a classic exam trap.
• TFTP — port 69 (UDP). Trivial FTP — a stripped-down, unauthenticated file transfer protocol used for things like pushing firmware to network devices. Because it is UDP and has no authentication, it is fast but insecure.

Remote administration:

• SSH — port 22 (TCP). Secure Shell — encrypted remote command-line access. Replaced Telnet.
• Telnet — port 23 (TCP). The old unencrypted remote terminal protocol. Still tested because you need to know not to use it.
• RDP — port 3389 (TCP). Remote Desktop Protocol — Microsoft's graphical remote desktop.

Email:

• SMTP — port 25 (TCP). Simple Mail Transfer Protocol — sending email between mail servers. (Also port 587 for message submission.)
• POP3 — port 110 (TCP). Post Office Protocol — receiving email by downloading it (usually deleting it from the server).
• IMAP — port 143 (TCP). Internet Message Access Protocol — receiving email while leaving it on the server, synced across devices.

Network services:

• DNS — port 53 (TCP and UDP). Domain Name System — resolves names to IP addresses. Uses UDP for normal queries and TCP for zone transfers and large responses.
• DHCP — ports 67 and 68 (UDP). Dynamic Host Configuration Protocol — automatically assigns IP addresses. Port 67 is the server side, port 68 is the client side.
• SNMP — ports 161 and 162 (UDP). Simple Network Management Protocol — monitors and manages network devices. Port 161 is the agent (polled by the manager), port 162 is for traps (unsolicited alerts from agent to manager).
• NTP — port 123 (UDP). Network Time Protocol — synchronizes clocks across devices. Critical for log correlation and Kerberos authentication.
• LDAP — port 389 (TCP/UDP). Lightweight Directory Access Protocol — queries directory services like Active Directory. LDAPS (secure LDAP) uses port 636.

TCP vs UDP: Reliability Against Speed

We met TCP and UDP at the Transport layer. Now let us understand them deeply, because the exam treats this comparison as foundational knowledge that unlocks dozens of other questions.

TCP (Transmission Control Protocol) is connection-oriented and reliable. Before any data moves, TCP performs a three-way handshake: the client sends a SYN (synchronize) packet, the server responds with SYN-ACK (synchronize-acknowledge), and the client sends a final ACK (acknowledge). Only then does data flow. Every byte is numbered with sequence numbers, every segment must be acknowledged, lost segments are retransmitted, and the receiving side reassembles everything in order. TCP also does flow control (using a sliding window to avoid overwhelming the receiver) and congestion control (slowing down when the network is congested). All of this reliability has a cost: overhead and latency.

UDP (User Datagram Protocol) is connectionless and unreliable — "unreliable" in the technical sense, meaning it makes no promises. No handshake, no sequence numbers, no acknowledgments, no retransmission, no flow control. The application hands UDP a chunk of data, UDP slaps on a minimal header (just source port, destination port, length, and checksum) and sends it. If it arrives, great. If it does not, nobody notices at the transport layer.

So why would anyone use UDP? Because sometimes speed matters more than perfection. Consider a voice call: if a tiny fragment of audio is lost, you would rather have a millisecond of silence than wait for a retransmission that arrives half a second late and out of order — the retransmitted fragment would be worse than useless. The same logic applies to live video streaming, online gaming, and DNS queries (a lost DNS query is simply re-sent by the application in a fraction of the time a TCP handshake would take).

The rule of thumb: TCP is for data that must arrive complete and in order — web pages, email, file transfers. UDP is for data where timeliness beats perfection — voice, video, gaming, DNS, DHCP, SNMP, TFTP.

Here is the comparison the exam wants you to internalize:

Network Topologies: The Shapes Networks Take

Topology describes how devices are arranged and connected in a network. There are two kinds: physical topology (where the cables actually run) and logical topology (how data actually flows, which may differ — a network can be wired as a physical star but behave as a logical bus). The exam focuses on these fundamental shapes:

Star Topology

In a star, every device connects to a central device — usually a switch. This is the dominant topology of modern Ethernet networks: each computer has its own cable running to the switch in the wiring closet. Its great advantage is fault isolation: if one cable fails, only that one device is affected. Its disadvantage is the central point of failure: if the switch dies, the entire network goes down. Troubleshooting is easy because each link is independent — you can test one cable without disturbing the rest.

Mesh Topology

In a mesh, devices connect directly to multiple other devices. A full mesh connects every device to every other device — maximum redundancy, maximum cost. A partial mesh connects devices to some other devices, balancing redundancy against expense. Mesh topologies are common in WANs and in wireless mesh networks, where reliability matters more than cabling cost. The number of connections in a full mesh with n devices is n(n−1)/2 — the exam occasionally asks you to compute this (for 5 devices: 5×4/2 = 10 connections).

Hybrid Topology

A hybrid combines two or more topologies — and this is what real networks actually look like. A typical office has star topologies on each floor (devices to a floor switch), and those switches connect in a partial mesh or star to core switches. The internet itself is the ultimate hybrid. When a question describes a real-world network, "hybrid" is very often the right answer.

The Legacy Topologies (Know Them, Do Not Build Them)

The exam still tests bus (all devices share a single cable — one break kills everything, collisions everywhere) and ring (devices connected in a circle, data travels in one direction — a break in the ring breaks the network, though FDDI used a dual ring for fault tolerance). You will almost never build these today, but you must recognize their characteristics: bus = single point of failure along the shared medium, ring = each device acts as a repeater for its neighbor.

Client-Server vs Peer-to-Peer: Who Is in Charge?

Finally, networks differ in how they organize responsibility. In the client-server model, dedicated servers provide resources and services while clients consume them. A file server holds the company's documents; a print server manages the printers; a web server serves the intranet site. Administration is centralized: user accounts, permissions, backups, and security policies are managed in one place (often through a directory service like Active Directory). This model scales well and is the standard for businesses of any real size — but it costs more and requires dedicated hardware and administration.

In the peer-to-peer (P2P) model, every device is both a client and a server. Each computer shares its own files and printers directly with the others; there is no central authority. This is cheap and simple to set up — fine for a handful of computers in a home or tiny office — but it does not scale. Every machine must be administered individually, security is inconsistent, and there is no central backup. (Note: this is the networking definition of peer-to-peer — local file sharing between equals — not the internet file-sharing sense of BitTorrent, though the principle is similar.)

The exam frames this as a design decision: a question will describe an organization (ten users in one office vs. five hundred users across three sites) and ask which model fits. Small, simple, cheap → peer-to-peer. Anything larger, or anything needing centralized security → client-server.

Chapter Summary

This chapter built the foundation everything else in networking stands on. The OSI model gives us seven layers — Application, Presentation, Session, Transport, Network, Data Link, Physical — each with a specific job, from user-facing protocols at the top to bits on the wire at the bottom. The TCP/IP model compresses this into four layers that describe how the real internet is organized. Encapsulation wraps data in headers at each layer on the way down (data → segment → packet → frame → bits) and strips them on the way up.

Ports and protocols are the addressing language of services: HTTP 80, HTTPS 443, DNS 53, DHCP 67/68, SSH 22, SMTP 25, FTP 20/21, SNMP 161/162, RDP 3389 — know them cold. TCP trades speed for reliability (handshake, sequencing, retransmission); UDP trades reliability for speed (voice, video, DNS). Topologies — star, mesh, hybrid, plus the legacy bus and ring — describe how networks are shaped, each with its trade-offs. And the client-server vs peer-to-peer decision comes down to scale and the need for centralized control.

If you can explain why each layer exists, why TCP and UDP differ, and why a star beats a bus for a modern office, you are not just memorizing — you are thinking like a network professional. That is what the exam rewards.

End-of-Chapter Test

1. A network administrator is troubleshooting connectivity and determines that IP addresses are being assigned correctly but devices cannot communicate beyond their local subnet. At which OSI layer is the problem most likely occurring?

• A. Layer 2 — Data Link
• B. Layer 3 — Network
• C. Layer 4 — Transport
• D. Layer 7 — Application

2. During the TCP three-way handshake, a client sends a SYN packet to a server. What does the server send back?

• A. ACK
• B. SYN
• C. SYN-ACK
• D. RST

3. Which of the following protocols uses port 443?

• A. HTTP
• B. FTP
• C. HTTPS
• D. Telnet

4. A company wants to deploy a network where every device connects directly to every other device for maximum fault tolerance, regardless of cabling cost. Which topology should they choose?

• A. Star
• B. Bus
• C. Ring
• D. Full mesh

5. At which layer of the OSI model does encryption with TLS/SSL primarily occur?

• A. Application
• B. Presentation
• C. Session
• D. Transport

6. A user reports that a VoIP call has brief moments of silence but the call never drops or delays. Which transport protocol is carrying the voice stream, and why is this behavior expected?

• A. TCP, because it retransmits lost segments
• B. UDP, because it prioritizes timeliness over retransmission
• C. TCP, because it uses flow control
• D. UDP, because it establishes a connection first

7. What is the PDU (Protocol Data Unit) at Layer 3 of the OSI model?

• A. Segment
• B. Packet
• C. Frame
• D. Bits

8. An administrator needs to transfer a router configuration file to a TFTP server. Which port and transport protocol will be used?

• A. Port 21 over TCP
• B. Port 69 over UDP
• C. Port 22 over TCP
• D. Port 69 over TCP

9. A small office with eight computers and no dedicated IT staff needs to share files between workstations as cheaply as possible. Which network model is most appropriate?

• A. Client-server with Active Directory
• B. Peer-to-peer
• C. Hybrid cloud
• D. Full mesh

10. In the TCP/IP model, which layer corresponds to OSI Layers 5, 6, and 7 combined?

• A. Transport
• B. Internet
• C. Application
• D. Network Access

Answer Key

1. B — Devices can communicate locally (Layer 2 switching and MAC addressing work) but not beyond the subnet, which means routing between networks is failing. Routing is a Layer 3 (Network) function. If Layer 2 were broken, local communication would fail too.

2. C — The three-way handshake is SYN → SYN-ACK → ACK. The client sends SYN, the server responds with SYN-ACK (synchronize-acknowledge), and the client completes the handshake with a final ACK.

3. C — HTTPS uses port 443 (TCP). HTTP uses port 80, FTP uses ports 20/21, and Telnet uses port 23. Do not confuse HTTP (80) with HTTPS (443).

4. D — A full mesh connects every device to every other device, providing maximum redundancy and fault tolerance at maximum cost. Star has a central point of failure; bus and ring both fail if the shared medium breaks.

5. B — TLS/SSL encryption and decryption occur at the Presentation layer (Layer 6), which handles data formatting, encryption, and compression. A common trap is choosing Application (Layer 7) because HTTPS is an Application-layer protocol — but the encryption itself is a Presentation-layer function.

6. B — Voice traffic uses UDP (via RTP) because timeliness matters more than perfection. Brief silence means a datagram was lost and, by design, was not retransmitted — retransmission would arrive too late to be useful. TCP would introduce delay waiting for retransmissions.

7. B — The PDU at Layer 3 (Network) is the packet. Layer 4 uses segments, Layer 2 uses frames, and Layer 1 uses bits. Memorize: segment → packet → frame → bits, top to bottom.

8. B — TFTP (Trivial File Transfer Protocol) uses port 69 over UDP. Port 21 is FTP (TCP), port 22 is SSH/SFTP (TCP). Remember that TFTP is the lightweight, unauthenticated UDP-based protocol used for device firmware and configuration transfers.

9. B — With only eight computers, no IT staff, and minimum cost as the priority, peer-to-peer is the right model — each computer shares its own resources with no dedicated server. Client-server with Active Directory would be overkill and far more expensive to implement and maintain.

10. C — The TCP/IP Application layer combines OSI Layers 5 (Session), 6 (Presentation), and 7 (Application). The Transport layer maps to OSI Layer 4, the Internet layer to OSI Layer 3, and the Network Access layer to OSI Layers 1 and 2.