Network Models toolkit
Every figure in the course, filed the way network work is actually divided: by the job the figure helps you do, and by the band of the stack it teaches about. Pick a task when you know what you are trying to achieve, or pick a layer band when you already know where the problem sits.
Figure library
88 of 88 shown- PlanAccess and link
Wi-Fi generations now buy reliability rather than headline speed
Read down each column and the speed row runs out first, since Wi-Fi 8 promises no new headline number at all, so the tinted row underneath, the one describing what improves in use, is where the three generations still differ.
- PlanNetwork
One segment, three kinds of host, no second network
Each host answers DHCPv4 option 108 for itself, so the segment sheds IPv4 leases one capable client at a time, and the IPv4-only host in the third lane is the single reason the address pool cannot yet be switched off.
- PlanNetwork
Reference model vs. live network: blueprint vs. building
Each arrow runs one way, from the blueprint role to the protocol that implements it, because ISO/IEC 7498-1 coordinates protocol design and does not itself run on the wire, so a fault is found in the building and only named in the blueprint's vocabulary.
- PlanNetwork
OSI is a reference model; TCP/IP is the operational stack
The diagram takes a symptom named in OSI vocabulary, follows the translate to arrow into the stack that captures and routing tools actually show, then follows choose test to the least disruptive test available there.
- PlanNetwork
The seven OSI layers each own a single responsibility
The lower view adds one header per step while the application data underneath is never rewritten, so the changing unit name, Data to Segment to Packet to Frame to Bits, records which wrapper was just added and not any change to what is carried.
- PlanNetwork
How OSI's seven layers map to the four TCP/IP layers
RFC 1122 gives the Internet application layer the OSI Presentation and Application functions, and session responsibilities live inside application protocols too, so only Transport and Internet line up one to one and no TCP/IP layer owns a session fault.
- PlanNetwork
CIDR decides local delivery before routing
The two destinations differ only in their network bits, and that single comparison sends one lane to ARP or NDP for the host and the other to the default gateway, so the route table is read only on the branch the mask has already ruled remote.
- PlanNetwork
Subnet mistakes usually happen at the boundary
The /26 spends its first and last address on the network and the broadcast before any host is served, which is why only the 62 cells between them can be assigned and why the next block can only start at .64, not .65.
- PlanNetwork
IPv6 is the road, and IPv4 is the diversion kept open
The upper lane carries the host's own global address end to end, while the lower lane works only because a NAT holds state deciding which reply may return, so an IPv4 answer depends on something an IPv6 answer never needs.
- PlanNetwork
An IPv6 address is a plan, not a number
Only the middle sixteen bits are yours to plan, because everything below the /64 is interface identifier, and the tree spends those bits on office, guest and server segments, so an IPv6 subnet is sized by purpose and never by the number of hosts it will hold.
- PlanNetwork
Four stages carry a learner from vocabulary to frontier judgement
Foundations, Applied and Practice run along the top row and Frontiers returns to the exam terminus, and each connector names what the stage before it hands on, so a stage taken out of order arrives without the language the next one assumes.
- PlanNetwork
Network Models revision poster
Every module card carries its takeaway above the source that backs it, letting a column be read down to revise a stage in module order and any claim recalled from the poster be traced back to that source.
- PlanNetwork
The pipeline catches the outage before the network does
One gate stands between the change and the devices and both exit routes return to the author, so a rejected change never reaches a device and a commit nobody confirms does not stay on one.
- PlanNetwork
Intent sits at the hub while telemetry closes the loop
Intent sits at the hub and the two extra arrows reach validate and compare, so the proposed change and the running network are tested against the same declared state, and the gap between them becomes the next change.
- PlanNetwork
Four migration positions, three dated anchors, four next steps
Three rows carry a dated anchor and the fourth records that no deadline is published, so every status chip is defensible from its own anchor cell and no claim leaves this board without one.
- PlanTransport
Choose the delivery contract, not the protocol reputation
TCP, UDP and QUIC each pair what the transport provides with what the application still owns: UDP hands back the connection state, reliability, ordering and congestion control that TCP provides, so the choice is only where that work lives, never whether it is done.
- PlanTransport
CUBIC reacts to loss while BBR models the path
The two lanes react to different signals: CUBIC's window collapses at every marked loss event while BBR's rate holds against its own bandwidth estimate and dips only when it chooses to probe, and only the left one is a published RFC.
- PlanTransport
TLS and QUIC show why strict layer maps fail
HTTPS over TCP and HTTP/3 over QUIC both put the emphasis row second, but on the right it is one component rather than two, so a test aimed at the TLS layer has something to isolate over TCP and nothing separate once QUIC folds transport and security together.
- PlanTransport
The post-quantum migration runs to published dates
The browser default arrived before the NIST standards were finalised and the disallowance date is already published, so what remains open on this timeline is signatures, which the closing note records as not yet migrated.
- PlanTransport
What is deployed, what is drafted, what is niche
Reading across says published or still a draft and reading down says general traffic or a niche, so DNS over QUIC and TCP Fast Open are placed by the same two questions, and Multipath QUIC and Multipath TCP share a row while only one may be cited as an RFC.
- PlanApplication and names
The OSI to TCP/IP map has deliberate mismatch zones
The spans are where the argument starts: the Application card covers the OSI upper layers while Transport and Internet sit one to one, so a dispute about which layer owns a session is one the map cannot settle and the implementation has to answer.
- PlanApplication and names
Identifiers answer different scope questions
Six rows narrow from URL through domain name, IP address, MAC address and port to socket, each indented inside the one above. That is why an IP address resolved by DNS settles reachability yet says nothing about which service answers, while only the socket names one conversation.
- PlanApplication and names
Four layers answer a request, and only one is not a cache
A miss is the thing that travels down the stack, so the first layer holding a copy answers and only the origin has to build the response, and that reply then fills every cache it passes on the way back.
- ConnectAccess and link
Multi-Link Operation turns a Wi-Fi roam into a non-event
What users report is the gap in the left panel, the moment when nothing is associated. Multi-Link Operation does not make the roam quicker; it keeps a second link carrying the session while the weak one is replaced and never opens the gap.
- ConnectAccess and link
Routers replace the frame, not the conversation
The same IP source and destination sit inside both frames, unchanged until a NAT rewrites them, while the MAC pair is replaced at the router, so an address lifted from a capture names a link and the only end to end record of the hop is the TTL falling from 64 to 63.
- ConnectAccess and link
Thread is the IPv6 mesh; Matter is the shared language
The same Matter language is spoken on the mesh and on the Wi-Fi network, and the border router routes IPv6 rather than translating protocols, so a mesh device is an ordinary part of the home network, not something behind a bridge.
- ConnectNetwork
464XLAT carries IPv4 habits across an IPv6 world
The IPv4-only application and the IPv4-only server are both left untouched while the CLAT on the host and the NAT64 at the edge absorb the change, so an application holding a hard-coded IPv4 literal still works where DNS64 alone would not save it.
- ConnectNetwork
Routing decides paths; forwarding moves packets
The planes run on different clocks, minutes on the left and microseconds on the right, and only the compile arrow joins them, so a route can already be correct in the RIB while packets keep following a FIB entry that has not been pushed yet.
- ConnectNetwork
Forwarding chooses the longest matching prefix
Forwarding counts specified bits and nothing else: the twenty four bit route wins over the twenty two bit route that legitimately covers the address, and prefix length settles the match with no check on who announced it.
- ConnectNetwork
PAT works because the NAT owns a state table
Laptop and Phone both chose source port 53144, so the only thing telling their return traffic apart is the public port the gateway assigned, 62000 against 62001, and a reply can be delivered only while that row is still in the table.
- ConnectNetwork
NAT is stateful translation, not universal reachability
The direct attempt is blocked because neither peer knows anything but a private address, so STUN has to supply the public mapping before hole punching can work, and where symmetric NAT defeats that the TURN relay carries every byte in both directions.
- ConnectNetwork
Encapsulation names the unit at each layer
A header earns its bytes by what it identifies rather than by its size: the bar is drawn to scale, and the four ahead of the payload, Ethernet at 14 bytes down to the TLS record at 5, supply MAC addresses, IP addresses, TCP ports and content type.
- ConnectNetwork
Some identifiers stay end to end; others change at every hop
MAC is tagged REWRITTEN from the local switch onward while IP holds UNCHANGED until the NAT rewrites it, so an address lifted from a capture identifies a hop rather than a host until you say which column it came from.
- ConnectNetwork
eBPF shortens the Service path that iptables made long
The iptables panel reads its chains in order, so its cost grows with the number of Services, while the eBPF panel answers at the socket with one map lookup and releases the packet already addressed to a pod.
- ConnectNetwork
Tenant networks travel inside UDP envelopes
The VXLAN or Geneve header, the outer UDP header and the outer IP header are added before the tenant frame travels and its addresses are never touched, so the envelope is paid for in usable payload and the tenant MTU is set below the underlay MTU rather than discovered later.
- ConnectNetwork
The nearest edge answers, and only a miss travels on
The user never picks an edge and is never told which one answered, so route A can end at the point of presence while route B travels on to the shield and the origin, and the route rather than the server sets the wait.
- ConnectTransport
TCP reliability is sequence, acknowledgement, and repair
The same sequence and acknowledgement counters that open the TCP connection also number the data, so the lost DATA 2 segment announces itself only as a missing acknowledgement and the sender waits out the retransmission timer before sending those bytes again.
- ConnectTransport
QUIC can survive address changes that break TCP
Both rows take the same walk from Wi-Fi to cellular, so the only thing separating BROKEN from SURVIVES is what names the connection: TCP keys it to a four-tuple the swap invalidates, while the QUIC Connection ID is unchanged by it.
- ConnectApplication and names
DNS uses cache first and TCP when UDP is not enough
The TC bit on the UDP reply buys nothing but a repeat, so the same DNS record a cache returns in two milliseconds costs a fresh TCP handshake and ninety milliseconds once the answer will not fit the datagram.
- ConnectApplication and names
A cold DNS lookup walks authority, then caches the result
Root and TLD only refer and just the authority answers, making the recursive resolver pay for the whole walk once and then serve the same name from its own cache until the three hundred second TTL runs out.
- ConnectApplication and names
DNS now tells the browser how to connect before it connects
The HTTPS record carries ALPN, address and ECH hints, so IPv6 races IPv4 and the connection often opens as QUIC on UDP 443 with no TCP handshake at all, which settles the transport and the time to first byte before a single byte of the page moves.
- SecureNetwork
Why CenturyLink oscillated for five hours on 30 August 2020
The fourth card feeds back into the first, so recovery is what re-arms the fault: BGP is both the thing the rule blocks and the only thing able to carry it, and every restoration hands the same rule out again.
- SecureNetwork
Controls belong where the risk is visible
Read across a threat row and the layers that cannot see it are tagged BLIND: lateral movement is blind at Layer 7 because the east-west traffic is encrypted, so identity is the only column left that can block it.
- SecureNetwork
A segmentation diagram must say what is allowed, denied, and monitored
Every crossing carries an explicit ALLOW, a default DENY or a monitored LOG, so the paths an attacker can take are countable, while the greyed diagonal marks the intra-zone traffic the policy never inspects.
- SecureNetwork
Segmentation weakens when rule intent drifts from reality
The rule text is identical in all four rows while the owner tag falls from OK to LOST and the last hit ages out, so the risk a rule carries lives in its metadata and a review that reads only the rule finds nothing wrong.
- SecureNetwork
Segmentation changes blast radius before the incident
The same patient zero and the same ten minutes reach sixteen hosts in the flat grid and four inside the Office VLAN, so the zone boundary drawn beforehand, not the response afterwards, is what sets the count.
- SecureNetwork
SASE is SD-WAN plus SSE, nothing more mysterious
The board splits SASE into an SD-WAN half that moves traffic and an SSE half that inspects and authorises it, and zero trust network access is one component of that second half, so buying the bundle is not adopting the principle.
- SecureNetwork
Zones decide the blast radius; conduits decide the crossings
The conduits are the only crossings drawn between the enterprise, DMZ and control zones, so a path with no conduit does not exist in the design, and the Purdue levels sit behind them as grey context rather than as the boundary itself.
- SecureTransport
TLS placement differs between TCP and QUIC paths
HTTP/2 over TCP and HTTP/3 over QUIC tag the same layers ENCRYPTED and the same ones VISIBLE, so the placement of TLS buys nothing in coverage and everything in time: 2 RTT to the first encrypted byte over TCP against 1 RTT when QUIC folds the handshakes together.
- SecureTransport
Two key exchanges, one session: hybrid post-quantum TLS
One ClientHello carries both the classical and the post-quantum share, and the two secrets are combined into a single key schedule, so recorded traffic stays private unless an attacker breaks both exchanges rather than either.
- SecureApplication and names
TLS protects the channel, not every system risk
Every property in the left column belongs to bytes while they are in transit, so the right column is not a weakness in TLS but the set of questions a valid certificate never answers, including whether the operator you reached deserves trust.
- SecureApplication and names
TLS everywhere is necessary but not sufficient
The ribbons run ENCRYPTED, then DECRYPTED at the edge, then CHECK YOURS between services, ending every guarantee the transit zone gives at the decryption point and leaving the east-west zone to earn its own.
- SecureApplication and names
A VPN grants a network; ZTNA grants one application
Both lanes start with the same user and the same three systems, but the VPN lane opens the finance database and build server nobody asked for while the ZTNA lane draws them denied, so authorisation is where blast radius is decided.
- SecureApplication and names
Intended features carry unintended invitations
Rapid Reset, 0-RTT replay, DNS amplification and NTP monlist are placed by what the feature was for against how far the abuse reaches, and the column decides the fix: a convenience can be closed, while a feature core to the protocol can only be rate limited and accounted for.
- SecureApplication and names
Cancelling work faster than servers can start it
The HTTP/2 loop runs on one connection with no new handshake, so the server completes work for streams already cancelled while its concurrency limit sees an idle connection, which is why the mitigation counts resets rather than streams.
- ObserveNetwork
Traceroute is path evidence, not path proof
Each row is one interface that answered a TTL or Hop Limit expiry, so the starred hops record silence rather than loss, and every RTT includes a return path the table never shows, which is why hop six can jump without anything on the forward path being wrong.
- ObserveNetwork
Three observatories count three different populations
One counts requests, one counts users and one counts websites, which is why three different answers to the same adoption question can all be correct and why a number is only usable once its population is named beside it.
- ObserveTransport
Choose observability signals by the question they answer
Each question scores metrics, logs, traces, flow records and packet capture BEST, ok or weak, and where did time go rates metrics and flow records weak, so a dashboard full of healthy metrics can still hold no answer to the question being asked.
- ObserveTransport
A capture point only sees traffic that crosses it
Each point lists what it proves beside what it is blind to, and the edge firewall is already blind to internal addresses because NAT translated them, so a capture taken past a boundary cannot answer a question about what sits behind it.
- ObserveTransport
A packet capture starts with a question and ends with deletion
The filter is derived from the question, so the file holds only the packets that question needs and the traffic of uninvolved users never enters it, and recording the retention decision is what gets the capture deleted rather than left to sit.
- ObserveApplication and names
Every observability signal has a blind spot the next one covers
Every signal to the left of the failure domain line is tagged BLIND, including the VPN used to reach the consoles, so a monitoring pipeline sharing the failing infrastructure leaves only the external checks reporting.
- ObserveApplication and names
Healthy dashboards can hide affected user states
Both charts hold the same data: the aggregate sits at 0.42 s under the SLO while EU-N climbs to 0.93 s above it, so a green tile is evidence only that the affected segment was small enough to average away.
- TroubleshootNetwork
Three ways to encrypt DNS, three different frictions
DoT and DoQ sit on a dedicated port a network can block as a category while DoH shares 443 with ordinary web traffic, but all three lanes end at the same card: the destination address, the server name without Encrypted ClientHello and the resolver's log survive every one of them.
- TroubleshootNetwork
Route Origin Validation now checks most of the internet's routes
The gate has three exits and only one of them rejects anything, so every route still outside the validated set leaves through NotFound unchecked, and even a Valid verdict tests which network claims the prefix rather than the path it travelled.
- TroubleshootNetwork
When NAT state expires, the return path disappears
Only traffic refreshes the gateway timer, and silence alone removes the NAT table entry while both endpoints still believe the connection is open. The next reply matches no row and is dropped without notice, so only a keep-alive inside the idle window holds the return path open.
- TroubleshootNetwork
Certificate lifetimes collapse on a published schedule
Every date was published in advance, so the schedule is not a surprise but a countdown: each cut shortens an interval that ACME renewal simply repeats, while the manual path holds at 200 days, strains at 100, and runs out of road at 47.
- TroubleshootNetwork
A repeatable diagnostic routine prevents random fixes
The loop can only close on a pass, and a fail leaves it standing at the named fault: keep to one change and one test per lap and the reading at nine o'clock belongs to the thing you altered rather than to the last three.
- TroubleshootNetwork
The next test should reduce the largest uncertainty
The two minute restart excludes nothing structurally and destroys the evidence, so the five minute capture is chosen instead: rank the candidates by what the EXCLUDES column rules out, not by what the HOW LONG column costs.
- TroubleshootNetwork
A packet-too-large problem is a path signal problem
The router does emit Fragmentation Needed, so path MTU discovery fails at the firewall dropping it on the return path: with no size to learn from, the sender repeats the same 1400 bytes indefinitely and the user reports what looks like plain packet loss.
- TroubleshootNetwork
Each OSI layer names a device, a failure and the check that finds it
The arrows between the seven OSI rows say what each layer needs from the one below, so the checks are ordered rather than optional: reading the certificate proves nothing while the port is blocked, and neither proves anything while the link light is dark.
- TroubleshootNetwork
Each layer owns a responsibility, evidence, and safe test
Every row has to fill all four columns, and a layer earns its place in a diagnosis only when it can name both the evidence you capture and the safe test that produces it, which is why most investigations begin at the transport row.
- TroubleshootNetwork
The next-action checklist that closes any network investigation
The checklist gives each column its own time budget, runs its items in order, and puts confirming the size of the impact in the first five minutes, ahead of rolling back the most recent deploy.
- TroubleshootNetwork
Troubleshooting routine poster
The loop leaves a layer only when its test passes, and the shelf below gives each layer one command with its pass and fail reading, so a failed test names the fault where it stands instead of passing you on.
- TroubleshootNetwork
Every layer owes the incident evidence before blame lands
Each lane owes its evidence before its gate opens, and the fail routes down the spine read counters are clean, the path is stable and transport looks healthy, so a layer that explains nothing still hands on what it ruled out.
- TroubleshootTransport
Throughput is bounded by window, RTT, and loss
Throughput is capped by the smaller of the receive and congestion windows divided by round-trip time, and a faster link does not lift that cap, so the three regimes named on the cards, window-bound, RTT-bound and loss-bound, each need their own lever.
- TroubleshootTransport
QUIC loss recovery is scoped to the affected stream
On the HTTP/2 over TCP track, one lost packet on stream B at slot four is enough to park streams A and C until the retransmit lands at slot seven. Under QUIC only the stream that lost something waits, and the other two keep delivering in every slot.
- TroubleshootTransport
L4S drains the queue that bufferbloat built
In the left panel the drop is the only signal, so a deep buffer stores the excess rather than dropping it and latency has already spiked before anything is lost, while the right panel marks instead of dropping and the sender trims within one round trip.
- TroubleshootApplication and names
NXDOMAIN and SERVFAIL mean different DNS failures
Each row carries its own next test, and the right one can only be chosen by reading the response code first: a name that does not exist, RCODE 3, never earns the resolver comparison that only RCODE 2 deserves.
- TroubleshootApplication and names
Error words point to different boundaries
Timeout, refused, NXDOMAIN, SERVFAIL, certificate failure and a 5xx or high TTFB do not share a boundary: refused returns a TCP RST while timed out returns nothing at all, and the DO NOT column names the wrong conclusion each of the six invites.
- TroubleshootApplication and names
A slow website diagnosis separates each delay bucket
Split the page into DNS, TCP, TLS or QUIC, HTTP and transfer and four of those buckets measure the same in both runs, so the entire difference between a 4200 millisecond page and a 445 millisecond one sits in DNS, and the dominant bar rather than the total names the boundary.
- TroubleshootApplication and names
Four checkpoints between a URL and a response
DNS then TCP then TLS then HTTP, each step running on the output of the one before it, so a signature from the red half, NXDOMAIN or a connect timeout or an expired certificate, marks every step to its right untested rather than healthy.
- TroubleshootApplication and names
Troubleshoot by failed function, not by layer recital
Classify turns the report that the site is down into one named failed function, name lookup or path or transport or app, and observe captures the evidence for that function alone. Test is reached only with both in hand, which is why a layer recital never yields a next safe test.
- TroubleshootApplication and names
Each request failure has a first useful test
Timeout, refused, NXDOMAIN, SERVFAIL, certificate failure and an HTTP 5xx or high TTFB each pair with the boundary they implicate first and one safe test, so refused sends you to the listener and SERVFAIL to the resolver, not to the same guess twice.
- TroubleshootApplication and names
URL to first byte is a timed chain
Each bar's width is its millisecond cost, from DNS through transport setup, TLS or QUIC and the HTTP request to first byte, and server work alone runs longer than DNS, TCP setup and TLS together, so shaving the handshake cannot recover the time the server is spending.
- TroubleshootApplication and names
One request path, with the evidence checkpoint at every hop
Every checkpoint from the radio to the response carries the observable a learner could collect there, so a narration advances only as far as the evidence in hand and the first missing observable names the failed function.
- TroubleshootApplication and names
A clear request-path diagnosis is an evidence chain
Symptom, hypothesis, evidence and next step are joined by connectors reading propose, prove and act, so a note that skips the evidence card is left offering a conclusion nobody else can check.
- TroubleshootApplication and names
Reconcile healthy dashboards with affected users
Each rung tests one hypothesis against one observable and returns PASS, FAIL or FAULT, so a health check that passes at the top and a refused connection two rungs below are both true, and the deleted rule reconciles them.
- TroubleshootApplication and names
The scenario decision map for the whole troubleshooting course
The map gives each symptom the owner to call and the one safe test to run first, hands the opening three minutes a decision already made, and leaves a symptom with no row to be written on afterwards.