A network is very complex. So we break the job into layers. Each layer does one small job. Each layer talks only to the layer above and below it. The OSI model has 7 layers. It is a reference model — a way to think and talk about networks.

Easy memory trick (top to bottom): "All People Seem To Need Data Processing" — Application, Presentation, Session, Transport, Network, Data Link, Physical.

The real Internet uses the simpler TCP/IP model. Books show it with 4 layers, and sometimes 5 layers (Physical split out). This table maps them to OSI.

When you send data, each layer adds its own header in front. This is called encapsulation. The receiver removes the headers one by one, from bottom to top (decapsulation).

A topology is the shape of the network — the pattern in which we connect the devices. The five classic shapes:

• Bus: one long shared cable; every device taps into it. Cheap, but if the main cable breaks, the whole network dies. Collisions are common.
• Star: every device connects to one central hub or switch. Cheap and easy to add devices, but the hub is a single point of failure — if it dies, everything dies. This is what almost every LAN uses today.
• Ring: each device connects to the next, forming a circle. Data travels one way (often with a token). One broken link can stop the ring (dual rings fix this).
• Mesh: every device connects directly to every other device. A full mesh with \( n \) devices needs \( \frac{n(n-1)}{2} \) links. It is the most fault-tolerant — many paths exist — but the most expensive in cables and ports.
• Hybrid: a mix of the above — for example, several star networks joined by a bus or a partial mesh backbone. Real large networks are hybrids.

Every network card (NIC) has a MAC address. It is a 48-bit (6-byte) hardware address, written in hex like 00:1A:2B:3C:4D:5E. The first 24 bits are the OUI (vendor code, like Intel or Realtek). The last 24 bits are unique for that card. The special address FF:FF:FF:FF:FF:FF means broadcast — everyone on the local network receives it.

MAC works only inside the local network (LAN). IP address works across networks. A packet keeps the same IP addresses end to end, but the MAC addresses change at every router hop.

The Data Link layer packs bits into frames. An Ethernet frame looks like this:

Old Ethernet used one shared wire. If two computers send at the same time, the signals crash — a collision. CSMA/CD (Carrier Sense Multiple Access with Collision Detection) handles this:

1. Carrier Sense: listen first. If the wire is busy, wait.
2. Multiple Access: many computers share the same wire.
3. Collision Detection: while sending, keep listening. If a collision is heard, stop, send a short jam signal, wait a random time (binary exponential backoff), then try again.

Modern switched full-duplex Ethernet has no collisions, so CSMA/CD is mostly history — but it is still a favorite exam topic. Wi-Fi uses a cousin called CSMA/CA (Collision Avoidance), because radios cannot detect collisions while sending.

A link can carry data in three different ways. This is called the transmission mode (or communication mode):

• Simplex: data flows in one direction only, forever. The receiver can never talk back. Examples: keyboard → computer, broadcast radio, TV broadcast.
• Half-duplex: data can flow in both directions, but only one at a time. The two sides take turns. Examples: walkie-talkie ("over!"), classic shared Ethernet with CSMA/CD.
• Full-duplex: data flows in both directions at the same time. Examples: a phone call, modern switched Ethernet (one pair of wires to send, one to receive).

ARP (Address Resolution Protocol) answers one question: "I know your IP. What is your MAC?" It is needed because frames need MAC addresses, but programs only know IP addresses.

Bits can flip during travel. Error detection adds extra bits so the receiver can notice damage.

• Parity bit: add 1 bit so the total number of 1s is even (even parity) or odd (odd parity). Very cheap, but it misses errors when 2 bits flip.
• Checksum: add up the data words, take the 1's complement of the sum, send it along. The receiver adds everything; the result should be all 1s. Used by IP, TCP, UDP.
• CRC (Cyclic Redundancy Check): treat bits as a polynomial, divide by a generator using XOR, and append the remainder. Very strong — catches burst errors. Used by Ethernet (FCS).

An IPv4 address is a 32-bit number. We write it as 4 decimal numbers (octets), each 0–255, separated by dots. Example: 192.168.10.5.

In binary: 11000000.10101000.00001010.00000101. Every address has two parts: a network part (which network) and a host part (which machine inside that network). The subnet mask tells where the split is.

Special addresses to memorize:

• Private ranges (not routable on the Internet): 10.0.0.0/8, 172.16.0.0/12 (172.16.x.x – 172.31.x.x), 192.168.0.0/16.
• Loopback: 127.0.0.1 (your own machine; the whole 127.x.x.x block).
• APIPA / link-local: 169.254.x.x (when DHCP fails).
• In any subnet: all host bits 0 = network address, all host bits 1 = broadcast address. Neither can be given to a host.

CIDR notation writes the mask as /n — the number of network bits. Example: /26 means the first 26 bits are network, the last \( 32-26=6 \) bits are host.

Mask /26 in binary: 11111111.11111111.11111111.11000000 = 255.255.255.192.

Here \( h \) = number of host bits. We subtract 2 for the network address and the broadcast address.

• 128-bit address, written as 8 groups of 4 hex digits: 2001:0db8:0000:0000:0000:0000:0000:0001.
• Shorten it: drop leading zeros, and replace one run of all-zero groups with :: → 2001:db8::1.
• No broadcast in IPv6 — it uses multicast and anycast instead. No NAT needed (huge address space). Header is simpler, and there is no header checksum.
• IPv4 has about \( 2^{32} \approx 4.3 \) billion addresses; IPv6 has \( 2^{128} \) — practically unlimited.

A router moves packets between networks. For every packet, it looks at the destination IP and checks its routing table: "for this network, send out of this interface, to this next hop." If nothing matches, it uses the default route 0.0.0.0/0.

If several routes match a destination, the router picks the one with the longest prefix (the most specific route).

• Static routing: a human types the routes by hand. Simple, safe, no extra traffic — but does not adapt when a link fails. Good for tiny networks.
• Dynamic routing: routers run a protocol (RIP, OSPF, BGP) and share routes with each other. They adapt automatically when the network changes.

One-liners to memorize:

• RIP: distance vector, metric = hop count, max 15 hops (16 = unreachable), updates every 30 seconds.
• OSPF: link state, metric = cost (based on bandwidth), uses Dijkstra, scales with areas, converges fast.
• BGP: path vector protocol between autonomous systems (AS) — the routing protocol of the Internet backbone. Chooses routes by policy, not just distance.

NAT (Network Address Translation) lets a whole private network share one public IP. The router rewrites addresses (and ports, in PAT/NAPT) as packets pass through, and keeps a translation table to send replies back to the right device. This is why your home Wi-Fi with 10 devices needs only one public IP. Cost: outside hosts cannot start a connection to an inside host directly.

People say "NAT" for everything, but the exam wants the exact difference:

• NAT (static / basic NAT): a one-to-one mapping. Each private IP gets its own public IP. Only IP addresses are rewritten; ports are not touched. If you have 10 inside hosts, you need 10 public IPs. Used when a server inside must always look like one fixed public address.
• PAT (Port Address Translation, also called NAT overload or NAPT): a many-to-one mapping. Many private IPs share one public IP. The router tells the connections apart using port numbers — it rewrites both the IP and the source port. This is what every home router actually does.

Memory trick: NAT = address for address. PAT = port makes it possible.

The Transport layer gives us two main protocols. TCP is careful: it connects first, numbers every byte, and re-sends lost data. UDP is fast and simple: it just throws packets and hopes for the best. Both use port numbers to find the right program on a machine.

• TCP header (20+ bytes): source port, destination port, sequence number, acknowledgment number, flags (SYN, ACK, FIN, RST, PSH, URG), window size (flow control), checksum.
• UDP header (only 8 bytes): source port, destination port, length, checksum. That is all — no seq, no ack, no flags.

TCP starts every connection with three messages:

1. SYN: client → server. "Let's talk. My starting sequence number is x."
2. SYN + ACK: server → client. "OK. My starting number is y. I acknowledge yours: ack = x + 1."
3. ACK: client → server. "Got it. ack = y + 1." Connection is now open.

Closing normally takes 4 messages, because each side closes its own direction:

1. A → B: FIN ("I am done sending.")
2. B → A: ACK
3. B → A: FIN ("I am done too.")
4. A → B: ACK, then A waits in TIME_WAIT for a while before fully closing, in case the last ACK gets lost.

TCP numbers every byte (not every packet). The receiver replies with an ack number = "the next byte I expect." If an ack does not come in time, the sender re-sends. This gives reliable, in-order delivery.

• Flow control (sliding window): protects the receiver. The receiver advertises a window size = how many bytes it can accept right now. The sender may send that much without waiting for an ack. Window 0 means "stop, I am full."
• Congestion control: protects the network. TCP keeps a congestion window (cwnd). In slow start, cwnd starts small (about 1 MSS) and doubles every RTT (1 → 2 → 4 → 8...) until it reaches a threshold (ssthresh). After that, congestion avoidance grows it by 1 MSS per RTT (additive increase). On packet loss, TCP cuts the window down sharply (multiplicative decrease) — together called AIMD.

How long does a packet take to travel? Four delays add up on every link. The two that exams love are transmission delay and propagation delay — students mix them up all the time.

• Transmission delay: time to push all the bits of the packet onto the wire. Depends on packet size \( L \) and link rate (bandwidth) \( R \).
• Propagation delay: time for one bit to travel the length of the wire. Depends on distance \( d \) and signal speed \( s \) in the medium (about \( 2 \times 10^{8} \) m/s in copper or fiber).
• Queuing delay: time waiting in the router's buffer for its turn.
• Processing delay: time the router spends checking headers and choosing the output link.

HTTP is a simple text protocol. The client (browser) sends a request; the server sends a response. HTTP is stateless — each request stands alone (cookies are used to remember users). HTTPS is HTTP over TLS encryption.

Code groups: 2xx success, 3xx redirect, 4xx client error, 5xx server error.

DNS (Domain Name System) turns names like www.example.com into IP addresses. It is a big distributed database arranged as a tree: root → TLD (.com, .org, .bd) → authoritative servers.

Common record types: A (name → IPv4), AAAA (name → IPv6), CNAME (alias), MX (mail server), NS (name server).

DHCP gives a device its IP address, subnet mask, gateway, and DNS server — automatically. The 4 steps spell DORA:

1. Discover — client broadcasts: "Any DHCP server here?"
2. Offer — server replies: "You can have 192.168.1.50."
3. Request — client broadcasts: "I accept 192.168.1.50."
4. Ack — server confirms and sets a lease time.

DHCP uses UDP: server port 67, client port 68.

• SMTP (port 25): sends mail — from your app to your mail server, and between mail servers. "SMTP = Send Mail To People."
• POP3 (port 110): downloads mail to one device and usually deletes it from the server. Simple, offline-friendly.
• IMAP (port 143): syncs mail — messages stay on the server, and all your devices see the same folders and read/unread state. This is what modern apps use.

FTP (File Transfer Protocol) moves files. It is unusual: it uses two TCP connections — port 21 for control (commands) and port 20 for data (active mode). It sends passwords in plain text, so today people use SFTP or FTPS instead.