Class notes · Professor Messer, CompTIA A+ 220-1201 Core 1 · Section 2 (objectives 2.1–2.8)

Quick reference: the short version of this section is the Section 2 cheat sheet.

Learning objectives

By the end of these notes you should be able to:

Explain how IP, TCP and UDP work together, and identify common ports (2.1).
Describe wireless frequencies, channels, Bluetooth, RFID and NFC (2.2).
Describe the purpose of common network services (2.3).
Explain DNS records (including SPF, DKIM, DMARC), DHCP, VLANs and VPNs (2.4).
Describe network devices and PoE (2.5).
Explain IPv4 and IPv6 addressing, and static, dynamic and APIPA assignment (2.6).
Compare internet connection types and network types (2.7).
Choose the right network tool for a job (2.8).
Use command-line tools to check addressing, DNS and connectivity.

1. IP, TCP, UDP and ports (2.1)

1.1 How data is packaged

Data sent across a network is wrapped in layers, like envelopes inside envelopes (

encapsulation):

+—————————————————————–+ | Ethernet frame (MAC addresses — gets it across the local link) | | +———————————————————–+ | | | IP packet (IP addresses — gets it to the right computer) | | | | +—————————————————–+ | | | | | TCP or UDP segment (ports — gets it to the right app)| | | | | | +———————————————–+ | | | | | | | Application data (web page, email, DNS query) | | | | | | | +———————————————–+ | | | | | +—————————————————–+ | | | +———————————————————–+ | +—————————————————————–+- IP delivers packets between devices using IP addresses. It doesn’t guarantee delivery.

TCP and UDP sit on top of IP and use port numbers to reach the right application.
An IP address plus a port identifies one end of a connection, e.g. 93.184.215.14:443.

1.2 TCP vs UDP

TCP

UDP

Connection

Connection-oriented: sets up a connection first

Connectionless: just sends

Reliability

Acknowledges data; retransmits losses; keeps order

No acknowledgements or retransmission

Overhead

Higher

Lower — faster

Used for

Web (HTTPS), email, file transfer, SSH, RDP

DNS queries, DHCP, streaming, VoIP, online gaming

The TCP three-way handshake:

1.3 Port numbers

Ports run from 0 to 65,535.

Well-known (non-ephemeral) ports, 0–1023, are where standard server services listen.
Ephemeral ports are temporary high-numbered ports that clients pick for their end of a connection (Windows uses 49152–65535).

1.4 Common ports (220-1201 list)

Port

Protocol

TCP/UDP

Purpose

Secure?

20, 21

FTP

TCP

File transfer (21 control, 20 data)

No — cleartext

SSH

TCP

Encrypted remote shell; also SFTP and SCP

Yes

Telnet

TCP

Remote shell

No — cleartext, legacy

SMTP

TCP

Sending mail between servers

Plain by default; STARTTLS adds encryption

DNS

UDP (TCP for large replies and zone transfers)

Name resolution

—

67, 68

DHCP

UDP

Automatic IP configuration (67 server, 68 client)

—

HTTP

TCP

Web

110

POP3

TCP

Download mail

No (995 for POP3S)

143

IMAP

TCP

Access mail kept on the server

No (993 for IMAPS)

389

LDAP

TCP/UDP

Directory queries (Active Directory)

443

HTTPS

TCP

Web over TLS

Yes

445

SMB

TCP

Windows file and printer sharing

Supports encryption (SMB 3)

636

LDAPS

TCP

LDAP over TLS

Yes

3389

RDP

TCP

Remote Desktop

Encrypted — but a major attack target

Useful extras outside the exam list: 587 (mail submission), 993 (IMAPS), 995 (POP3S), 137–139 (NetBIOS), 161/162 (SNMP), 514 (syslog).

1.5 Worked example — which port?

Scenario

Port(s)

A user can browse http:// sites but not https:// sites

443 is blocked

An admin needs an encrypted command-line session to a Linux server

22 (SSH)

An email client downloads mail and removes it from the server

110 (or 995 secure) — POP3

An email client keeps mail synced on the server across devices

143 (or 993 secure) — IMAP

PCs get no IP address automatically

67/68 (DHCP)

A PC can reach 8.8.8.8 but not google.com

53 (DNS)

Mapping a network drive to \\fileserver\share

445 (SMB)

Test-NetConnection fileserver -Port 445 \

TcpTestSucceeded : True/False

Get-NetTCPConnection -State Listen \

what’s listening on this machine

netstat -ano \

all connections, with process IDs

nc -zv fileserver 445 ss -tulpn

2. Wireless networking (2.2)

2.1 Frequencies

Band

Range

Speed

Interference

Channels

2.4 GHz

Longest

Lowest

Highest (microwaves, Bluetooth, neighbours)

Few; only 3 non-overlapping

5 GHz

Medium

Higher

Lower

Many more

6 GHz (Wi-Fi 6E / 7)

Shortest

Highest

Lowest

Lots of clean spectrum

2.2 Channels in 2.4 GHz

Each 20 MHz channel overlaps its neighbours. Only 1, 6 and 11 don’t overlap each other:

Ch: 1 2 3 4 5 6 7 8 9 10 11 [=========] [=========] [=========] 1 6 11- Neighbouring access points should use different non-overlapping channels.

Channel width: wider channels (40/80/160 MHz, 320 MHz on Wi-Fi 7) carry more data but interfere more easily.
Regulations: allowed channels and power vary by country.
DFS: some 5 GHz channels must avoid radar, using dynamic frequency selection.

2.3 Wi-Fi standards (for reference)

Standard

Name

Bands

802.11n

Wi-Fi 4

2.4 / 5 GHz

802.11ac

Wi-Fi 5

5 GHz

802.11ax

Wi-Fi 6 / 6E

2.4 / 5 GHz (6E adds 6 GHz)

802.11be

Wi-Fi 7

2.4 / 5 / 6 GHz

2.4 Other wireless technologies

Technology

Frequency / range

Use

Bluetooth

2.4 GHz, around 10 m

Personal area network: headsets, keyboards, speakers

RFID

Various frequencies

Tags read by radio: access badges, inventory, toll tags. Passive tags are powered by the reader’s signal

NFC

13.56 MHz, a few cm

A subset of RFID: payments, pairing, access control

netsh wlan show interfaces \

SSID, signal %, band, channel, speed

netsh wlan show networks mode=bssid \

nearby networks and their channels

3. Network services (2.3)

Service

What it does

Example

DNS server

Translates names to IP addresses

mail.example.com → 203.0.113.10

DHCP server

Hands out IP configuration automatically

Address, mask, gateway, DNS

File share

Central storage

SMB shares on Windows, NFS on Linux

Print server

Manages print queues and drivers centrally

One queue per printer for the whole office

Mail server

Sends (SMTP) and stores (IMAP/POP3) email

Exchange, Postfix

Syslog

Collects log messages from many devices centrally

Firewall and switch logs into a SIEM

Web server

Serves websites and web applications

IIS, Apache, Nginx

AAA server

Authentication, authorisation and accounting for network access

RADIUS, TACACS+

Spam gateway

Filters email for spam and malware before delivery

Email security appliance or cloud service

All-in-one security appliance (UTM)

Firewall, IPS, content filtering, anti-malware, VPN in one box

Small-office firewall

Load balancer

Spreads requests across servers; removes failed ones

Web server farm

Proxy server

Makes requests on clients’ behalf — filtering, caching, logging

Web proxy

SCADA / ICS

Monitors and controls industrial equipment

Power, water, manufacturing

Legacy and embedded systems

Old or single-purpose systems that can’t easily be updated

Old OS running a machine tool

IoT devices

Networked smart devices

Cameras, thermostats, sensors

4. Network configuration (2.4)

4.1 DNS and how a name is resolved

PC –(1) “www.example.com?”–> Recursive resolver (ISP or company DNS) | +-(2) root server: “ask .com” +-(3) .com TLD server: “ask example.com’s” +-(4) authoritative server: 93.184.215.14 PC <–(5) “93.184.215.14” ——+ (answer cached for its TTL)

The TTL (time to live) controls how long the answer is cached. That’s why DNS changes aren’t instant, and why ipconfig /flushdns sometimes fixes stale results.

Record

Purpose

Example

Name → IPv4 address

www → 93.184.215.14

AAAA

Name → IPv6 address

www → 2606:2800:21f:cb07:6820:80da:af6b:8b2c

CNAME

Alias: one name points to another name

shop → shops.myplatform.com

Mail servers for the domain, with priority

10 mail.example.com

TXT

Free-form text — used for verification and email security

SPF, DKIM, DMARC

4.2 Email authentication records

Record

Answers

Lives at

SPF

Which servers may send mail for this domain?

TXT on the domain itself

DKIM

Is this message’s signature valid? (Publishes the public key)

TXT at ._domainkey.

DMARC

What should receivers do if SPF/DKIM fail — and where to report?

TXT at _dmarc.

Worked example — reading the records:

example.com. TXT “v=spf1 include:spf.protection.outlook.com -all” _dmarc.example.com. TXT “v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com”- SPF: Microsoft 365’s servers may send for example.com. -all means hard fail — every other sender is unauthorised. (~all would be a soft fail.)

DMARC: mail failing authentication should be quarantined (sent to spam). Aggregate reports go to dmarc@example.com. Policies escalate none → quarantine → reject.

nslookup -type=txt example.com nslookup -type=txt _dmarc.example.com Resolve-DnsName example.com -Type MX

4.3 DHCP

DORA:

Term

Meaning

Scope

The range of addresses the server can hand out, plus options

Pool

The available addresses within the scope

Exclusion

Addresses inside the scope that are never handed out (e.g. for static devices)

Reservation

A specific address always given to a specific MAC address

Lease

How long the client may keep its address; it tries to renew at 50 % of the lease

Options

Extra settings sent to clients: default gateway, DNS servers, domain name

Worked example — designing a small office scope:

Network: 192.168.10.0/24 (usable addresses 1–254).
Router (gateway): 192.168.10.1, static.
Servers and printers: statically set in .2–.19, so exclude .1–.19.
Scope: .20–.240 for clients. The printer at .15 could instead get a reservation tied to its MAC address.
Options: gateway 192.168.10.1; DNS 192.168.10.2; lease 8 hours.

ipconfig /all \

DHCP enabled?, DHCP server, lease obtained/expires

ipconfig /release ipconfig /renew

4.4 VLANs

A VLAN (virtual LAN) splits one physical switch into several separate logical networks — separate broadcast domains. Devices in different VLANs can’t talk directly; traffic between them must go through a router or layer 3 switch, where it can be filtered.

        One managed switch

4.5 VPNs

A VPN (virtual private network) creates an encrypted tunnel across an untrusted network such as the internet.

Type

Connects

Example

Client-to-site (remote access)

One user’s device to the organisation’s network

A remote worker’s VPN client connects to the office firewall or VPN concentrator

Site-to-site

Two networks permanently

Head office ↔ branch office, between firewalls

5. Network devices (2.5)

5.1 The devices

Device

Works with

Behaviour

Router

IP addresses (layer 3)

Forwards traffic between networks; connects the LAN to the internet. Home routers add NAT, DHCP, Wi-Fi and a firewall

Unmanaged switch

MAC addresses (layer 2)

Plug and play. Learns which MAC is on which port and forwards frames only there; no configuration

Managed switch

MAC (layer 2) and sometimes IP

Configurable: VLANs, port settings, QoS, port mirroring, monitoring

Access point

Layer 2

Bridges wireless clients onto the wired network

Patch panel

—

Cable runs punched down at the back; short patch cables at the front connect to switches

Firewall

Layer 3–7

Allows or blocks traffic by rules (IP, port, application)

Cable modem

—

Connects to the ISP over coax (DOCSIS)

DSL modem

—

Connects to the ISP over the telephone line

ONT

—

Optical network terminal: converts the ISP’s fibre to Ethernet

NIC

Layer 2

The device’s network interface; each has a unique MAC address

Worked example — how a switch learns:

PC A (port 1) sends a frame to PC B. The switch records “MAC A is on port 1”.
It doesn’t yet know where MAC B is, so it floods the frame to all ports.
PC B replies from port 5. The switch records “MAC B is on port 5”.
From now on, frames between A and B go only to ports 1 and 5.

(A hub, by contrast, always repeats everything to every port.)

5.2 Power over Ethernet

PoE sends power and data over one Ethernet cable — ideal for access points, IP phones and cameras mounted where there’s no power socket.

Standard

Name

Max power per port

802.3af

PoE

15.4 W

802.3at

PoE+

30 W

802.3bt

PoE++ (Type 3 / Type 4)

60 W / 100 W

Power can come from a PoE switch or a PoE injector placed between a normal switch and the device.

6. IP addressing (2.6)

6.1 IPv4

An IPv4 address is 32 bits, written as four octets (0–255): 192.168.1.50.

The subnet mask shows which part identifies the network and which identifies the host:

Notation

Mask

Network part

Host part

255.0.0.0

First octet

Last three octets

/16

255.255.0.0

First two octets

Last two octets

/24

255.255.255.0

First three octets

Last octet

Worked example — 192.168.1.50 /24:

Item

Value

Network address

192.168.1.0

Usable host range

192.168.1.1 – 192.168.1.254 (254 hosts)

Broadcast address

192.168.1.255

This host

.50

Two devices can talk directly only if they’re on the same network. Otherwise traffic goes to the default gateway (the router), usually .1.

6.2 Public, private and special addresses

Range

Type

10.0.0.0/8

Private

172.16.0.0/12 (172.16.x.x – 172.31.x.x)

Private

192.168.0.0/16

Private

169.254.0.0/16

APIPA / link-local — self-assigned when DHCP fails

127.0.0.1

Loopback (“this computer”)

Everything else (mostly)

Public — routable on the internet

Private addresses aren’t routed on the internet. NAT on the router translates them to the router’s public IP for outbound traffic.

6.3 IPv6

128 bits, written as eight groups of four hex digits.
Shortening rules:
1. Drop the leading zeros in each group.
2. Replace one run of consecutive all-zero groups with ::.
Special addresses: ::1 is loopback; fe80::/10 is link-local (every interface has one); addresses beginning 2 or 3 are global unicast.

Worked example — shortening:

Start: 2001:0db8:0000:0000:0000:ff00:0042:8329
Drop leading zeros: 2001:db8:0:0:0:ff00:42:8329
Collapse the zero run: 2001:db8::ff00:42:8329

6.4 Assigning addresses

Method

How

Best for

Static

Manually set IP, subnet mask, default gateway and DNS servers

Servers, printers, network devices

Dynamic (DHCP)

Automatically leased from a DHCP server

Client PCs, phones, laptops

DHCP reservation

DHCP always gives the same IP to a given MAC

Printers that need a fixed address but central management

APIPA

The OS gives itself 169.254.x.x when no DHCP server answers

A symptom, not a solution — it only reaches the local segment, with no gateway

Worked example — an APIPA ticket:

A user has “no internet”; ipconfig shows 169.254.23.7, so DHCP failed.
Check the physical connection: cable and port lights, or Wi-Fi association.
Retry DHCP: ipconfig /release then ipconfig /renew.
Still APIPA? Check whether others are affected (DHCP server down or scope exhausted), and check the switch port or VLAN.
Record the cause in the ticket — e.g. “scope full; extended scope; lease shortened”.

Setting a static address:

Get-NetIPConfiguration New-NetIPAddress -InterfaceAlias “Ethernet” -IPAddress 192.168.10.15 -PrefixLength 24 -DefaultGateway 192.168.10.1 Set-DnsClientServerAddress -InterfaceAlias “Ethernet” -ServerAddresses 192.168.10.2

7. Connection types and network types (2.7)

7.1 Internet connection types

Type

Medium

Traits

Fibre

Light through glass; ONT at the premises

Fastest; symmetric options; low latency

Cable

Coax (DOCSIS)

Fast; bandwidth shared with the neighbourhood

DSL

Telephone line

Slower; download faster than upload; slows with distance from the exchange

Satellite

Radio to satellites

Geostationary: high latency. Low-earth-orbit constellations: much lower latency

Cellular

4G/5G

Mobile routers and hotspots; good backup links

WISP

Fixed wireless to a tower

Rural areas; needs line of sight

7.2 Network types

Type

Scale

Example

PAN

Personal — around one person

Bluetooth headset and phone

LAN

A building or site

Office network

WLAN

Wireless LAN

Office Wi-Fi

WAN

Connects distant sites

Offices linked across the country; the internet

SAN

Dedicated high-speed storage network

Servers accessing shared block storage

8. Network tools (2.8)

Tool

Use

Scenario

Crimper

Attaches RJ45 connectors to cable

Making a patch cable

Cable stripper

Removes the outer jacket cleanly

Preparing cable for crimping or punching down

Cable tester

Checks continuity and correct pin-out

“Is this new cable wired right?”

Punch-down tool

Seats wires into patch panels and keystone jacks

Terminating a wall-port cable run

Tone generator and probe

Traces a cable to its other end

“Which patch panel port goes to desk 14?”

Loopback plug

Loops a port’s transmit back into its receive

Testing a NIC or switch port

Wi-Fi analyzer

Shows networks, channels, signal and interference

Choosing the least congested channel

Network tap

Copies traffic passing through a link

Feeding a monitoring or IDS system

9. Security perspective

Prefer encrypted protocols: SSH (22) over Telnet (23); SFTP over FTP; HTTPS (443) over HTTP (80); LDAPS (636) over LDAP (389).
Never expose RDP (3389) or SMB (445) directly to the internet. Both are among the most attacked services. Use a VPN or gateway, with MFA.
Rogue DHCP servers can hand out an attacker’s gateway or DNS server. Managed switches use DHCP snooping to allow DHCP offers only from trusted ports.
DNS matters: a hijacked DNS server setting sends users to fake sites. Check ipconfig /all shows the expected DNS servers.
SPF, DKIM and DMARC are the first things to check on a spoofed-email ticket. Without DMARC, a domain is easy to impersonate.
Segment with VLANs. IoT, cameras, guests and legacy or SCADA systems belong on separate VLANs, with firewall rules between them.
Change default credentials on routers, APs, cameras and IoT devices, and keep their firmware updated.
Know what’s listening: unexpected open ports (Get-NetTCPConnection -State Listen, ss -tulpn) are worth investigating.

Summary

Encapsulation: data rides inside TCP/UDP (ports) inside IP (addresses) inside Ethernet (MACs).
TCP vs UDP: TCP is reliable and connection-oriented (SYN, SYN-ACK, ACK); UDP is fast and connectionless.
Ports to memorise: 20/21, 22, 23, 25, 53, 67/68, 80, 110, 143, 389, 443, 445, 636, 3389.
Wireless: 2.4 GHz = range and interference, channels 1/6/11; 5 and 6 GHz = speed. Bluetooth, RFID and NFC are short-range.
DNS: A, AAAA, CNAME, MX, TXT, with SPF/DKIM/DMARC for email. Resolution goes resolver → root → TLD → authoritative.
DHCP uses DORA, with scope, pool, exclusions, reservations and leases. VLANs split networks; VPNs tunnel securely.
Devices: a router joins networks; switches learn MACs; APs bridge wireless; PoE = 15.4 / 30 / 60–100 W.
IPv4: /24 = 254 hosts. Private ranges are 10/8, 172.16/12 and 192.168/16; 169.254 = APIPA. IPv6 is 128-bit, shortened with :: once.

Glossary

Term

Definition

Encapsulation

Wrapping data in successive protocol headers

IP address

A logical address identifying a device on a network

Port

A number identifying an application or service on a host

TCP / UDP

Reliable connection-oriented / fast connectionless transport

Three-way handshake

SYN, SYN-ACK, ACK — how TCP opens a connection

Ephemeral port

A temporary high-numbered client port

Non-overlapping channels

2.4 GHz channels 1, 6 and 11

RFID / NFC

Radio tags / very short-range wireless communication

DNS

Translates names to IP addresses

TTL

Time to live — how long a DNS answer is cached

SPF / DKIM / DMARC

Email sender authorisation / signing / policy and reporting

DHCP / DORA

Automatic IP configuration / Discover, Offer, Request, Acknowledge

Scope / reservation / exclusion

DHCP range / fixed MAC-to-IP mapping / addresses kept out of the pool

VLAN

A logical network separated on shared switch hardware

VPN

An encrypted tunnel over an untrusted network

Router / switch

Forwards between networks by IP / within a network by MAC

PoE

Power over Ethernet

ONT

Optical network terminal

Subnet mask / CIDR

Network/host split, e.g. 255.255.255.0 = /24

APIPA

Self-assigned 169.254.x.x address when DHCP fails

NAT

Translates private addresses to a public address

Link-local (IPv6)

An fe80:: address valid only on the local link

Review questions

Which transport protocol would you expect a video call to use, and why?
What are the three steps of the TCP handshake?
A user can reach websites by IP address but not by name. Which service is failing, and on which port?
Which port does LDAPS use?
Why should 2.4 GHz access points use channels 1, 6 and 11?
What does an MX record do?
Interpret v=spf1 include:_spf.google.com ~all.
Put the DHCP process in order, and name the ports used.
What’s the difference between a DHCP reservation and an exclusion?
A PC shows 169.254.10.4. What does that mean?
For 10.20.30.40/24, what are the network and broadcast addresses?
Shorten fe80:0000:0000:0000:0204:61ff:fe9d:f156.
Which device do you need to find which wall port a cable in the comms room goes to?
What’s the difference between client-to-site and site-to-site VPNs?

Answer key

UDP — low latency matters more than retransmitting lost packets, which would arrive too late anyway.
SYN → SYN-ACK → ACK.
DNS, port 53.
636.
They’re the only non-overlapping 20 MHz channels, so neighbouring APs don’t interfere.
It lists the mail servers that accept email for a domain, with priorities.
Google’s mail servers may send for the domain; mail from other servers is a soft fail (~all), usually marked rather than rejected.
Discover → Offer → Request → Acknowledge; UDP 67 (server) and 68 (client).
A reservation always gives a specific IP to a specific MAC; an exclusion keeps addresses out of the pool entirely (e.g. for static devices).
APIPA — the PC couldn’t reach a DHCP server and gave itself a link-local address. It has no internet or routed access.
Network 10.20.30.0, broadcast 10.20.30.255 (usable hosts .1–.254).
fe80::204:61ff:fe9d:f156.
A tone generator and probe.
Client-to-site connects one user’s device to a network; site-to-site permanently links two networks.