CCNA Overview and Packet Life

A general CCNA cheat sheet followed by the complete visual encapsulation and packet-life explanation.

CCNA 200-301 v1.1 exam map

The percentages and domain names come from Cisco's official 200-301 CCNA v1.1 exam topics.

General CCNA rules to remember

1. A host uses its subnet mask or prefix length to decide whether a destination is local or remote.
2. For a remote destination, the host sends the first frame to the default gateway MAC address.
3. A Layer 2 switch forwards frames by destination MAC address and VLAN.
4. A router forwards packets by destination IP address using longest-prefix match.
5. A router removes the incoming Layer 2 header and creates a new Layer 2 header for the next link.
6. Normal routing preserves source and destination IP addresses, but decreases TTL or Hop Limit.
7. NAT can change IP addresses. PAT can also change TCP or UDP port numbers.
8. ARP maps a local IPv4 next-hop address to a MAC address. IPv6 uses Neighbor Discovery.
9. VLANs create separate Layer 2 broadcast domains.
10. An access port normally carries one untagged data VLAN. A trunk carries multiple VLANs with 802.1Q tags.
11. The native VLAN is normally untagged on an 802.1Q trunk. Both ends must agree.
12. STP blocks redundant Layer 2 paths to prevent loops. EtherChannel makes multiple links act as one logical link.
13. Routing chooses longest prefix first, then administrative distance, then the protocol metric.
14. ACLs process top to bottom, stop at the first match, and end with an implicit deny.
15. Inbound and outbound ACL direction is relative to the interface, not the user or server.
16. An SVI usually needs the VLAN to exist and at least one active Layer 2 member or trunk path.
17. up/up normally means Layer 1 and Layer 2 are operational. administratively down means shutdown.
18. Do not save a remote change until you verify management access, forwarding, and required services.

IPv4 and IPv6 quick reference

Subnet size table

Fast subnet method: Find the first mask octet that is not 255 or 0. Calculate 256 - mask octet. The result is the subnet increment.

Wildcard masks

Switching and routing cheat sheet

Common administrative distances

Administrative distance compares routes to the same prefix from different route sources. It is not carried end to end as part of the IP packet.

Common ports, protocol numbers, and services

TCP versus UDP

Security and network services reminders

Automation and programmability quick sheet

{
  "hostname": "SW1",
  "vlans": [10, 20, 30],
  "enabled": true,
  "management_ip": null
}

Packet life and encapsulation

The rest of this page preserves the full visual explanation from the previous edition and expands the path from application data to bits.

Encapsulation and de-encapsulation map

What each header does

End-to-end example: PC opens an HTTPS website

Expanded CCNA explanation

Packet versus frame

How the host chooses the destination MAC

1. The host compares the destination IP with its own subnet using the subnet mask.
2. For a local destination, the host resolves the final host MAC.
3. For a remote destination, the host resolves the default gateway MAC.
4. ARP resolves IPv4 next hops. IPv6 Neighbor Discovery resolves IPv6 next hops.

What a router does in order

1. Receives and validates the incoming Layer 2 frame.
2. Removes the incoming Layer 2 header and trailer.
3. Reads the destination IP address.
4. Decrements TTL or Hop Limit.
5. Performs a longest-prefix route lookup.
6. Applies configured policy, such as ACL, NAT, QoS, or firewall inspection.
7. Resolves the next-hop Layer 2 address when required.
8. Builds a new Layer 2 frame for the outgoing link.

Ethernet, IPv4, TCP, and UDP header quick reference

MTU and MSS

• Common Ethernet MTU: 1500-byte Layer 3 packet.
• Common IPv4 TCP MSS without options: 1460 bytes, because 1500 - 20 IPv4 - 20 TCP.
• Common IPv6 TCP MSS without options: 1440 bytes, because 1500 - 40 IPv6 - 20 TCP.
• VPN, PPPoE, and tunneling headers reduce available payload size.

What Wireshark might not show

• The Ethernet preamble and interframe gap are normally not captured.
• The NIC often removes the Ethernet FCS before the operating system receives the frame.
• Checksum and segmentation offload can make host-side captures look unusual.
• A normal switched port does not receive unrelated unicast frames. Use SPAN, a TAP, or an endpoint capture.

Common mistakes to avoid

Show the original reference diagram

Back to top