Introduction to TCP/IP Networking for CCNA 200-301: Models, Addressing, Protocols, and Packet Flow

1. Introduction: Why TCP/IP Matters for CCNA

For CCNA 200-301, TCP/IP isn’t just one more topic on the checklist—it’s the foundation everything else is built on. Honestly, it’s the backbone of routing, switching, wireless, IP services, security, and just about every troubleshooting job we end up doing in the real world. Once you understand how hosts, switches, and routers each make forwarding decisions, CCNA starts feeling a lot less like random trivia and a lot more like one connected system.

A cleaner version of the classic teaching shortcut is this: a host knows its own addressing, default gateway, DNS settings, local routing information, and ARP or neighbor cache. A switch learns MAC addresses, tracks VLAN membership, and forwards Layer 2 frames. A router uses interface state, ARP or Neighbor Discovery, and a routing table to move packets between networks. If you keep those roles straight, packet flow becomes way easier to follow.

CCNA expects you to understand the concepts, but it also wants you to know how to prove them on real gear. You should be comfortable with addressing, subnetting, ARP, IPv6 Neighbor Discovery, default gateways, VLANs, routing tables, DHCP, DNS, NAT, and verification commands such as show ip interface brief, show ip route, show arp or show ip arp, show ipv6 route, and show ipv6 neighbors.

2. OSI Model vs. TCP/IP Model

The OSI model is a troubleshooting model. The TCP/IP model is a little closer to how we actually talk about protocol stacks in the real world. CCNA materials may show TCP/IP as a 4-layer model—Application, Transport, Internet, Network Access—or as a 5-layer teaching model that separates Data Link and Physical. Honestly, both versions are fine as long as you understand how the layers line up.

OSI to TCP/IP mapping table

Important nuance: ARP does not fit neatly into one OSI box. For CCNA, it’s easiest to think of ARP as the IPv4 address-resolution protocol that sits right on the Layer 2 and Layer 3 boundary on the local link. IPv6 doesn’t use ARP at all, by the way—it uses Neighbor Discovery over ICMPv6 instead.

In practice, I use OSI when I’m asking, ‘Where is this problem actually living—cable, VLAN, IP, transport, or application?’ Then I switch to TCP/IP thinking to explain what should happen next.

3. Encapsulation and De-encapsulation

Encapsulation is the process of adding headers as data moves down the stack. De-encapsulation is removing those headers at the destination. These terms matter because CCNA questions really love asking which addresses or ports should be in play at each step.

Application data becomes a TCP segment or UDP datagram, then an IP packet, then an Ethernet frame, then bits on the medium. Key header fields include:

- Ethernet adds the source MAC, destination MAC, EtherType, and the FCS trailer.
- The IP header carries the source IP, destination IP, TTL or Hop Limit, and the protocol field.
- The TCP header includes the source port, destination port, sequence number, acknowledgment number, flags, and window size.
- The UDP header is much lighter: source port, destination port, length, and checksum.

The most important forwarding rule is this: IP addresses usually stay end to end, while MAC addresses change hop by hop. That’s true in normal routing, although things like NAT can change IP addressing and some overlay designs can change how encapsulation works.

In a packet capture, a same-subnet web request will show the target host’s MAC address as the destination MAC. A remote-subnet request, on the other hand, shows the default gateway’s MAC as the destination MAC, even though the destination IP is still the remote server.

4. IPv4 and IPv6 Addressing Fundamentals

IPv4 uses 32-bit dotted-decimal addresses such as 192.168.10.25. IPv6 uses 128-bit hexadecimal addresses such as 2001:db8:10::25. In both cases, the prefix tells you where the network portion ends and the host or interface portion begins.

For IPv4, know the RFC1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Also know APIPA or IPv4 link-local addressing: 169.254.0.0/16. If a PC gives itself a 169.254.x.x address, DHCP probably didn’t complete successfully.

For IPv6, you’ll want to know these address types:

- Global unicast: publicly routable, typically 2000::/3
- Link-local: fe80::/10, automatically used on the local link
- Unique local: fc00::/7, commonly seen as fd00::/8 allocations for internal use
- Multicast: ff00::/8
- Loopback: ::1

IPv6 doesn’t use broadcast. Instead, it uses multicast and Neighbor Discovery. That does simplify a few things, but IPv6 definitely has its own learning curve in real operations.

IPv6 representation rules: you can omit leading zeros in a hextet, and one contiguous run of zero hextets can be compressed with :: once per address. Example: 2001:0db8:0000:0000:0000:0000:0000:0025 becomes 2001:db8::25.

A host decides whether traffic is local or remote by comparing the destination address with its own prefix. If the destination is remote, the host sends the traffic to its default gateway. And that default gateway has to be reachable on the local link first. On routers, the equivalent catch-all route is a default route: 0.0.0.0/0 for IPv4 or ::/0 for IPv6.

5. Subnetting and CIDR Basics

SSubnetting is one of those CCNA skills that touches everything—addressing, VLAN design, routing, and troubleshooting. CIDR notation such as /24 or /27 tells you how many bits belong to the network portion.

Quick rules:
- IPv4 usable hosts = 2^h - 2, where h is the number of host bits
- /24 means 24 network bits and 8 host bits
- A longer prefix is more specific than a shorter prefix, which is a really important routing concept.

Worked example 1: 192.168.10.34/27
A /27 mask is 255.255.255.224, so the block size is 32. That means the subnets start at 0, 32, 64, 96, and keep going by 32s. Address 34 falls in the 192.168.10.32/27 subnet. Network = 192.168.10.32, broadcast = 192.168.10.63, usable range = 192.168.10.33-62.

Worked example 2: Split 192.168.1.0/24 into four equal subnets. You borrow 2 host bits to get /26. The four subnets are 192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26, and 192.168.1.192/26.

Worked example 3: Are 192.168.10.20/24 and 192.168.11.20/24 in the same subnet? No. Different network IDs mean they need a gateway to talk to each other.

VLANs and subnets are related, but they’re not the same thing. A VLAN is a Layer 2 broadcast domain. A subnet is a Layer 3 network. One-to-one mapping is common in Cisco design, but they are different concepts.

6. Ethernet, MAC Addressing, VLANs, and Switching

Ethernet is still the main LAN technology you’ll deal with in CCNA. Switches learn source MAC addresses and build a MAC address table, which people often call a CAM table. When a frame comes in, a Layer 2 switch forwards it based on the destination MAC within the VLAN.

There are three behaviors you really want to know:

- Broadcast: sent to all devices in the VLAN
- Unknown unicast flooding: the switch does not know the destination MAC yet, so it floods within the VLAN
- Multicast: sent to a group address; handling depends on switching features and snooping behavior

MAC table entries age out over time. If a device stays quiet long enough, the switch can forget which port it was learned on and flood the next unknown-unicast frame until it relearns it.

VLAN tagging matters too. Access ports carry one VLAN. Trunk ports carry multiple VLANs using 802.1Q tags. Inter-VLAN communication needs Layer 3 forwarding, either through a router-on-a-stick design or through a multilayer switch that uses SVIs.

Useful commands:
show mac address-table
show vlan brief
show interfaces trunk
show cdp neighbors or show lldp neighbors

CCNA note: when we say a switch does not inspect destination IP for basic forwarding, we mean pure Layer 2 switching behavior. A multilayer switch can absolutely do Layer 3 forwarding too, once it’s configured for that role.

7. ARP and IPv6 Neighbor Discovery

In IPv4, a host uses ARP to resolve a known local IPv4 address into a MAC address. If the destination is remote, the host does not ARP for the far-end server. Instead, it ARPs for the default gateway’s MAC because that’s the next hop on the local segment.

IPv6 uses Neighbor Discovery Protocol instead of ARP. ND uses ICMPv6 and multicast instead of broadcast. The main message types you should know are:

- Neighbor Solicitation (NS): asks for a neighbor's link-layer address
- Neighbor Advertisement (NA): replies with that information
- Router Solicitation (RS): a host asks routers for information
- Router Advertisement (RA): a router advertises prefixes and gateway information

RA messages are a big part of SLAAC, where a host can build its own IPv6 address from the advertised prefix. IPv6 also uses Duplicate Address Detection (DAD) to verify an address is not already in use.

Verification commands:
Windows: arp -a, ipconfig
Linux: ip neigh, ip addr
Cisco IPv4: show arp or show ip arp
Cisco IPv6: show ipv6 neighbors, show ipv6 interface brief

8. TCP vs. UDP and Port Behavior

The transport layer uses port numbers to identify applications. A socket endpoint is basically an IP address plus protocol plus port. A full flow is identified by source IP, source port, destination IP, destination port, and protocol.

TCP is connection-oriented. It starts with the three-way handshake: SYN, SYN-ACK, ACK. TCP uses sequence numbers, acknowledgments, retransmissions, and windowing to provide reliability and flow control. That makes it a solid fit for web traffic, SSH, and file transfer.

UDP is connectionless and lightweight. It doesn’t provide built-in reliability or ordering. That’s exactly why it works so well for services where low overhead matters, like DNS queries, DHCP, NTP, voice, and video.

Clients usually use ephemeral ports, while servers listen on well-known ports. That’s how one host can keep multiple simultaneous sessions open to different services without everything getting mixed together.

9. Common Application Protocols and Services

For CCNA, you really need to know both the port numbers and the behavior behind them.

DHCP basics: clients typically use DORA: Discover, Offer, Request, Acknowledge. Those early messages are usually broadcast because the client may not even know its own IP settings yet. In routed networks, DHCP relay on Cisco devices is commonly configured with ip helper-address.

DNS basics: if ping by IP works but ping by hostname fails, check DNS server assignment and use nslookup or dig.

10. Local vs. Remote Traffic and Packet Flow

The first thing a host does is check whether the destination lives in the same subnet. If it is, the host resolves the local target’s MAC address and sends directly to it. If it doesn’t, it sends the frame to the default gateway’s MAC instead. The destination IP stays the final target, while the destination MAC is just the next hop on the local link.

Same-subnet example: PC1 192.168.10.10/24 sends to PC2 192.168.10.20/24. PC1 ARPs for PC2, learns PC2’s MAC address, and the switch forwards the frame within the VLAN.

Remote-subnet example: PC1 192.168.10.10/24 sends to server 203.0.113.50. PC1 determines the destination is remote, ARPs for gateway 192.168.10.1, and sends the frame to the router's MAC. The router then forwards the packet using the destination IP and its routing table.

Documentation note: 203.0.113.0/24 is reserved for examples and documentation.

11. Routing Fundamentals, Default Routes, and Inter-VLAN Routing

Routers forward packets by consulting the routing table. Cisco devices install connected routes when interfaces are up/up and correctly addressed. They may also show local host routes for the interface addresses themselves.

Three ideas matter most:

- Longest prefix match: a /24 beats a /16 if both match
- Default route: used when no more specific route exists
- Administrative distance and metric: help choose between multiple possible routes at a basic CCNA level

Static default route example:
ip route 0.0.0.0 0.0.0.0 192.0.2.1

IPv6 default route example:
ipv6 route ::/0 2001:db8:ffff::1

Router-on-a-stick example:

interface g0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0

interface g0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0

With multilayer switches, the gateway is often an SVI instead:

interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown

Verification: show ip route, show ipv6 route, show ip interface brief, show running-config

12. ICMP, Traceroute, NAT/PAT, and MTU

ICMP supports diagnostics such as ping and traceroute. If ping works, you know some Layer 3 reachability exists, but that doesn’t automatically mean the application itself is healthy. And if ping fails, the network can still be fine if ICMP is being filtered or rate-limited.

Traceroute nuance: Windows tracert uses ICMP Echo by default. Many Linux or Unix traceroute implementations traditionally use UDP probes unless options specify ICMP or TCP.

NAT/PAT basics: NAT translates addresses. PAT, also called overload, lets many inside hosts share one public IP by translating ports as well. In Cisco terminology, an inside host's private address is the inside local address. The translated public address is the inside global address.

Compact example: host 192.168.10.25:51514 goes to 198.51.100.20:443. The edge device may translate that to 203.0.113.10:40001. Return traffic to 203.0.113.10:40001 is mapped back to 192.168.10.25:51514 using the translation table.

Cisco PAT example:

access-list 1 permit 192.168.10.0 0.0.0.255
interface g0/0
ip nat inside
interface g0/1
ip nat outside
ip nat inside source list 1 interface g0/1 overload

Verify with show ip nat translations and show ip nat statistics.

MTU is the maximum Layer 3 payload size a link can carry without fragmentation. Standard Ethernet commonly uses 1500 bytes for the Layer 3 payload MTU. In IPv4, fragmentation can happen if it’s allowed. In IPv6, routers do not fragment transit packets; the source host handles fragmentation after Path MTU Discovery.

Practical symptom: small ping works, but large transfers fail or a large ping with DF set fails. That usually points to an MTU or PMTUD issue.

13. Basic TCP/IP Troubleshootinging and Security Notes

Use a repeatable workflow:

1. Verify host settings: IP, mask or prefix, gateway, DNS
2. Test local stack and local subnet reachability
3. Test the default gateway
4. Test remote IP reachability
5. Test name resolution and application ports
6. Verify VLANs, trunks, and MAC learning
7. Verify routes, NAT, ACLs, and the upstream path

Useful host commands:
Windows: ipconfig, ping, tracert, arp -a, nslookup, netstat -an
Linux: ip addr, ip neigh, ping, traceroute, dig, ss -tuln

Useful Cisco commands by layer:
Layer 1/2: show interfaces status, show vlan brief, show interfaces trunk, show mac address-table
Layer 3 IPv4: show ip interface brief, show ip route, show arp
Layer 3 IPv6: show ipv6 interface brief, show ipv6 route, show ipv6 neighbors

Common clues:
- 169.254.x.x address: likely DHCP failure
- Can ping IP but not name: likely DNS issue
- Same VLAN works, other VLAN fails: check gateway or inter-VLAN routing
- One VLAN has no DHCP: check trunk allowed VLANs or ip helper-address
- Remote IP fails from one subnet only: check ACL, NAT match, or route

Security notes: NAT is not a firewall. Telnet is insecure; prefer SSH. SNMPv1/v2c rely on community strings; prefer SNMPv3 when possible. First-hop attacks such as ARP spoofing, rogue DHCP, and IPv6 RA abuse can break otherwise-correct TCP/IP behavior. Features such as DHCP snooping, Dynamic ARP Inspection, port security, and RA Guard help reduce that risk. Also remember that switching loops can overwhelm a LAN and make TCP/IP look broken even when addressing is correct.

14. Real-World Packet Walk and CCNA Exam Checklist

Picture a PC on VLAN 10 with 192.168.10.25/24, gateway 192.168.10.1, and DNS server 192.168.10.53. The user browses to a public website. First, the PC resolves the name with DNS. If the DNS server is remote, the PC sends that query to the gateway's MAC because the destination is off-subnet. Once the server IP is known, the PC compares it to its own subnet, decides it is remote, ARPs for the gateway if needed, and sends the frame to the router's MAC. The switch forwards based on MAC. The router strips the Layer 2 header, consults the routing table, optionally performs NAT/PAT, and re-encapsulates the packet for the next hop. That process repeats at each routed hop. The server replies, and the return traffic is mapped back through NAT if translation was used.

Must memorize for CCNA:
- OSI and TCP/IP layer mapping
- Private IPv4 ranges and IPv6 link-local fe80::/10
- Local vs remote host decision logic
- ARP for IPv4, ND for IPv6
- TCP vs UDP behavior and common ports
- Default route concepts: 0.0.0.0/0 and ::/0
- Key commands: show ip route, show arp, show mac address-table, show vlan brief, show interfaces trunk, show ipv6 route, show ipv6 neighbors

Common exam traps:
- A host does not ARP for a remote destination; it ARPs for the gateway
- VLANs are Layer 2, subnets are Layer 3
- MAC addresses change hop by hop; IP usually stays end to end unless translation occurs
- Ping success does not prove DNS or application health
- NAT changes addressing; it does not replace security policy

If you can explain what the host knows, what the switch knows, what the router knows, and what each device does next, you are in very good shape for both the CCNA exam and real troubleshooting.