Use this page for quick orientation; follow the linked reference sections when a design or incident requires more context.
Common services and ports
| Service |
Default port(s) |
Role |
| SSH |
22 |
Encrypted remote administration |
| DNS |
53 |
Name resolution |
| DHCP |
67/68 |
IPv4 address and configuration assignment |
| HTTP / HTTPS |
80 / 443 |
Web transport |
| SMTP |
25 |
Mail transfer between systems |
| IMAP / POP3 |
143 / 110 |
Mailbox retrieval |
| SNMP |
161/162 |
Management polling and notifications |
| RADIUS |
1812/1813 |
Network-access AAA |
| TACACS+ |
49 |
Network-device administration AAA |
| RDP |
3389 |
Remote desktop access |
| SIP |
5060/5061 |
VoIP session signaling |
Frequently confused terms
| Pair |
Distinction |
| DHCP vs. DNS |
DHCP supplies network configuration; DNS resolves names |
| NAT vs. PAT |
NAT is address translation broadly; PAT is many-to-one translation using ports |
| ACL vs. firewall |
ACLs match rules; firewalls commonly provide stateful inspection and broader policy features |
| RTO vs. RPO |
RTO is acceptable service-restoration time; RPO is acceptable data-loss interval |
| MTTR vs. MTBF |
MTTR is average recovery time; MTBF is average time between failures |
| In-band vs. out-of-band management |
In-band shares the production path; out-of-band uses a separate management path |
| Latency vs. jitter vs. loss |
Delay, variation in delay, and missing packets |
| Threat vs. vulnerability |
Potential danger versus the weakness it could exploit |
Addressing and path signals
| Signal |
Meaning |
Useful first check |
169.254.0.0/16 address |
IPv4 link-local self-assignment after DHCP does not complete |
DHCP scope, relay, VLAN, and reachability |
127.0.0.1 |
IPv4 loopback |
Local stack or application, not network reachability |
::1 |
IPv6 loopback |
Local IPv6 stack |
fe80::/10 |
IPv6 link-local addressing |
Same-link communication and neighbor discovery |
| IP works but hostname fails |
Likely naming dependency |
Resolver configuration and DNS records |
| Local subnet works but remote subnet fails |
Routed-path or policy issue |
Gateway, route, return path, ACL, or firewall policy |
| One VLAN is affected |
A localized boundary issue |
VLAN membership, trunking, interface routing, or policy |
Wireless and security controls
| Need |
Useful control or concept |
| Prevent unknown devices joining a production network |
Network access control (NAC) |
| Isolate visitors from internal systems |
Guest segment with narrowly defined access |
| Secure device administration |
Restricted SSH/HTTPS management plane with individual identities |
| Inspect switched traffic |
Mirror session, often called SPAN on Cisco switches, or a network tap |
| Host a public service away from trusted internal systems |
Screened subnet or DMZ |
| Keep the management path available during a production failure |
Console or out-of-band management |
For context, see Network Concepts, Network Operations, and Network Security.