Overview
This two-hour Study Buddy session ran on Wednesday 23 September 2026, 20:00–22:00 BST. It was a supplementary session alongside the instructor-led cybersecurity course, not a numbered classroom session. It built directly on Session 5: Networking Fundamentals — Part 1 two days earlier.
The instructor worked through number systems, IPv4 and IPv6 addressing, the OSI model, historical classful addressing, CIDR and subnet masks, and how a device finds its network address. The session then moved to routing between two networks, ARP, a VyOS router’s routing table in a lab environment, and how to find an interface’s IP and MAC addresses on Windows and Ubuntu.
The sections below follow the order in which the material was taught. Each section records what was covered, then adds explanation to make it understandable. Boxes labelled Supplementary explanation are my own explanatory additions, not the instructor’s words, and examples marked illustrative are not real configurations. The diagrams are original and do not reproduce the instructor’s screenshots. I observed the demonstrations; I did not complete the lab or run the commands myself. How this entry was put together gives the full evidence details.
Number systems: decimal, binary and hexadecimal
By about 20:35 the whiteboard set out three number systems, because network addresses are written in one system and processed in another.
- Decimal (base 10) uses place values that are powers of 10: 10,000, 1,000, 100, 10 and 1.
- Binary (base 2) uses powers of 2. The instructor wrote the eight place values of an octet, the group of eight bits used in IPv4 addresses: 128, 64, 32, 16, 8, 4, 2, 1.
- Hexadecimal (base 16) uses the digits 0–9 and then A–F, where A = 10. The board worked through a value of 64 + 10 = 74, showing that hexadecimal
4Aequals decimal 74.
Write each bit under its place value, then add the place values where the bit is 1.
| Place value | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
|---|---|---|---|---|---|---|---|---|
| Bit | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
- The 128 and 64 positions contain 1.
- 128 + 64 = 192.
- So
11000000in binary is 192 in decimal, the first octet of many private addresses such as 192.168.1.10.
- An octet ranges from
00000000(0) to11111111(255): 256 distinct values. That is why each part of an IPv4 address is between 0 and 255. - One hexadecimal digit represents exactly four bits.
4Ais 4 × 16 + 10 = 74, which is0100 1010in binary: the 4 and the A (1010) each fill four bits.
IPv4 and IPv6 addresses
The instructor wrote IPv4 as 32 bits in four octets and introduced the notation N and H for the network and host portions of an address. IPv6 was discussed as a 128-bit address written in hexadecimal.
An IP address has two jobs. The network portion says which network the device is on; the host portion identifies the device within that network. Devices on the same network share the same network portion.
131.107.5.15/24: the first 24 bits are the network portion and the last 8 bits are the host portion. Applying the /24 mask gives the network address 131.107.5.0.
N Network portion: 24 bits H Host portion: 8 bits
- IPv4 addresses are written in dotted decimal: four octets separated by dots, such as 131.107.5.15.
- IPv6 addresses are normally written as colon-separated hexadecimal.
2001:db8::10is an illustrative address from the range reserved for documentation;::stands for a run of zero groups. - The N/H split is not fixed by the address itself. It is set by the prefix length or subnet mask, covered below.
The OSI model and encapsulation
The same whiteboard outlined the seven OSI layers with examples for most of them. Layer 5 was part of the outline, but its annotation is not legible in my notes; its standard name is Session.
| Layer | Name | Examples on the whiteboard |
|---|---|---|
| 7 | Application | HTTP, SMTP |
| 6 | Presentation | Encryption, compression |
| 5 | Session | (annotation not recorded) |
| 4 | Transport | TCP, UDP |
| 3 | Network | IP, router |
| 2 | Data Link | MAC, switch |
| 1 | Physical | 802.3 (Ethernet cabling) and 802.11 (wireless radio) |
Sketches showed encapsulation: each layer adds its own information around the application data as it moves down towards the cable or radio. The board also noted MTU = 1500 bytes.
- The OSI model is a conceptual reference, not a description of how every protocol is built. Some protocols do not sit neatly in one layer; TLS, for example, is often associated with Layer 6 but is not a complete Presentation layer.
- MTU (maximum transmission unit) is the largest packet a link carries without fragmenting it. A typical Ethernet MTU of 1,500 bytes refers to the IP packet and excludes the Ethernet frame’s own header and trailer. It is common, not universal.
- Session 5 also covered the model, and the Networking Fundamentals module explains it in more depth: see The seven OSI layers.
Historical classful addressing
By about 20:50–20:57 the instructor had covered the historical address classes. Each class was recognised from the first octet and implied which octets were network and which were host.
The class was identified from the first octet, which set a default split between network (N) and host (H) octets.
Class A
First octet 1–126
Octets: network, host, host, host
Default mask 255.0.0.0 (/8)
Class B
First octet 128–191
Octets: network, network, host, host
Default mask 255.255.0.0 (/16)
Class C
First octet 192–223
Octets: network, network, network, host
Default mask 255.255.255.0 (/24)
N Network octet H Host octet
127 is reserved for loopback, 224–239 was Class D (multicast) and 240–255 Class E (reserved). Modern networks use CIDR, so the prefix length is configured rather than implied by the class.
The default masks written for each class were 255.0.0.0 (Class A), 255.255.0.0 (Class B) and 255.255.255.0 (Class C).
Two questions came up in the meeting chat. The first asked whether both of the first two octets of a Class B address had to fall within the class limits. The answer is no: the class was determined by the first octet, strictly by its leading bits, so only that octet decides the class. The second asked whether a Class A address could use the mask 255.255.255.0, and whether subnet masks remove the need for classes. That question led straight into CIDR.
- Classes explain older textbooks and default masks, but modern networks do not assign masks by class.
- Not every address in a class range is usable everywhere. 0.0.0.0/8 and 127.0.0.0/8 (loopback) are special, 224–239 is multicast and 240–255 is reserved. Private ranges such as 10.0.0.0/8 are also reserved for internal use; Private IPv4 and IPv6 covers them.
CIDR, subnet masks and the network address
Between about 20:57 and 21:15 the instructor introduced CIDR (Classless Inter-Domain Routing). With CIDR, the number of network bits is written after a slash as a prefix length:
| Subnet mask | Prefix |
|---|---|
| 255.0.0.0 | /8 |
| 255.255.0.0 | /16 |
| 255.255.255.0 | /24 |
A subnet mask marks the network bits with 1s and the host bits with 0s. The prefix length simply counts the 1s: 255.255.255.0 is 24 ones followed by 8 zeros, so it is /24. The prefix and the mask are two ways of writing the same boundary.
The worked example on the board was 131.107.5.15 with the mask 255.255.255.0 (/24). Its network address is 131.107.5.0, and a /24 network has 2⁸ − 2 = 254 conventional host addresses. A bitwise AND was written out to show how the address and mask produce the network address.
131.107.5.15 AND 255.255.255.0 gives 131.107.5.0. Each result bit is 1 only where both the address bit and the mask bit are 1, so the first 24 bits are kept and the remaining host bits become 0.
N Network bits: first 24 H Host bits: last 8. 1 AND 1 = 1; any other combination = 0.
Chat questions asked whether /24 is the same thing as the mask, and whether 131.107.x.x could really use /24 when 131 is historically Class B. Under CIDR it can: the prefix length is configured, not taken from the class.
- Identify the mask. /24 means the first 24 bits are network bits: 255.255.255.0.
- Apply AND octet by octet. 131 AND 255 = 131; 107 AND 255 = 107; 5 AND 255 = 5; 15 AND 0 = 0. Where the mask is 255 the octet is kept, and where it is 0 the octet becomes 0.
- Network address: 131.107.5.0, with the host bits all 0.
- Broadcast address: 131.107.5.255, with the host bits all 1.
- Usable host range: 131.107.5.1 to 131.107.5.254. The 8 host bits give 2⁸ = 256 addresses; removing the network and broadcast addresses leaves 254.
That is only true when the prefix falls on an octet boundary, as with /24. With /26, for example, 131.107.5.15 is in the network 131.107.5.0 but its broadcast address is 131.107.5.63. There are also special cases: /31 is used for point-to-point links and /32 identifies a single host.
Routing between two networks
By about 21:15 the instructor had drawn two PCs connected through a router, with PC1 at 10.1.16.1/24 and PC2 at 10.1.15.8/24. The word “ping” was written beside the drawing; my notes do not show a ping being run or its result.
Based on the hand-drawn example. PC1 and PC2 have different network addresses, so traffic between them must be routed.
Network 10.1.16.0/24
PC110.1.16.1/24
Network 10.1.15.0/24
PC210.1.15.8/24
Applying each /24 mask gives different network addresses (10.1.16.0 and 10.1.15.0), so the PCs cannot reach each other without the router. The PCs would also need correct gateway settings and routes, and traffic policy must allow the traffic.
The meeting chat summed up the difference between the two devices: a switch connects devices within a network, and a router connects different networks.
- A device compares a destination with its own network. If the destination is in the same network (on-link), it delivers directly. If not, it sends the packet to a next hop, usually its default gateway.
- Layer 2 switches forward frames within a network or VLAN. Routers, and Layer 3 switches, forward packets between IP networks.
- IP forwarding, default gateways and NAT/PAT works through this decision step by step.
ARP and the ARP cache
By about 21:17 the whiteboard connected an IPv4 address, a MAC address and the ARP cache, which records which MAC address belongs to which IP address. The discussion contrasted routing between networks with switching within one.
ARP answers the question: which MAC address should this frame be sent to? Continuing the two-network example makes the answer less obvious than it first seems.
Illustrative: PC1 (10.1.16.1/24) sends to PC2 (10.1.15.8/24) through a router, with no NAT involved. The router’s interface IP and MAC addresses were not recorded, so they are described rather than given.
- 1 · Compare networksPC1: 10.1.15.8 is not in 10.1.16.0/24
The destination is off-link, so PC1 sends the packet to its next hop, normally its default gateway.
- 2 · ARP for the next-hop routerPC1 → Broadcast on the local 10.1.16.0/24 network
PC1 asks which device has the configured next-hop router’s IPv4 address: the router’s own address on this network. 10.1.16.0/24 names the network; it is not the router’s address. The reply gives the router’s MAC address, which PC1 needs instead of PC2’s.
- 3 · Frame to the routerDestination MAC: router’s MAC · Destination IP: 10.1.15.8
The Ethernet frame is addressed to the router’s MAC address. Because this example involves no NAT, the IP packet inside still carries PC2’s address, 10.1.15.8.
- 4 · Router repeats on the far sideRouter → ARP for 10.1.15.8 → PC2
The router forwards the packet into 10.1.15.0/24 in a new frame addressed to PC2’s MAC address.
Each ARP cache stores learned IPv4-to-MAC mappings for devices on its own link. IPv6 uses Neighbour Discovery instead of ARP.
- For a destination in another network, the sending PC resolves the MAC address of its next hop (normally the gateway), not the remote PC. It does this by asking for the next-hop router’s own IPv4 address on the local network, not the network address.
- In this example, which involves no NAT, the destination IP address (10.1.15.8) stays the same in the IP header from PC1 to PC2, while the destination MAC address changes at each hop. This is not true of all routed traffic: a device performing NAT can rewrite addresses in the IP header.
- The ARP cache is also called the IPv4 neighbour table. On Windows,
arp -alists it; on Linux,ip -4 neighdoes. These commands are supplementary context and were not part of the demonstration I observed. - DHCP and ARP develops ARP requests, replies and spoofing risks.
VyOS routing demonstration
By about 21:46 the instructor had opened a Go Deploy lab (CT-N10-008-CAC, Module 4), selected the virtual machine rLAN10 and was showing the console of a VyOS router. VyOS is an open-source network operating system; the lab ran it as a virtual machine, a setup explained further in Virtual Machines.
The instructor had run show ip route, which displays the router’s routing table. The table on screen read:
S 0.0.0.0/0 [1/0] via 10.1.128.1 inactive
C>* 10.1.16.0/24 is directly connected, eth1
C>* 10.1.24.0/24 is directly connected, eth2
C>* 10.1.254.254/32 is directly connected, lo
C>* 127.0.0.0/8 is directly connected, loThe console also showed configure failed! messages for firewall configuration while the system started. What caused them, and whether they were fixed, is not established in my notes.
- Reading the codes:
Cis a directly connected network, on one of the router’s own interfaces.Sis a static route, entered by an administrator.>marks the selected route and*a route installed for forwarding. - Connected routes: the router has interfaces in 10.1.16.0/24 (
eth1) and 10.1.24.0/24 (eth2), so it can forward between those networks.lois the loopback interface; 10.1.254.254/32 is a single-address route on it. - The default route
0.0.0.0/0matches any destination without a more specific route. Here it pointed to 10.1.128.1 but was marked inactive, so it was not being used. The table alone does not show working connectivity beyond the connected networks. - This lab’s second network, 10.1.24.0/24, is a different network from the hand-drawn 10.1.15.0/24 example. They are separate illustrations.
Windows and Ubuntu demonstrations
The instructor also went through Windows and Ubuntu lab machines to show where to find a network card’s IP and MAC addresses on each operating system.
On Windows the command was ipconfig /all. Its output is worth learning to read:
| Field | What it tells you |
|---|---|
| Description | Which network adapter the section describes |
| Physical Address | The adapter’s MAC address |
| DHCP Enabled | Whether the address was assigned automatically |
| IPv4 Address | The device’s address on this network |
| Subnet Mask | Which part of the address is the network |
| Default Gateway | The next hop for other networks |
| DNS Servers | Where name lookups are sent |
On Ubuntu the instructor gave a similar command-line demonstration. I did not record the exact command used.
On modern Linux, ip addr show (shortened to ip a) lists interfaces and their addresses. The older ifconfig command is a legacy tool; ip from the iproute2 package is the current standard. The output below is illustrative, not taken from the instructor’s machine:
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
link/ether 02:00:00:00:00:10 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.10/24 brd 192.168.1.255 scope global eth0link/ethershows the MAC address.inetshows the IPv4 address with its prefix length.ip -4 routeshows routes; on Windows,route print -4does the same.
A MAC address can be changed in software or randomised, and one interface can have several IP addresses, so treat the output as a description of the current configuration rather than proof of a device’s identity.
What I learned
- Binary is the key to addressing: once an address is written in bits, the network and host portions and the AND operation become straightforward.
- Classes are history. CIDR means the prefix length is configured, so 131.107.5.15/24 is valid even though 131 was a Class B first octet.
- A subnet mask and a prefix length describe the same boundary, and the network address is the result of ANDing the address with the mask.
- Devices in different networks need a router. The sender ARPs for its gateway’s MAC address, not for the remote device.
- A routing table records what a router believes it can reach. An inactive route, or configuration errors during start-up, are reminders not to assume connectivity from configuration alone.
Next steps
- Practise binary conversions and AND calculations for prefixes that do not fall on octet boundaries, such as /26 and /20.
- Revisit What Is a Network? and DHCP and ARP with this session’s examples in mind.
- Look out for opportunities to explore routing tables in an authorised lab environment. No practical work from this session is claimed here.
How this entry was put together
- Sources: six screenshots I took of the instructor’s whiteboard and the meeting at about 20:35, 20:50, 20:57, 21:15, 21:17 and 21:46, together with my own recollection of the Windows and Ubuntu demonstrations. The entry is a reconstruction of visible notes and recollection, not a verbatim transcript. The screenshots are not published here.
- Instructor-covered material: the topics, worked values (64 + 10 = 74, 131.107.5.15/24, the PC1 and PC2 addresses), the classful ranges and masks,
show ip routeand its output, andipconfig /all. - Meeting-chat discussion: the questions about classes, masks and /24, and the switch-versus-router summary, came from participants in the meeting chat and are summarised rather than quoted.
- Supplementary explanations: the labelled boxes and the calculation walkthroughs are my own explanations, checked against standard references, and are not attributed to the instructor.
- Not recorded: the exact Ubuntu command, the Layer 5 annotation, the router’s interface addresses in the hand-drawn example, any ping result, and the cause of the firewall configuration errors.
- No completed lab work: I observed the VyOS, Windows and Ubuntu demonstrations. I did not configure VyOS, run the commands, fix the firewall errors or complete an assessment.