CCNA Cutsheets

The ports that show up constantly on the exam. Know the transport protocol (TCP vs UDP) as well as the number — several are asked both ways.

Every port number (0–65,535) falls into one of three IANA-defined ranges. Knowing the boundaries helps you reason about unfamiliar ports on the exam.

Classful addressing is legacy (CIDR replaced it), but the exam still tests it — first octet range and default mask especially.

Usable hosts = 2^{(host bits)} − 2. Number of subnets from a classful base = 2^{(borrowed bits)}. The last octet column assumes the mask boundary falls in the 4th octet (a /24 base network).

The manual "by-hand" method for solving subnetting problems on paper (or on the exam) — place values, CIDR-to-octet mapping, and the host table formulas.

1. Fill in what's given.
2. Determine the Class of the given IP address.
3. Fill in the Default Subnet Mask (DSM) for that class.
4. Bit out the DSM and draw the default line.
5. Determine # of subnets (BBN) or # of hosts (BBH) using the Power-of-2 chart (2ⁿ − 2).
6. BBN + BBH = free bits.
7. Turn on the number of BBN bits after the default line; draw a line under the last bit turned on to get the CSM & INC value.
8. Use the last bit turned on to determine which octet the INC applies to.
9. Solve SubID = IP × CSM (in binary — "ANDing").
10. Solve BC (broadcast) = (SubID + INC) − 1 in the 4th octet.
11. Add the INC to every IP address down the host table to fill it in — first usable = SubID + 1, last usable = BC − 1.

A full IPv6 address is 128 bits written as eight 16-bit hextets separated by colons. Two shorthand rules let you compress it — the exam tests both, including where people get them wrong.

Before using a global unicast or link-local unicast address, a device may verify the address is unique on the network.

• The device sends a Neighbor Solicitation (NS) message targeting its own IPv6 address.
• If another device already has that address, it responds with a Neighbor Advertisement (NA), notifying the sender the address is in use.
• DAD is not required, but RFC 4861 recommends performing it on unicast addresses.

The Layer 3 header every routed packet carries. IPv6 was designed to simplify this header for faster router processing — several IPv4 fields were dropped entirely or pushed into optional extension headers.

The upper three OSI layers collapse into a single TCP/IP "Application" layer — the interface between the applications people use and the underlying network.

DNS, HTTP, SMTP, POP3, DHCP, FTP, TFTP, IMAP — see the Ports section for their port numbers.

TCP carries a heavier, connection-oriented header for reliability; UDP strips it down to four fields for speed.

An ICMP Destination Unreachable message notifies the source that a destination or service is unreachable, and includes a code explaining why.

• 48-bit address expressed as 12 hex digits (6 bytes total).
• First 6 hex digits (3 bytes / 24 bits) = OUI — Organizationally Unique Identifier, registered by the vendor with the IEEE.
• Last 6 hex digits (3 bytes / 24 bits) = vendor-assigned value, unique per device.
• MAC addressing provides device identification at the data link layer, since every device on an Ethernet LAN shares the same media.

The core switching config workflow: create the VLAN, assign access ports to it, then trunk the link between switches so every VLAN's traffic can cross it.

Trunks are Layer 2 links that carry traffic for all VLANs between switches (or switch-to-router).

A phone+PC on one port needs both a data VLAN and a voice VLAN, with QoS trust turned on so voice traffic gets prioritized.

The resulting link state when each side of a connection is set to a given DTP mode.

How a switch actually builds and uses its MAC address table for every frame it handles.

• Ingress — a frame entering an interface.
• Egress — a frame exiting an interface.
• A switch forwards based on the ingress interface plus the destination MAC address, using its MAC address table to decide.

Spanning Tree builds a loop-free topology in three elections: pick the root bridge, pick each non-root switch's root port, then pick each segment's designated port. Whatever's left over is blocked.

The switch with the lowest BID wins root bridge election. BID = Bridge Priority + Extended System ID + MAC Address.

• Bridge Priority — default is 32768 on every Cisco switch. Range is 0–61440 in increments of 4096; lower is preferred, and a priority of 0 always wins.
• Extended System ID — a decimal value added to the bridge priority to identify which VLAN a given BPDU belongs to.
• MAC Address — the tiebreaker. If two switches share the same priority and extended system ID, the lowest MAC address (hex) wins root bridge.

Equal to the sum of all port costs along the path to the root bridge. Lower total cost wins; the losing (higher-cost) redundant path gets blocked.

When a switch has more than one equal-cost path to the root bridge, it works down this list in order until the tie breaks:

1. Lowest sender BID — compare the BID of the switch sending the BPDU on each path (not your own switch's BID).
2. Lowest sender port priority — default port priority is 128 on every port; the sender's lower-priority port wins.
3. Lowest sender port ID — the final tiebreaker, based on the sending switch's port number (e.g. F0/1 beats F0/2), not the receiving switch's port.

EtherChannel bundles multiple physical links into one logical link — more bandwidth, and since spanning tree sees the whole bundle as a single port, none of the redundant links get blocked.

Port Aggregation Protocol negotiates the bundle by exchanging PAgP packets every 30 seconds, checking that both sides are configured consistently before enabling the channel.

Link Aggregation Control Protocol does the same job as PAgP, but as an open IEEE standard it works across vendors, not just Cisco-to-Cisco.

A classic failure: show etherchannel summary shows Po1(SD) with both member ports flagged (D) — down. show run | begin interface port-channel reveals why: S1's ports are set to channel-group 1 mode on while S2's are set to mode desirable — an incompatible PAgP combination (see the mode table above), so no channel forms.

Fix: change both sides to a compatible mode (e.g. desirable on both). Critically, the port-channel interface is removed and re-added rather than edited directly:

• no interface port-channel 1
• interface range fa0/1 - 2 → channel-group 1 mode desirable → no shutdown
• interface port-channel 1 → switchport mode trunk

One physical router interface, divided into logical subinterfaces — one per VLAN — so a single link can route between every VLAN on the trunk.

How a client obtains and renews an IPv4 lease, how to stand up a Cisco IOS router as the DHCPv4 server, and how to relay requests to a server on another subnet.

A four-step process when a client boots or joins a network:

Before the lease expires, a shorter two-step exchange — both sent directly (unicast) to the server that originally offered the address:

Excludes the router/DNS-facing addresses, then builds the pool with a gateway and DNS server reachable through another interface.

• ip dhcp excluded-address 192.168.10.1 192.168.10.9
• ip dhcp excluded-address 192.168.10.254
• ip dhcp pool LAN-POOL-1
• network 192.168.10.0 255.255.255.0
• default-router 192.168.10.1
• dns-server 192.168.11.5
• domain-name example.com

If the DHCPv4 server sits on a different subnet than the client, the router in between needs to relay the broadcast as a unicast to the server.

By default the command forwards eight UDP services, not just DHCP:

IPv6's equivalent of DHCP — except every device can build its own address without a server at all, via SLAAC. RA message flags decide how much (if any) DHCPv6 gets involved.

• Stateless — no server tracks which IPv6 addresses are in use or available.
• The router sends periodic ICMPv6 Router Advertisement (RA) messages (every 200 seconds by default) with addressing info for hosts to self-configure.
• A host can also send a Router Solicitation (RS) to request an RA immediately, instead of waiting.
• Deployable as SLAAC only, or SLAAC combined with DHCPv6.

show ipv6 interface confirms the link-local address, the GUA/subnet, and the multicast groups the interface has joined: FF02::1 (all-nodes — where RAs are sent every 200s) and FF02::2 (all-routers).

Whenever an RA indicates DHCPv6 (stateless or stateful) is in play, the same six-step exchange follows the initial RS/RA:

1. Host sends a Router Solicitation (RS).
2. Router responds with a Router Advertisement (RA).
3. Host sends a DHCPv6 SOLICIT message.
4. DHCPv6 server responds with an ADVERTISE message.
5. Host responds to the DHCPv6 server (REQUEST or INFORMATION-REQUEST).
6. DHCPv6 server sends a REPLY message.

A single Cisco IOS router can be configured as any of the three:

Same overall flow as stateful, with two differences: pool options are typically just dns-server and domain-name (no address prefix, since SLAAC handles that), and the flag change is ipv6 nd other-config-flag (O flag 0→1) instead — the A flag stays at its default of 1, since hosts still use SLAAC for the GUA itself.

A router can be a DHCPv6 client too — it needs ipv6 unicast-routing and a link-local address to send/receive IPv6 messages (Cisco IOS builds the LLA with EUI-64).

Same idea as the IPv4 helper address — configured on the interface facing the clients, pointing at the DHCPv6 server:

The ability of a network to dynamically recover from the failure of the device acting as the default gateway. A redundancy protocol decides which router is active and when a standby must take over — invisibly to the end hosts.

What happens when the active router fails:

1. The standby router stops seeing Hello messages from the forwarding (active) router.
2. The standby router assumes the role of forwarding router.
3. The new forwarding router takes over both the IPv4 and MAC addresses of the virtual router — so host devices see no disruption in service.

• By default, the router with the numerically highest IPv4 address becomes active — but explicit priority gives predictable control instead of leaving it to chance.
• Default HSRP priority is 100; range is 0–255. Highest priority wins the active role.
• If priorities tie, the numerically highest IPv4 address is the tiebreaker.
• Set priority with the interface command standby priority value.

Routers and switches share the same modal CLI, command structure, and initial setup steps — name the device, then lock down access.

Long output pauses every 24 lines by default (--More--). terminal length 0 disables paging entirely. Add a pipe | after any show command to filter what's returned.

"802" is the IEEE working group for LAN/MAN standards. Each sub-number covers a different piece of the stack — mostly Layer 1–2. These show up throughout the exam even when the question doesn't say "802" out loud.

Lower AD wins when the same route is learned from multiple sources.

The current blueprint is v1.1, live through February 2, 2027 (v2.0 takes over the same 200-301 exam number on Feb 3, 2027 — check for an updated topic list if your test date lands after that). Cisco runs it as a single 120-minute exam, roughly 100–120 questions, across six weighted domains.

This page is strongest on Domain 1 and touches Domain 2/3 — it does not cover Domain 5 (Security) or Domain 6 (Automation) yet.