Network Engineer
Lộ trình phát triển toàn diện Network Engineer theo tiêu chuẩn quốc tế nilbuild/developer-roadmap
Hướng dẫn từng bước từ nền tảng đến chuyên sâu giúp bạn làm chủ Network Engineer. Tích hợp tài liệu lý thuyết, bài viết thực chiến, video tham khảo và bài tập lập trình trực tiếp trên IDE.
Nền Tảng & Khái Niệm Cốt Lõi
Giai đoạn 1 tập trung hoàn thiện 41 chủ đề then chốt.
Access Points & Controllers
Wireless access points (APs) are devices that broadcast Wi-Fi signals and connect wireless clients to a wired network. In larger deployments, multiple access points are managed by a wireless controller, which centralizes configuration, monitoring, and roaming policies across all APs. This controller-based architecture simplifies management and ensures consistent performance and security across the entire wireless network.
Access Points
A wireless access point (AP) is a networking device that creates a Wi-Fi network by broadcasting a wireless signal and acting as a bridge between wireless clients and the wired network infrastructure. APs connect to the network via an Ethernet uplink to a switch and allow devices like laptops, phones, and tablets to join the network without a physical cable. In home environments, the AP function is typically built into the router, while in enterprise deployments, standalone APs are deployed throughout a building and managed either individually or through a centralized wireless controller.
Access Points
A wireless access point (AP) is a device that creates a wireless local area network, typically in an office or large building, by connecting to a wired router or switch and broadcasting a Wi-Fi signal. Multiple access points can be deployed across a large area to extend wireless coverage and allow devices to roam seamlessly. Access points are distinct from routers —they extend the network wirelessly but do not typically perform routing functions on their own.
ACLs
ACLs, or Access Control Lists, are ordered sets of rules applied to a router or switch interface that permit or deny traffic based on criteria such as source IP address, destination IP address, protocol, and port number. They are one of the most fundamental tools for controlling traffic flow and enforcing security policies on a network. ACLs can be applied inbound or outbound on an interface and are evaluated sequentially, with the first matching rule determining the action taken on the packet.
Ansible
Ansible is an open-source automation tool that uses simple, human-readable YAML files called playbooks to automate the configuration and management of servers, network devices, and cloud infrastructure. Unlike some automation tools, Ansible is agentless — it communicates with devices directly over SSH or APIs without requiring any software to be installed on the target device first. For network engineers, Ansible is particularly valuable for pushing configuration changes to many routers and switches simultaneously, ensuring consistency across the network and eliminating the need to log into each device manually.
AP Placement & Coverage
AP placement is the process of determining the optimal physical location for access points to ensure complete wireless coverage across a space without dead zones or excessive overlap. Signal strength degrades with distance and is affected by physical obstacles like walls, floors, glass, and metal, so engineers must account for building materials and layout when planning deployments. Good AP placement balances coverage, capacity, and interference. Placing APs too far apart creates dead zones, while placing them too close causes co-channel interference that degrades performance for all connected devices.
APIs
An API, or Application Programming Interface, is a standardized interface that allows software applications and automation tools to communicate with network devices and services programmatically, without a human typing commands manually into a CLI. In networking, APIs are the foundation of modern automation: when a Python script configures a switch, when Ansible pushes a change to a router, or when Terraform creates a cloud network, they are all talking to devices and platforms through an API under the hood.
Application
The Application layer of the TCP/IP model is the topmost layer and encompasses all the protocols that applications use to communicate over the network. It combines the functions of the OSI Session, Presentation, and Application layers into one. Protocols like HTTP, DNS, SMTP, FTP, and SSH all operate here, directly serving user-facing applications.
Application
The Application layer is the seventh and topmost layer of the OSI model, where end-user software interacts with the network. It provides network services directly to applications, enabling functions like web browsing, email, file transfer, and domain name resolution. Protocols such as HTTP, FTP, SMTP, and DNS all operate at this layer.
ARP
ARP, or Address Resolution Protocol, is used to map an IP address to a physical MAC address on a local network. When a device wants to communicate with another device on the same network, it uses ARP to discover which MAC address corresponds to a known IP address. The result is stored temporarily in an ARP cache to speed up future lookups.
AWS
AWS (Amazon Web Services) offers a comprehensive set of networking services that allow engineers to build and manage network infrastructure entirely in the cloud. Core networking components include VPC (Virtual Private Cloud) for creating isolated virtual networks, subnets for segmenting those networks, Security Groups and Network ACLs for controlling traffic, Route Tables for directing traffic between subnets and to the Internet, and Internet Gateways for enabling public connectivity. For connecting cloud and on-premises environments, AWS provides services like Direct Connect for dedicated private connections, AWS VPN for encrypted tunnels, Transit Gateway for connecting multiple VPCs and on-premises networks at scale, and Elastic Load Balancing for distributing traffic across resources.
Azure
Microsoft Azure provides a full suite of networking services built around the concept of Virtual Networks (VNets), which are the foundational isolated network environments where Azure resources are deployed. Key networking services include VNet Peering for connecting virtual networks together, Azure VPN Gateway for site-to-site and point-to-site VPN connections, ExpressRoute for dedicated private connectivity between on-premises networks and Azure, Azure Firewall for centralized network security, Network Security Groups (NSGs) for controlling inbound and outbound traffic, and Azure Load Balancer and Application Gateway for distributing traffic across services. Azure also offers Azure Virtual WAN for large-scale branch connectivity and Azure DNS for managing domain name resolution within and across cloud environments.
Bandwidth
Bandwidth refers to the maximum amount of data that can be transmitted over a network connection in a given amount of time, typically measured in bits per second (bps). Higher bandwidth means more data can flow simultaneously, which generally results in faster network performance. It is often compared to the width of a pipe: the wider the pipe, the more water (data) can flow through it at once.
BGP
BGP, or Border Gateway Protocol, is the routing protocol that powers the Internet by exchanging routing information between autonomous systems, i.e., the large networks operated by ISPs, corporations, and other organizations. It is a path-vector protocol that makes routing decisions based on network policies, path attributes, and rules rather than simply the shortest path. BGP is responsible for ensuring that traffic can reach any two points on the global Internet.
Bluetooth Basics
Bluetooth is a short-range wireless communication standard used to connect devices over distances typically up to 10 meters. It operates in the 2.4 GHz frequency band and is designed for low-power, point-to-point or small-group connections between devices like phones, headsets, keyboards, and IoT sensors. Bluetooth is not a replacement for Wi-Fi, but complements it for personal area networking and device pairing scenarios.
Bluetooth Basics
Bluetooth is a short-range wireless communication standard used to connect devices over distances typically up to 10 meters. It operates in the 2.4 GHz frequency band and is designed for low-power, point-to-point or small-group connections between devices like phones, headsets, keyboards, and IoT sensors. Bluetooth is not a replacement for Wi-Fi, but complements it for personal area networking and device pairing scenarios.
CCNA
The Cisco Certified Network Associate (CCNA) certification is an entry-level certification for IT professionals who want to specialize in networking, specifically within the realm of Cisco products. This certification validates an individual's ability to install, configure, operate, and troubleshoot medium-sized routed and switched networks. It also covers the essentials of network security and management.
CCNP
CCNP (Cisco Certified Network Professional) is an intermediate-level professional certification that validates a candidate's ability to plan, implement, verify, and troubleshoot local and wide-area enterprise networks. It focuses on advanced core technologies, including routing, switching, security, automation, and programmable network solutions. Earning this credential requires passing a core exam followed by a concentration exam, demonstrating that an individual possesses the deep technical expertise necessary to manage complex network infrastructures in large-scale environments.
Channel Planning
Channel planning is the process of assigning specific radio frequency channels to access points in a way that minimizes interference between them. In the 2.4 GHz band, only three non-overlapping channels (1, 6, and 11) are available, making careful planning essential in dense deployments. The 5 GHz band offers significantly more non-overlapping channels, giving engineers more flexibility. The goal of channel planning is to ensure that neighboring APs operate on different channels so their signals do not interfere with each other, which would otherwise reduce throughput and increase retransmissions across the network.
Channel Planning
Channel planning is the process of assigning specific radio frequency channels to access points in a way that minimizes interference between them. In the 2.4 GHz band, only three non-overlapping channels (1, 6, and 11) are available, making careful planning essential in dense deployments. The 5 GHz band offers significantly more non-overlapping channels, giving engineers more flexibility. The goal of channel planning is to ensure that neighboring APs operate on different channels so their signals do not interfere with each other, which would otherwise reduce throughput and increase retransmissions across the network.
CIDR
CIDR, or Classless Inter-Domain Routing, is a method of allocating IP addresses and routing that replaced the older class-based system. Instead of fixed classes (A, B, C), CIDR uses a slash notation (e.g., 192.168.1.0/24) to indicate how many bits are used for the network portion of the address. This allows for more flexible and efficient use of IP address space and is the standard method used in modern networking.
Circuit Level Gateway
A circuit-level gateway is a type of firewall that operates at the session layer and monitors TCP handshakes to verify that a connection is legitimate before allowing data to flow. Unlike application-layer proxies, it does not inspect the content of the data itself — only the connection establishment. Once a session is deemed valid, traffic passes through without further inspection, making it faster but less thorough than application-layer firewalls.
Cisco Packet Tracer
Cisco Packet Tracer is a visual simulation and modeling tool that allows users to design, configure, and troubleshoot network topologies without the need for physical hardware. It provides a drag-and-drop interface where you can place virtual routers, switches, and end devices, and then execute Cisco IOS commands to test network connectivity and protocols. It is widely used to practice networking concepts, build simulated lab environments, and prepare for certification exams in a safe, risk-free virtual space.
Client-Server Network
A client-server network is a model where one or more central servers provide resources or services, and multiple client devices request and consume those resources. The server manages shared resources such as files, databases, or applications, while clients interact with them through the network. This model is widely used in enterprise environments because it centralizes management, improves security, and makes it easier to scale.
Client
A client is any device or software application that sends requests to a server to access resources or services. In everyday terms, your web browser acts as a client when it asks a web server to load a page. Clients initiate communication in the client-server model and rely on servers to respond with the requested data or functionality.
Cloud Certifications
Cloud certifications are professional credentials that validate an individual's ability to design, deploy, and manage scalable infrastructure and services on platforms like AWS, Microsoft Azure, and Google Cloud. These programs cover essential technical competencies, including virtual networking, identity and access management, storage solutions, and security configurations within public and hybrid cloud environments. Earning these certifications demonstrates proficiency in transitioning traditional on-premises network architectures to cloud-native models while ensuring connectivity, performance, and reliability.
Cloud Network Types
Cloud providers offer several types of virtual network constructs that mirror traditional networking concepts but operate in software. The most fundamental is the Virtual Private Cloud (VPC), a logically isolated section of the cloud where resources are deployed. Within a VPC, public subnets host resources accessible from the Internet, while private subnets contain resources with no direct public exposure. Cloud environments also support concepts like peering connections between VPCs, transit networks for hub-and-spoke architectures, and overlay networks for connecting cloud resources across regions or providers.
Cloud Networking Basics
Cloud networking refers to the networking infrastructure and services delivered through cloud platforms, allowing organizations to build, connect, and secure their resources in the cloud using virtual equivalents of traditional network components. Instead of physical routers, switches, and firewalls, cloud networking uses software-defined resources that can be provisioned, configured, and scaled through APIs and web consoles. Understanding cloud networking is increasingly essential for network engineers as more infrastructure moves away from on-premises data centers and into cloud environments.
Cloud Routing
Cloud routing refers to how traffic is directed between subnets, virtual networks, on-premises environments, and the Internet within a cloud platform. Each cloud provider uses route tables (collections of rules that determine where traffic destined for specific IP ranges should be sent) to control the flow of packets through the virtual network. Cloud routing also involves dynamic routing protocols through services like AWS Transit Gateway, Azure Route Server, or GCP Cloud Router, which use BGP to exchange routes automatically between cloud and on-premises environments, making large hybrid network architectures manageable without manual route configuration.
Cloud VPN
A Cloud VPN is a managed service offered by cloud providers that creates encrypted IPSec tunnels between a cloud virtual network and an on-premises network or another cloud environment over the public Internet. It allows organizations to securely extend their private network into the cloud without needing a dedicated physical connection, making it a cost-effective option for hybrid connectivity. Cloud VPNs are suitable for moderate traffic volumes and scenarios where the latency and variability of the public Internet are acceptable, as opposed to dedicated interconnect services that provide more consistent, higher-bandwidth private connections.
Cloud
In networking, the cloud refers to a model of delivering computing resources, such as servers, storage, databases, and networking, over the Internet on a pay-as-you-go basis. Rather than owning and maintaining physical infrastructure, organizations can provision and scale resources through cloud providers like AWS, Azure, or Google Cloud. This shifts network design considerations to include connectivity to cloud environments, hybrid architectures, and cloud-native security.
Cloudflare
Cloudflare's DNS resolver, known by its address 1.1.1.1, is a public DNS service focused on speed and privacy. It is consistently ranked among the fastest DNS resolvers in the world and does not log user queries for advertising purposes. Cloudflare also supports DNS over HTTPS (DoH) and DNS over TLS (DoT) to encrypt DNS queries and prevent snooping.
Common Network Issues
Common network issues are recurring problems that network engineers encounter regularly across different environments and infrastructures. These include IP address conflicts where two devices share the same address, DNS resolution failures where domain names cannot be translated to IP addresses, default gateway misconfigurations that prevent traffic from leaving the local network, duplex and speed mismatches between connected devices causing performance degradation, VLAN misconfigurations that isolate devices unintentionally, routing loops where packets cycle endlessly between routers, and high latency or packet loss caused by congestion, faulty hardware, or misconfigured QoS policies.
Common Network Issues
Common network issues are recurring problems that network engineers encounter regularly across different environments and infrastructures. These include IP address conflicts where two devices share the same address, DNS resolution failures where domain names cannot be translated to IP addresses, default gateway misconfigurations that prevent traffic from leaving the local network, duplex and speed mismatches between connected devices causing performance degradation, VLAN misconfigurations that isolate devices unintentionally, routing loops where packets cycle endlessly between routers, and high latency or packet loss caused by congestion, faulty hardware, or misconfigured QoS policies.
CompTIA Network+
The CompTIA Network+ is a highly sought-after certification for IT professionals who aim to build a solid foundation in networking concepts and practices. This certification is vendor-neutral, meaning that it covers a broad range of knowledge that can be applied to various network technologies, products, and solutions. The Network+ certification is designed for beginners in the world of IT networking, and it is recommended that you first obtain the CompTIA A+ certification before moving on to Network+.
CompTIA Security+
CompTIA Security+ is a global certification that establishes the baseline knowledge required to perform core security functions and pursue an IT security career. It covers foundational principles of network security, including threat identification, risk management, cryptography, and identity and access management. Earning this credential validates an individual's ability to secure devices, applications, and networks against common vulnerabilities and cyberattacks.
Controllers
A wireless controller is a centralized device or software platform that manages multiple access points across a network from a single point of administration. Instead of configuring each AP individually, a controller lets engineers push configurations, monitor performance, manage roaming, and enforce security policies across the entire wireless infrastructure at once. Controllers can be hardware appliances installed on-premises, virtual machines running in a data center, or cloud-based platforms.
Data Link
The Data Link layer is the second layer of the OSI model, responsible for node-to-node data transfer and error detection within a single network segment. It organizes raw bits from the Physical layer into frames and uses MAC addresses to identify devices on the local network. This layer is divided into two sublayers: the Logical Link Control (LLC) and the Media Access Control (MAC).
Datadog
Datadog is a cloud-based observability platform that provides monitoring, logging, and security capabilities across infrastructure, applications, and networks in a single unified interface. It collects metrics, traces, and logs from servers, containers, cloud services, and network devices, correlating them to give a complete picture of system health. For network engineers, Datadog offers network performance monitoring (NPM) features that provide visibility into traffic flows, latency between services, and the health of network paths across on-premises and cloud environments.
Default Gateway
A default gateway is the IP address of the router that a device uses to send traffic destined for networks outside its own local subnet. When a device does not have a specific route for a destination, it forwards the packet to the default gateway, which then handles the routing decision. In most home and office networks, the default gateway is the IP address of the local router.
Design Best Practices
Network design best practices are a set of proven principles that engineers follow to build networks that are reliable, secure, and maintainable over time. Key practices include designing for redundancy at every layer to eliminate single points of failure, keeping the design as simple as possible since complexity increases the chance of misconfiguration and makes troubleshooting harder, segmenting the network using VLANs and subnets to limit broadcast domains and contain security incidents, documenting everything from IP address assignments to device configurations, and designing with scalability in mind so the network can grow without requiring a fundamental redesign. Following established frameworks like Cisco's PPDIOO (Prepare, Plan, Design, Implement, Operate, Optimize) lifecycle model provides a structured approach to network projects from initial planning through ongoing operation.
Kỹ Năng Trọng Tâm & Thực Hành
Giai đoạn 2 tập trung hoàn thiện 41 chủ đề then chốt.
DHCP
DHCP, or Dynamic Host Configuration Protocol, is a network management protocol that automatically assigns IP addresses and other network configuration parameters to devices when they join a network. Without DHCP, administrators would need to manually configure the IP address, subnet mask, gateway, and DNS settings on every device. DHCP simplifies network management by handling these assignments dynamically from a central server or router.
DNS
DNS, or Domain Name System, is the system that translates human-readable domain names like [www.example.com](http://www.example.com) into IP addresses that computers use to identify each other on the network. Without DNS, users would need to memorize IP addresses to visit websites or access online services. DNS operates as a distributed, hierarchical database spread across many servers around the world.
DoS & DDoS
A DoS (Denial of Service) attack is an attempt to make a network resource or service unavailable by overwhelming it with a flood of illegitimate traffic or requests. A DDoS (Distributed Denial of Service) attack is the same concept but launched from many different sources simultaneously — often thousands of compromised machines in a botnet — making it much harder to block. These attacks do not typically steal data but can cause significant downtime and financial damage to the targeted organization.
Dynatrace
Dynatrace is an AI-powered observability platform that automatically discovers, maps, and monitors the full technology stack, from infrastructure and networks to applications and user experience. Its standout feature is the Davis AI engine, which automatically detects anomalies, determines root causes, and reduces alert noise by correlating data across the entire environment. While primarily used by application and platform teams, network engineers in large enterprises use Dynatrace to gain visibility into how network performance impacts application behavior and end-user experience.
EIGRP
EIGRP, or Enhanced Interior Gateway Routing Protocol, is an advanced distance-vector routing protocol developed by Cisco that combines features of both distance-vector and link-state protocols. It uses a composite metric based on bandwidth, delay, load, and reliability to calculate the best route and converges faster than traditional distance-vector protocols. EIGRP is efficient in terms of bandwidth usage and CPU load, making it popular in Cisco-based enterprise networks.
Encryption Basics
Encryption is the process of converting readable data (plaintext) into an unreadable format (ciphertext) using an algorithm and a key, so that only authorized parties with the correct key can decrypt and read it. It is the foundation of data security in networking, protecting information in transit and at rest from unauthorized access. The two main types are symmetric encryption, where the same key is used to encrypt and decrypt, and asymmetric encryption, which uses a pair of public and private keys.
EVE-NG
EVE-NG (Emulated Virtual Environment - Next Generation) is a multi-vendor network emulation platform that allows users to create virtual network topologies. It runs as a virtual machine on a server, enabling engineers to drag and drop various virtual appliances, such as routers, switches, and firewalls, into a workspace to simulate complex enterprise environments. It provides a functional environment to test configurations, troubleshoot connectivity, and practice new protocols without the need for physical hardware.
Failover
Failover is the process by which a system automatically switches to a backup server, network path, or resource when the primary one becomes unavailable due to failure or maintenance. The goal is to minimize downtime and ensure continuity of service without requiring manual intervention. Failover configurations can be active-passive, where the backup sits idle until needed, or active-active, where multiple systems share the load and take over seamlessly if one fails.
Firewalls
A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predefined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, blocking traffic that does not meet the specified criteria. Firewalls are a foundational component of network security and can be implemented in hardware, software, or as a cloud-based service.
Frame
A frame is a unit of data transmission at the Data Link layer of the OSI model. It wraps raw bits into a structured format that includes source and destination MAC addresses, the data payload, and error-checking information. Frames are used to move data between devices on the same local network segment.
FTP / SFTP
FTP (File Transfer Protocol) is a standard protocol used to transfer files between a client and a server over a network. It operates over two channels (one for commands and one for data), but transmits information in plain text, making it insecure. SFTP (SSH File Transfer Protocol) is a secure alternative that encrypts both commands and data using SSH, making it the preferred choice for transferring sensitive files.
GCP
Google Cloud Platform (GCP) takes a unique approach to networking with its globally distributed Virtual Private Cloud (VPC), which, unlike AWS and Azure, operates as a single global resource rather than being tied to a specific region. Key networking services include Cloud Router for dynamic routing between on-premises and GCP networks using BGP, Cloud VPN and Cloud Interconnect for hybrid connectivity, Cloud Load Balancing for distributing traffic globally across regions, Firewall Rules for controlling traffic at the network level, and Cloud DNS for scalable domain name resolution. GCP's network is built on the same private global fiber infrastructure that powers Google's own services, giving it a performance advantage for traffic that can be routed through Google's backbone rather than the public Internet.
GLBP
GLBP, or Gateway Load Balancing Protocol, is a Cisco proprietary protocol that goes beyond simple redundancy by also distributing traffic across multiple routers simultaneously. Unlike HSRP and VRRP, where only one router actively handles traffic at a time, GLBP allows all routers in the group to forward traffic, improving both availability and bandwidth utilization. Each router in the group shares the same virtual IP address but is assigned a different virtual MAC address, allowing traffic to be load-balanced across all active gateways.
GNS3
GNS3 is a graphical network simulation software that allows users to design, configure, and test complex network topologies in a virtual environment. It works by combining real Cisco IOS images or open-source network operating systems with virtual machines to emulate hardware behavior, enabling engineers to build lab environments without the need for physical equipment. It uses a drag-and-drop interface that facilitates the creation and troubleshooting of routed and switched networks, making it a standard tool for study, certification preparation, and proof-of-concept testing.
Google Public DNS
Google Public DNS is a global Domain Name System (DNS) resolution service that translates human-readable domain names into numerical IP addresses. It functions as a recursive name server, allowing users and network devices to perform lookups more efficiently by leveraging Google's massive infrastructure for faster responses and enhanced security. By utilizing Anycast routing, it directs DNS queries to the nearest data center, minimizing latency and providing a highly available, reliable alternative to standard ISP-provided DNS resolvers.
Grafana
Grafana is an open-source data visualization and dashboarding platform that connects to a wide range of data sources, including Prometheus, InfluxDB, Elasticsearch, and SNMP collectors, and displays the data in customizable, real-time dashboards. In network engineering, it is commonly used to visualize metrics like interface traffic, packet loss, latency, and device health collected from monitoring tools. Grafana does not collect data itself but excels at making complex time-series data understandable through graphs, gauges, and alerts.
GRE / IPSec Tunnels
GRE, or Generic Routing Encapsulation, is a tunneling protocol that wraps packets from one protocol inside packets of another, allowing traffic to be carried across networks that would not normally support it. On its own, GRE provides no encryption, so it is commonly combined with IPSec, which adds authentication and encryption to secure the tunnel. Together, GRE over IPSec is widely used to create flexible, secure connections between sites while supporting routing protocols and multicast traffic that plain IPSec tunnels cannot carry on their own.
High Availability
High Availability refers to systems and network configurations designed to ensure continuous operational uptime by minimizing service disruptions caused by hardware failures, software errors, or maintenance. It is typically achieved through redundancy, where backup components or secondary paths are ready to take over automatically if the primary system fails.
Host
A host is any device connected to a network that has an IP address and can send or receive data. This includes computers, servers, printers, smartphones, and any other networked device. The term is used broadly to refer to any endpoint that participates in network communication.
Hotspot and Tethering
A hotspot is a physical location or device that provides wireless Internet access to other devices, typically by sharing a cellular data connection. Tethering is the act of connecting a device, such as a laptop, to a smartphone's mobile data connection via Wi-Fi, USB, or Bluetooth to access the Internet. Both concepts are relevant for network engineers when designing mobile connectivity solutions or troubleshooting remote access scenarios.
How does the Internet Work?
The Internet is a massive global network of interconnected computers and devices that communicate by sending data to each other using a shared set of rules. When you visit a website, your device sends a request that travels through multiple routers and networks until it reaches the server hosting that site, which then sends the data back to your screen. This exchange happens through a system of protocols —most notably TCP/IP— that break data into small packets, route them across the network, and reassemble them at the destination.
HSRP
HSRP, or Hot Standby Router Protocol, is a Cisco proprietary protocol that provides gateway redundancy by allowing two or more routers to work together as a single virtual router. One router acts as the active gateway handling all traffic, while one or more standby routers monitor it and take over automatically if the active router fails. End devices are configured to use the shared virtual IP address as their default gateway, so they experience no disruption when a failover occurs.
HTTP / HTTPS
HTTP (HyperText Transfer Protocol) is the foundation of data communication on the web, defining how messages are formatted and transmitted between browsers and servers. HTTPS is the secure version of HTTP, adding an SSL/TLS encryption layer to protect data from being intercepted during transmission. Most modern websites use HTTPS to ensure privacy and data integrity for their users.
Hub
A hub is a basic network device that connects multiple devices in a LAN and broadcasts incoming data to all connected ports, regardless of the intended recipient. This makes hubs simple but inefficient, as all devices receive all traffic, even if it is not meant for them. Hubs have largely been replaced by switches, which are smarter and handle traffic more efficiently.
ICMP
ICMP (Internet Control Message Protocol) carries diagnostic and error messages between devices on a network, rather than application data. Routers and hosts use it to report problems like an unreachable destination or an expired packet, and tools like ping and traceroute rely on it directly. It works at the network layer, alongside IP, but it doesn't transport regular traffic.
IDS / IPS
An IDS (Intrusion Detection System) monitors network traffic for suspicious patterns and known attack signatures, alerting administrators when potential threats are detected without taking direct action. An IPS (Intrusion Prevention System) goes a step further by automatically blocking or dropping malicious traffic in real time based on the same detection mechanisms. Together, they provide visibility into network threats and an active layer of defense against intrusions.
Infrastructure as Code
Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure — including networks, servers, and cloud resources — through machine-readable configuration files rather than manual processes or interactive tools. Instead of clicking through a web console or typing commands into a CLI to set up a network, IaC lets you write code that describes exactly what the infrastructure should look like, check that code into version control, and apply it automatically and repeatably. This brings software development practices like version control, code review, and automated testing to infrastructure management, making changes more reliable, auditable, and consistent across environments
Internet
The Internet layer of the TCP/IP model corresponds to the Network layer of the OSI model and is responsible for logical addressing and routing packets across networks. The primary protocol at this layer is IP (Internet Protocol), which assigns addresses to packets and determines how they are routed toward their destination. ICMP and ARP also operate at this layer.
Introduction
A network engineer is a technology professional responsible for designing, building, and maintaining the communication infrastructure that allows computers and devices to exchange data. This includes planning how networks are structured, selecting and configuring hardware like routers and switches, troubleshooting connectivity issues, and ensuring the network remains secure and reliable. Network engineers work across a wide range of environments and must understand both the theoretical principles behind how data travels and the practical skills needed to implement and manage real-world systems.
IP Address
An IP address is a numerical label assigned to each device on a network that uses the Internet Protocol for communication. It serves two main purposes: identifying the host and providing its location in the network for routing purposes. IP addresses come in two versions: IPv4, which uses a 32-bit format, and IPv6, which uses a 128-bit format to accommodate a much larger number of devices.
IP Addressing
IP addressing is the system used to assign unique numerical identifiers to devices on a network so they can communicate with each other. Every device connected to a network needs an IP address, which tells other devices where to send data. IP addresses come in two versions — IPv4 and IPv6 — and can be assigned statically by an administrator or dynamically by a DHCP server.
IP vs MAC vs ARP
An IP address is a logical address used to identify a device across networks and is assigned by software, while a MAC address is a physical address burned into the network interface hardware, used for communication within a local network segment. ARP (Address Resolution Protocol) bridges the two by resolving a known IP address to its corresponding MAC address so that data can be delivered on the local network. Together, these three concepts work in layers: IP handles routing across networks, MAC handles delivery within a network, and ARP connects them.
ipconfig / ifconfig
ipconfig (on Windows) and ifconfig (on Linux and macOS) are command-line tools used to view and manage the network configuration of a device's interfaces. They display information such as the assigned IP address, subnet mask, default gateway, and MAC address for each network adapter. They are among the first tools used when troubleshooting a connectivity issue at the device level, confirming whether the device has a valid network configuration.
IPSec vs SSL VPN
IPSec (Internet Protocol Security) VPNs operate at the network layer, encrypting all IP traffic between two endpoints and are commonly used for site-to-site connections between networks. SSL/TLS VPNs operate at the application layer, typically accessible through a web browser or lightweight client, and are better suited for remote individual user access. The choice between the two depends on the use case: IPSec is generally preferred for permanent network-to-network tunnels, while SSL VPNs offer more flexibility for end-user remote access.
IPv4 vs IPv6
IPv4 is the original version of the Internet Protocol, using 32-bit addresses written in dotted decimal notation (e.g., 192.168.1.1), allowing for about 4.3 billion unique addresses. IPv6 was introduced to solve the problem of IPv4 address exhaustion, using 128-bit addresses written in hexadecimal (e.g., 2001:0db8::1), providing an astronomically larger address space. Beyond address size, IPv6 also introduces improvements in routing efficiency, auto-configuration, and built-in security features.
LAN
A LAN, or Local Area Network, is a network that connects devices within a limited geographic area, such as a home, office, or building. LANs typically use Ethernet cables or Wi-Fi to link computers, printers, and other devices, allowing them to share files and resources at high speeds. Because all devices are physically close together, LANs offer low latency and high bandwidth compared to larger networks.
Latency
Latency is the time it takes for a data packet to travel from its source to its destination, usually measured in milliseconds. Low latency means data arrives quickly, which is critical for real-time applications like video calls and online gaming. Latency is influenced by factors such as physical distance, network congestion, and the number of hops between devices.
Least Connections
The Least Connections algorithm is a load-balancing method that routes each new request to the server with the fewest active connections at that moment. This approach is more adaptive than Round Robin because it accounts for varying request durations and server load. It is particularly useful when requests have significantly different processing times, ensuring that no single server gets backed up while others are idle.
Link Aggregation
Link aggregation is a technique that combines multiple physical network connections between two devices into a single logical link, increasing bandwidth and providing redundancy. If one physical link fails, the others continue to carry traffic without interruption. It is standardized under IEEE 802.3ad (LACP) and is commonly used between switches, servers, and storage devices to improve both performance and reliability.
Linux for Networking
Linux is the operating system that powers the majority of the world's network infrastructure, from routers and firewalls to servers and cloud platforms. Network engineers working with Linux need to understand how to configure network interfaces, manage routing tables, control firewall rules, monitor traffic, and automate tasks through the command line. Unlike GUI-based systems, Linux gives engineers direct, low-level control over every aspect of network behavior, making it an essential skill for anyone working in modern networking environments.
Load Balancer
A load balancer is a device or software that distributes incoming network traffic across multiple servers to prevent any single server from becoming overwhelmed. By spreading the workload, load balancers improve application availability, responsiveness, and fault tolerance. They can operate at Layer 4 (based on IP and TCP/UDP) or Layer 7 (based on application-level data like HTTP headers and URLs).
Kiến Trúc Nâng Cao & Tối Ưu
Giai đoạn 3 tập trung hoàn thiện 41 chủ đề then chốt.
Load Balancing
Cloud load balancing distributes incoming network traffic across multiple backend resources, such as virtual machines, containers, or serverless functions, to ensure no single resource is overwhelmed and that applications remain available even if individual components fail. Unlike hardware load balancers in traditional data centers, cloud load balancers are fully managed services that scale automatically with traffic and require no physical maintenance. Cloud providers offer multiple types, including application load balancers that operate at Layer 7 and make routing decisions based on HTTP content, and network load balancers that operate at Layer 4 for high-performance, low-latency traffic distribution.
LoRaWAN
LoRaWAN, or Long Range Wide Area Network, is a wireless communication protocol designed for IoT devices that need to transmit small amounts of data over very long distances while consuming minimal power. It operates in unlicensed sub-GHz radio bands and can achieve ranges of several kilometers in open environments, making it suitable for applications like smart meters, agricultural sensors, asset tracking, and environmental monitoring. LoRaWAN devices are typically battery-powered and designed to last years without replacement, prioritizing low power consumption and long range over speed, as data rates are intentionally very low.
MAC Address Tables
A MAC address table, also called a CAM (Content Addressable Memory) table, is a database maintained by a network switch that maps MAC addresses to the specific ports those devices are connected to. When a frame arrives, the switch looks up the destination MAC address in this table to determine which port to forward the frame to. If the address is not found, the switch floods the frame to all ports until it learns the correct mapping.
Mac Address
A MAC address, or Media Access Control address, is a unique hardware identifier assigned to a network interface card (NIC) by its manufacturer. It operates at the Data Link layer and is used to identify devices within the same local network segment. Unlike IP addresses, MAC addresses are typically fixed and do not change as a device moves between networks.
MAN
A MAN, or Metropolitan Area Network, is a network that covers a geographic area roughly the size of a city or a large campus. It is larger than a LAN but smaller than a WAN, often used by organizations or service providers to connect multiple buildings or locations within the same metropolitan region. MANs typically use fiber optic cables or wireless links to achieve high-speed connectivity across the area.
Troubleshooting Methodologies
A troubleshooting methodology is a structured approach to diagnosing network problems that prevents guesswork and reduces time to resolution. The most common approaches are bottom-up (starting at the Physical layer and working up through the OSI model), top-down (starting at the Application layer and working down), and divide and conquer (starting at a middle layer based on available evidence). Most methodologies follow a general cycle: identify the problem, establish a theory of probable cause, test the theory, create a plan of action, implement the fix, verify full functionality, and document the outcome.
Troubleshooting Methodologies
A troubleshooting methodology is a structured approach to diagnosing network problems that prevents guesswork and reduces time to resolution. The most common approaches are bottom-up (starting at the Physical layer and working up through the OSI model), top-down (starting at the Application layer and working down), and divide and conquer (starting at a middle layer based on available evidence). Most methodologies follow a general cycle: identify the problem, establish a theory of probable cause, test the theory, create a plan of action, implement the fix, verify full functionality, and document the outcome.
MPLS VPN
MPLS VPN is a technique that uses Multiprotocol Label Switching to create private, isolated network connections over a shared provider backbone. Service providers use it to offer private WAN connectivity to enterprise customers, where each customer's traffic is logically separated from others, even though it travels across the same physical infrastructure. MPLS VPNs are highly scalable and offer predictable performance, making them a popular choice for connecting multiple branch offices across a wide area network.
Mobile Networks
Mobile networks are wireless communication systems that provide connectivity to devices over large geographic areas through a network of cell towers and base stations. They have evolved through generations, from 2G and 3G through 4G to 5G, each offering faster speeds, lower latency, and greater capacity. Understanding mobile network architecture is increasingly important as more devices rely on cellular connectivity and as 5G enables new enterprise and IoT use cases.
Modems
A modem (modulator-demodulator) is a device that converts digital data from a computer into a format suitable for transmission over a communication medium such as telephone lines or cable, and vice versa. It serves as the bridge between your local network and your Internet Service Provider's infrastructure. Modern modems often include router functionality built in, combining both devices into a single unit.
MPLS
MPLS, or Multiprotocol Label Switching, is a technique for speeding up network traffic by using short labels to direct packets along predetermined paths rather than making complex routing decisions at each hop. When a packet enters an MPLS network, it is assigned a label, and subsequent routers forward it based on that label without needing to inspect the IP header. Service providers widely use MPLS to manage traffic efficiently and deliver services such as VPNs and quality-of-service guarantees.
NAPALM
NAPALM, which stands for Network Automation and Programmability Abstraction Layer with Multivendor support, is an open-source Python library that provides a unified API for interacting with network devices from different vendors in a vendor-agnostic way. While Netmiko focuses on sending CLI commands and capturing output, NAPALM works at a higher level of abstraction. It can retrieve structured data like routing tables, interfaces, and BGP neighbors, and apply configuration changes in a consistent format regardless of whether the device is a Cisco IOS router, a Juniper device, or an Arista switch. NAPALM is particularly valued for its ability to validate configurations, compare desired versus actual state, and perform configuration rollbacks, making it a powerful tool for building reliable network automation workflows.
NAT / PAT
NAT, or Network Address Translation, is a method used by routers to map private IP addresses on a local network to a single public IP address before traffic leaves for the Internet. This allows many devices to share one public IP, which helps conserve the limited pool of available IPv4 addresses. PAT, or Port Address Translation, is an extension of NAT that also maps different port numbers to each internal device, allowing multiple simultaneous connections to be tracked and distinguished even when they all share the same public IP.
NAT64
NAT64 is a transition mechanism that allows IPv6-only devices to communicate with IPv4-only servers and services by translating between the two address formats at the network boundary. As the Internet continues its gradual migration from IPv4 to IPv6, NAT64 bridges the gap during the transition period, ensuring that devices operating exclusively on IPv6 networks are not cut off from the large portion of the Internet that still runs on IPv4. It works in conjunction with DNS64, which synthesizes AAAA (IPv6) records for destinations that only have A (IPv4) records, allowing IPv6 clients to initiate connections to IPv4 destinations transparently.
NETCONF
NETCONF, or Network Configuration Protocol, is a network management protocol designed specifically for configuring and retrieving the state of network devices. It uses XML to encode data and runs over SSH, providing a structured, transactional approach to device management that is far more reliable than screen-scraping CLI output. NETCONF supports operations like get, edit-config, copy-config, and commit, and works alongside YANG data models, which define the structure of the configuration data being exchanged, making it one of the primary protocols used in programmatic network management and automation.
NetFlow / sFlow
NetFlow is a Cisco-developed protocol that collects and exports metadata about IP traffic flows passing through a network device, providing visibility into who is communicating with whom, how much data is being exchanged, and what protocols are in use. sFlow is a similar, vendor-neutral sampling-based protocol that works across a broader range of hardware. Both are used for traffic analysis, capacity planning, anomaly detection, and security monitoring without requiring full packet capture.
Netmiko
Netmiko is an open-source Python library that simplifies SSH connections to network devices from multiple vendors, including Cisco, Juniper, Aruba, and many others. It handles the complexity of establishing SSH sessions, sending commands, and capturing output in a consistent way regardless of the underlying device type, eliminating the need to write custom connection code for each vendor. Netmiko is one of the most widely used Python libraries in network automation and is often the first tool network engineers learn when starting to automate CLI-based device interactions.
netstat
netstat, short for network statistics, is a command-line tool that displays active network connections, listening ports, routing tables, and network interface statistics on a device. It is useful for identifying which services are listening on which ports, spotting unexpected or unauthorized connections, and understanding the current state of network activity on a machine. Although largely replaced by the newer `ss` command on Linux systems, netstat remains widely used and available across Windows, macOS, and Linux.
Network Access
The Network Access layer is the lowest layer of the TCP/IP model, combining the functions of the OSI Physical and Data Link layers. It handles how data is physically transmitted over the network medium, including framing, MAC addressing, and hardware-level error detection. Ethernet and Wi-Fi protocols operate at this layer.
Network Attacks
Network attacks are deliberate actions taken by malicious actors to disrupt, intercept, or gain unauthorized access to network resources and data. They can target vulnerabilities in protocols, devices, software, or human behavior to compromise the confidentiality, integrity, or availability of a network. Understanding the types of attacks that exist is the first step in designing defenses and responding effectively when incidents occur.
Network Automation
Network automation is the process of using software, scripts, and tools to automatically configure, manage, monitor, and operate network devices and infrastructure instead of performing these tasks manually. Traditionally, network engineers would log into each device individually and type commands one at a time — a process that is slow, error-prone, and impossible to scale across hundreds or thousands of devices. Automation replaces repetitive manual work with code that can apply consistent configurations across the entire network in seconds, respond to events without human intervention, and make infrastructure changes as reliable and repeatable as software deployments.
Network Design Principles
Network design principles are the guidelines and frameworks used to plan and build network infrastructure that is scalable, reliable, secure, and easy to manage. A well-designed network is not just about connecting devices; it is about making deliberate decisions about topology, redundancy, segmentation, and traffic flow so the network can grow and adapt over time without requiring a complete rebuild. Understanding design principles allows network engineers to evaluate tradeoffs, justify architectural decisions, and build networks that meet both current needs and future requirements.
Network Devices
Network devices are the physical hardware components that make up a network and enable communication between connected devices. Each type of device serves a specific function, such as directing traffic, amplifying signals, or connecting different network segments. Understanding what each device does and how they interact is fundamental to designing and troubleshooting any network.
Network Simulators
Network simulators are software applications that allow engineers to create, configure, and test virtual network topologies without needing physical hardware. By modeling the behavior of devices like routers, switches, and firewalls, these tools enable the practice of complex configurations, troubleshooting scenarios, and protocol analysis in a safe, controlled environment. They serve as a practical platform for verifying network designs and preparing for certification exams by emulating various operating systems and network conditions.
Network
The Network layer is the third layer of the OSI model, responsible for logical addressing and routing data packets between devices across different networks. It uses IP addresses to determine the best path for data to travel from source to destination. Routers operate at this layer, making forwarding decisions based on routing tables and protocols.
Next-Generation
A Next-Generation Firewall (NGFW) is an advanced firewall that goes beyond traditional packet filtering and stateful inspection to include deep packet inspection, application awareness, intrusion prevention, and user identity tracking. NGFWs can identify and control traffic based on the specific application being used, regardless of port or protocol, and can detect and block sophisticated threats in real time. They represent the current standard for enterprise perimeter security.
NFC
NFC, or Near Field Communication, is a short-range wireless communication technology that allows two devices to exchange small amounts of data when brought within a few centimeters of each other. It operates at 13.56 MHz and is most commonly used for contactless payments, access control cards, and quick device pairing. Unlike Wi-Fi or Bluetooth, NFC requires no manual pairing or configuration (proximity alone initiates the connection) making it ideal for fast, simple interactions where security through physical closeness is sufficient.
Nmap
Nmap (Network Mapper) is a free, open-source tool used to discover hosts and services on a network by sending packets and analyzing the responses. It can identify active devices, open ports, running services, operating systems, and potential vulnerabilities across a network. Nmap is widely used by network engineers and security professionals for network inventory, auditing, and reconnaissance.
nslookup
nslookup is a command-line tool used to query DNS servers and retrieve information about domain name resolution. It allows a network engineer to check what IP address a domain resolves to, which DNS server is being used, and whether DNS records such as A, MX, or CNAME entries are correctly configured. It is an essential tool for diagnosing DNS-related issues, such as a website being unreachable due to a missing or incorrect DNS record.
NTP
NTP, or Network Time Protocol, is used to synchronize the clocks of computers and network devices over a network. Accurate timekeeping is essential for logging events, coordinating distributed systems, and ensuring security certificates work correctly. NTP works by having devices query time servers and adjust their local clocks to match, accounting for network delay in the process.
Observability
Network observability refers to the ability to understand the internal state and behavior of a network by collecting and analyzing data from its components, including logs, metrics, traces, and flow records. It goes beyond basic monitoring by providing deep insight into why things are happening, not just what is happening. Good observability enables network engineers to detect issues early, troubleshoot faster, and optimize performance across complex, distributed environments.
OpenDNS
OpenDNS is a cloud-based DNS service operated by Cisco that provides fast DNS resolution along with additional security and filtering features. It can block access to malicious websites, phishing domains, and unwanted content categories before a connection is ever established. OpenDNS is commonly used by organizations and families to add a layer of protection at the DNS level without requiring software on individual devices.
OSI Model
The OSI (Open Systems Interconnection) model is a conceptual framework that standardizes the functions of a network into seven distinct layers, from physical transmission up to application-level communication. It was developed to help different systems and vendors communicate using common standards, making troubleshooting and network design more systematic. Each layer has a specific role and interacts only with the layers directly above and below it.
OSPF
OSPF, or Open Shortest Path First, is a link-state interior gateway routing protocol used within a single autonomous system or organization. It works by having each router build a complete map of the network topology and then calculate the shortest path to every destination using Dijkstra's algorithm. OSPF converges quickly after network changes and is widely used in medium to large enterprise networks.
Package
In networking, a package (or packet) is a small chunk of data broken off from a larger message for transmission across a network. Each packet travels independently through the network and is reassembled at the destination. Packets contain both the payload data and header information, such as source and destination addresses, needed to route them correctly.
Packet Analysis
Packet analysis is the process of capturing and inspecting the raw data packets traveling across a network to understand exactly what is happening at a detailed level. By examining individual packets, network engineers can diagnose connectivity issues, identify security threats, verify that protocols are behaving correctly, and understand the root cause of performance problems. Tools like Wireshark and tcpdump are the primary instruments used for packet analysis, allowing engineers to filter, decode, and interpret traffic at every layer of the OSI model.
Packet Filtering
Packet filtering is the most basic type of firewall technique, where each packet is inspected individually against a set of rules based on attributes like source IP, destination IP, port numbers, and protocol. If a packet matches an allow rule, it passes through; if it matches a deny rule or no rule at all, it is dropped. Packet filtering is fast and lightweight, but provides limited protection since it does not consider the state of the connection or the content of the data.
Packet prioritization
Packet prioritization is the process of classifying network traffic and assigning different levels of importance to different types of packets so that critical traffic is processed and delivered first. Real-time traffic, like VoIP and video conferencing, is given higher priority than background activities like file downloads or software updates. This ensures that time-sensitive applications remain functional even when the network is under heavy load.
PAN
A PAN, or Personal Area Network, is a small network designed for communication between devices in proximity to a single person, typically within a range of a few meters. Examples include connecting a smartphone to wireless earbuds via Bluetooth or linking a laptop to a smartwatch. PANs can be wired (such as USB) or wireless (such as Bluetooth or infrared).
PAT / NAT Overload
PAT, or Port Address Translation, also called NAT Overload, is the most common form of NAT used in home and enterprise networks. It allows many devices with private IP addresses to share a single public IP address simultaneously by tracking each connection using a unique combination of the public IP address and a port number. When a device on the internal network initiates a connection, the router assigns it a unique source port number and records the mapping in a translation table, using that mapping to correctly deliver return traffic back to the right internal device. This is what allows an entire office or household to access the Internet through a single public IP address.
Peer-to-Peer Network
A peer-to-peer (P2P) network is one where each device, or peer, can act as both a client and a server, sharing resources directly with other devices without a central server. This model is simpler and cheaper to set up than a client-server network, making it common in small home networks or applications like file sharing. However, P2P networks can be harder to manage and secure as they grow in size.
Hệ Sinh Thái & Triển Khai Thực Tế
Giai đoạn 4 tập trung hoàn thiện 41 chủ đề then chốt.
Physical
The Physical layer is the first and lowest layer of the OSI model, responsible for the actual transmission of raw bits over a physical medium such as copper cables, fiber optics, or radio waves. It defines the electrical, mechanical, and timing specifications for hardware components like network cables, connectors, and network interface cards. Everything at this layer deals with the physical delivery of signals, not their meaning.
ping
ping is one of the most basic and widely used network diagnostic tools, sending ICMP Echo Request packets to a target host and measuring whether a response is received and how long it takes. It is typically the first tool used when troubleshooting connectivity, quickly confirming whether a device is reachable on the network. The results show round-trip time and packet loss, giving an immediate indication of whether a path exists between two devices and how stable it is.
Port
A port is a numerical identifier used to direct network traffic to a specific application or service running on a device. While an IP address identifies the device, the port number identifies which program on that device should handle the incoming data. For example, web traffic typically uses port 80 for HTTP and port 443 for HTTPS.
Presentation
The Presentation layer is the sixth layer of the OSI model, responsible for translating data between the format used by the application and the format used for network transmission. It handles tasks such as data encryption and decryption, compression, and character encoding. This layer ensures that data sent from one system can be read by another, regardless of differences in internal data representation.
Prometheus
Prometheus is an open-source monitoring and alerting toolkit originally built at SoundCloud and now widely adopted across the industry. It collects metrics by scraping data from configured targets at regular intervals, stores them in a time-series database, and provides a powerful query language called PromQL to analyze and visualize the data. While not network-specific, Prometheus is commonly used in modern infrastructure to monitor network devices, services, and applications, often paired with Grafana for visualization and alerting.
Protocol
A protocol is a set of rules that defines how data is formatted, transmitted, and received between devices on a network. Protocols ensure that different systems, regardless of manufacturer or operating system, can predictably communicate with each other. Examples include TCP, IP, HTTP, and DNS, each governing a specific aspect of how network communication works.
Proxy
A proxy firewall operates at the application layer and acts as an intermediary between internal clients and external servers, inspecting the full content of network requests and responses. Instead of allowing direct connections, all traffic is routed through the proxy, which can apply content filtering, authentication, and logging. Because it terminates and re-establishes each connection, a proxy firewall provides deep inspection but can introduce latency.
Public vs Private Addresses
Public IP addresses are globally unique addresses assigned by Internet Service Providers and are reachable over the Internet. Private IP addresses are reserved for use within local networks and are not routable on the public Internet (ranges like 192.168.x.x, 10.x.x.x, and 172.16.x.x are commonly used internally). Devices with private addresses access the Internet through a process called NAT (Network Address Translation), which maps multiple private addresses to a single public one.
Python for Networking
Python has become the dominant programming language in network engineering due to its simplicity, readability, and the rich ecosystem of libraries built specifically for interacting with network devices and infrastructure. Network engineers use Python to write scripts that automate configuration changes, parse device output, interact with APIs, process network data, and build custom tools. Libraries like Netmiko and NAPALM abstract away the complexity of connecting to and communicating with different vendors' devices, allowing engineers to write automation code without needing to handle low-level connection management themselves.
QoS (Quality of Service)
QoS, or Quality of Service, refers to a set of techniques used to manage network traffic and ensure that critical applications receive the bandwidth, low latency, and reliability they need. Without QoS, all traffic is treated equally, which can cause voice calls to break up or video to buffer when the network is congested. QoS works by classifying, prioritizing, and managing packets so that high-priority traffic is delivered first.
Quad9
Quad9 is a free, public DNS resolver that focuses on security by blocking access to known malicious domains at the DNS level. It uses threat intelligence from multiple cybersecurity partners to identify and block harmful websites before a connection is made, without logging personally identifiable information. Quad9 is operated by a non-profit organization and is accessible at the address 9.9.9.9.
RESTCONF
RESTCONF is a network management protocol that exposes the same YANG-modeled data as NETCONF but through a RESTful HTTP/HTTPS interface, making it more accessible to developers and tools already familiar with web APIs. Instead of XML over SSH, RESTCONF uses HTTP methods like GET, POST, PUT, PATCH, and DELETE, and supports both JSON and XML as data formats. It is easier to use and integrate than NETCONF for many automation use cases, though it lacks some of NETCONF's more advanced transactional features, making the two protocols complementary rather than direct replacements for each other.
RIP
RIP, or Routing Information Protocol, is one of the oldest dynamic routing protocols, using a distance-vector algorithm to determine the best path based on hop count —the number of routers a packet must pass through to reach its destination. It has a maximum hop count of 15, making it unsuitable for large networks. RIP is simple to configure but has largely been replaced by more efficient protocols like OSPF and EIGRP in modern networks.
Roaming & Band Steering
Roaming is the process by which a wireless client seamlessly transitions from one access point to another as it moves through a space, without dropping its network connection. In enterprise environments, fast roaming protocols like 802.11r (Fast BSS Transition) allow clients to re-authenticate quickly as they move between APs, which is critical for real-time applications like voice and video. Band steering is a related technique where the wireless controller or AP encourages dual-band capable devices to connect on the less congested 5 GHz band rather than the 2.4 GHz band, improving overall network performance by distributing clients more evenly across available spectrum.
Round Robin
Round Robin is one of the simplest load balancing algorithms, where incoming requests are distributed sequentially to each server in the pool, one after another, cycling back to the first when the end is reached. It assumes all servers have roughly equal capacity and is easy to implement. Round Robin works well when the servers are similar in performance and the requests are similar in complexity.
Routers
A router is a network device that forwards data packets between different networks, directing traffic based on IP addresses. It determines the best path for data to travel from source to destination, making routing decisions using routing tables and protocols. Routers are what connect your home or office network to the Internet and are essential for communication between separate networks.
Routing
Routing is the process of selecting a path for traffic to travel across one or more networks from source to destination. Routers perform this function by examining the destination IP address of each packet and consulting a routing table to determine where to forward it next. Routing can be done statically, where paths are manually configured, or dynamically, where routers automatically discover and update paths using routing protocols.
SAN
A SAN, or Storage Area Network, is a specialized high-speed network that provides block-level access to shared storage devices such as disk arrays and tape libraries. Unlike a regular network where files are shared, a SAN makes storage appear as locally attached to the servers that use it, enabling fast and reliable data access. SANs are commonly used in enterprise environments to support databases, virtualization, and backup systems.
Satellite
Satellite networking uses orbiting satellites to provide wireless connectivity to locations where terrestrial infrastructure is unavailable or impractical, such as remote areas, ships, and aircraft. Traditional geostationary (GEO) satellites orbit at approximately 36,000 km altitude, introducing significant latency (around 600ms round trip) that makes them unsuitable for real-time applications. Low Earth Orbit (LEO) satellite networks like Starlink orbit at 550–1,200 km, reducing latency to 20–60ms and offering speeds comparable to broadband Internet, making them increasingly viable as a primary or backup connectivity option for remote sites and as a redundant WAN link in enterprise network designs.
SD-WAN
SD-WAN, or Software-Defined Wide Area Network, is a technology that uses software to centrally manage and optimize how traffic is routed across multiple WAN connections, such as MPLS, broadband Internet, and 4G/5G links, based on real-time conditions and application requirements. Instead of rigidly sending all traffic through a single expensive MPLS circuit, SD-WAN can intelligently distribute traffic across the best available link at any given moment, improving performance and reducing costs. It is managed through a centralized controller that gives network engineers visibility and control over the entire WAN from a single interface, without needing to manually configure each individual device at every site.
Security Groups
Security groups are virtual firewalls applied at the resource level in cloud environments, controlling which traffic is allowed to reach individual instances, containers, or services based on rules that specify protocol, port range, and source or destination IP address. Unlike traditional network firewalls that sit at the perimeter, security groups travel with the resource and enforce rules wherever that resource is deployed within the cloud. Most cloud providers implement security groups as stateful, meaning if an inbound connection is allowed, the corresponding outbound response is automatically permitted without needing an explicit outbound rule.
Server
A server is a computer or software system that listens for requests from clients and responds by providing resources, data, or services. Servers can host websites, store files, manage emails, or run applications that many users access simultaneously. They are typically designed to be always available, handling multiple client connections at the same time.
Session
The Session layer is the fifth layer of the OSI model, responsible for establishing, managing, and terminating communication sessions between applications. It handles synchronization and dialog control, ensuring that data exchanges are organized and that sessions can be paused and resumed if needed. Examples of protocols operating at this layer include NetBIOS and RPC.
Shell & Scripting
The shell is the command-line interface used to interact with a Linux system, while scripting is the practice of combining shell commands into reusable files called scripts. For network engineers, shell scripting helps automate repetitive tasks such as backing up device configurations, parsing log files, running diagnostic checks across multiple devices, and generating reports. Bash is the most common shell used in networking environments, and even basic scripting knowledge can significantly reduce manual work and human error. Python is equally important and has become the dominant programming language in network engineering. Compared to Bash, Python is better suited for complex automation tasks and serves as the foundation for many modern network automation tools and frameworks, including Ansible and API-based network management.
Site-to-Site vs Remote Access
Site-to-site VPNs connect two entire networks together — such as a branch office to a headquarters — over an encrypted tunnel, allowing devices on both networks to communicate as if they were on the same LAN. Remote access VPNs allow individual users to securely connect to a corporate network from any location, typically using a VPN client on their device. Both serve different purposes and are often deployed together in enterprise environments to address different connectivity needs.
SMTP / IMAP
SMTP (Simple Mail Transfer Protocol) is the protocol used to send emails from a client to a server or between mail servers. IMAP (Internet Message Access Protocol) is used by email clients to retrieve and manage messages stored on a mail server, allowing access from multiple devices while keeping messages synchronized. Together, these protocols handle the sending and receiving sides of email communication.
SNMP
SNMP, or Simple Network Management Protocol, is a widely used protocol for monitoring and managing network devices such as routers, switches, servers, and printers. It allows a central management system to query devices for performance data — like CPU usage, interface statistics, and error counts — and can also receive unsolicited alerts called traps when certain conditions occur. SNMP is a foundational tool in network operations centers (NOCs) for maintaining visibility across large infrastructure.
SNTP
SNTP, or Simple Network Time Protocol, is a simplified version of NTP used to synchronize device clocks over a network. It is less precise than full NTP but requires fewer resources, making it suitable for devices that do not need highly accurate timekeeping. SNTP is commonly used in embedded systems, IoT devices, and environments where simplicity is prioritized over precision.
Socket
A socket is the combination of an IP address and a port number, forming a unique endpoint for network communication. When two devices establish a connection, each end uses a socket to send and receive data, creating a two-way communication channel. Sockets are the fundamental abstraction used by applications to interact with the network.
speedtest
A speedtest is a diagnostic tool that measures the actual throughput of a network connection by downloading and uploading data to a remote server and reporting the results in megabits per second. It is used to verify that a connection is delivering the bandwidth expected from an ISP or internal network link, and to identify discrepancies between advertised and real-world speeds. Speedtest tools like [Speedtest.net](http://Speedtest.net) or iPerf (used internally between two endpoints) are common first steps when users report slow Internet or network performance.
Spine-Leaf
Spine-leaf is a two-tier data center network architecture designed to provide consistent, low-latency connectivity between servers and storage in modern data centers. Every leaf switch connects to every spine switch, and no leaf connects directly to another leaf. All traffic between devices on different leaves passes through a spine switch in exactly two hops. This predictable, any-to-any connectivity pattern eliminates the bottlenecks and spanning tree complexity of traditional hierarchical designs, making spine-leaf the dominant architecture for hyperscale data centers, cloud environments, and any network carrying large volumes of east-west traffic between servers.
SSH
SSH, or Secure Shell, is a network protocol that provides a secure, encrypted channel for remotely accessing and managing devices over an unsecured network. It replaces older, insecure protocols like Telnet by encrypting all communication between the client and the server. Network engineers use SSH extensively to configure routers, switches, and servers from a remote location.
SSL / TLS
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols designed to provide secure communication over a network. They work by encrypting the data exchanged between a client and a server, verifying the identity of the parties involved through digital certificates. TLS is the modern standard and is used to secure HTTPS connections, email, and many other internet services.
Stateful Inspection
Stateful inspection, also known as dynamic packet filtering, is a firewall technique that tracks the state of active network connections and makes filtering decisions based on context, not just individual packets. By maintaining a state table of established connections, a stateful firewall can allow response packets that belong to a legitimate session while blocking unsolicited incoming traffic. This provides significantly better security than simple packet filtering without sacrificing too much performance.
Static vs Dynamic NAT
Static NAT creates a permanent, one-to-one mapping between a specific private IP address and a specific public IP address, ensuring that a device always appears on the Internet with the same public IP. It is commonly used for servers that need to be consistently reachable from outside the network, such as web servers or mail servers hosted internally. Dynamic NAT, on the other hand, maps private IP addresses to public IP addresses from a pool on a first-come, first-served basis, with no device being guaranteed a specific public IP. Dynamic NAT is less common than PAT since it still requires one public IP per active connection, but is used in scenarios where full PAT is not suitable.
Static vs Dynamic Routing
Static routing involves manually configuring fixed routes in a router's routing table, which do not change unless an administrator updates them. It is simple and predictable, but does not adapt automatically to network changes or failures. Dynamic routing uses routing protocols that allow routers to automatically discover routes, share information with neighboring routers, and adapt to topology changes in real time.
STP
STP, or Spanning Tree Protocol, is a network protocol that prevents loops in Ethernet networks by creating a logical tree topology from a physically redundant network. Without STP, multiple paths between switches could cause broadcast storms that would bring a network down. STP works by electing a root bridge and blocking redundant paths, re-enabling them only if the primary path fails.
Subnet Masks
A subnet mask is a 32-bit number used alongside an IP address to determine which portion of the address identifies the network and which portion identifies the individual host. It works by applying a bitwise AND operation with the IP address to extract the network address. For example, a subnet mask of 255.255.255.0 means the first three octets represent the network and the last octet identifies hosts within that network.
Subnetting
Subnetting is the process of dividing a large network into smaller, more manageable sub-networks called subnets. It helps improve network performance by reducing broadcast traffic and allows organizations to organize their network logically, such as separating departments or locations. Subnetting works by borrowing bits from the host portion of an IP address to create a subnet identifier, controlled by the subnet mask.
Supernetting
Supernetting, also known as route aggregation or summarization, is the process of combining multiple smaller network routes into a single, larger route advertisement. This reduces the size of routing tables and simplifies routing by representing several contiguous subnets as one summary route. It is commonly used in large-scale networks and by ISPs to keep routing tables manageable.
Switches
A switch is a network device that connects multiple devices within the same local network and forwards data based on MAC addresses. Unlike a hub, a switch sends data only to the specific device it is intended for, making communication more efficient and reducing unnecessary network traffic. Managed switches offer additional features like VLANs, port security, and traffic monitoring.
Chuyên Gia & Mở Rộng Hệ Thống
Giai đoạn 5 tập trung hoàn thiện 37 chủ đề then chốt.
Switching
Switching is the process of forwarding data frames within a local network based on MAC addresses. A network switch receives incoming frames and sends them only to the port connected to the intended destination device, unlike a hub, which broadcasts to all ports. Switching forms the foundation of modern LAN design and can be enhanced with features like VLANs, STP, and link aggregation.
TCP
TCP (Transmission Control Protocol) sets up a connection between two devices before sending any data, then makes sure every piece of data arrives in order and without errors. It splits data into segments, numbers them, and asks for retransmission if a segment gets lost or corrupted. Most applications that need reliability, like web browsing, email, or file transfer, run on top of TCP.
TCP/IP Model
The TCP/IP model is a practical, four-layer framework that describes how data is transmitted over the Internet and most modern networks. It was developed by the U.S. Department of Defense and serves as the foundation for Internet communication. Unlike the OSI model's seven layers, the TCP/IP model consolidates functions into four layers: Network Access, Internet, Transport, and Application.
Terraform
Terraform is an open-source Infrastructure as Code tool developed by HashiCorp that allows engineers to define and provision infrastructure — including network resources — using a declarative configuration language called HCL (HashiCorp Configuration Language). Instead of manually creating networks, subnets, firewall rules, and load balancers through a cloud console, Terraform lets you describe the desired state of your infrastructure in code and then automatically creates or modifies resources to match that state. It supports all major cloud providers and many network vendors, making it a popular choice for managing cloud networking infrastructure consistently and repeatably.
Three-Tier
The three-tier architecture organizes a network into three distinct layers: the core, distribution, and access layers. The core layer provides high-speed backbone connectivity between distribution blocks and is optimized purely for fast packet forwarding with no policy enforcement. The distribution layer handles routing, filtering, and policy between the core and access layers, while the access layer connects end-user devices to the network. This design is the traditional standard for large enterprise campus networks where scalability, redundancy, and clear separation of functions are critical.
Throughput
Throughput is the actual amount of data successfully transferred over a network in a given period of time, as opposed to the theoretical maximum that bandwidth represents. While bandwidth is the capacity of a network link, throughput reflects real-world performance after accounting for packet loss, latency, and protocol overhead. It is also measured in bits per second.
traceroute / tracert
traceroute (on Linux and macOS) and tracert (on Windows) are diagnostic tools that map the path packets take from a source device to a destination, showing each hop along the route and the latency at each one. By sending packets with incrementally increasing TTL (Time to Live) values, they reveal every router the traffic passes through on its way to the target. This makes them invaluable for identifying where in the network a problem is occurring — whether a packet is being dropped, a specific hop has high latency, or traffic is taking an unexpected route.
Traffic Management
Traffic management refers to the set of techniques and tools used to control how network traffic flows, ensuring efficient use of available bandwidth and reliable delivery of data. It covers everything from prioritizing critical applications over less important ones, to shaping traffic to prevent congestion, to distributing load across multiple servers or links. Effective traffic management ensures that the network performs well under normal conditions and degrades gracefully under heavy load.
Traffic shaping
Traffic shaping is a QoS technique used to control the rate at which data is transmitted on a network, smoothing out bursts and enforcing bandwidth limits for specific types of traffic. By delaying or queuing packets that exceed a defined rate, traffic shaping ensures that no single application or user monopolizes network resources. It is commonly used by ISPs and enterprises to manage congestion and maintain consistent performance across the network.
Transmission Media Types
Transmission media refers to the physical or wireless channels through which data travels between devices. Wired media includes twisted pair cables (like Ethernet), coaxial cables, and fiber optic cables, each with different speeds, ranges, and interference characteristics. Wireless media uses radio waves, microwaves, or infrared signals to transmit data without physical connections.
Transport
The Transport layer is the fourth layer of the OSI model, responsible for end-to-end communication, data flow control, and error recovery between applications on different hosts. It breaks data into segments, ensures they are delivered reliably and in order, and manages retransmission if packets are lost. The two main protocols at this layer are TCP, which provides reliable delivery, and UDP, which prioritizes speed over reliability.
Transport
The Transport layer of the TCP/IP model is responsible for end-to-end communication between applications on different hosts. It uses TCP for reliable, ordered delivery and UDP for faster, connectionless communication where some data loss is acceptable. This layer manages segmentation, flow control, and error handling to ensure data reaches the correct application.
Troubleshooting
Network troubleshooting is the process of identifying, diagnosing, and resolving problems that affect network connectivity, performance, or reliability. It requires a combination of systematic methodology, knowledge of networking concepts, and familiarity with diagnostic tools. Good troubleshooting is not about randomly trying fixes, it is about gathering evidence, forming a hypothesis, testing it, and working through the problem layer by layer until the root cause is found and resolved.
VPNs
A VPN, or Virtual Private Network, is a technology that creates an encrypted, secure tunnel between a device and a remote network or server over the public Internet. It allows users to access private network resources securely from remote locations and hides their traffic from potential eavesdroppers. VPNs are used by organizations for secure remote access and site-to-site connectivity, as well as by individuals for privacy and anonymity online.
Two-Tier
The two-tier architecture, also called the collapsed core design, organizes a network into two layers: the distribution layer and the access layer. The distribution layer handles routing, policy enforcement, and inter-VLAN communication, while the access layer connects end devices like computers, phones, and printers to the network. This design is simpler and more cost-effective than three-tier architectures and is well suited for small to medium-sized networks where a dedicated core layer would add unnecessary complexity and cost.
UDP
UDP (User Datagram Protocol) sends data without setting up a connection first and without checking whether it arrives. It skips the overhead of acknowledgments and retransmissions, which makes it faster than TCP but less reliable. Applications like video streaming, online gaming, and DNS lookups use UDP when speed matters more than guaranteed delivery.
Virtual Networks
A virtual network in cloud computing is a software-defined network that replicates the functionality of a physical network entirely in software, allowing cloud resources to communicate with each other, with on-premises systems, and with the Internet. Virtual networks are defined through configuration rather than physical cabling, making them fast to create, easy to modify, and infinitely scalable. Each cloud provider has its own implementation —AWS calls it a VPC, Azure calls it a VNet, and GCP also uses the VPC model— but all share the same core concept of providing isolated, configurable network environments for cloud resources.
VLANs
A VLAN, or Virtual Local Area Network, is a logical subdivision of a physical network that groups devices together regardless of their physical location. VLANs allow network administrators to segment traffic, improve security, and reduce broadcast domains without needing separate physical switches. Devices in different VLANs cannot communicate directly without going through a router or a Layer 3 switch.
VLSM
VLSM, or Variable Length Subnet Masking, is a technique that allows a network to be divided into subnets of different sizes by using different subnet masks within the same network. Unlike fixed-length subnetting, where all subnets are the same size, VLSM lets you allocate address space more efficiently based on the actual needs of each subnet. This is especially useful for conserving IP addresses in complex network designs with varying host requirements.
VPN
A VPN, or Virtual Private Network, creates an encrypted tunnel between a device and a remote network over the public Internet, allowing secure communication as if the device were directly connected to that network. Organizations use VPNs to let remote employees securely access internal resources, while individuals use them for privacy and to bypass geographic content restrictions. VPNs mask the user's IP address and encrypt all traffic passing through the tunnel.
VPNs
A VPN, or Virtual Private Network, is a technology that creates an encrypted, secure tunnel between a device and a remote network or server over the public Internet. It allows users to access private network resources securely from remote locations and hides their traffic from potential eavesdroppers. VPNs are used by organizations for secure remote access and site-to-site connectivity, as well as by individuals for privacy and anonymity online.
VRFs
VRF, or Virtual Routing and Forwarding, is a technology that allows a single physical router to run multiple independent routing tables at the same time. Each VRF acts like a completely separate virtual router, meaning traffic in one VRF is fully isolated from traffic in another, even if they share the same physical hardware. This is commonly used by service providers to keep customer traffic separate on shared infrastructure, and by enterprises to isolate different departments or network segments on the same device.
VRRP
VRRP, or Virtual Router Redundancy Protocol, is an open standard protocol that provides the same gateway redundancy function as HSRP but works across equipment from any vendor. A group of routers share a virtual IP address, with one elected as the master and the others as backups ready to take over if the master becomes unavailable. Because it is vendor-neutral, VRRP is the preferred choice in multi-vendor network environments.
VXLAN
VXLAN, or Virtual Extensible LAN, is a network virtualization technology that extends Layer 2 networks over a Layer 3 infrastructure by encapsulating Ethernet frames inside UDP packets. It was created to overcome the scalability limitations of traditional VLANs, which support a maximum of 4,096 network segments, by supporting up to 16 million virtual network identifiers. VXLAN is widely used in data centers and cloud environments where large numbers of isolated virtual networks need to coexist on shared physical infrastructure.
WAN
A WAN, or Wide Area Network, is a network that spans a large geographic area, often connecting multiple LANs across cities, countries, or continents. The Internet itself is the largest example of a WAN. Organizations use WANs to connect their branch offices and data centers, often leasing connections from telecommunications providers.
Web Application
A Web Application Firewall (WAF) is a specialized security tool designed to filter, monitor, and block HTTP/HTTPS traffic to and from web applications. It protects against common web-based attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF) by inspecting application-layer traffic against a set of rules or policies. WAFs can be deployed as hardware, software, or cloud services and are an essential layer of defense for any publicly accessible web application.
What are Networks?
A network is a collection of two or more devices connected to share resources and communicate. Networks can be as small as two computers linked in a home office or as large as the global infrastructure of the Internet. They form the backbone of modern digital communication, enabling everything from file sharing and printing to video streaming and cloud computing.
WiFi Standards
Wi-Fi standards are a series of specifications developed by the IEEE under the 802.11 family that define how wireless networks operate. Each generation, from 802.11b and 802.11g through to 802.11ac (Wi-Fi 5) and 802.11ax (Wi-Fi 6), brings improvements in speed, range, efficiency, and the ability to handle more simultaneous connections. Understanding the differences between standards helps in selecting the right hardware for a given environment.
Wireless Networking
Wireless networking refers to the technology that allows devices to connect to a network and communicate without physical cables, using radio frequency signals instead. It encompasses standards like Wi-Fi, Bluetooth, and cellular networks, each suited to different ranges and use cases. Wireless networks introduce unique considerations around signal strength, interference, frequency bands, and security that wired networks do not face.
Wireless Security
Wireless security refers to the measures taken to protect wireless networks from unauthorized access, eavesdropping, and attacks. Because wireless signals travel through the air and can be intercepted by anyone within range, securing Wi-Fi networks requires encryption, strong authentication, and proper configuration. Key considerations include choosing strong encryption protocols, using strong passwords, and monitoring for rogue access points.
Wireless Site Surveys
A wireless site survey is the process of systematically assessing a physical environment before and after a wireless network deployment to determine optimal AP placement, identify sources of interference, and validate coverage. A passive survey involves walking the space with a Wi-Fi analyzer tool to measure existing signal strength and interference without connecting to any network. An active survey involves connecting to the network and measuring real throughput and performance across the space. Site surveys are standard practice before any enterprise wireless deployment and are used to produce heat maps that visually represent signal coverage and help justify AP placement decisions.
Wireshark
Wireshark is an open-source network protocol analyzer that captures and displays the data traveling across a network in real time. Engineers use it to inspect individual packets, decode protocols, diagnose connectivity problems, and investigate security incidents at a granular level. It supports hundreds of protocols and is one of the most widely used tools for deep network troubleshooting and analysis.
WLAN
A WLAN, or Wireless Local Area Network, is a type of LAN that uses wireless radio signals instead of cables to connect devices. It is the technology behind Wi-Fi networks found in homes, offices, and public spaces. WLANs offer the convenience of mobility within the coverage area, though they can be more susceptible to interference and security risks than wired networks.
WPA vs WPS
WPA (Wi-Fi Protected Access) is a security protocol designed to protect wireless networks through encryption and authentication, with WPA2 and WPA3 being the current standards offering strong AES-based encryption. WPS (Wi-Fi Protected Setup) is a feature designed to simplify the process of connecting devices to a Wi-Fi network, typically using a PIN or button press. However, WPS has well-known security vulnerabilities (particularly the PIN method) and is generally recommended to be disabled on network equipment.
YANG
YANG is a data modeling language used to define the structure, syntax, and semantics of the data that network devices exchange through management protocols like NETCONF and RESTCONF. It describes exactly what configuration and operational data a device supports in a way that both humans and machines can understand. YANG models are the foundation of modern network automation: before a script or tool can configure a device via NETCONF or RESTCONF, it needs to know the YANG model for that device to understand how to structure its requests correctly.
Zero Trust Architecture
Zero Trust is a security model based on the principle of "never trust, always verify" — meaning no user, device, or network segment is trusted by default, even if they are inside the corporate network. Every access request must be authenticated, authorized, and continuously validated regardless of where it originates. Zero Trust architecture replaces the traditional perimeter-based security model and is increasingly adopted as networks become more distributed and cloud-based.
Zigbee & Z-Wave
Zigbee and Z-Wave are low-power, short-range wireless communication protocols designed primarily for IoT and smart home devices such as sensors, lights, locks, and thermostats. Both operate on mesh network topologies where devices can relay signals through each other to extend range, making them well suited for environments with many small, battery-powered devices spread across a space. Zigbee operates in the 2.4 GHz band and is an open standard, while Z-Wave operates in sub-GHz frequencies (around 900 MHz) and is managed by a single industry alliance. Both are widely used in home automation and building management systems.