Cheat Sheets
4 sheets, 87 rows, built to be printed and stuck next to a monitor. This is the reference the drills are testing you on, not practice itself.
Where the numbers come from
The subnet table is computed, not typed: every mask, wildcard and host count is derived from the prefix, so no row can be quietly wrong. The ports sheet is the same list the Ports & Protocols drill asks from, so the sheet and the drill cannot disagree with each other. A cheat sheet with one bad row is worse than no cheat sheet, because it is the thing people copy without checking.
Subnetting
Every prefix from /8 to /30, with the mask, the wildcard and how many hosts fit.
| Prefix | Subnet mask | Wildcard | Addresses | Usable hosts |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 |
| /9 | 255.128.0.0 | 0.127.255.255 | 8,388,608 | 8,388,606 |
| /10 | 255.192.0.0 | 0.63.255.255 | 4,194,304 | 4,194,302 |
| /11 | 255.224.0.0 | 0.31.255.255 | 2,097,152 | 2,097,150 |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 |
| /13 | 255.248.0.0 | 0.7.255.255 | 524,288 | 524,286 |
| /14 | 255.252.0.0 | 0.3.255.255 | 262,144 | 262,142 |
| /15 | 255.254.0.0 | 0.1.255.255 | 131,072 | 131,070 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 |
- Usable = addresses − 2. The first address names the network and the last is its broadcast; neither can be assigned to a host.
- /31 is the exception: RFC 3021 allows both addresses on a point-to-point link, so a /31 carries 2 usable, not 0.
- /32 is a single host route: one address, no network or broadcast to lose.
- The wildcard is the mask inverted. ACLs and OSPF network statements take the wildcard, not the mask.
Ports & protocols
The well-known ports, in number order. Same list the drill asks from.
| Port | Service | Transport | What it is |
|---|---|---|---|
| 20 | FTP data | TCP | File Transfer Protocol, data channel |
| 21 | FTP | TCP | File Transfer Protocol, control channel |
| 22 | SSH | TCP | Secure Shell |
| 23 | Telnet | TCP | Telnet: unencrypted remote login |
| 25 | SMTP | TCP | Simple Mail Transfer Protocol |
| 53 | DNS | TCP + UDP | Domain Name System |
| 67 | DHCP server | UDP | DHCP server |
| 68 | DHCP client | UDP | DHCP client |
| 69 | TFTP | UDP | Trivial File Transfer Protocol |
| 80 | HTTP | TCP | Hypertext Transfer Protocol |
| 110 | POP3 | TCP | Post Office Protocol v3 |
| 123 | NTP | UDP | Network Time Protocol |
| 137 | NetBIOS name | UDP | NetBIOS name service |
| 138 | NetBIOS datagram | UDP | NetBIOS datagram service |
| 139 | NetBIOS session | TCP | NetBIOS session service |
| 143 | IMAP | TCP | Internet Message Access Protocol |
| 161 | SNMP | UDP | Simple Network Management Protocol |
| 162 | SNMP trap | UDP | SNMP trap / notification |
| 179 | BGP | TCP | Border Gateway Protocol |
| 389 | LDAP | TCP | Lightweight Directory Access Protocol |
| 443 | HTTPS | TCP | HTTP over TLS |
| 445 | SMB | TCP | Server Message Block over TCP |
| 500 | IKE | UDP | ISAKMP / IKE, IPsec key exchange |
| 514 | Syslog | UDP | Syslog |
| 587 | SMTP submission | TCP | Mail submission |
| 636 | LDAPS | TCP | LDAP over TLS |
| 993 | IMAPS | TCP | IMAP over TLS |
| 995 | POP3S | TCP | POP3 over TLS |
| 1433 | MS SQL | TCP | Microsoft SQL Server |
| 1701 | L2TP | UDP | Layer 2 Tunneling Protocol |
| 1723 | PPTP | TCP | Point-to-Point Tunneling Protocol |
| 3260 | iSCSI | TCP | iSCSI target |
| 3306 | MySQL | TCP | MySQL database |
| 3389 | RDP | TCP | Remote Desktop Protocol |
| 4500 | IPsec NAT-T | UDP | IPsec NAT traversal |
| 5060 | SIP | TCP + UDP | Session Initiation Protocol |
| 5061 | SIP-TLS | TCP | SIP over TLS |
- These are the IANA-registered assignments. Where real-world use differs (syslog over TCP, HTTPS over QUIC on UDP) the registered value is the one shown.
- Ports below 1024 are the well-known range and normally need privilege to bind.
OSI & TCP/IP
Seven layers, what each one carries, and how they map onto the four-layer model.
| Layer | Name | Unit | Lives here | TCP/IP model |
|---|---|---|---|---|
| 7 | Application | Data | HTTP, DNS, SMTP, SSH | Application |
| 6 | Presentation | Data | TLS, character encoding, compression | Application |
| 5 | Session | Data | Session setup and teardown | Application |
| 4 | Transport | Segment (TCP) / Datagram (UDP) | Ports, reliability, flow control | Transport |
| 3 | Network | Packet | IP addresses, routers, routing | Internet |
| 2 | Data link | Frame | MAC addresses, switches, VLANs, ARP | Link |
| 1 | Physical | Bits | Cable, optics, radio, connectors | Link |
- Encapsulation runs down the stack on the way out and back up on the way in: each layer wraps what the one above handed it.
- A switch decides at layer 2 and a router at layer 3. That boundary is also where broadcast domains end.
- ARP sits awkwardly between 2 and 3: it uses layer-2 broadcast to answer a layer-3 question. Interviewers ask about it for exactly that reason.
Cisco IOS commands
The commands you reach for first: look at things, change things, save things.
Look at things
show ip interface brief | Every interface, its address, and whether it is up |
|---|---|
show ip route | The routing table, with how each route was learned |
show running-config | The configuration in memory, right now |
show vlan brief | VLANs and which access ports are in them |
show interfaces trunk | Trunk ports, their native VLAN and what they carry |
show mac address-table | Which MAC the switch has learned on which port |
show cdp neighbors | What is plugged into this device, and where |
show version | Model, IOS version, uptime |
Change things
configure terminal | Enter configuration mode |
|---|---|
interface gigabitethernet0/1 | Configure one interface |
ip address 192.168.1.1 255.255.255.0 | Set an address and mask |
no shutdown | Bring the interface up: routers boot theirs down |
switchport mode access | One VLAN, untagged, for an end device |
switchport access vlan 10 | Which VLAN that port belongs to |
switchport mode trunk | Carry several VLANs, tagged with 802.1Q |
ip route 0.0.0.0 0.0.0.0 203.0.113.1 | A default route to a next hop |
Save and move around
copy running-config startup-config | Save, or lose it at the next reload |
|---|---|
end | Back to privileged mode from anywhere |
exit | Up one level |
do show ip route | Run a show command without leaving config mode |
- Nothing is saved until you copy running-config to startup-config. A reload undoes everything you did not save, which is occasionally the fastest way out of a mistake.
- Most commands can be abbreviated as far as they stay unambiguous: sh ip int br is the same as show ip interface brief.
- The address in the default route above is from 203.0.113.0/24, which RFC 5737 reserves for documentation.
A word on cheat sheets
Reference is not practice, and the two get confused. Reading the subnet table until it feels familiar is not the same as being able to produce a mask under time pressure: that is what the Subnet Trainer and the Speed Test are for. Print these, use them while you work, and let the drills tell you which rows you no longer need to look up.