Block 3 Study Guide — Comprehensive

The Network Switch

// What It Is

Fact	Detail
Hardware	Hardware-based; uses ASICs (Application Specific Integrated Circuits) to make filtering decisions
OSI Layer	Moves frames at the Data-Link Layer (Layer 2) by reading the MAC address off the host's NIC. A Layer 3 switch adds routing, but that routing function is always Layer 3
Identification	Each device is identified by a 48-bit unique MAC address, which the switch uses to regulate traffic flow
Switch vs. Hub	A hub floods every port with every message (shared bandwidth, no security/ID). A switch is smarter — each switch port is its own collision domain

// Switch Performance Traits

Trait	Meaning
Hardware-based bridging	ASICs let the switch learn and form multiple internal connections to pass or filter traffic
Wire speed	Can be configured to match the media/cable speed
Low latency	Processes and applies an update in minimum time so traffic flow resumes quickly
Broadcast control	Can segment a network into smaller broadcast domains when paired with VLANs

Switch Components

// External Components

Component	Detail
Console Port	Direct local access for initial configuration of a "blank" switch; DoD policy requires it be password protected
Network Interfaces	Where end devices connect. Once an IP is assigned, interfaces accept Telnet for remote management — the IP is only for logging in; forward/filter decisions still use MAC addresses

// Internal Components

Memory	Holds
Flash Memory	The operating system (OS); loaded into RAM at boot
ROM	Diagnostic and boot-up routines; burned-in and unchangeable
RAM	Running memory — configuration changes live here in the running-configuration
NVRAM	Long-term storage for the startup-configuration, loaded into RAM at boot

// Backup habitCopying the running-configuration into the startup-configuration saves your changes from RAM into NVRAM so they survive a reboot.

Layer 2 Protocols & Standards

Protocol / Standard	Description
PPP	Connects two devices directly; provides encryption, compression, authentication
STP (IEEE 802.1D)	Loop-prevention — switches discover physical loops and build a loop-free logical topology
UDLD & Loopguard	Handle unidirectional links. UDLD shuts down the affected port; Loopguard puts it into a "loop inconsistent" state
LLDP	Open, vendor-neutral Layer 2 discovery/monitoring protocol
CDP	Cisco-proprietary version, shares info between directly connected Cisco devices
802.1Q vs. ISL	802.1Q encapsulates a VLAN frame using space in the standard header (open standard). ISL adds a new header/trailer (Cisco only)

Core Switch Functions

Function	What Happens
Address Learning	Reads a frame's source MAC and stores it (with interface ID) in the MAC address table (CAM), in RAM
Forward/Filter Decision	If the destination MAC is known, forward only out that interface. If unknown, flood out all active ports except the one it arrived on
Loop Avoidance	Prevents broadcast storms, multiple frame copies, and multiple loops

Loop Avoidance & Broadcast Storms

Problem	Description
Broadcast Storm	Nodes rebroadcast traffic back and forth, eventually failing communication
Multiple Frame Copies	A device receives the same frame more than once, thrashing the MAC address table
Multiple Loops	Loops within loops — combined with a broadcast storm, consumes all bandwidth

Standard	Detail
STP (802.1D)	Prevents bridging loops, provides loop-free topologies
RSTP (802.1w)	Rapid Spanning Tree Protocol, introduced 2001

Switching Methods & Collisions

Method	How It Works
Store-and-Forward	Stores the entire frame, checks it with a CRC before forwarding; discards bad frames
Cut-Through	Reads only the destination MAC, forwards immediately — lowest latency, but bad frames pass through
Fragment-Free	Stores the first 64 bytes (where fragmentation is likely) before forwarding

// No one-size-fits-allCut-Through works best at the core layer, where errors are rare and speed matters most.

VLAN Fundamentals

VLAN Definition	A "logical" grouping of network devices into a single broadcast domain, independent of physical location
Inter-VLAN Traffic	Must go through a Layer 3 routing process, since VLANs keep broadcasts contained

// Benefits

Increased Security	Only devices in the same VLAN receive its frames
Flexibility & Scalability	Devices can be added/moved regardless of physical location
No Geographical Barrier	A VLAN can span multiple physical segments as one logical broadcast domain

VLAN Creation & Port Membership

Default	Cisco switches start with VLAN 1, and all ports assigned to it, until an admin changes them
Port Membership	A port can only belong to one VLAN at a time — view with show vlan
Unused Ports	Should be shut down and assigned to an inactive VLAN to reduce vulnerabilities

VLAN Trunking & Tagging

Port Type	Detail
Trunk Port (tagged)	Carries more than one VLAN; frame tagging assigns a trunking ID matching each frame to its VLAN
Access Port (untagged)	A member of only one VLAN — the VLAN tag is removed here

Switch(config)# interface f0/1
Switch(config-if)# switchport trunk encapsulation dot1q

Management VLANs & Logical Security

Default Behavior	Switches use VLAN 1 by default for in-band management and untagged protocol traffic (STP, CDP, DTP, VTP, PAgP)
The Risk	If not pruned, VLAN 1 may span the entire network, raising compromise risk
Best Practice	Don't make VLAN 1 the management VLAN — separate management, protocol, and data traffic

Switch(config)# interface vlan 99
Switch(config-if)# ip address 172.16.10.2 255.255.255.0
Switch(config-if)# no shutdown

// Quiz yourself · Units 1–2

The Router — What It Does & Its Anatomy

Concept	Detail
Router	A Layer 3 device that uses IP addressing to forward packets between networks
Console / Auxiliary port	Console = local config on a "blank" router. Auxiliary = remote config via modem — should be disabled for security in the field

// Internal Memory

Memory	Holds
ROM	Diagnostic & bootstrap routines
FLASH	The Internetwork Operating System (IOS)
NVRAM	The startup-configuration file
RAM	Running-configuration, IOS copy, routing tables, process data

// Startup sequenceBootstrap (ROM) → hardware test → IOS loads FLASH→RAM → startup-config (NVRAM) copies into RAM as the running-config. Running-config changes are volatile until copied back to NVRAM.

Gateways & Autonomous Systems

Type	Role
Default gateway	The nearest router interface off a host's own subnet
Autonomous System (AS)	RFC 1930: "a connected group of IP prefixes run by one or more operators with a SINGLE, CLEARLY DEFINED routing policy"
Interior Gateway	Exchanges info within an AS using IGPs: RIP, IGRP, OSPF, EIGRP
Exterior Gateway	Moves info between AS's using EGPs, e.g. BGP

Internetworking Challenges & Broadcast Domains

Challenge	Description
Connectivity	Supporting very different technologies, media, and speeds
Network management	Fault, Configuration, Accounting, Performance, Security

// NoteRouters segment networks into broadcast domains; switches (and routers) segment collision domains.

Addressing & Routed vs. Routing Protocols

Term	Definition
Routed protocol	Provides the logical addressing used to determine destination (IP, IPX). "The messages."
Routing protocol	Delivers those messages via routing tables (RIP, OSPF, EIGRP, BGP)

Key Support Protocols — ARP, Hello & ICMP

Protocol	Function
ARP	Maps IP addresses to MAC addresses; across LANs the router acts as proxy
Hello Protocol	Neighbor discovery and keep-alive to confirm a link is still functional
ICMP	Reports errors/info: Destination Unreachable, Time Exceeded, Echo Request/Reply
Ping	ICMP echo request testing IP reachability — Network-Layer-to-Network-Layer only

Path Determination & Packet Switching

// Constant vs. changingA packet's Layer 2 (MAC) addresses change at every hop; its Layer 3 (IP) source/destination stays constant end to end.

// Why a Packet Gets Discarded

No routing table entry	TTL expired
Checksum error	Fragmentation not allowed but needed

Static, Default & Dynamic Routes

Type	Detail
Static route	Manually configured, doesn't change — good for security, unsuitable for large changing networks
Default route	"Gateway of last resort" — used when no other route is known
Dynamic route	Learned automatically via RIP, OSPF, EIGRP, BGP; recalculates on topology change

Administrative Distance

When a router knows multiple paths to the same destination from different sources, it uses the path with the lowest Administrative Distance (AD) — lower AD = more trustworthy.

Source	AD
EIGRP	90
OSPF	110

Routing Metrics

Metric	What It Measures
Path length	Hop count, or sum of arbitrary link costs
Reliability	Bit-error rate of a link
Delay	Bandwidth, queues, congestion, physical distance
Load	How busy a router is (CPU, packets/sec)

Distance Vector vs. Link State

Category	Distance Vector	Link State
Updates	Regular intervals + on change (broadcast)	Only on change (multicast)
Content	Whole routing table	Just the changed link
Convergence	Slower, "routing by rumor"	Faster
Loops	More prone	Less prone
CPU/memory	Less	More

Interior Gateway Protocols — RIP, OSPF & EIGRP

// RIP — Distance Vector

Metric	Hop count, limited to 15
RIPv1 vs RIPv2	RIPv1 has no VLSM support; RIPv2 adds VLSM + multicast updates

// OSPF — Link State

Algorithm	Dijkstra's Shortest Path First (SPF)
Hierarchy	AS divided into areas; Area 0 is the backbone
Classless	Advertises subnet masks — supports VLSM

// EIGRP (Enhanced Interior Gateway Routing Protocol) — Balanced Hybrid

Origin	Cisco proprietary; became an open standard in 2013
"Balanced hybrid"	Maintains neighbor tables like DV, sends multicast updates only on change like LS
Algorithm	Diffusing Update Algorithm (DUAL) Finite State Machine
Successor / feasible successor	DUAL determines the best route and a backup route

Exterior Gateway Protocol — BGP

Trait	Detail
Role	The predominant EGP — "the protocol that runs the Internet," used between ISPs
Classification	A path vector protocol
Metrics	Does NOT use hop count/bandwidth/delay — uses manually-configured attributes/policies
Neighbor discovery	No automatic discovery — admins manually define BGP neighbors

Router Logical Security & STIGs

STIG	Standardized secure install/maintenance methodology; term coined in 1998 by DISA
Advanced STIGs	Can cover corporate network design — routers, firewalls, DNS servers, switches

IP Addressing Scheme Application

Method	Detail
Dynamic	Assigned temporarily via DHCP; can be reassigned if unused
Static	Manually applied by a technician, or as a DHCP reservation

The Three-Layer Model & the Core Layer

A conceptual framework (like the OSI model) breaking network design into Core, Distribution, and Access layers, each optimized for its role.

Definition	The "high-speed backbone" — its only job is transporting traffic reliably and fast
Speed	Avoid ACLs, routing, and packet filtering here when possible
Fault tolerance	Essential — a core failure can affect every user, so redundancy is critical

Distribution Layer

Role	The communication point between access and core layers
Functions	Routing, filtering, WAN access, ACLs, inter-VLAN routing, redistribution between routing protocols

// AvoidFunctions belonging to another layer — e.g. directly connecting PCs, which belongs to the access layer.

Access Layer

Role	Ensures frames reach end-user computers — the "desktop layer"
Functions	Shared/switched bandwidth, VLAN membership, MAC-based traffic filtering

// Quiz yourself · Units 3–4

Why We Subnet

A subnet is a logical division of a network based on IP addressing — a "network within a network." Subnetting borrows bits from the host portion of an address and reassigns them to identify a subnet, splitting the address into Network / Subnet / Host portions.

// ExampleBorrow 1 bit from a Class C host address: 0 = first subnet, 1 = second subnet. One borrowed bit = 2 subnets, each with 126 usable hosts (down from 254).

Classful Addressing

Class	1st Octet	Default Mask	CIDR
A	1–126	255.0.0.0	/8
B	128–191	255.255.0.0	/16
C	192–223	255.255.255.0	/24

Subnet Masks & CIDR Notation

A subnet mask is a 32-bit number marking which bits of an address are network/subnet vs. host — it "masks out" the borrowed host bits. CIDR (Classless Inter-Domain Routing) writes this as a slash-prefix, e.g. 205.112.45.60/25 — 25 of 32 bits are network/subnet bits.

Step	205.112.45.60/25
Classful default	Class C → /24
Bits borrowed	25 − 24 = 1
Subnets created	2¹ = 2
Equivalent mask	255.255.255.128, 126 usable hosts/subnet

Subnet Mask Reference Chart

CIDR	Mask (last octet)	Subnets (from /24)	Usable Hosts
/24	255.255.255.0	1	254
/25	255.255.255.128	2	126
/26	255.255.255.192	4	62
/27	255.255.255.224	8	30
/28	255.255.255.240	16	14
/29	255.255.255.248	32	6
/30	255.255.255.252	64	2

CIDR & Supernetting

CIDR replaced classful routing. Instead of breaking one network into many subnets, supernetting aggregates multiple smaller networks into one larger block — allocating address space much closer to actual need than fixed classful sizes.

VLSM — Variable Length Subnet Masking

When a network uses more than one subnet mask ("subnetting a subnet"), it's using VLSM — sizing each subnet for exactly how many hosts it needs.

Protocol	VLSM Support
RIPv1	No
RIPv2 / OSPF	Yes — advertises prefix length with each route

The Subnetting Calculation Method

Subnets created = 2ⁿ | n = bits borrowed

Usable hosts = 2^h − 2 | h = remaining host bits

Process: (1) determine subnets/hosts needed → (2) find the starting classful mask → (3) find the subnet count that meets/exceeds the need → (4) that column's CIDR is your new mask → (5) that column's host count minus 2 is usable hosts per subnet.

Worked Example

215.60.192.0/24, need 4 subnets (max 3 hosts each): borrow 2 bits (2²=4) → new mask /26 (255.255.255.192), block size 64, usable hosts = 64−2 = 62.

Network ID	Host Range	Broadcast ID
215.60.192.0	.1 – .62	215.60.192.63
215.60.192.64	.65 – .126	215.60.192.127
215.60.192.128	.129 – .190	215.60.192.191
215.60.192.192	.193 – .254	215.60.192.255

// PatternEach Network ID increases by the block size (64). Each Broadcast ID is one less than the next subnet's Network ID.

// Quiz yourself · Unit 5

Physical Network Diagrams

Shows the actual physical arrangement of components, cables, and hardware — a bird's-eye view of the network's physical space, like a floorplan.

Physical Topologies

Topology	Description
Bus	All nodes on one central medium with two endpoints; whole network fails if the bus fails
Star	Central hub/switch through which all data passes; hub failure takes down every connected node
Full/Partial Mesh	Every node connected to every other (full) or just the ones it interacts with most (partial)
Tree	Bus + star combined — star segments connect to a linear backbone
Hybrid	Any other combination — most real-world networks are hybrids

Cabling, Ports & Connectors

Physical diagrams also capture cabling type/distance, port assignments, and connector types (RJ45, RS232, fiber). CAT5e is limited to 100 meters (328 ft) between devices before signal degradation.

Logical Network Diagrams

Describes how information flows — subnets (VLAN IDs, masks, addresses), routers/firewalls, and routing protocols. Correlates with Layer 3 (Network layer) information.

Logical Topology & CSMA/CD

Logical topology is how information actually passes through the network, independent of physical layout — twisted-pair Ethernet is physically a star but logically a bus. Ethernet is contention-based: devices compete for the right to transmit.

Letters	Meaning
CS	Carrier Sense — listen before transmitting
MA	Multiple Access — many devices share the network
CD	Collision Detection — rules for managing collisions (IEEE 802.3)

Data Flow Diagrams

A DFD uses four symbols: data flows (movement), data stores (repositories), processes (transforms), and external entities (sources/destinations outside the system). It does NOT show decisions, timing, repetition, or volume — like a road map showing possibilities, not the trip actually taken. Representing different levels of detail is called leveling.

Cisco Structured Troubleshooting Process

Step	What Happens
1. Define Problem	Be specific — "this one PC can't get online," not "the internet is out"
2. Gather Information	From the reporter, "show" commands, ping, telnet
3. Analyze Information	Consider everything gathered, even what seems unhelpful
4. Eliminate Possible Causes	Rule out what can't be it — e.g. common causes if only some users are affected
5. Propose Hypothesis	Use experience to propose the most likely cause
6. Test Hypothesis	Validate or disprove it
7. Implement & Document	Make the fix and record it

Troubleshooting Methodologies

Approach	When to Use
Bottom-up	Fault localized at the network edge — start at Layer 1
Top-down	Fault at the top of the OSI model, e.g. can't reach a specific web page
Divide-and-conquer	Quickly eliminates part of the OSI model

Switch & Router Troubleshooting Objectives

A switch and a router use the same troubleshooting process. Both objectives (7a: troubleshoot a switch, 7b: troubleshoot a router) are measured during the final block's Capstone. Troubleshooting is an art, not a science — it becomes automatic with experience.

// Quiz yourself · Units 6–7

// Appendix C · Cisco switching & routing commands

// Getting help & command modes

Type e? at a prompt to list every command starting with "e". Type ? alone to list every command available in the current mode. After a partial command + space, ? lists valid keywords/parameters — a lone <CR> response means the command is ready to run as-is.

Switch>                    User mode
Switch>enable              Moves to privileged mode
Switch#                    Privileged mode
Switch#configure terminal  Moves to global configuration mode
Switch(config)#            Global configuration mode
Switch(config)#exit        Moves one level below current mode

Router> / Router#          Same user/privileged split as a switch
Router(config-if)          Interface mode
Router(config-subif)       Sub-interface mode
Router(config-line)        Line mode
Router(config-router)      Router configuration mode

// Verifying commands

show version	Software and hardware information
show flash	Flash memory contents
show mac-address-table	Current MAC address forwarding table
show running-config	Current configuration in DRAM
show startup-config	Current configuration in NVRAM
show vlan	Current VLAN configuration
show interfaces	Interface config and status (up/up, up/down, admin down)

// Hostname, passwords & encryption

Switch(config)# hostname Dolan_Hall
Switch(config)# enable secret enspass
Switch(config)# line console 0
Switch(config-line)# password conpass
Switch(config-line)# login
Switch(config-line)# exit
Switch(config)# line vty 0 15
Switch(config-line)# password vtypass
Switch(config-line)# login

Router(config)# service password-encryption   ! weak-encrypts clear-text passwords

On a router: enable password sets an unencrypted enable password; enable secret is encrypted and always overrides it. The line aux 0 mode configures the auxiliary (remote modem) port — not available on switches.

// IP address, default gateway & interface basics

Switch(config)# interface vlan 1
Switch(config-if)# ip address 172.16.10.2 255.255.255.0
Switch(config-if)# exit
Switch(config)# ip default-gateway 172.16.10.1

Router(config)# interface fastethernet 0/0
Router(config-if)# description Marketing LAN
Router(config-if)# ip address 192.168.20.1 255.255.255.0
Router(config-if)# no shutdown

Router(config)# interface serial 0/0/0
Router(config-if)# ip address 192.168.10.1 255.255.255.0
Router(config-if)# clock rate 56000
Router(config-if)# no shutdown

// VLANs, trunking & port security

Switch(config)# vlan 4
Switch(config-vlan)# name Finance
Switch(config-vlan)# exit

Switch(config)# interface fastethernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 4

Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 4
Switch(config-if)# switchport port-security mac-address 1234.5678.90ab
Switch(config-if)# switchport port-security violation shutdown   ! or: restrict / protect

violation shutdown	Port goes err-disabled + logged; needs manual/errdisable recovery
violation restrict	Bad frames dropped + logged; port stays operational
violation protect	Bad frames dropped, no log; port stays operational

// Saving, erasing & resetting configuration

Switch# copy running-config startup-config   ! saves RAM config to NVRAM

Switch# delete flash:vlan.dat                ! removes the VLAN database
Switch# erase startup-config                 ! erases NVRAM
Switch# reload                               ! restarts the switch

Router# copy running-config tftp             ! saves config remotely to a TFTP server

// Banners

Router(config)# banner motd ^Building will be hosting IT conference tomorrow^
Router(config)# banner login ^Authorized personnel allowed^

The ^ is a delimiting character — any character not used in the message text itself.

// Standard Access Control Lists (ACLs)

Router(config)# access-list 10 permit 172.16.0.0 0.0.255.255
Router(config)# access-list 10 deny host 172.17.0.1
Router(config)# access-list 10 permit any

Router(config)# interface fastethernet 0/0
Router(config-if)# ip access-group 10 out

Router# show ip interface       ! ACLs applied to that interface
Router# show access-lists       ! contents of all ACLs
Router# show run                ! all ACLs and interface assignments

Router(config)# no access-list 10   ! removes all ACEs in ACL 10

ACL number 1–99 or 1300–1999 = standard IP ACL. Every ACL ends with an implicit deny, so it must contain at least one permit statement. Apply standard ACLs as close as possible to the destination; best practice applies them outbound.

// Inter-VLAN routing: router-on-a-stick

Router(config)# interface fastethernet 0/0
Router(config-if)# no shutdown
Router(config-if)# interface fastethernet 0/0.40
Router(config-subif)# description Finance VLAN 40
Router(config-subif)# encapsulation dot1q 40
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Best practice: give the sub-interface the same number as the VLAN (fa0/0.40 for VLAN 40) — easier to troubleshoot. Multilayer switches instead use a Switch Virtual Interface (SVI) for inter-VLAN routing.

// Static routes

Router(config)# ip route 172.16.20.0 255.255.255.0 172.16.10.2   ! via next-hop address
Router(config)# ip route 172.16.20.0 255.255.255.0 serial 0/0/0  ! via exit interface

// Quiz yourself · CLI Command Reference

// Appendix A · Block 3 acronym reference

ADAdministrative Distance

ARPAddress Resolution Protocol

ASAutonomous System

ASICsApplication Specific Integrated Circuits

ASWsAccess Switches

BGPBorder Gateway Protocol

CDPCisco Discovery Protocol

CRCCyclical Redundancy Check

DISADefense Information Systems Agency

DoDDepartment of Defense

DSWsDistribution Switches

DTPDynamic Trunking Protocol

DUALDiffusing Update Algorithm

EGPExterior Gateway Protocol

EIGRPEnhanced Interior Gateway Routing Protocol

FSMFinite State Machine

FSOField Security Operations

I/OInput/Output

IAInformation Assurance

ICMPInternet Control Message Protocol

IGPInterior Gateway Protocol

IGRPInterior Gateway Routing Protocol

IOSInternetwork Operating System

IPInternet Protocol

IPXInternetwork Packet Exchange

ISLInter-Switch Link

ISPInternet Service Provider

LANLocal Area Network

LSALink State Advertisement

MACMedia Access Control

MTUMaximum Transmission Unit

NSANational Security Agency

NVRAMNon-Volatile Random Access Memory

OESOpen Enterprise Server

OSOperating System

OSIOpen Systems Interconnection

OSPFOpen Shortest Path First

PAgPPort Aggregation Protocol

PINGPacket Internet Groper

RAMRandom Access Memory

RIPRouting Information Protocol

ROMRead Only Memory

SNMPSimple Network Management Protocol

SPFShortest Path First

STPSpanning Tree Protocol

STIGSecurity Technical Implementation Guide

TCPTransmission Control Protocol

TFTPTrivial File Transfer Protocol

TTLTime To Live

VLANVirtual Local Area Network

VLSMVariable Length Subnet Mask

VTPVLAN Trunking Protocol

WANWide Area Network

// Appendix B · Key term definitions

Broadcast DomainAll nodes on a network segment, VLAN, or subnet that receive broadcast frames from a host within it. Bounded by a Layer 3 device (a router sets the boundary).

Collision DomainA network segment sharing bandwidth between devices, such as a switch port and a PC. Each switch port is its own collision domain; every device on a hub shares one collision domain.

Console PasswordThe most basic security step — controls who can log in via the console port, preventing someone from plugging in and changing the configuration.

Dead VLANSince VLAN 1 is a well-known default, unused ports are instead assigned to a dedicated, isolated VLAN that never passes traffic device-to-device, eliminating a path for malicious traffic.

Enable SecretThe encrypted "super user" password used to move from user mode to privileged mode — always used instead of the unencrypted enable password, which it overrides.

HostnameA device's identification on the network. Used in the command prompt, log files, and accounting info wherever device identity matters.

IEEE 802.1QStandard for adding VLAN information to trunk frames as they cross trunk links.

MOTDMessage Of The Day — a banner shown to users on console, Telnet, or SSH login, often used to state legal/authorized-use notices.

PasswordProtects data on a network device from being lost, misused, or deleted by an unauthorized person.

Port-Security (Sticky-MAC)A Layer 2 access-control feature limiting a port to a specific number of registered MAC addresses; any other MAC attempting to communicate triggers port security.

Secure Shell (SSH)The secure form of Telnet — functions the same but encrypts usernames/passwords before sending them.

TelnetAn application protocol providing bidirectional interactive text communication over TCP — unencrypted, unlike SSH.

VLAN TaggedAn 802.1Q Ethernet frame altered to include a VLAN ID in its header, which the receiving switch uses to determine which port to send a broadcast packet to.