Network Services – DHCP, DNS and More

DHCP, the Dynamic Host Configuration Protocol, supplies an IPv4 address and settings for a limited time called a lease. The server listens on UDP 67; the client uses UDP 68. Laptops, printers, phones and router interfaces can all be clients. On Cisco IOS, ip address dhcp makes an interface request its settings.

Get the first lease

A new client uses four messages, remembered as DORA:

1. Discover: with no usable address or known server, the client broadcasts from 0.0.0.0 to 255.255.255.255.
2. Offer: a server proposes an address, lease time and settings.
3. Request: the client asks for the chosen offer. This request is normally broadcast, so other offering servers learn that they were not selected.
4. Acknowledge: the chosen server confirms the lease. The client can now use it.

For example, a laptop receives 192.168.10.57/24, gateway 192.168.10.1, DNS server 192.168.10.5 and an 8-hour lease. Many clients check the address with ARP before using it. If another host answers for that address, the client sends DHCPDECLINE and starts again.

Settings arrive as numbered options. Option 1 supplies the subnet mask, 3 the router, 6 the DNS servers, 15 the domain name and 51 the lease time. Options such as 43 or 150 help phones and access points find a controller or configuration server. A correct address with an incorrect DNS server is therefore still a DHCP configuration problem.

Renew before the lease ends

The lease has two default renewal times, measured from its start:

An acknowledgment during renewal restarts the lease, usually for the same address. Users keep working during normal background renewal; a short lease does not disconnect them on a schedule.

On Windows, ipconfig /all shows the server and lease times. ipconfig /release returns the address, and ipconfig /renew requests a lease. A device that leaves without releasing still occupies its lease until it expires. If DHCP fails, Windows may assign itself a link-local APIPA address such as 169.254.37.112. This permits communication with other link-local hosts on that segment, but provides no routed internet access.

Compare IPv6 address setup

With SLAAC, a host builds an IPv6 address using a /64 prefix advertised by a router. Router Advertisement flags direct hosts toward DHCPv6: M requests managed address configuration; O requests other settings such as DNS. Stateful DHCPv6 supplies an address; stateless DHCPv6 supplies extra settings while SLAAC supplies the address. DHCPv6 uses UDP 546 for clients and 547 for servers. The default gateway comes from Router Advertisements or manual configuration, not DHCPv6.

A scope, called a pool on Cisco devices, combines a subnet's leasable addresses with the settings clients need there. Plan the addresses before entering commands, so the DHCP server and devices configured by hand never claim the same address.

Choose the available range

Start with the network, prefix and usable host range. List the gateway, servers and other fixed devices, then exclude their addresses. For 192.168.10.0/24, the usable range is .1 through .254. Excluding .1 through .20 leaves .21 through .254:

That pool supports 234 leases. An expected 260 clients will not fit; use a larger subnet such as a /23 with 510 usable addresses, or another subnet. Count excluded and reserved space as well as active users when planning growth.

An exclusion tells the server never to lease an address. A reservation ties an address to a particular MAC address or client identifier, while the device still uses DHCP. A printer with a reservation receives updated DNS settings at renewal. A printer with a manually typed static configuration must be updated on the device itself.

Configure a pool on Cisco IOS

Enter the exclusion in global configuration. The remaining settings belong inside the pool:

ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool OFFICE
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.10.5
 domain-name example.com
 lease 0 8

lease 0 8 means 0 days and 8 hours. Without a lease command, the IOS default is 1 day. The gateway must match this subnet; copying another pool's default-router can leave clients able to reach local hosts but unable to leave their network.

Check the result with show ip dhcp pool for pool capacity, show ip dhcp binding for clients and expiry times, and show ip dhcp conflict for addresses removed after a conflict. Windows Server uses the same scope, exclusion, reservation and option concepts; scope options can override server-wide options.

Match lease time and redundancy to demand

Guest Wi-Fi benefits from leases of roughly 1–4 hours because departed devices release their space sooner through expiry. Stable desktops can use leases lasting several days; the Windows Server default is 8 days. A pool of 200 addresses with 60 new guest devices each day can fill in about 3.3 days if those leases remain held. Shortening the configured duration helps as new leases and renewals take effect; it does not instantly erase existing leases.

Two servers may split the range without overlap, such as an 80/20 split, or use a supported failover feature that shares lease state. Two independent servers must not freely allocate the same addresses: each could otherwise give one address to a different client.

A client broadcasts its Discover on its local segment. An ordinary router does not forward that broadcast, so a DHCP server in another subnet needs a relay agent to hear it. The relay usually runs on the router or layer-3 switch interface that serves as the client subnet's gateway.

Relay the request and identify the subnet

The relay receives the broadcast and sends a unicast request to the server. It inserts its client-facing interface address in giaddr, the gateway IP address field. The server uses this address to select the client's scope and sends its reply back through the relay.

For VLAN 20, suppose the gateway is 192.168.20.1 on GigabitEthernet0/1 and the server is 10.0.0.10. Configure:

interface GigabitEthernet0/1
 ip helper-address 10.0.0.10

The command belongs on the client-facing interface. A helper on the server-facing interface misses the client broadcast. The server also needs a scope for 192.168.20.0/24 and a route back to 192.168.20.1. A second helper line can name a backup server. On IOS, helper addresses forward several UDP broadcast services by default, including DNS and TFTP, so review that behavior when designing the network.

Work outward from the client

Use the symptom to choose the next check:

Then inspect the path. Confirm the switch port's VLAN, the helper's server address, routing in both directions and ACL or firewall rules for DHCP. Clients use UDP 68 and servers UDP 67; relay-to-server traffic uses the server port. A working DNS service does not show that DHCP traffic is permitted.

For example, VLAN 10 works but a new VLAN 30 receives only APIPA addresses. If the server is remote and VLAN 30 has no helper, its Discover never reaches the server. Add the relay on that VLAN's gateway and verify that the server has a matching scope before testing renewal again.

Fix the cause before clearing state

An exhausted pool has no free addresses to offer. In show ip dhcp pool, compare leased addresses with total minus excluded addresses, then check the conflict list for further unavailable space. Repeated ipconfig /renew requests cannot create capacity. Review stale exclusions and reservations, adjust lease duration for turnover, or enlarge the address space.

A static device inside the dynamic pool can cause duplicate-address warnings. Find and correct that overlap, then clear resolved conflict entries with clear ip dhcp conflict * when appropriate. Clearing the list while the duplicate still exists invites the same fault again.

An unauthorized rogue DHCP server, often a connected home router, may supply the wrong gateway. Identify it from the client configuration and remove it. DHCP snooping prevents untrusted switch ports from sending server replies, protecting later clients from the same mistake.

IP address management (IPAM) joins planning with record keeping and discovery. It answers practical questions: Which subnet belongs to this VLAN? Who owns this address? Is it static, reserved or leased? Which range still has room? A spreadsheet can hold a small plan; a dedicated tool can also compare that plan with live devices. Products combining DNS, DHCP and IPAM are called DDI.

Record enough to make the next change safely

For every subnet, record its network and prefix, VLAN ID, gateway, purpose, location, DHCP range and exclusions. For each static assignment, record the hostname, MAC address, device type, owner and assignment date. These fields make it possible to distinguish an address that is merely quiet from one that is available for reuse.

A site using 10.20.0.0/16 might assign:

Within each subnet, .1 can be the gateway, .2–.20 the fixed range, and .21–.254 the DHCP range. Documenting this pattern helps an engineer recognize a device's role and prevents two teams from allocating overlapping space. The plan still needs an individual record when a fixed address is assigned.

Measure headroom

Address utilization compares used addresses with usable addresses:

A /22 has 1,022 usable IPv4 addresses. If 870 are in use, utilization is about 85.1%. An alert threshold of 80% would already have triggered planning for more space. Keep this subnet measure separate from DHCP pool availability: exclusions and reservations can leave a dynamic pool full even while the subnet still has unassigned addresses.

Reconcile the plan with evidence

IPAM discovery can read DHCP leases, DNS records and router ARP tables, and scan subnets. Compare these views: a discovered address with no owner may be an undocumented device; a recorded server with no current evidence may have been retired. Investigate the difference before changing the assignment.

Before assigning a static address, check the IPAM record, DHCP leases and DNS. A failed ping is too little evidence: the current owner may be switched off or may block ping. After assigning the address, record the device and protect the assignment from DHCP. When retiring it, reclaim the address and remove stale DNS records so a future user does not inherit the old name.

DHCP can update DNS dynamically, keeping a client's A and PTR records aligned with its lease. IPAM brings these records into one view, but automatic discovery still needs an accurate plan and ownership information to explain what a device is supposed to be doing.

IPv6 removes the pressure to count every possible host address in a /64. It does not remove the need to plan. Record which /64 prefix belongs to each site and VLAN, along with gateways and important fixed assignments. Track the structure and ownership of the address space even when individual host addresses change often.

DNS, the Domain Name System, stores information under names arranged in a tree. Read www.example.com. from right to left: the root is the final dot, com is the top-level domain, and example and www identify lower levels. A fully qualified domain name (FQDN) gives the complete path to the root.

Find who owns the answer

A zone is a managed part of that tree, held on authoritative name servers. The primary holds the editable copy; secondaries hold read-only copies obtained by zone transfer over TCP 53. The SOA serial number lets secondaries detect a newer version. Multiple authoritative servers keep answers available when one server fails.

Read the record type before its value

For example, "www.example.com. 3600 IN A 203.0.113.10" maps a name to an IPv4 address. "www.example.com. 3600 IN AAAA 2001:db8::10" supplies IPv6. In these records, 3600 is the cache lifetime in seconds and IN is the internet class.

An alias such as "shop.example.com. 3600 IN CNAME www.example.com." points to the name, not directly to its address. A lookup follows that target to obtain an A or AAAA answer. A CNAME cannot share its name with ordinary data such as A, MX, SOA or NS records. DNSSEC metadata is a special exception. The zone apex needs SOA and NS records, so a standard CNAME cannot be placed there; provider alias or flattening features are different record-handling features.

MX preferences run in the opposite direction from a “higher is better” score. With preference 10 for mail1.example.com. and 20 for mail2.example.com., senders try mail1 first. MX values must be hostnames with direct A or AAAA records. MX and NS targets must not be CNAME aliases.

Reverse the address and control caching

Forward lookups start with a name; reverse lookups start with an address. For IPv4 address 203.0.113.25, the PTR owner is 25.113.0.203.in-addr.arpa.. IPv6 reverse lookup uses reversed hexadecimal digits under ip6.arpa. Adding an A record does not create a PTR unless an update feature does so.

Time to live (TTL) is the maximum normal cache lifetime in seconds: 300 is 5 minutes, 3600 an hour and 86400 a day. Before an address change, lower the TTL from 86400 to 300 and wait at least the old day-long TTL. Then change the address, allowing ordinary caches to refresh within 5 minutes, and raise the TTL again after the move.

In a zone file, a name without a final dot is relative to the current zone. Writing mail.example.com in the example.com zone produces mail.example.com.example.com. Use mail.example.com. for the complete name, or the relative name mail.

A computer does not normally contact every DNS server itself. Its stub resolver asks a recursive resolver to obtain the answer. The resolver either has a usable cached answer or contacts the servers that are authoritative for parts of the name.

Start on the client

Local sources include the hosts file and the client's DNS cache. A hosts entry can override DNS for that computer. The Windows path is C:\Windows\System32\drivers\etc\hosts; Linux and macOS use /etc/hosts. A forgotten test entry can explain why one computer reaches an old server while every other computer works.

The client learns its resolver address from DHCP option 6 or manual configuration. Its request is recursive: it asks that resolver for the final answer. The client is delegating the search, not asking for directions to the next DNS server.

Work from the root toward the name

For a lookup of www.example.com with empty caches:

1. The client asks its recursive resolver.
2. The resolver asks a root server, which refers it to the com servers.
3. A com server refers it to the authoritative servers for example.com.
4. A domain server returns "A 203.0.113.10", with TTL 3600.
5. The resolver caches that answer and returns it to the client.

The resolver's requests along the hierarchy are iterative: each server supplies its best answer or referral. The root does not hold every site's address. There are 13 root server identities, named a through m, each served by many physical systems using anycast addresses.

The next client can receive the cached answer without repeating this search. A tool may label it "Non-authoritative answer"; this identifies the answer's source, not an error. Referrals and negative answers are cached too. An NXDOMAIN result can therefore remain visible after a missing name has been added, until its negative cache lifetime ends.

Use forwarding when another resolver should search

A resolver can send unanswered requests to an upstream forwarder, which performs the search. A conditional forwarder sends requests for a particular domain to designated servers. For example, a company can direct a partner's internal domain to the partner's resolver while sending ordinary public names elsewhere.

Separate privacy from authenticity

Ordinary DNS uses UDP or TCP port 53. Most small queries use UDP; zone transfers and many large replies use TCP. DNS over TLS (DoT) encrypts the client-resolver connection on TCP 853. DNS over HTTPS (DoH) carries queries through HTTPS on port 443 and can bypass filtering that watches only ordinary DNS.

DNSSEC instead lets a validating resolver check signatures and detect altered or forged DNS data. It does not encrypt queries or answers. Encryption protects the transport path; signed data supports authenticity.

After an address edit, authoritative servers publish the new data but do not push it into every resolver cache. Users can temporarily receive different answers because their cached copies have different remaining TTLs. That cache lifetime explains the usual delay described as “DNS propagation.”

Start with the exact failure. “Could not find host” means a name lookup failed. “Connection refused” after a successful lookup points elsewhere. Testing a known address and then its name helps separate name resolution from access to the destination.

If ping 203.0.113.10 works but ping www.example.com reports that it cannot find the host, investigate resolution. If both fail, check addressing and routing, but remember that ping can also be filtered. A failed ping alone cannot establish that DNS is broken or that the service is unreachable.

Ask the right server directly

Find the configured DNS servers using ipconfig /all, resolvectl status, or /etc/resolv.conf where applicable. Then compare queries:

nslookup www.example.com
nslookup www.example.com 192.0.2.53
nslookup -type=MX example.com
dig @192.0.2.53 example.com MX
dig -x 203.0.113.25
dig +trace www.example.com
Resolve-DnsName www.example.com -Type AAAA

The first lookup tests the client's selected resolver; an explicit server address tests a chosen resolver or authority. dig +trace follows referrals. A successful direct query but a failing application lookup suggests local settings, cache or the hosts file.

Interpret the reply

SERVFAIL can follow an unreachable authority or failed DNSSEC validation. REFUSED is different: a reachable server may allow recursion only for internal clients. In dig, the aa flag identifies an authoritative answer.

Compare old and new data

Suppose a server moved from 203.0.113.10 to 203.0.113.80. The authority returns .80 while the office resolver returns .10 with time left on an old 86400-second TTL. The edit is published; the office cache is stale. Wait for expiry or clear the affected resolver and client caches. ipconfig /flushdns clears the Windows client cache, not every upstream cache. Lowering the TTL in advance avoids a long wait during a planned move.

When only one computer differs, inspect its hosts file and local cache. When authoritative servers disagree, compare SOA serials: a changed primary zone with an unchanged serial may not transfer to secondaries.

Match the failing service to its records

A wrong A record affects IPv4. An incorrect or unusable AAAA record can cause IPv6 connection delays even when IPv4 works; an IPv4-only server does not need an AAAA record. For mail, verify the MX names and their direct A or AAAA records. Without MX, senders can try the domain's own address records. A missing PTR may affect mail acceptance and makes logs harder to read.

Finally, allow both UDP and TCP 53 where ordinary DNS requires them. A firewall allowing UDP alone may pass small replies yet break large answers and zone transfers.

Shared time makes events comparable. If a switch records a port failure and a router records a lost neighbor, accurate timestamps help establish their order. Time also affects certificate validity and authentication: Active Directory's Kerberos default allows only 5 minutes of clock difference.

Understand the clock hierarchy

NTP, the Network Time Protocol, exchanges timestamped packets over UDP 123. Four timestamps let the client estimate its clock offset and network delay. It polls repeatedly, commonly at intervals of 64–1,024 seconds. Small corrections are usually made gradually, called slewing, to avoid sudden backward jumps.

A stratum describes distance from a reference clock:

Usable network strata run from 1 to 15. Stratum is not an accuracy score: a nearby stratum 2 server may produce better results than a distant stratum 1 source reached over a variable-delay path.

Use several upstream sources, ideally at least four, for the internal time servers. This lets NTP compare sources and reject a false one. Other network devices can synchronize to those internal servers, limiting external traffic and keeping the local timeline consistent.

Configure and verify a client

On Cisco IOS, ntp server 192.0.2.123 selects an upstream server; adding prefer marks a preferred source. A synchronized device can then answer time requests from other devices. ntp master 4 instead advertises the router's own clock as a stratum 4 source. Its default is stratum 8 when the number is omitted. Use such a local reference only when no better source exists, such as in an isolated lab.

Check show ntp status for synchronization and the local stratum. If the upstream is stratum 2, the synchronized client becomes stratum 3. In show ntp associations, an asterisk marks the selected source. Allow several minutes for a new association to settle before treating the initial unsynchronized state as a persistent fault.

NTP distributes UTC. The device's time-zone and daylight-saving configuration controls the displayed local time. For example, clock timezone CET 1 sets a one-hour standard offset on IOS. An exact whole-hour error suggests display settings. Many organizations log in UTC to avoid converting between sites during an incident.

Protect time and choose the needed precision

Symmetric-key authentication limits accepted time sources to those sharing the configured key. Network Time Security (NTS) uses a TLS-based key exchange on TCP 4460, then authenticates the NTP packets that still travel over UDP 123. Restrict which hosts may query or control time services as well.

Precision Time Protocol (PTP, IEEE 1588) follows a grandmaster clock and uses hardware timestamps in network cards and switches to reach sub-microsecond accuracy on suitable local networks. It serves needs such as mobile networks and industrial control where ordinary NTP's millisecond-level timing is insufficient. PTP can run over Ethernet or IP; IP transport uses UDP 319 for event messages and UDP 320 for general messages. SNTP is a simpler NTP implementation for clients with less demanding time needs.

SNMP, the Simple Network Management Protocol, lets a monitoring manager read data from an agent on a device. The data is described by a management information base (MIB). Each object has an object identifier (OID), a dotted path in a tree. For example, 1.3.6.1.2.1.1.5.0 identifies sysName; 1.3.6.1.2.1.1.3.0 identifies sysUpTime. Vendor objects live under the enterprises branch, 1.3.6.1.4.1.

Combine scheduled polling with alerts

The agent listens on UDP 161 for requests. The manager receives traps and informs on UDP 162.

A manager might poll traffic, CPU and memory every 5 minutes to build graphs. A trap can report a failed link immediately. Use both: traps may be lost over UDP, and a failed device may be unable to send any notification. Informs retry according to timeout and retry settings, but can still fail after retries run out.

Choose a secure version

SNMPv1 and v2c send a community string in plain text. Read-only (RO) access permits reads; read-write (RW) access also permits supported changes. Version 2c adds GetBulk, informs and high-capacity counters. SNMPv3 uses accounts with security levels noAuthNoPriv, authNoPriv and authPriv. Prefer authPriv, which authenticates and encrypts messages, where supported.

An IOS v2c configuration can use snmp-server community N3tM0n-RO RO 10 to restrict reads using ACL 10. snmp-server host 192.0.2.50 version 2c N3tM0n-RO selects the notification receiver, and snmp-server enable traps enables traps. A v3 example is:

snmp-server group NMS v3 priv
snmp-server user monitor NMS v3 auth sha <auth-password> priv aes 128 <priv-password>

Avoid default communities such as "public" and "private", limit access to management hosts and grant write access only when needed. SNMP exposes MIB objects; it is not a remote command shell.

Convert a counter change into utilization

Counters measure accumulated bytes, also called octets. Suppose ifHCInOctets rises from 18,250,000,000 to 19,750,000,000 in 300 seconds:

1. Subtract the readings: 1,500,000,000 bytes arrived.
2. Multiply by 8: 12,000,000,000 bits arrived.
3. Divide by 300 seconds: 40,000,000 bit/s, or 40 Mbit/s.
4. Divide by the 100 Mbit/s link rate: inbound utilization averaged 40%.

This is an interval average, so brief peaks may be higher. Forgetting the byte-to-bit factor gives a rate eight times too small.

A 32-bit counter reaches 4,294,967,295 and wraps to zero. At 1 Gbit/s it wraps in about 34 seconds, so a 5-minute poll interval can miss several wraps. Use 64-bit ifHCInOctets and ifHCOutOctets, supported by v2c and v3, for fast links. Check counter continuity before interpreting a negative difference as negative traffic.

Syslog sends event messages to a central collector. Central collection preserves evidence across device restarts and allows an engineer to search several devices together. A security information and event management system (SIEM) can use those records to correlate events.

Traditional syslog uses UDP 514. TCP transport provides delivery acknowledgments at the transport layer; TLS on TCP 6514 also protects the connection. Even reliable transport needs working collection and storage, so verify that messages actually arrive.

Read the severity threshold correctly

Syslog levels run from 0 to 7, with smaller numbers meaning greater severity:

A configured threshold includes that level and every more severe level. logging trap warnings sends levels 0–4, not just level 4. The IOS remote-logging default is informational, levels 0–6. Enabling debugging sends all levels and can generate a large amount of traffic and processing work.

Separate facility from severity

The syslog facility identifies a source category. Examples include kern (0), user (1), mail (2) and auth (4). Local0 through local7, codes 16–23, are available for local use; Cisco devices default to local7. A collector can sort network-device messages using that code.

A message's priority combines both fields:

Local7 at severity 3 produces 187, written as "<187>". The number is an encoded pair, not a separate severity scale.

Cisco's visible message pattern is "%FACILITY-SEVERITY-MNEMONIC: description". In "%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down", LINEPROTO names the IOS feature, 5 means Notice, and UPDOWN identifies the event. This feature name is distinct from the transport facility local7. "%SYS-5-CONFIG_I: Configured from console by admin on vty0" records a configuration change.

Choose destinations and align timestamps

Destinations have separate settings. logging buffered 16384 informational keeps an in-memory buffer, read with show logging. logging host 192.0.2.50 selects a collector. logging trap warnings sets its threshold. In a remote terminal session, terminal monitor displays monitored messages. Debug output to the console can overload a busy device's CPU.

Use service timestamps log datetime msec to add date and millisecond timestamps, and NTP to synchronize clocks. A port-down event at 10:42:13.208, a router neighbor loss at 10:42:13.350 and the port's return at 10:42:17.511 form a useful sequence. They suggest a related link problem worth investigating; they do not identify a faulty cable by themselves. Without shared time, the apparent order may simply reflect clock error.

A voice call and a file transfer react differently to congestion. A file can wait while TCP retransmits missing data. A conversation suffers when packets arrive late, arrive unevenly or disappear. Quality of service (QoS) lets the network give different traffic different treatment.

Identify the service need

Four properties matter: bandwidth, the amount sent per second; delay, the end-to-end travel time; jitter, variation in that delay; and loss, the share of packets dropped. Common voice design targets are no more than 150 ms one-way delay, 30 ms jitter and 1% loss. These are planning targets for usable interactive voice, not extra capacity created by a policy.

QoS is a per-hop behavior (PHB). Each router or switch applies its own policy. A packet marked for priority still needs each congested hop to recognize and serve that class. Queue priorities change service order when traffic competes; classification, marking and rate limits can act even on an uncongested link.

Classify first, then mark

Classification identifies traffic using addresses and ports, an incoming interface, an existing marking or application recognition such as Cisco NBAR. Marking writes a value into a frame or packet so later devices can identify its class cheaply.

DSCP occupies six bits of IPv4's ToS byte or IPv6's Traffic Class. The remaining two bits are ECN, explicit congestion notification. CoS cannot appear in a frame sent without the VLAN tag.

Decode common DSCP values

Best effort is 0. Expedited forwarding (EF) is 46, binary 101110, commonly used for voice media. Assured forwarding (AFxy) identifies class x, from 1–4, and drop precedence y, from 1–3:

Thus AF11, AF21, AF31 and AF41 are 10, 18, 26 and 34. For AF32, calculate 8 times 3 plus 2 times 2 to obtain 28. Within class 4, AF43 (38) has higher drop precedence than AF42 (36), which is higher than AF41 (34). Higher drop precedence means greater loss preference during congestion, not better protection. The configured policy determines resources between different AF classes.

Class selectors use 8 times their number: CS3 is 24, often used for call signaling; CS6 is 48, commonly used for routing traffic.

Decide whose markings to trust

At a trust boundary, the network decides which incoming markings it will honor. An access switch can trust an IP phone while re-marking the connected PC's traffic to best effort. Otherwise, a user could mark a large download EF and compete with calls. Internet providers' ordinary services generally do not preserve a customer's QoS treatment end to end.

To size voice capacity, include headers. A G.711 call sending 50 packets per second, each with 160 voice bytes plus 40 header bytes, uses 200 bytes per packet. Multiplying by 8 and then by 50 gives 80,000 bit/s, or 80 kbit/s per direction. Twenty calls use 1.6 Mbit/s in each direction at the IP layer, before layer-2 overhead.

Congestion begins when packets arrive faster than an interface can send them. A 1 Gbit/s LAN feeding a 100 Mbit/s WAN can create this bottleneck even if the LAN itself is lightly loaded. Waiting packets enter an output queue; time spent there adds delay.

Select the next packet to send

FIFO, first in, first out, sends packets in arrival order. Class-based weighted fair queuing (CBWFQ) gives traffic classes minimum bandwidth shares during congestion. Low-latency queuing (LLQ) adds a strict priority queue for delay-sensitive traffic, with a configured limit to protect other classes.

On a 100 Mbit/s WAN, a policy might allocate a 10 Mbit/s priority class to voice, guarantee 30% to business applications, and leave the remainder to default traffic. A bandwidth guarantee is a minimum share under competition, not necessarily a maximum when other classes are idle. The priority limit prevents voice-class traffic from consuming the whole congested link.

Drop before every queue fills together

Tail drop discards newly arriving packets when a queue is full. If many TCP flows experience that loss together, they can all slow down and later speed up together. This global synchronization wastes capacity.

Weighted random early detection (WRED) starts dropping selected packets before the queue fills. Flows then back off at different times. A DSCP-aware policy can drop AF13 more readily than AF11 because both are in class 1 but AF13 has higher drop precedence. UDP voice does not reduce its sending rate in response to such loss, so WRED is not the usual treatment for the voice priority queue.

Distinguish policing from shaping

A provider may police at the committed information rate (CIR). Bursts above the contract can be discarded even if the physical port is faster. TCP may show a sawtooth pattern as it recovers and is cut back again.

A shaper buffers bursts locally and releases traffic at the configured rate. Its burst allowance for an interval is:

For 200 Mbit/s and a 10 ms interval, convert 10 ms to 0.010 s. Multiplication gives 2,000,000 bits per interval; division by 8 gives 250,000 bytes.

Suppose the site has a 1 Gbit/s handoff but the provider polices at 200 Mbit/s. Shape the site's outbound traffic to 200 Mbit/s and apply the voice queue inside that shaper. The waiting then occurs where the site controls priority, before the provider discards excess packets.

Apply and inspect the policy

On IOS, a class-map identifies traffic, a policy-map defines actions, and service-policy attaches the policy to an interface and direction. A queue policy only changes competition during congestion. Policing and shaping still enforce their configured rate on an otherwise idle link. Oversized queues can make voice delay worse by increasing waiting time.

A proxy receives a request and makes a separate request toward its destination. The client connects to the proxy, and the proxy connects onward. This application-level role lets it filter, cache or route requests. NAT instead rewrites addresses in packets without acting as the application's request-handling server.

Ask whom the proxy represents

A forward proxy can provide one controlled internet exit for an organization's users. A reverse proxy can publish www.example.com at 203.0.113.10 while forwarding requests to internal servers such as 10.1.1.21 and 10.1.1.22. The direction of representation is the defining difference.

Configure or intercept client traffic

An explicit proxy is known to the client. Its address and port, such as 10.0.0.8 on 3128 or 8080, may be entered manually, distributed by management software or selected through a PAC, proxy auto-configuration, file. WPAD helps discover proxy configuration automatically. These port numbers are common choices, not universal requirements for all proxies.

A transparent proxy receives traffic redirected by the network without client proxy settings. It can still be a forward proxy because it acts for clients. Client awareness and whom the proxy represents are two different comparisons.

Understand what happens to HTTPS

With an explicit proxy, a client can send a CONNECT request. The proxy establishes a tunnel, and encrypted traffic passes through it. The proxy can see the requested destination, but tunneling alone does not reveal the protected HTTP content.

To inspect that content, the proxy must perform TLS interception. It creates separate protected connections and presents certificates signed by the organization's certificate authority. Clients must trust that authority. Certificate-pinned applications can reject this replacement certificate, so some destinations need inspection exemptions. Interception also changes who can read the traffic, which makes privacy part of the design decision.

A caching proxy can reuse responses only when HTTP caching rules allow it. Repeated software downloads or static resources can save WAN bandwidth. Personal or frequently changing data often cannot be shared from a cache. Ordinary encrypted tunnels do not give a proxy access to the content needed for such inspection and caching.

Diagnose a proxy-specific failure

If browsing fails while other applications work, inspect the proxy address, port and reachability. If automatic configuration fails, test access to the PAC file. If internal sites fail only through the proxy, check the bypass rules: a pattern such as *.corp.example.com can keep those requests on the internal path.

For incoming web services, a reverse proxy may send /api to an application server and /images to a static-content server. If it spreads eligible requests among several back ends, it is also performing load balancing. Central TLS termination simplifies certificate management, while the internal connections may be re-encrypted when required.

A load balancer presents a virtual IP address (VIP) to clients and sends traffic to a pool of back-end servers. The client uses one service name while the pool supplies capacity and tolerates individual server failures. For maintenance, draining stops new connections to one server and lets existing work finish before removal.

Test the service before sending it work

A health check should match the service clients need. Ping tests whether a host responds, a TCP check tests whether a port accepts connections, and an HTTP check can test a page such as /health for status 200. A host may answer ping even after its web process crashes.

For shop.example.com, suppose the VIP is 203.0.113.20 on port 443 and the pool is 10.1.2.11–10.1.2.13 on port 8080. Checks run every 5 seconds and mark a server down after three consecutive failures. Detection takes roughly three check intervals, about 15 seconds, with actual timing affected by check scheduling and timeouts. Once .13 is down, new connections go to .11 and .12. Those survivors need enough spare capacity for the extra load.

Choose how to distribute work

Weights 3:2:1 divide 600 new connections into 300, 200 and 100. With active counts 12, 7 and 9, least connections chooses the second server. These algorithms choose among eligible healthy servers, not ones already removed by health checks.

Keep session state available

Session persistence, or sticky sessions, sends a user back to the same server when that server stores their session, such as a cart. A cookie or source address can identify the user. Stickiness can make the load less even; if that server fails, its local session may be lost. A shared database or cache lets other servers recover the session and reduces dependence on one back end.

A layer 4 balancer uses addresses and ports to distribute TCP or UDP traffic without reading application content. A layer 7 balancer reads information such as HTTP hostnames, paths and cookies. To inspect HTTPS content it terminates TLS, called TLS offload, and can establish a new encrypted connection toward the back end.

Protect the entry point too

A single load balancer can itself fail. An active-passive pair has a standby ready to take over the VIP; an active-active design lets both handle traffic.

Plain DNS round robin publishes several A records for a name and rotates their order. It offers simple distribution but has no built-in service health checks or immediate removal of cached addresses. Clients can keep using a failed address until records are changed and caches expire. Global server load balancing adds health and location decisions to DNS responses, but cache lifetimes still matter.