Networking for IT Support

A network lets connected devices exchange data and share resources. Its name tells you about its reach or purpose. A cable, a radio link, and an encrypted tunnel describe different parts of that picture, so several network names can apply at one site.

From one person to many sites

A WLAN belongs to the local network; wireless does not mean internet. A tablet can reach a local printer over Wi-Fi even during an internet outage. The router joins that local network to the provider's WAN. The internet is the largest WAN.

Device count does not decide the type. Three devices in an apartment and hundreds of devices at one office site can both form LANs. When classifying a network, ask where its links go and what they serve.

Storage has its own distinction

A storage area network (SAN) gives servers access to shared storage as disk blocks. A server sees that storage much like an attached drive. Network-attached storage (NAS) shares files and folders over the ordinary LAN. A user opening a shared folder on a NAS is using file sharing; the presence of network storage alone does not make the office LAN a SAN.

A private connection over another network

A virtual private network (VPN) creates an encrypted tunnel over an existing network, usually the internet. A remote-access VPN joins one user's device to an office network. A site-to-site VPN joins two office LANs. The tunnel protects traffic between its ends against reading or alteration in transit. It leaves endpoint care and website trust as separate jobs.

Follow a small business connection

A repair shop has wired desktop computers, Wi-Fi tablets, and a technician's phone paired to earbuds. The desktops use the LAN, the tablets use its WLAN, and the earbuds use a PAN. A branch in another city reaches the shop through a site-to-site VPN carried over the internet.

If the shop loses internet access but its local file share still opens, the LAN is still carrying local traffic. Check the WAN side before replacing the LAN switch. If only a home worker loses access to office files while ordinary websites work, the remote-access VPN becomes a useful place to check. These names help locate the affected connection before anyone changes settings.

Follow a packet from a laptop toward the internet and you meet several jobs: joining the local network, carrying traffic within it, and passing traffic to other networks. A small office or home (SOHO) router often performs all three, but each function has a different name.

Local connections and network boundaries

A network interface card (NIC) connects a device by Ethernet or Wi-Fi. Its media access control (MAC) address is normally 48 bits, written as 12 hexadecimal digits, such as 3C-52-82-1A-7F-09. Manufacturer-assigned addresses usually identify the maker in their first half. Private Wi-Fi addresses can differ from the hardware address, so use the address actually seen on that network when making device-based settings.

A switch learns which addresses are reachable through each port. It sends known unicast traffic toward the destination port; broadcasts and unknown destinations are flooded to other ports in the same logical network. An old hub repeats signals to every port, sharing capacity and allowing collisions.

An unmanaged switch works without configuration. A managed switch offers settings and monitoring. Its virtual LANs (VLANs) split one physical network into logical networks, such as staff and guest networks. Communication between VLANs needs a router or firewall. A patch panel performs no switching: short patch cords join its ports to a switch while the permanent wall cables stay in place.

Carry power with the data

Power over Ethernet (PoE) powers access points, cameras, and IP phones over twisted-pair cable. A PoE switch supplies it directly; an injector adds it to one link from an ordinary switch.

Some power is lost in the cable. Check both the per-port standard and the switch's total budget. Three PoE+ access points and four 802.3af cameras can require:

A 150 W switch is short by 1.6 W at that planned maximum. Use a larger budget or power a camera through an injector with its own supply.

Read the box before changing it

A SOHO box commonly combines a router, LAN switch, AP, firewall, automatic address server, and name-service forwarder. A provider gateway may also contain the modem. Adding Wi-Fi coverage may need only an AP; replacing the whole gateway changes several services at once. Label each box by the functions it actually provides.

A host is a device with a network address. A server provides services to other devices, called clients. Server roles describe work, not necessarily separate physical machines: one computer can provide several roles, and a service can run on a virtual machine.

Match the request to its service

A user may reach a web page but still fail to open an accounting database. Those requests depend on different services. Identify the function that failed before deciding that every server is unavailable.

Time is easy to overlook. Windows domain authentication normally permits a clock difference of up to five minutes. A PC nine minutes ahead can fail sign-in even with a correct password. Synchronizing with the network's time source addresses the cause. Correct time also supports certificate checks and lets technicians compare event times.

Collect events and control access

A syslog server gathers messages from network devices and hosts, traditionally over UDP 514. Central records let a technician compare a switch event with a firewall event at the same time.

An AAA server supports authentication, authorization, and accounting: who you are, what you may do, and a record of your activity. A Remote Authentication Dial-In User Service (RADIUS) server can check employee Wi-Fi accounts and record session activity. A successful sign-in and permission to open a resource are separate decisions.

Recognize network appliances

A spam gateway filters incoming mail before delivery. A unified threat management (UTM) appliance combines functions such as a firewall, intrusion prevention, malware scanning, and web filtering. A proxy makes requests for clients and may filter, cache, or log them. A load balancer distributes requests across servers and avoids servers that fail health checks. These devices can sit in the traffic path even when the user's own computer is healthy.

Support devices with limited control

A legacy system is an older system still in use. An embedded system is a computer built into a device for a dedicated job. Neither label alone tells you whether updates exist. Check the product and its support status.

Supervisory control and data acquisition (SCADA) systems monitor and control equipment such as pumps and factory lines. When prompt updates or replacement are impractical, separate, tightly restricted networks reduce exposure. Internet of Things (IoT) devices sense or act on the physical world: cameras, locks, and thermostats are examples. Change default passwords, apply firmware updates, and separate them from business computers. Their update support and available settings vary by product.

An internet service provider (ISP) connects a site to the internet. Choose a service by the work people do, the connections available at the site, and the equipment needed. A large download number alone can hide a slow upload path or a long delay.

Compare the connection paths

An ONT converts the fiber signal to a connection the router can use. Cable internet commonly uses a screw-on F-type coaxial connector. A digital subscriber line (DSL) uses the smaller RJ11 telephone connector. Where voice service shares the DSL line, a filter separates the signals. Fiber reaching only a street cabinet still leaves a copper last section whose length affects speed.

Read bits, bytes, and both directions

Bandwidth is a data rate, commonly in megabits per second (Mbps) or gigabits per second (Gbps). File sizes use bytes: one byte contains eight bits. A 100 Mbps service can carry at most about 12.5 megabytes per second (MB/s), before overhead.

For a 1.5 GB download at 100 Mbps, convert the decimal file size to megabits and divide:

That is a two-minute best case. Protocol overhead and competing traffic increase the actual time.

An asymmetric 500/50 Mbps plan gives up to 500 Mbps downstream and 50 Mbps upstream. A 2 GB upload contains 16,000 megabits and takes at least 320 seconds at 50 Mbps. Using the download rate would incorrectly predict 32 seconds. Backups and sending video both use upload capacity.

Delay is different from capacity

Latency measures delay. A round-trip measurement such as ping reports milliseconds for a request and reply. Low delay helps calls, games, and remote desktop work even when their data rates are modest.

Geostationary satellites orbit about 35,786 km above the equator. The long outward and return path alone takes about 0.48 seconds; typical round-trip latency is around 600 ms. Low Earth orbit systems use much lower satellites and often achieve roughly 20–60 ms, with results depending on service and conditions.

An office making calls while uploading backups benefits from symmetric fiber if available. A remote workshop may compare fixed wireless, cellular, and satellite by signal conditions and delay as well as speed. A second connection, such as cellular backup, can keep essential work running when the primary link fails.

Choose a cable using the required speed, complete link length, connectors, interference, and installation space. A faster switch cannot remove a limit in the cable path. Include patch cords and connectors when checking the whole channel.

Copper Ethernet

Twisted-pair cable has four pairs of copper wires. Twisting helps cancel electrical interference. Unshielded twisted pair (UTP) suits ordinary offices. Shielded twisted pair (STP) adds shielding for electrically noisy locations and needs proper grounding.

The 100 m channel normally allows 90 m of fixed cable plus 10 m of patch cords. Lower-category components reduce the performance the complete channel can guarantee. A Cat5e cord in a Cat6a installation prevents treating the whole path as Cat6a merely because the fixed cable has that label.

Ethernet uses an eight-contact RJ45 connector. The smaller RJ11 is for telephone and DSL connections. They serve different signals.

Put each wire on the correct pin

Hold the RJ45 plug with contacts up, clip down, and pin 1 at the left. T568B, pins 1 through 8, is white/orange, orange, white/green, blue, white/blue, green, white/brown, brown. T568A swaps the green and orange pairs: white/green, green, white/orange, blue, white/blue, orange, white/brown, brown.

The same standard at both ends makes a straight-through cable, used for almost all current connections. T568A at one end and T568B at the other makes the familiar crossover arrangement used on older links. Modern auto-MDI-X ports adjust automatically. Follow the building's standard consistently.

Match the jacket and medium

Plenum-rated cable limits flame spread and smoke in spaces used to circulate air, such as a ceiling return-air space. A suspended ceiling alone does not identify a plenum. Use the jacket rating required for the actual space. Direct-burial cable is designed for ground installation without conduit; outdoor and burial suitability must match the route.

Coaxial cable has a central conductor surrounded by insulation and shielding. RG6 with a screw-on F-type connector serves cable internet and TV; RG59 and BNC connectors appear in older video installations.

Fiber carries light, resists electrical interference, and avoids a conductive path between buildings. Single-mode fiber has a roughly 9 µm core and supports long links with matching laser optics. Multimode fiber has a 50 or 62.5 µm core and serves shorter links; 10GBASE-SR reaches about 300 m on OM3 and 400 m on OM4. Match the fiber and both transceivers. ST connectors twist-lock, SC connectors push-pull, and smaller LC connectors latch.

Never look into a fiber end or optical port; invisible laser light can injure your eyes.

For a 70 m, 10 Gbps run through an air-return ceiling, choose plenum-rated Cat6a. For a 400 m building-to-building link, fiber fits the reach and electrical separation; single-mode also leaves expansion margin. OM4 with suitable 10 Gbps optics can reach 400 m, but has little distance margin.

A cable fault may be a damaged conductor, a poor termination, an unknown route, or a link that fails its performance requirement. Choose a tool that answers the actual question. A successful test has meaning only within what that tool measures.

Build and terminate the link

A stripper removes the jacket without cutting the conductors. A crimper secures a modular plug: contacts engage the wires, and the strain relief grips the jacket. A punchdown tool presses wires into the contacts of wall jacks, patch panels, or blocks and trims their ends.

To make a T568B patch cable:

1. Remove about 25 mm of jacket without nicking the wires.
2. Arrange the conductors in T568B order: white/orange, orange, white/green, blue, white/blue, green, white/brown, brown.
3. Trim the ends evenly, to about 13 mm for a suitable plug.
4. Insert the wires fully, with the jacket held inside the strain relief, then crimp.
5. Terminate the other end to the same standard and test it.

Use connectors suited to the cable and follow their preparation instructions. At a jack or panel, follow its printed A or B labels. Keep the pairs twisted to within about 13 mm of termination; long untwisted sections increase interference between pairs.

Test wiring or certify performance

A cable tester connects a main unit and a remote unit to opposite ends. Its wire map reveals an open conductor, a short between conductors, or a miswire. A basic eight-light test establishes continuity and pin order. A certification tester measures properties such as length, loss, and crosstalk to assess a rated channel. Eight lights alone do not establish 10 Gbps performance.

A toner probe traces a cable. Attach the tone generator to one end and use the probe to locate the matching cable or panel port. Tracing identifies the route; a wire-map test checks its connections. A loopback plug returns transmitted signals to a port's receive side to test the interface locally. Passing that test still leaves the real cable and far-end device to check.

Observe radio signals and live traffic

A Wi-Fi analyzer shows network names, channels, and received signal strength. Strength is often a negative dBm value: −50 dBm is stronger than −75 dBm. Around −67 dBm is a common planning target for voice and video; actual service also depends on noise and congestion. Values below about −80 dBm often give unreliable service.

A network tap copies link traffic to a monitoring port for a packet analyzer or security monitor. It observes traffic; it does not assign client addresses or repair cabling.

Work through an unknown wall jack

A known-good laptop and patch cable fail at a newly occupied desk. Trace the wall cable to the patch panel with a toner. Test between the panel and wall jack: wire 3 is open. Inspect and re-punch the affected termination, retest the wire map, then patch the labeled panel port to the switch. Finally verify a real network connection. Replacing the desk's already tested patch cord would leave the permanent-link fault in place.

An Internet Protocol version 4 (IPv4) address identifies an interface on a network. It contains 32 bits, displayed as four decimal octets separated by dots. Each octet is from 0 to 255, so 192.168.1.25 is valid notation and 192.168.1.300 is not.

Give each setting its job

The Domain Name System (DNS) server can share the gateway's address because one router often provides both services. The jobs remain separate. Devices can communicate locally without a gateway; named internet services need the relevant addressing, gateway, and name-resolution settings.

With mask 255.255.255.0, also called /24, the first three octets identify the network. 192.168.1.37 and 192.168.1.200 are local to each other. 192.168.0.200 is on another network. In this /24, .0 identifies the network, .255 is broadcast, and .1 through .254 are the 254 device addresses. An address must be unique on its local network.

Recognize private and special addresses

Private IPv4 ranges are 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, and 192.168.0.0–192.168.255.255. They can be reused inside separate organizations and are not routed across the public internet. A SOHO router uses network address translation (NAT) so private clients can share a public IPv4 address. Check the full range: 172.20.5.4 is private; 172.32.0.1 is outside it.

127.0.0.1 is loopback, meaning this device itself. Pinging it checks local network software without sending traffic through the cable or Wi-Fi.

169.254.x.x belongs to IPv4 link-local addressing. Windows calls automatic use of these addresses Automatic Private IP Addressing (APIPA). On a Windows client set to obtain settings automatically, it usually means no usable DHCP lease was obtained. It permits local link communication but supplies no routed internet access. A link-local address alone identifies a symptom, not which cable, server, or setting caused it.

Read a real configuration

On Windows, ipconfig shows address, mask, and gateway. ipconfig /all adds DNS servers, the physical MAC address, DHCP status, the lease, and its server. On macOS use System Settings > Network > connection > Details; ifconfig lists interface information. Linux ip addr lists addresses and ip route shows the gateway after "default via".

A PC with 192.168.1.37/24, gateway 192.168.1.1, and DNS 192.168.1.1 has consistent settings. Another PC with 169.254.88.14 and no gateway needs its automatic-address path checked. Confirm its physical or Wi-Fi connection and DHCP service before requesting a fresh lease. A wrong gateway can leave local printing working while outside destinations fail.

Most client devices should obtain their settings automatically. Some devices need a predictable address so users and applications can find them. Choose an addressing method that meets that need and remains manageable when the network changes.

Choose who controls the settings

Dynamic Host Configuration Protocol (DHCP) provides the address, mask, gateway, and DNS settings. A mobile laptop can join a different network and receive appropriate settings there. A static entry stays on the device until changed. A reservation leaves the device on DHCP but tells the server to keep assigning that device the same address.

Check the address the server actually sees, especially on Wi-Fi devices using private MAC addresses. If that identifier changes, an existing reservation can stop matching.

Choose a safe static address

Suppose a router uses 192.168.1.1/24 and its DHCP pool is 192.168.1.100 through 192.168.1.199. A printer can use 192.168.1.20 if that address is unused and recorded. Enter mask 255.255.255.0, gateway 192.168.1.1, and the network's approved DNS server.

Check all three address conditions:

1. The static address belongs to the gateway's local network.
2. DHCP will not assign it to another client: it is outside the pool or excluded.
3. No other device already uses it.

An address outside the DHCP pool is not necessarily free. Another technician may already have assigned it manually. Check the site's records and current devices before using it.

Read the symptom caused by a wrong field

A duplicate IP address can cause intermittent access as two devices claim the same address. Choosing a manual address inside an active DHCP pool creates this risk when the server later assigns it. Move the manual address outside the pool or exclude it, and document the change.

A wrong mask changes which destinations the client considers local. A missing gateway blocks other networks while local resources can work. Wrong DNS settings break name lookups even when connections to known IP addresses still work. A laptop left on a static home configuration may therefore fail when it joins an office network.

Handle a router replacement

An old router used 192.168.0.x; its replacement uses 192.168.1.x. A printer still fixed at 192.168.0.50/24 is now on the wrong network for the PCs. Either retain the old LAN range on the replacement router or move the printer to an unused address on the new range. Update the PCs' printer ports if its address changes. Repeatedly renewing the PCs' leases will not change a manually configured printer.

A DHCP server gives clients IP settings automatically. In a small network it is often part of the router. The server manages addresses for a network and provides options such as the subnet mask, default gateway, DNS servers, and lease duration.

Follow DORA

A new IPv4 client commonly uses four messages, remembered as DORA:

1. Discover: the client broadcasts to find a server.
2. Offer: a server proposes an address and settings.
3. Request: the client asks to use a selected offer.
4. Acknowledge: the server confirms the lease and its options.

DHCP uses UDP 67 at the server and UDP 68 at the client. The initial broadcast stays on the local network unless a router relays it. A connected client cannot obtain a lease from an unreachable server merely because the server exists elsewhere in the organization.

Plan enough addresses

A scope combines an address range with the options for that network. An exclusion removes addresses from automatic allocation, often to protect manually configured devices. A reservation associates an address with one client's MAC address.

A range from 192.168.1.100 through 192.168.1.199 contains 100 addresses because both endpoints count. Excluding .100 through .109 removes 10, leaving 90. If 95 new clients simultaneously need leases and none has a usable lease, five cannot obtain one. Windows clients in that situation can fall back to link-local 169.254.x.x addresses. Expanding a pool must still respect static allocations and the local network range.

Understand lease timing

A lease authorizes the client to use its address for a limited time. With the default timer proportions, a 24-hour lease renews with its original server after 12 hours. If unsuccessful, the client tries any available server after 21 hours. Once the lease expires without renewal, it must stop using that leased address.

Existing clients with valid leases can keep working during a DHCP outage. A restarted client can often reuse a remembered, unexpired lease. New clients without usable leases fail first, so the fact that established users work does not clear DHCP of suspicion.

On Windows, ipconfig /release gives up a lease; ipconfig /renew requests one. Releasing the lease interrupts that client's connection. Use these commands after checking that a working path to the intended DHCP service exists.

Recognize competing or unmatched settings

A rogue DHCP server is unauthorized. A spare home router connected by a LAN port can offer the wrong network or gateway, producing different results for different clients. Remove the unintended service or configure the spare device as an access point with DHCP disabled. Multiple authorized servers are valid when configured to coordinate.

Reservations depend on a matching MAC address. A fixed private Wi-Fi MAC can be reserved; a rotating one will stop matching. Check the address seen by the router and the device's privacy setting for that network.

DHCP can supply a correct address and an incorrect DNS server. In that case the lease succeeds while websites by name fail. Inspect the delivered options as well as the address.

Internet Protocol version 6 (IPv6) uses 128-bit addresses. IPv4's roughly 4.3 billion possible addresses are too few to give every device a unique public address. IPv6 provides a much larger space and commonly runs alongside IPv4.

Read and shorten the notation

A full address has eight groups of four hexadecimal digits, separated by colons. Hexadecimal uses 0–9 and a–f. Start with:

2001:0db8:0000:0000:0000:ff00:0042:8329

First remove leading zeros within groups:

2001:db8:0:0:0:ff00:42:8329

Then replace one consecutive run of zero groups with :::

2001:db8::ff00:42:8329

Use :: at most once. Two occurrences leave the positions of missing groups uncertain. Remove only leading zeros: changing db80 to db8 changes the address. Expand an abbreviated address by restoring enough zero groups to make eight groups in total.

Recognize the address types

An interface with IPv6 enabled automatically creates a link-local address. Having one is normal. A global address identifies global scope, but working internet access also requires an appropriate route and permitted traffic. A device may have a link-local address, several global addresses, and changing temporary privacy addresses at the same time. That is not an address conflict.

The suffix /64 commonly identifies a LAN prefix length. An interface marker such as %12 in fe80::1%12 identifies the local network interface; it is not part of the address.

Learn where settings come from

With stateless address autoconfiguration (SLAAC), the router advertises a prefix and the client creates an address. DHCPv6 can supply addresses or other settings, including DNS servers. Router advertisements provide the default-router information; the gateway often appears as a link-local address such as fe80::1.

Dual stack means running IPv4 and IPv6 together. A Windows listing might show a global IPv6 address, a link-local IPv6 address, and both IPv4 and IPv6 gateways. If only link-local IPv6 appears, a valid IPv4 configuration can still provide internet access. Check which protocol family a connection actually uses before treating the whole device as offline.

IPv6 has no broadcast address. Home networks generally give devices their own global IPv6 addresses instead of using IPv4-style NAT. The router's firewall still controls incoming traffic; address scope and permission to connect are separate matters.

The Domain Name System (DNS) turns names such as www.example.com into addresses. It is distributed: different servers hold different parts of a hierarchy. A working internet link and working name resolution are separate requirements.

Follow the hierarchy

Read www.example.com from right to left. The root directs requests toward a top-level domain (TLD) such as .com. That TLD's servers identify the authoritative servers for example.com. The authoritative servers hold the domain's official records, including names below it such as www.example.com.

A device uses its local name information, including its cache and hosts file. If it needs DNS, it asks its configured recursive resolver. This may be a company server, a provider service, a public resolver, or a service reached through the router. The resolver answers from cache when possible. Otherwise it follows referrals from root to TLD to authoritative server and returns the result. DNS uses port 53.

Cached records have an expiration time

A record's time to live (TTL) limits how long it can be cached. A TTL of 3600 seconds permits one hour; 300 seconds permits five minutes. A changed authoritative record does not instantly replace copies still valid in caches.

Before a planned move, reduce the TTL early enough for old cached copies to expire. On Windows, ipconfig /flushdns clears the local cache, but not a resolver's cache elsewhere. Repeatedly clearing the PC cannot force an external resolver to forget an answer whose TTL remains valid.

Check local overrides and the resolver

The hosts file maps names to addresses locally. Windows uses C:\Windows\System32\drivers\etc\hosts; macOS and Linux use /etc/hosts. An entry such as "203.0.113.50 intranet.example.com" can make applications on that device reach that address without a DNS lookup. If only one PC reaches an old site, inspect local overrides as well as caches.

Run nslookup www.example.com to see the DNS server and answer. "Non-authoritative answer" means the replying resolver is not authoritative for that name. It may have used a cache or performed a fresh lookup. The label is normal. To compare resolvers, nslookup www.example.com 1.1.1.1 sends the query to a specified server. Remember that nslookup queries DNS; it does not reproduce every application's local hosts-file behavior.

Separate a name failure from a connection failure

If a known responsive internet address replies to ping but a name produces "host not found," name resolution needs attention. Check the configured DNS server and compare lookup results. A timed-out ping alone is inconclusive: a host or firewall may block ping while another service works. If address-based connections fail too, investigate connectivity alongside DNS.

Company PCs may need internal names such as fileserver.corp.example.com. Use the approved internal DNS servers. Replacing them with a public resolver can restore public lookups while breaking internal resources and domain sign-in. The default gateway and DNS server are independent settings even when a home router supplies both.

A DNS record has a name, type, time to live (TTL), and value. The type tells you what the value means. Read the type before deciding whether the value should be an address, another name, a mail destination, or policy text.

Find hosts, aliases, and mail destinations

A name can have A and AAAA records together. A CNAME points to another name, whose address must then be resolved; putting an IP address in its target confuses the record types. An ordinary alias owner cannot also carry its own A, MX, or TXT data.

For MX records, lower preference numbers are tried first. If example.com has 10 mail1.example.com and 20 mail2.example.com, senders normally try mail1 before mail2. The MX value is a host name with address records, not the mail server's IP address. It describes receiving mail for the domain, not which outgoing submission port a user's mail app should use.

Read the three email checks

Sender Policy Framework (SPF) publishes permitted sending systems in a TXT record for the domain used in the message's envelope sender. A record can include an IP address and a provider's list. Its -all ending marks an unmatched sender as fail; ~all marks soft fail. Receiver policy determines the final handling. Publish one SPF policy record for a domain; multiple SPF policy records produce an error.

DomainKeys Identified Mail (DKIM) adds a digital signature using the sender's private key. The public key is published under a selector name such as selector1._domainkey.example.com. A receiver uses it to verify the signing domain and signed parts of the message. A valid signature concerns those signed parts; it is not a guarantee that the message is honest.

Domain-based Message Authentication, Reporting, and Conformance (DMARC) adds alignment with the visible From domain. At least one method must pass and align: SPF or DKIM. Passing a check for an unrelated domain is insufficient. A TXT policy at _dmarc.example.com can request p=none for monitoring, p=quarantine for suspicious handling, or p=reject for refusal, and name a reporting destination. Receivers apply their own handling policies.

Support a provider change

A business changes email providers and its mail starts landing in spam. Check whether the existing SPF policy authorizes the new provider and whether the provider's DKIM key is published at the correct selector. Then check DMARC alignment and reports. Creating a second SPF record is not a repair; update the single policy. Separately, a website move changes A or AAAA data and can leave old cached addresses in use until their TTLs expire.

An IP address gets data to a host. A transport protocol and port number identify the program's endpoint on that host. A firewall rule therefore needs more than an address: TCP and UDP traffic using the same number are separate cases.

Read an endpoint

A protocol is a set of communication rules. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) carry application data over IP. A port is a number from 0 to 65535. Well-known ports run from 0 to 1023, registered ports from 1024 to 49151, and dynamic/private ports from 49152 to 65535. Client software usually selects an ephemeral, or temporary, source port from a high range; operating systems choose their own available ranges.

A socket is an IP address and port for a particular transport protocol. A laptop might connect from 192.168.1.37:51544 to a web server at 203.0.113.10:443 over TCP. The server replies to the laptop's port 51544. The client does not need to listen on 443 just because the server does.

A second TCP connection between the same client and server endpoint uses a different client source port. Several browser tabs can also share a connection, with the web protocol keeping requests separate. Do not count tabs to infer the number of transport connections.

Compare delivery behavior

TCP numbers data and recovers missing pieces, which suits file transfer and many web, mail, and remote sessions. UDP has less built-in overhead. It suits short queries and time-sensitive voice, video, and game traffic. If an old voice packet arrives too late, replaying it can be less useful than continuing the call. Applications can add their own reliability on top of UDP.

Calling UDP "unreliable" means that UDP itself makes no delivery guarantee. It does not mean that most datagrams disappear. Calling TCP reliable means it provides detection and recovery while the connection works; it does not keep a broken link alive forever.

Match both parts of a rule

DNS normally uses UDP 53 for ordinary queries but also uses TCP 53, including large responses and server transfers. Remote Desktop uses TCP 3389 and can add UDP 3389. HTTP/3 uses QUIC over UDP 443, so modern web traffic is not exclusively TCP.

If an application requires UDP 3478, allowing TCP 3478 does not open the required path. Check the transport, destination port, and intended host together. Port numbers are defaults, not proof of identity: a management web service can use 8443, and different software can occupy a familiar port. Identify the configured service as well as its number.

Ports help you identify which part of an application path to inspect. Web access, sending email, reading email, name lookup, and automatic addressing use different services. A successful incoming-mail connection says little about the outgoing-mail settings.

Web access and connection security

Hypertext Transfer Protocol (HTTP) commonly uses TCP 80 and carries web traffic without encryption. HTTPS commonly uses TCP 443 with Transport Layer Security (TLS). TLS protects the traffic in transit, and the browser checks the server's certificate. A phishing site can also have a valid certificate: connection security and the owner's honesty are separate questions. HTTP/3 carries HTTPS over QUIC on UDP 443.

Send mail and read mail

STARTTLS upgrades a connection to TLS; implicit TLS starts with encryption. Use the provider's required port and encryption mode together. Many providers block outbound 25 on residential connections to limit spam. Do not substitute server-to-server port 25 for the app's authenticated submission settings.

POP3 downloads messages and often removes server copies. Device-local folders and read status are not synchronized across devices. IMAP keeps the mailbox on the server and synchronizes folders and message state. It is the better fit when a user works across a phone, laptop, and webmail.

If received mail works but sending fails, inspect the SMTP server name, submission port, TLS mode, and sign-in. Changing the incoming IMAP port targets the working half of the account.

Move a POP3 user carefully

A user's phone and laptop show different messages and read status because POP3 has created separate local collections. Add the account using IMAP or the provider's supported account type. Copy messages stored only on a device into the server mailbox and verify them from another client. Remove the old POP3 configuration only after the messages are safely present. Deleting it first can lose mail that exists nowhere else.

Keep name and address services separate

The Domain Name System (DNS) uses port 53, usually UDP for ordinary queries and TCP when required. Dynamic Host Configuration Protocol (DHCP) uses UDP 67 at the server and 68 at the client. DNS finds the address behind a name; DHCP provides a client's own configuration.

To learn the defaults, group them by task: web 80/443, server mail transfer 25, mail download 110, mailbox synchronization 143, name lookup 53, and automatic IPv4 configuration 67/68. Keep the encrypted mail ports beside the plain defaults so configuration work does not stop at recognition.

Support work often involves remote commands, remote desktops, shared folders, or file transfer. These are different tasks. Choose the service that fits the task and avoid sending credentials over an unencrypted connection.

Remote management and file transfer

FTP's data connection is separate from its command connection. Active mode uses server port 20; passive mode uses a server-selected data port. Opening only 21 can therefore permit sign-in while transfers fail. FTPS adds TLS to FTP; SFTP is a different protocol carried through SSH. The similar names do not make them interchangeable in client settings.

Use SSH instead of Telnet for remote commands. SSH also carries SFTP and secure copy (SCP). For Windows graphical control, reach RDP through a VPN or remote desktop gateway. Exposing RDP directly with an internet port forward invites attacks against the service.

Shared files and older Windows networking

Server Message Block (SMB) uses TCP 445 for file and printer sharing. A path such as \\fileserver\shared names a shared folder. Windows, macOS, Linux, and NAS devices can all use SMB. Common Internet File System (CIFS) names an early SMB dialect; the labels are sometimes used loosely in device menus.

Keep SMBv1 disabled because it is obsolete and insecure. A failed connection to an old device calls for checking supported protocols and updating or replacing it, not enabling obsolete sharing across the office.

NetBIOS over TCP/IP (NetBT) uses UDP 137 for names, UDP 138 for datagrams, and TCP 139 for sessions, including older SMB connections. Modern networks normally use DNS for names and SMB directly on 445.

Directories and scoped firewall access

Lightweight Directory Access Protocol (LDAP) queries and updates directory information such as users, groups, and address books. Its normal port is 389. LDAPS uses TLS on TCP 636; LDAP can also upgrade to TLS on 389 when configured for STARTTLS. A copier might query the directory for staff email addresses.

Suppose a firewall separates staff and server networks. An administrator's encrypted Linux shell needs TCP 22 to the intended server. A shared-folder request needs TCP 445 to the file server. Remote desktops need TCP 3389 from approved VPN clients, optionally with UDP for performance. Name the source, destination, transport, and port in each rule. Opening one broad range because several tasks fail hides which service is actually needed.

Wi-Fi is the IEEE 802.11 family of wireless networking standards. The generation name tells you about supported technology; the band, channel width, client hardware, and surroundings affect what one device actually achieves.

Match generations to bands

These are ideal totals across supported streams, not normal speeds for one laptop. Both the access point and client must support the relevant band and features. A Wi-Fi 6 device does not gain 6 GHz simply because the access point supports Wi-Fi 6E.

Balance reach and available spectrum

The 2.4 GHz band usually reaches farther through walls, but shares crowded spectrum with nearby networks, Bluetooth, and microwave ovens. The 5 GHz band offers more channel choices and often higher rates over a shorter range. The 6 GHz band offers additional spectrum and wide channels for compatible 6E and Wi-Fi 7 devices, with shorter practical range and WPA3 security for ordinary secured networks.

Channel numbers on 2.4 GHz are only 5 MHz apart, while a typical channel occupies about 20 MHz. Channels 1, 6, and 11 form the usual separated plan. Channel 3 overlaps traffic near both 1 and 6. Sharing one planned channel can work better than creating partial overlap.

Widths include 20, 40, 80, 160, and, with Wi-Fi 7, 320 MHz. Wider channels raise potential rates but occupy more spectrum and leave fewer independent channels. Use 20 MHz on crowded 2.4 GHz; 40 or 80 MHz often fits 5 GHz. Choose wider options only when the available spectrum and clients support them.

Set the country or region correctly. Allowed bands, channels, and power depend on the national regulator. Some 5 GHz channels require dynamic frequency selection (DFS): the access point detects radar and moves away. Do not copy a channel plan from equipment set for a different country.

Recognize the other radios

Bluetooth forms nearby personal area networks, commonly around 10 m, using 2.4 GHz. Pairing involves discovery, selection, and confirmation. Bluetooth Low Energy supports small battery-powered devices.

Near-field communication (NFC) operates over centimeters at 13.56 MHz for taps such as payment or access. Radio-frequency identification (RFID) reads tags by radio over distances set by the tag system. Passive tags use energy from the reader and have no battery. NFC is a specialized short-range form of RFID.

For a camera behind exterior walls, try 2.4 GHz for reach. For a nearby compatible laptop transferring large files, 5 or 6 GHz may fit better. Earbuds use Bluetooth; an access badge uses an appropriate RFID or NFC system.

A small office or home router joins the local network to the provider and often supplies Wi-Fi, automatic addressing, and a firewall. Set up the physical path first, then management, internet settings, and the LAN. Keep a record so another technician can maintain it.

Connect and secure management

Connect the modem or optical network terminal (ONT) to the WAN or internet port. Connect local computers or a switch to LAN ports. Some cable modems remember the first connected device; restarting the modem after router replacement can let it recognize the replacement.

Open the router's local management address, found on its label or in a client's default gateway setting, or use its supported app. Change the default administrator password to a strong, unique one. Use HTTPS management when available and disable internet-side management unless required. Update firmware and enable automatic updates when offered. Replace equipment that no longer receives security updates.

Match the provider's WAN settings

The provider determines the method. Choosing automatic DHCP on a service requiring PPPoE can leave local networking functional while internet access fails. A static WAN address and a static LAN address describe different sides of the router.

For the LAN, choose the router address and mask, DHCP pool, lease duration, DNS options, and reservations. With 192.168.1.1/24 and a .100–.199 pool, leave room for documented static devices outside the pool.

Identify upstream translation

Double NAT occurs when a provider gateway routes one private LAN and a second router routes another behind it. Browsing often works, but incoming connections and some applications become harder to support. Bridge the provider gateway when supported, or make the second device an access point. Planned forwarding can work through two local routers if both are configured.

Check the WAN address before arranging remote access. A private address can mean an upstream local router or provider translation. The shared range 100.64.0.0–100.127.255.255 commonly indicates carrier-grade NAT (CGNAT). With CGNAT, the customer's forward alone cannot open the provider's shared address. Ask for a public address or use a remote-access method designed for that situation.

Open only the intended service

A port forward might send external TCP 8443 to 192.168.1.50:443. Give the internal device a reservation or static address so the target stays stable. A forward exposes that service; use updated devices and prefer a VPN for remote access. Avoid the broad DMZ host setting. Universal Plug and Play (UPnP) lets clients create mappings automatically; leave it off unless its convenience is needed.

Record the WAN method, LAN range, DHCP pool, reservations, forwards, network name, and where credentials are stored. Export a configuration backup if supported. Verify local access and internet access from a client after saving the settings.

A useful Wi-Fi setup has suitable access controls and usable signal where people work. Configure the network name and security first, then place the access points, choose channels, and verify the result from the client's locations.

Name the network and protect access

The service set identifier (SSID) is the visible network name. Use a neutral name that does not reveal a home address, family name, or router model. Multiple access points or mesh nodes can share an SSID for roaming. Band steering helps compatible devices choose between bands under one name.

SAE means simultaneous authentication of equals. AES means Advanced Encryption Standard, the cipher in the WPA2-AES option.

Wi-Fi Protected Access (WPA) modes differ from the router's administration login. Set a long, unique Wi-Fi passphrase and a different administrator password. Four or five random words or at least 16 characters gives a practical starting point. Change shared access when people who knew the passphrase should no longer connect.

Do not use obsolete Wired Equivalent Privacy (WEP), WPA with Temporal Key Integrity Protocol (TKIP), or an open private network. Disable Wi-Fi Protected Setup (WPS) because its PIN method can expose the passphrase to guessing attacks. Hiding an SSID leaves it discoverable in wireless traffic. MAC filtering can be bypassed by copying an allowed address and can reject devices whose private addresses rotate. Neither replaces strong encryption.

Separate visitors and smart devices

Give guests and Internet of Things devices a separate network. Confirm that it blocks access to the main LAN; the label "guest" alone is not a test of isolation. Client isolation also blocks guests from reaching each other. A visitor who can browse but cannot open the staff file server may be seeing the intended separation.

Put the signal where it is needed

Place the router or access point centrally, raised, and in the open. Walls, metal cabinets, mirrors, and water weaken signals. Microwave ovens can interfere with 2.4 GHz. Add mesh nodes or access points when one location cannot cover the site; Ethernet backhaul carries traffic between them without consuming the same wireless airtime.

A single-radio extender receives and retransmits on the same channel, often roughly halving available client throughput. Put it where the original signal is still usable, not inside the dead zone.

Measure and choose channels

A Wi-Fi analyzer reports nearby networks, channels, and strength in dBm. Less negative means stronger. Suppose channel 1 has five networks, the strongest at −48 dBm; channel 6 has three, strongest −62 dBm; channel 11 has one at −85 dBm. Channel 11 is the best of these separated choices because its competing signal is weak. Network count alone would miss the difference in strength.

Walk the work areas and aim for around −67 dBm or stronger where calls take place. Test useful application performance and speed in several locations. Record the SSID, channels, security mode, and AP locations so later changes can be compared with the working setup.