C Glossary · CCNA

This glossary defines 293 key terms used throughout the book and on the CCNA 200-301 exam. Terms are listed alphabetically; acronyms appear where they are most commonly used, with the expansion in the definition. Chapter numbers are not given because many terms recur in several chapters; use the book's Contents to locate the main treatment.

0–9

1000base-sx / lx

Gigabit Ethernet over fiber: SX uses multimode

fiber (short reach); LX uses single-mode or

multimode fiber (longer reach).

1000base-t

Gigabit Ethernet (IEEE 802.3ab) over all four

pairs of Category 5e or better UTP, up to 100 m.

100base-tx

Fast Ethernet (IEEE 802.3u) at 100 Mbps over

two pairs of Category 5 or better UTP, up to 100

10base-t

IEEE 802.3 Ethernet at 10 Mbps over two pairs

of twisted-pair copper cable, up to 100 m.

802.11

The IEEE family of wireless LAN standards (a,

b, g, n/Wi-Fi 4, ac/Wi-Fi 5, ax/Wi-Fi 6/6E, be/Wi-Fi 7).

802.1Q
IEEE standard for VLAN trunking that inserts a
4-byte tag (TPID 0x8100 plus PCP, DEI and a 12-

bit VLAN ID) after the source MAC address.

802.1X
IEEE standard for port-based network access
control; a supplicant authenticates through an
authenticator (switch or WLC) to an

authentication server, usually RADIUS.

802.3af / at / bt
IEEE Power over Ethernet standards delivering
up to 15.4 W (PoE), 30 W (PoE+) and 60–90 W

(PoE++) per port at the PSE.

Aaa

Authentication, authorization and accounting:

the framework for identifying users, controlling

what they may do and recording what they did.

Access control entry (ACE)

A single permit or deny statement within an

access control list.

Access control list (ACL)
An ordered list of permit and deny statements
used to filter packets or to identify traffic;
processed top-down with an implicit deny at the

end.

Access layer
The campus layer where end devices connect to
the network, providing ports, PoE, VLAN

assignment and edge security.

Access point (AP)
A device that connects wireless clients to a
wired network, bridging 802.11 frames to

Ethernet.

Access port
A switch port that belongs to a single data
VLAN (optionally plus a voice VLAN) and sends

untagged frames.

Ad hoc network
An Independent Basic Service Set (IBSS) in
which wireless clients communicate directly

without an AP.

Address Resolution Protocol (ARP)
IPv4 protocol that finds the MAC address
associated with a known IP address on the local
subnet using a broadcast request and unicast

reply.

Administrative distance (AD)
A value (0–255) that rates the trustworthiness
of a route source; the lower value wins when
two sources offer the same prefix (connected 0,
static 1, eBGP 20, EIGRP 90, OSPF 110, RIP

120).

Advanced Encryption Standard (AES)
A symmetric block cipher used by WPA2/WPA3
(via CCMP/GCMP), IPsec and many other

protocols.

Ansible
An agentless, push-based configuration
management tool from Red Hat that uses YAML

playbooks and connects over SSH or APIs.

Anycast address
An IPv6 address assigned to several interfaces;
packets are delivered to the nearest one

according to routing.

Api

Application Programming Interface: a defined

way for software to request services or data

from other software.

Apipa

Automatic Private IP Addressing: a host self-assigns an address in 169.254.0.0/16 when DHCP fails.

Area (OSPF)
A group of OSPF routers and links that share an
identical link-state database; area 0 is the

backbone.

Area border router (ABR)

An OSPF router with interfaces in area 0 and at

least one other area.

Artificial intelligence (AI)
Technologies that let systems learn, reason and
predict; in networking used for anomaly
detection, assurance and predictive operations

(AIOps).

Asic

Application-Specific Integrated Circuit: custom

hardware that lets switches and routers forward

frames and packets at wire speed.

Asymmetric encryption

Encryption using a key pair (public and private);

used for key exchange and digital signatures.

Authentication
Verifying the identity of a user or device, for
example by password, certificate or multifactor

methods.

Authorization

Determining what an authenticated user or

device is permitted to do.

Autonomous AP
An AP that is configured and managed
individually and does not depend on a

controller.

Autonomous system (AS)
A collection of networks under a single
administrative routing policy, identified by an

AS number.

Autostate

Feature that keeps an SVI up only while at least

one port in its VLAN is up and forwarding.

Backbone area

OSPF area 0; all other areas must connect to it.

Backup designated router (BDR)

The OSPF router on a multiaccess segment that

takes over if the DR fails.

Basic Service Set (BSS)

A wireless cell formed by one AP and its

associated clients.

Bearer token
An authentication token sent with each REST
API request (typically in the Authorization

header) to prove the client's identity.

Blocking state
An STP state in which a port discards frames
and does not learn MAC addresses, to prevent

loops.

Botnet
A network of compromised computers
controlled by an attacker, often used for DDoS

attacks.

Bpdu

Bridge Protocol Data Unit: the message STP

switches exchange to elect a root bridge and

compute a loop-free topology.

BPDU Guard

An STP feature that err-disables a PortFast port

if it receives a BPDU.

Bridge ID (BID)
An STP identifier made of the bridge priority
(with extended system ID) and MAC address;

the lowest BID becomes root.

Broadcast address
The address that reaches all hosts in a subnet:
host bits all 1s in IPv4; FFFF.FFFF.FFFF at

Layer 2.

Broadcast domain
The set of devices that receive each other's
broadcasts; bounded by routers, divided by

VLANs.

Brute-force attack

An attack that tries every possible password or

key until one works.

Bssid

The MAC address that identifies a BSS (one AP

radio and SSID).

C
CAM table
Content Addressable Memory table: the switch's

MAC address table.

Campus network
The LAN serving one or more buildings in a site,
usually designed as access, distribution and

core layers.

Capwap

Control and Provisioning of Wireless Access

Points: tunnels between lightweight APs and a

WLC (UDP 5246 control, 5247 data).

Catalyst Center
Cisco's enterprise network controller (formerly
DNA Center) providing intent-based

automation, assurance and APIs.

Cdp

Cisco Discovery Protocol: Cisco-proprietary
Layer 2 protocol that advertises device
information to directly connected neighbors

every 60 s (holdtime 180 s); enabled by default.

Channel
A specific frequency range within a wireless
band; in 2.4 GHz only channels 1, 6 and 11 do

not overlap (in North America).

Cidr

Classless Inter-Domain Routing: addressing and

routing with prefix lengths independent of

address classes, written as /n.

Class of Service (CoS)

The 3-bit 802.1p priority value in the 802.1Q

tag's PCP field (0–7).

Classful address
An IPv4 address interpreted according to its
class (A, B or C), with a default mask of /8, /16

or /24.

Classification

In QoS, identifying traffic and assigning it to a

class, often by examining headers or markings.

Client mode (VTP)

A VTP mode in which a switch learns VLANs

from servers but cannot create or modify them.

Cloud computing
On-demand, self-service, elastic, metered
computing resources accessed over a network

(NIST definition).

Collision domain
A network segment in which simultaneous
transmissions collide; each switch port is its

own collision domain.

Command-line interface (CLI)

The text-based interface for configuring and

monitoring Cisco devices.

Community string

An SNMPv1/v2c shared password that grants

read-only or read-write access.

Connected route

A route (code C) automatically added for the

subnet of an up/up interface with an IP address.

Console port

A physical management port for out-of-band CLI

access with a rollover or USB cable.

Container
A lightweight, portable unit that packages an
application and its dependencies and shares the

host operating system kernel.

Control plane
The part of a network device that builds
forwarding information, for example by running

routing protocols, STP and ARP.

Controller-based networking
An architecture in which a centralized
controller programs network devices, typically

through southbound APIs.

Convergence
The process (and time taken) for all routers or
switches to agree on a consistent topology after

a change.

Core layer

The high-speed backbone of a campus network,

interconnecting distribution blocks.

Crc

Cyclic Redundancy Check: an error-detection

calculation; in Ethernet, the FCS. Increasing

CRC errors indicate physical problems.

Crud

Create, Read, Update, Delete: the basic data

operations, mapped in REST to POST, GET,

PUT/PATCH and DELETE.

Csma/ca

Carrier Sense Multiple Access with Collision

Avoidance: the 802.11 media access method.

Csma/cd

Carrier Sense Multiple Access with Collision

Detection: the half-duplex Ethernet media

access method.

D
Data plane
The part of a network device that forwards
traffic based on tables built by the control

plane; also called the forwarding plane.

Dead interval
The time an OSPF router waits without hellos
before declaring a neighbor down (default 40 s

on broadcast networks, four times the hello).

Default gateway

The router address a host uses to reach

destinations outside its own subnet.

Default route
A route that matches all destinations (0.0.0.0/0
or ::/0), used when no more specific route

exists.

Default VLAN

VLAN 1: the VLAN to which all switch ports

belong by default.

Denial of service (DoS)

An attack that makes a resource unavailable; a

distributed DoS (DDoS) uses many sources.

Designated port

In STP, the port on each segment with the best

path to the root bridge; it forwards traffic.

Designated router (DR)
The OSPF router elected on a multiaccess
segment to reduce adjacencies and LSA

flooding.

Dhcp

Dynamic Host Configuration Protocol:
automatically assigns IP addresses and options
using Discover, Offer, Request and
Acknowledgment (DORA) on UDP ports 67 and

DHCP relay agent
A router function ( ip helper-address ) that
forwards client DHCP broadcasts as unicasts to

a server on another subnet.

DHCP snooping
A switch feature that drops DHCP server
messages on untrusted ports and builds a

binding table of legitimate leases.

DHCPv6
DHCP for IPv6; can be stateful (assigns
addresses) or stateless (supplies only options

such as DNS).

DiffServ
Differentiated Services: a scalable QoS model
that marks packets with DSCP values and

applies per-hop behaviour.

Distance vector
A routing protocol type in which routers
advertise distances to networks to neighbors

(for example RIP).

Distribution layer
The campus layer aggregating access switches,
providing routing, policy and redundancy (often

the default gateways).

Dns

Domain Name System: resolves names to IP

addresses; uses UDP and TCP port 53.

Dscp

Differentiated Services Code Point: a 6-bit QoS

marking in the IP header (for example EF = 46

for voice).

Dtp

Dynamic Trunking Protocol: Cisco protocol that

negotiates whether a link becomes a trunk

(modes dynamic auto and dynamic desirable).

Dual stack

Running IPv4 and IPv6 simultaneously on the

same devices and interfaces.

Duplex
Half duplex sends or receives at one time; full
duplex sends and receives simultaneously

without collisions.

Duplex mismatch
One end of a link at full duplex and the other at
half, causing late collisions and poor

performance.

Dynamic ARP Inspection (DAI)
A switch feature that validates ARP messages
against the DHCP snooping binding table to

stop ARP spoofing.

Dynamic NAT

NAT that maps inside local addresses to a pool

of public addresses one-to-one, on demand.

Eigrp

Enhanced Interior Gateway Routing Protocol: a

Cisco-developed advanced distance-vector

protocol (AD 90 internal, 170 external).

Enable secret

An IOS command that sets a hashed password

protecting privileged EXEC mode.

Encapsulation

Adding headers (and trailers) as data passes

down the protocol stack.

Encryption

Transforming data so that only parties with the

correct key can read it.

Error-disabled (err-disabled)
A port state in which IOS shuts down an
interface because of a violation, such as port

security or BPDU Guard.

Ess

Extended Service Set: multiple BSSs (APs)

sharing an SSID to allow roaming.

EtherChannel
Bundling several physical Ethernet links into
one logical link for bandwidth and redundancy;

negotiated with LACP or PAgP or set statically.

Ethernet

The family of IEEE 802.3 LAN standards

defining physical media and frame format.

EtherType
A 2-byte Ethernet header field identifying the
encapsulated protocol (0x0800 IPv4, 0x86DD

IPv6, 0x0806 ARP).

Eui-64

Method of creating a 64-bit IPv6 interface ID

from a 48-bit MAC address by inserting FFFE

and flipping the seventh bit.

Extended ACL
An IPv4 ACL (100–199, 2000–2699 or named)
matching source and destination addresses,

protocol and ports.

Extended-range VLAN

VLAN IDs 1006 to 4094.

Fcs

Frame Check Sequence: the 4-byte CRC at the

end of an Ethernet frame used to detect errors.

Fiber-optic cable
Cable carrying light through glass; multimode
for shorter distances, single-mode for longer

distances.

Firewall

A device that filters traffic between security

zones based on stateful inspection and policy.

First Hop Redundancy Protocol (FHRP)
A protocol (HSRP, VRRP, GLBP) that provides a
virtual default gateway shared by multiple

routers.

Floating static route
A static route with an administrative distance
higher than the primary route, used as a

backup.

Flooding
A switch sending a frame out of all ports in the
VLAN except the incoming one, for broadcasts

and unknown unicasts.

Forwarding state

An STP state in which a port sends and receives

data frames.

Ftp

File Transfer Protocol: TCP-based file transfer

using ports 21 (control) and 20 (data, active

mode).

G
Gateway of last resort
The router's default route, shown in show ip

route .

Get

The HTTP method used to read a resource in a

Rest api.

Glbp

Gateway Load Balancing Protocol: a Cisco

FHRP that load-balances among several active

gateways.

Global unicast address (GUA)

A globally routable IPv6 address, currently

allocated from 2000::/3.

Gre

Generic Routing Encapsulation: a tunneling

protocol that carries many protocols over IP,

without encryption.

H
Hello interval
How often a protocol sends hellos; OSPF default

10 s on broadcast and point-to-point networks.

Host route

A route to a single address: /32 in IPv4 or /128

in IPv6.

Hsrp

Hot Standby Router Protocol: a Cisco FHRP

with one active and one standby router sharing

a virtual IP and MAC.

Http / https

Hypertext Transfer Protocol on TCP port 80;

HTTPS adds TLS encryption on TCP port 443.

Hypervisor
Software that creates and runs virtual
machines; Type 1 runs on bare metal, Type 2 on

a host OS.

I
IaaS
Infrastructure as a Service: a cloud model
providing virtual compute, storage and

networking.

Icmp

Internet Control Message Protocol: used for

diagnostics and errors, for example by ping

(echo) and traceroute.

Igp

Interior Gateway Protocol: a routing protocol

used within an autonomous system (OSPF,

EIGRP, RIP).

Implicit deny

The invisible final ACL entry that denies all

traffic not matched by earlier entries.

Inside global address

In NAT, the public address representing an

inside host to the outside.

Inside local address

In NAT, the private address actually assigned to

an inside host.

Intent-based networking (IBN)
An approach in which administrators express
desired outcomes and a controller translates

them into configurations and verifies them.

Inter-VLAN routing

Routing between VLANs using router on a stick,

Layer 3 switch SVIs or routed ports.

IoT

Internet of Things: network-connected sensors,

cameras and other devices.

IP address

A logical Layer 3 address: 32 bits in IPv4, 128

bits in IPv6.

IP phone

A telephone that sends voice over IP, typically

with a built-in switch for a PC.

IPsec
A suite of protocols providing confidentiality,
integrity and authentication for IP traffic, used

for site-to-site and remote-access VPNs.

IPv4

Internet Protocol version 4, with 32-bit

addresses.

IPv6

Internet Protocol version 6, with 128-bit

addresses written in hexadecimal.

Isl

Inter-Switch Link: an obsolete Cisco trunking

protocol that encapsulated entire frames.

J
Jitter
Variation in delay between packets; harmful to

voice and video.

Json

JavaScript Object Notation: a text data format

of objects (key/value pairs in braces) and arrays

(in brackets), common in REST APIs.

Lacp

Link Aggregation Control Protocol: IEEE

802.3ad/802.1AX protocol negotiating

EtherChannels (modes active and passive).

Lan

Local area network: a network within a limited

area such as a building or campus.

Latency

The time taken for data to travel from source to

destination; also called delay.

Layer 2 switch

A switch that forwards frames based on MAC

addresses within VLANs.

Layer 3 switch
A switch that can also route IP packets in
hardware, using SVIs and routed ports; also

called a multilayer switch.

Lightweight AP (LAP)

An AP managed by a WLC, using CAPWAP; split-MAC architecture.

Link-local address

An IPv6 address in FE80::/10 used only on the

local link; every IPv6 interface has one.

Link-state
A routing protocol type in which routers flood
topology information and run SPF (for example

OSPF).

Link-state advertisement (LSA)

An OSPF data structure describing routers,

links and networks, stored in the LSDB.

Lldp

Link Layer Discovery Protocol: IEEE 802.1AB
vendor-neutral discovery protocol; default timer
30 s, holdtime 120 s; disabled by default on

Cisco.

Lldp-med

LLDP Media Endpoint Discovery: LLDP

extensions for endpoints such as IP phones

(voice VLAN, PoE, location).

Local route

A route (code L) for a router's own interface

address with a /32 (IPv4) or /128 (IPv6) prefix.

Longest prefix match
The routing rule that a router uses the most
specific matching route (the longest prefix

length).

Loopback interface
A virtual router interface that is always up
unless shut down; often used for router IDs and

management.

Lsdb

Link-state database: the collection of LSAs an

OSPF router has learned for an area.

M
MAC address
A 48-bit Layer 2 address, written in hex; the

first 24 bits form the OUI.

MAC address table

A switch table mapping MAC addresses to ports

per VLAN, learned from source addresses.

Man-in-the-middle (MITM)
An attack in which the attacker secretly
intercepts and possibly alters communication

between two parties; also on-path attack.

Management plane

Functions used to manage a device, such as

SSH, SNMP and syslog.

Marking

Setting a QoS value (CoS, DSCP) in a header so

later devices can apply policy.

Maximum transmission unit (MTU)

The largest packet an interface can send

without fragmentation; 1500 bytes on Ethernet.

Metric

A value a routing protocol uses to choose

among routes; OSPF uses cost.

Mfa

Multifactor authentication: using two or more of

something you know, have or are.

Multicast

One-to-many delivery to a group address

(224.0.0.0/4 in IPv4, FF00::/8 in IPv6).

Multimode fiber

Fiber with a larger core that carries multiple

light modes; suited to shorter distances.

N
Named ACL
An ACL identified by a name, allowing

sequence-numbered editing.

Nat

Network Address Translation: changing IP

addresses in packets as they pass a router,

typically private to public.

Native VLAN
The VLAN whose frames cross an 802.1Q trunk
untagged (VLAN 1 by default); must match on

both ends.

Neighbor (OSPF)

A router that shares a link and matching

parameters and has exchanged hellos.

Neighbor Discovery Protocol (NDP)
IPv6 ICMPv6-based protocol for address
resolution (NS/NA), router discovery (RS/RA),

DAD and redirects.

Netconf

An IETF network management protocol that

uses XML over SSH (port 830) with YANG

models.

Network address

The address identifying a subnet, with host bits

all 0.

Next hop

The address of the next router toward a

destination.

Northbound API

An interface that a controller exposes to

applications and administrators, typically REST.

Ntp

Network Time Protocol: synchronizes device

clocks using UDP 123 and a hierarchy of strata.

Nvram

Nonvolatile RAM, where a Cisco device stores

its startup configuration.

O
Octet
Eight bits; one of the four parts of an IPv4

address.

OSI model
The seven-layer reference model: physical, data
link, network, transport, session, presentation,

application.

Ospf

Open Shortest Path First: an open link-state IGP

that uses cost as its metric (AD 110).

OSPF cost

The OSPF metric: reference bandwidth (default

100 Mbps) divided by interface bandwidth.

Oui

Organizationally Unique Identifier: the first 24

bits of a MAC address, assigned to a

manufacturer.

Out-of-band management
Device management over a separate path, such
as a console port or dedicated management

network.

Outside global address

In NAT, the public address of an outside host.

Overlay
A virtual network built on top of a physical
underlay, often with tunnels (for example

VXLAN).

P
PaaS
Platform as a Service: a cloud model providing
an application platform without managing

infrastructure.

PAgP
Port Aggregation Protocol: Cisco-proprietary
EtherChannel negotiation (modes desirable and

auto).

Pat

Port Address Translation: NAT overload,

mapping many inside addresses to one public

address using unique port numbers.

Pdu

Protocol Data Unit: the unit of data at a given

layer (segment, packet, frame).

Phishing
A social-engineering attack using fraudulent
messages to steal credentials or install
malware; variants include spear phishing and

whaling.

Ping

A utility that sends ICMP echo requests to test

reachability.

Pki

Public Key Infrastructure: certificate authorities

and digital certificates that bind public keys to

identities.

Playbook

An Ansible YAML file describing tasks to run on

managed hosts.

PoE
Power over Ethernet: delivering DC power over
twisted-pair cable to devices such as phones

and APs.

Point-to-point

A link connecting exactly two devices; OSPF

does not elect a DR on point-to-point networks.

Policing

A QoS tool that drops or re-marks traffic

exceeding a rate, without buffering.

Port number

A 16-bit transport-layer identifier for an

application (for example SSH 22, HTTPS 443).

Port security
A switch feature that limits which and how
many MAC addresses may use a port; violation

modes protect, restrict and shutdown.

PortFast

An STP feature that moves an edge port

immediately to forwarding.

Post

The HTTP method used to create a resource in

a REST API.

Prefix length

The number of network bits in an address,

written as /n.

Private IPv4 address

Addresses reserved by RFC 1918 for internal

use: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Privileged EXEC mode
The IOS mode (prompt #) allowing full
monitoring commands and access to

configuration mode.

Puppet
An agent-based, pull-model configuration
management tool using a declarative manifest

language.

Put / patch

HTTP methods used to update a resource in a

REST API (replace or partially modify).

Q
QoS
Quality of Service: tools that classify, mark,
queue, police and shape traffic to meet

application needs.

Queuing

Holding packets in buffers and scheduling their

transmission; for example LLQ for voice.

Radius

Remote Authentication Dial-In User Service:

open AAA protocol using UDP 1812/1813 that

encrypts only the password.

Ransomware

Malware that encrypts data and demands

payment for the key.

Rapid PVST+

Cisco's per-VLAN implementation of Rapid STP

(802.1w).

Reflection / amplification attack
A DoS attack that spoofs the victim's address so
that third-party servers send large responses to

it.

Regional Internet Registry (RIR)
An organization that allocates IP addresses
within a region (ARIN, RIPE NCC, APNIC,

LACNIC, AFRINIC).

Remote-access VPN

A VPN connecting an individual user's device to

a network, typically with TLS or IPsec.

Rest

Representational State Transfer: an API

architecture using HTTP methods, stateless

operation and URIs to identify resources.

Roaming

A wireless client moving its association from

one AP to another within an ESS.

Rogue AP

An unauthorized access point connected to the

network.

Root bridge

The STP switch with the lowest bridge ID; all its

ports are designated ports.

Root port

The single port on a non-root switch with the

lowest cost path to the root bridge.

Route summarization

Advertising one route that covers several more

specific prefixes.

Routed port

A Layer 3 switch port configured with no

switchport , acting like a router interface.

Router ID (RID)
A 32-bit identifier for an OSPF router:
configured, else highest loopback IP, else

highest active interface IP.

Router on a stick (ROAS)
Inter-VLAN routing using one router interface
configured with 802.1Q subinterfaces over a

trunk.

Routing protocol

A protocol that routers use to exchange routes

dynamically, such as OSPF.

Routing table

The table of routes a router uses to forward

packets, viewed with show ip route .

Rsa

An asymmetric cryptographic algorithm; IOS

generates RSA keys to enable SSH.

Running configuration

The active configuration in RAM.

S
SaaS
Software as a Service: a cloud model delivering

complete applications.

Server mode (VTP)

The default VTP mode; can create, modify and

advertise VLANs.

Shaping

A QoS tool that buffers traffic exceeding a rate

to smooth it, adding delay instead of dropping.

Single-mode fiber

Fiber with a small core carrying a single light

mode, for long distances.

Site-to-site VPN

A VPN connecting two networks, typically with

IPsec between routers or firewalls.

Slaac

Stateless Address Autoconfiguration: an IPv6

host builds its own address from a router

advertisement prefix.

Small form-factor pluggable (SFP)

A hot-swappable transceiver module for fiber or

copper connections.

Snmp

Simple Network Management Protocol:

monitors and manages devices using a manager,

agents and MIBs (UDP 161; traps to UDP 162).

SNMPv3 adds authentication and encryption.

Social engineering

Manipulating people into revealing information

or performing actions.

Software-defined networking (SDN)
An architecture that separates the control plane
from the data plane and centralizes it in a

controller.

Solicited-node multicast

An IPv6 multicast address (FF02::1:FFxx:xxxx)

used by NDP for address resolution.

Southbound API
An interface a controller uses to program
network devices (for example NETCONF,

RESTCONF, OpenFlow, CLI/SSH).

Spanning Tree Protocol (STP)

IEEE 802.1D protocol that prevents Layer 2

loops by blocking redundant paths.

Split-MAC
The division of 802.11 functions between a
lightweight AP (real-time) and a WLC

(management).

Ssh

Secure Shell: encrypted remote CLI access

using TCP port 22.

Ssid

Service Set Identifier: the name of a wireless

network.

Standard ACL
An IPv4 ACL (1–99, 1300–1999 or named) that
matches only the source address; placed near

the destination.

Startup configuration

The configuration stored in NVRAM and loaded

at boot.

Stateful firewall

A firewall that tracks connections and allows

return traffic automatically.

Static NAT

One-to-one permanent mapping of an inside

local address to an inside global address.

Static route

A manually configured route (code S), AD 1 by

default.

Subinterface

A logical interface on a physical router

interface, such as G0/0.10, used for ROAS.

Subnet

A logical subdivision of an IP network.

Subnet mask

A 32-bit value that marks the network and host

portions of an IPv4 address.

Subnetting

Borrowing host bits to divide a network into

smaller subnets.

Switch virtual interface (SVI)

A logical Layer 3 interface for a VLAN on a

switch ( interface vlan ).

Symmetric encryption

Encryption using the same shared key for

encryption and decryption (for example AES).

Syslog
Standard protocol for sending log messages to a
server, UDP port 514, with severity levels 0

(emergency) to 7 (debugging).

Tacacs+

Cisco-developed AAA protocol using TCP 49

that encrypts the entire payload and separates

authentication, authorization and accounting.

Tcp

Transmission Control Protocol: connection-oriented, reliable transport with a three-way handshake, sequencing, acknowledgments and

windowing.

Tftp

Trivial File Transfer Protocol: simple,

unauthenticated file transfer on UDP port 69.

Three-way handshake

The TCP connection setup sequence: SYN, SYN-ACK, ACK.

Tls

Transport Layer Security: protocol encrypting

application sessions, for example HTTPS.

Tlv

Type-Length-Value: a flexible data encoding

used by CDP, LLDP and other protocols.

Topology
The physical or logical arrangement of a
network: star, mesh, bus, ring, spine-leaf and so

on.

Traceroute

A utility that discovers the path to a destination

by sending packets with increasing TTL values.

Transparent mode (VTP)

A VTP mode that keeps local VLANs and relays

but does not apply advertisements.

Trunk

A link that carries multiple VLANs, tagging

frames with 802.1Q.

Ttl

Time to live: an IPv4 header field decremented

by each router; the packet is discarded at 0

(Hop Limit in IPv6).

Udp

User Datagram Protocol: connectionless, best-effort transport with low overhead.

Underlay

The physical network that carries overlay

tunnels.

Unique local address (ULA)

An IPv6 private address in FC00::/7 (in practice

FD00::/8).

Unknown unicast

A frame whose destination MAC is not in the

MAC address table; the switch floods it.

Uri

Uniform Resource Identifier: identifies a

resource in a REST API, such as

https://host/api/v1/devices.

User EXEC mode

The initial, limited IOS mode (prompt >).

V
Virtual machine (VM)
A software emulation of a computer that runs

its own OS on a hypervisor.

Virtual routing and forwarding (VRF)

Multiple independent routing tables on one

router, used to separate networks.

Vlan

Virtual LAN: a logical broadcast domain created

on switches, normally mapped to one IP subnet.

VLAN hopping

An attack that gains access to another VLAN,

via DTP trunk negotiation or double tagging.

Vlsm

Variable-Length Subnet Masking: using

different mask lengths within one network for

efficiency.

Voice VLAN
A separate VLAN for IP phone traffic,
configured with switchport voice vlan ;

frames are tagged by the phone.

Vpn

Virtual private network: a secure tunnel over a

shared or public network.

Vrrp

Virtual Router Redundancy Protocol: an open-standard FHRP with a master and backups.

Vtp

VLAN Trunking Protocol: a Cisco protocol that

propagates VLAN definitions to switches in the

same domain.

Vulnerability

A weakness that a threat could exploit.

Wan

Wide area network: a network spanning large

geographic distances.

Wildcard mask
A mask used in ACLs and OSPF network
commands where 0 bits must match and 1 bits

are ignored.

Windowing
TCP flow control in which the receiver
advertises how much data the sender may send

before an acknowledgment.

Wlan

Wireless LAN.

Wlc

Wireless LAN controller: centrally manages

lightweight APs, WLANs and security policies.

Wpa2

Wi-Fi Protected Access 2: uses AES-CCMP;

Personal (PSK) or Enterprise (802.1X) modes.

Wpa3

Wi-Fi Protected Access 3: adds SAE for personal

networks, stronger enterprise options and

protected management frames.

Xml

Extensible Markup Language: a tagged data

format used by NETCONF and some APIs.

Yaml

YAML Ain't Markup Language: a human-readable data format based on indentation, used by Ansible.

Yang

A data modeling language describing device

configuration and state for NETCONF and

Restconf.

Z
Zero Trust
A security model that never implicitly trusts any
user or device and verifies every access

request.

Zero-day

A vulnerability unknown to the vendor, with no

patch available.