Networking fundamentals

Networking fundamentals is the heaviest objective on the 102 paper: addressing and subnetting, TCP and UDP, configuring interfaces and routes, name resolution, and diagnosing what has failed. Objective 109 of LPIC-1 Exam 102-500, worth 23.33% of the exam.

Share of the exam
23.33%
Questions in a real sitting
roughly 14 of 60
Questions in this bank
70
Signed for by a person
0
Machine-checked only
70

Partly checked. None of the 70 questions here has been read against the cited source by a person. 70 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.

Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

What this objective covers

The 70 questions written for this objective cite 3 LPI exam objectives (109.1, 109.2, 109.3) and 28 manual pages (dig(1), getent(1), host(1), hostname(1), hostnamectl(1), hosts(5), icmp(7), ifup(8), ip(8), ip-address(8), ip-link(8), ip-neighbour(8), ip-route(8), ipv6(7), nc(1), netstat(8), networkctl(1), nm-settings-keyfile(5), nmcli(1), nsswitch.conf(5), ping(8), resolv.conf(5), resolved.conf(5), ss(8), systemd.network(5), tracepath(8), traceroute(8), traceroute6(8)).

They break down as 49 single-answer questions, 9 choose-several questions and 12 type-the-answer questions.

What this objective is really about

Nearly a quarter of the paper, and the only objective with real arithmetic in it. The subnetting questions are entirely mechanical once you can convert a prefix length to a mask, so they are the most reliable marks on the exam — provided you have practised them enough to do it without hesitating.

Addressing and subnetting

For a prefix length n, the block holds 2^(32-n) addresses and two of them are unusable: the all-zeros host part is the network address and the all-ones host part is the broadcast address. So a /26 has 64 addresses and 62 usable hosts, a /28 has 16 and 14, and a /30 has 4 and 2 — which is why /30 is the classic point-to-point link.

To find the network address, AND the address with the mask. The practical shortcut is to work out the block size in the octet the prefix splits: a /20 is 255.255.240.0, so blocks step by 16 in the third octet and 172.20.35.77 sits in the block starting at 172.20.32.0. The last-octet mask values for /25 through /32 are 128, 192, 224, 240, 248, 252, 254, 255, and memorising that row makes most of these questions instant.

The three private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The middle one is the most misremembered: it covers 172.16 through 172.31 inclusive, so 172.15 and 172.32 are public. 169.254.0.0/16 is link-local, self-assigned when DHCP fails — not private space, and seeing one is a diagnostic clue in itself.

For IPv6, ::1 is loopback, :: is unspecified, fe80::/10 is link-local, fc00::/7 is unique local and ff00::/8 is multicast. There is no broadcast at all. Text compression has two rules: drop leading zeros within a group, and replace exactly one run of consecutive all-zero groups with :: — and it may appear only once, because two occurrences would be ambiguous.

Configuration and resolution

iproute2 splits by object: ip addr for addresses, ip link for the device itself, ip route for routing, ip neigh for the ARP and neighbour cache. ip addr add takes CIDR notation rather than a netmask keyword, and it adds rather than replaces, so an interface can hold several addresses. Nothing set this way survives a reboot — persistence comes from /etc/network/interfaces on Debian-style systems, from NetworkManager profiles, or from DHCP.

Name resolution has two layers and the exam tests the boundary. /etc/nsswitch.conf decides which sources are consulted for hostnames and in what order, and the first source that answers ends the lookup. dig, host and nslookup speak DNS directly and deliberately ignore /etc/hosts and the rest of NSS. getent hosts goes through the same path an application does, which makes it the right tool for "what will this program actually resolve?". A disagreement between getent and dig is normally an /etc/hosts entry or an nsswitch ordering rather than a DNS fault.

Diagnosis

The standard split: pinging an IP address exercises the interface, the routing table and the path; pinging a name additionally exercises resolution. When the address works and the name does not, the fault is above layer 3 — check /etc/resolv.conf for nameserver entries and /etc/nsswitch.conf for the hosts line. When neither works, look at the interface, the address and the default route.

Tools worth knowing: ss -tulpn for listening sockets with owning processes (-t TCP, -u UDP, -l listening, -p process, -n numeric), traceroute and the unprivileged tracepath for the path, and nc -z for a scriptable check of whether a remote port accepts connections.

Lessons in this objective

The objective cut into the pieces the blueprint declares. Each one has the material written out and the questions that test it.

Drill this objective

The trainer can run a short practice set drawn from this objective alone, which is what the weight column above is for: revise the heavy objectives first.

Practise Networking fundamentals

Questions on this objective (page 1 of 4)

Practise Networking fundamentals

The other objectives in LPIC-1 Exam 102-500