Monday, April 27, 2026

Cohort 3 | Project CloudIgnite Topics: Subnet Masks, CIDR Blocks, OSI Model Recap, TCP vs UDP, Application Protocols, DNS, Troubleshooting Tools Duration: ~3 hours

Topics covered: Subnet Masks · CIDR Blocks · OSI Model Recap · TCP vs UDP · Application Protocols (HTTP/S, SSL/TLS, SMTP, RDP, SSH) · DNS · Troubleshooting Tools · Labs 265 & 266

Key Takeaways

• Subnet mask: alternative to CIDR; bitwise AND determines if IP belongs to network
• Application protocols: HTTP (80), HTTPS (443), SSL/TLS, SMTP, POP, IMAP, SSH (22), RDP (3389)
• DNS: translates domain names to IP addresses
• Troubleshooting tools: ping (L3), traceroute (L3), nslookup (DNS), telnet (port check, L4), curl/wget (L7)
• Lab 266: Apache web server not reachable — root causes: service not running + missing port 80 Security Group rule
• Key insight: If port 22 works but port 80 doesn't, the issue is at the instance level (service or SG), not VPC/IGW

1. Subnet Mask

A subnet mask is an alternative notation to CIDR that indicates how many bits of an IP address are fixed (network portion) vs. variable (host portion).

CIDR vs. Subnet Mask – Same Information, Different Format

• /18 → first 18 bits are fixed (network), last 14 bits are for hosts
• Subnet mask in binary: 11111111.11111111.11000000.00000000 → 255.255.192.0
• Subnet mask is not always 255; the boundary octet reflects the exact split

Calculating the IP Range

For 192.168.0.0/18:

• Network IP (start): 192.168.0.0
• Ending IP: Set all host bits to 1 → 192.168.63.255
• Host bits: 14 bits → 2¹⁴ = 16,384 addresses (0–16,383 usable range across last two octets)

Bitwise AND Operation – How Computers Use Subnet Masks

Computers determine whether an IP belongs to a network using bitwise AND:

IP Address   AND   Subnet Mask   =   Network Address

• If both bits are 1 → result is 1
• If either bit is 0 → result is 0
• If the result equals the network address, the IP is in the network
• This is faster than decimal range comparison for computers

Example: Does 192.168.70.119 belong to 192.168.0.0/18?

• AND with mask 255.255.192.0 → result ≠ 192.168.0.0 → not in range

💡 Why subnet mask over CIDR? Bitwise AND using the mask is computationally efficient; the computer doesn't need to compare upper/lower bounds.

2. CIDR Blocks

CIDR (Classless Inter-Domain Routing) is a compact notation: <network IP>/<prefix length>

• /20 → first 20 bits fixed; last 12 bits for hosts
• /28 → first 28 bits fixed; last 4 bits for hosts (smaller network)
• Larger prefix = smaller network
• /31 → only 2 IPs, both reserved (network + broadcast) → not a valid usable subnet
• CIDR can define subnets (split a network) or supernets (combine networks)

Subnetting

• Adding 1 bit to the mask splits the network into 2 subnets
• Adding 2 bits → 4 subnets, etc.
• Subnetting does not add more IP addresses — it divides existing ones

Benefits of Subnetting

• More granular IP address control
• Reduces broadcast traffic / improves efficiency
• Extends effective life of IPv4
• Enables IP segmentation (e.g., separating departments, VLANs)

IP Address Classes (for reference)

Class A has the most host addresses.

3. OSI Model Recap

Focus on Layers 3, 4, and 7 for AWS and exam purposes.

4. TCP vs. UDP

TCP – Transmission Control Protocol

• Connection-oriented — establishes connection before sending data
• Uses the 3-Way Handshake: SYN → SYN-ACK → ACK
  • Only at the start of the connection
  • During transmission: sender expects periodic acknowledgements (ACKs) for ranges of packets, and retransmits any missing ones
• Reliable but slower due to overhead
• Use cases: HTTP/S, FTP, SSH, email (SMTP), file transfers

UDP – User Datagram Protocol

• Connectionless — sends packets without setup or acknowledgement
• No guarantee of delivery; lost packets are not retransmitted
• Faster — no handshake, no ACK overhead
• Use cases: video streaming, voice/video calls, online gaming, DNS queries

TCP vs. UDP Comparison

💡 Real-world analogy: In a video call, if a packet is lost, it's better to skip it (UDP) than re-send old audio and fall behind (TCP).

5. Application Layer Protocols

HTTP & HTTPS

• HTTP (port 80) — unencrypted; data can be intercepted in plain text
• HTTPS (port 443) — HTTP + SSL/TLS encryption; data is encrypted end-to-end
• Never submit sensitive info (passwords, payment data) on HTTP-only sites

SSL / TLS

• TLS is the updated, more secure version of SSL
• Uses a TLS Handshake to negotiate:
  • Encryption algorithm (e.g., RSA minimum)
  • Shared key
• Once negotiated, all data is encrypted with that key/algorithm
• Free certificates available via Let's Encrypt; AWS and most hosting providers offer HTTPS out of the box

URL Structure

https://www.amazon.com/products?category=books
  ^           ^              ^         ^
Protocol    Domain          Path      Query

Email Protocols

Remote Access Protocols

Common Port Numbers to Memorise

6. Management & Support Protocols

DNS Explained

• Works like a phone book: domain name = name, IP address = phone number
• When you visit google.com, your device queries a DNS server to get the IP
• You could type the IP directly instead of the domain name (but that's impractical)

7. Network Troubleshooting Commands

ping

• Tests reachability of a host using ICMP
• Reports packet loss and round-trip time
• ping -c 5 8.8.8.8 — send exactly 5 packets
• 100% packet loss = host unreachable

traceroute (Linux) / tracert (Windows)

• Shows the path (hops) packets take from your device to the destination
• Each hop is a router/network device along the route
• * (asterisk) = timeout — that hop didn't respond within TTL
• Useful for diagnosing where a connection fails

nslookup

• Queries DNS to find the IP address for a domain
• Example: nslookup google.com → returns IPv4 and IPv6 addresses
• Useful for verifying DNS resolution

netstat

• Shows current network connections and status
• netstat -t → TCP connections only
• netstat -u → UDP connections only
• netstat -p → includes process information
• Example: can reveal your active SSH session to an EC2 instance

telnet

• Tests if a specific port on a server is open and responding
• telnet google.com 80 → if it says "Connected", port 80 is open
• telnet <ip> 22 → test SSH port
• Not installed by default on some systems: sudo yum install telnet

curl / wget

• Makes HTTP requests (Layer 7)
• curl and wget are used for downloading or testing HTTP endpoints

OSI Layer Mapping for Tools

8. Lab Summary

Lab 265 – Exploring Network Commands

Practised on an EC2 instance (Amazon Linux):

• ping -c 5 8.8.8.8 — verified connectivity to Google DNS
• traceroute 8.8.8.8 — traced route through multiple hops to destination
• nslookup google.com — retrieved Google's IPv4 and IPv6 addresses
• telnet www.google.com 80 — confirmed port 80 open; port 21 closed
• netstat -tp — observed active TCP connections including SSH session

Lab 266 – Connectivity Troubleshooting (Real Scenario)

Problem: Client has an Apache web server on EC2 but cannot ping it or view the page in a browser.

Troubleshooting Steps:

1. Check port 22 with Telnet → open ✅ (means VPC, Internet Gateway, route table are fine)
2. Check port 80 with Telnet → not open ❌ (identified as the issue)
3. SSH into EC2 → verified Apache service status → found Apache was inactive/dead
4. Start Apache: sudo systemctl start httpd
5. Fix Security Group → navigate: EC2 instance → Security tab → Security Group → Edit Inbound Rules → Add HTTP (port 80, source: Anywhere IPv4 0.0.0.0/0)
6. Verify → paste public IP into browser → Apache test page loads ✅

Root causes:

• Apache server was not running
• Security group had no inbound rule for port 80

💡 Key insight: Port 22 being open confirms the VPC/IGW/route table are correctly configured. If port 22 also failed, you'd need to check those layers first.

9. Additional Notes

Outbound Rules (Security Groups vs. Network ACL)

• Security Groups: Outbound traffic is allowed by default; you rarely need to configure it
• Network ACL (NACL): Controls outbound rules at the subnet level; can explicitly deny outbound traffic
• CIDR 0.0.0.0/0 = all IPs (any source/destination)
• CIDR 0.0.0.0/8 ≠ all IPs — it means first 8 bits fixed at 0 (a specific range)

TTL – Time to Live

• Determines how long a device waits for a response before giving up
• Used in ping and traceroute
• If TTL expires with no response → asterisk * shown in traceroute

10. CLF-C02 Exam Relevance

The following topics from this lecture are directly relevant to the AWS Certified Cloud Practitioner (CLF-C02) exam:

⚠️ Note: The CLF-C02 exam tests conceptual understanding, not deep implementation. You should understand what each protocol/service does and when to use it, rather than memorising binary subnet calculations.

Notes compiled from Cohort 3 Project CloudIgnite lecture, April 27, 2026. Instructor: Forward College.