Study guide
Frames, Packets, Segments, and Data Flow
CCST Networking Study Guide Exam
Track your progress as you read
Finished sections get a check mark.
1 Orientation, Official Sources, and Exam Strategy
Official Exam Profile and Source Hierarchy Registration, Delivery, Attempts, and Results Using the Six Official Topic Areas Building a Practical Study Plan Exam Strategy Without Unsupported Shortcuts Ethical Preparation and Path Forward
2 Network Standards, Models, and Common Protocols
Network Building Blocks OSI and TCP/IP Models Frames, Packets, Segments, and Data Flow Network Types and Scope Cloud, On-Premises, Protocols, and Ports Bandwidth, Throughput, Latency, and Jitter
3 Chapter 3: IPv4, IPv6 Addressing, and Subnet Formats
3.1 Public, Private, and Local Addressing 3.2 IPv4 Dotted Decimal and Binary Basics 3.3 Subnet Masks, CIDR, and Prefix Lengths 3.4 Subnet Logic, Host Ranges, and Gateways 3.5 IPv6 Address and Prefix Formats 3.6 MAC vs IP in Addressing Troubleshooting
4 Endpoints, Media, Cabling, and Client Connectivity
Endpoint Devices and Network Roles Network Interface Cards and Link Status Copper, Fiber, Coax, and Connector Basics Wired, Wi-Fi, and Cellular Access Methods Interference, Signal Quality, and Physical Reliability Client Connectivity Checks by Operating System
5 Infrastructure Devices, Ports, and Physical Installation
Infrastructure Device Roles Ports, Connectors, and Device Identification Cisco Device LEDs and Status Checks Network Diagrams and Cabling Instructions Power over Ethernet and Powered Devices Racks, Patch Panels, and Installation Basics
6 Switching, Routing, and Network Services
Basic Switching and MAC Learning VLANs and Local Boundaries Routing, Default Gateway, and ARP DNS, DHCP, and NAT Services Transport-Layer Services Small Network Traffic Flow
7 Troubleshooting Methodology, Ticketing, and Documentation
Help Desk Intake and Information Gathering Scope, Impact, and Prioritization Reproduce, Isolate, and Escalate Ticket Quality and Operational Documentation User Communication and Change History Physical, Data Link, and Network Layer Triage
8 Diagnostic Commands, Packet Capture, and Device Data
Command-Line Triage and Ping Path and Client Configuration Commands DNS and Socket Diagnostics Wireshark Capture and Save Device Access and Data Collection Basic Cisco Show Commands
9 Security, Firewalls, Wireless, and Safe Defaults
Firewall Filtering and Traffic Policy Least Privilege, AAA, Passwords, and MFA Wireless Security, WPA2, WPA3, and WPAx Guest Networks, Segmentation, and Shared Devices Common Threats and Safe User Practices Secure Home Router Baseline
10 Integrated Small Network Build and Repair Labs
Lab 1: Build a Basic Office LAN Lab 2: Repair No Internet After an Office Move Lab 3: Wireless Clients Cannot Reach Local Resources Lab 4: DHCP, DNS, and Default Gateway Symptoms Lab 5: Switch, Router, and Service Boundaries Lab 6: Escalation, Documentation, and Handoff
11 CCST to CCNA Career Path and Operational Readiness
Entry-Level Networking Roles and Expectations CCST vs CCNA and the Cisco Roadmap NetAcad 70-Hour Path and Study Plan Lab Habits for Real Operational Readiness Ethical Preparation, Portfolio, and Logbook Exam Scheduling Calendar and Readiness Check
12 Final Review, Exam Day, and Remediation Plan
Final Review Map to Official Objectives 50-Minute Exam Day Timing Unsupported Facts and Ethical Preparation Retake Planning Before the First Attempt Post-Fail Remediation Workflow Post-Pass Next Steps and Validity
Frames, Packets, Segments, and Data Flow
Key Takeaways Explain This Topic AI
A segment is the transport-layer PDU for TCP; UDP's PDU is usually called a datagram.
An IP packet carries source and destination IP addresses end to end so routers can forward it.
A data link frame carries local source/destination MAC addresses and is rebuilt at every routed hop.
Knowing which PDU you are looking at tells you whether a problem is local switching, routing, transport, or application.
Last updated: June 2026
Names for Data at Different Layers
When people say a network "sends data," they compress several steps into one phrase. Each layer packages data differently, and switches, routers, firewalls, operating systems, and analyzers all make decisions on different headers. The CCST exam expects you to use the precise term for each protocol data unit (PDU) .
- Layer PDU name Key addressing it adds Device that acts on it
- Transport (4) Segment (TCP) / Datagram (UDP) Source + destination port Host OS
- Network (3) Packet Source + destination IP Router
- Data Link (2) Frame Source + destination MAC Switch
- Physical (1) Bits none (signals) Cable, AP, modem
- Transport, Network, and Data Link in Detail
At the transport layer , TCP or UDP identifies which application conversation owns the data using port numbers . TCP adds reliability: a three-way handshake (SYN, SYN-ACK, ACK), sequencing, acknowledgments, retransmission, and flow control; its PDU is a segment . UDP skips the handshake and reliability, so its PDU is a datagram . DNS, Voice over IP (VoIP), live video, and many games use UDP because timeliness beats retransmitting every lost piece.
At the network layer , IP wraps the segment into a packet carrying source and destination IP addresses. Routers read the destination IP, compare it to the routing table, and forward toward the next hop. The IP addresses normally stay constant from original sender to final receiver, except where Network Address Translation (NAT) intentionally rewrites them at a boundary.
At the data link layer , Ethernet or Wi-Fi wraps the packet into a frame with source and destination MAC addresses for the local link only. This is the most-tested concept in the section: MAC addresses are local-hop information . When a laptop sends to a server on another network, it builds a frame addressed to the MAC of its default gateway , not the remote server's MAC. The router strips that frame, makes a routing decision on the IP packet, then builds a brand-new frame for the next link. The packet travels end to end; the frame is rebuilt hop by hop.
At the physical layer , the frame becomes bits sent as electrical signals on copper, light on fiber, or radio in the air. Link light, negotiated speed, duplex, signal level, and physical errors live here.
A Worked Web Example
Follow one HTTPS request to tie the terms together:
DNS resolves the site name to an IP address.
The client opens a TCP connection to destination port 443 on the server.
Application data rides inside TCP segments .
IP packets carry those segments toward the server.
Ethernet or Wi-Fi frames carry each packet across each local link, rebuilt at every router.
The physical layer transmits the bits .
Along that path, a switch attends mainly to frame (MAC) information, a router to packet (IP) information, and the host OS to transport ports so it delivers data to the right process.
Reading Captures Without Drowning
Tools such as Wireshark display all layers for one captured frame at once: Ethernet, IP, TCP, and the HTTPS-related fields stacked together. For CCST-level work you do not decode every byte. You should be able to tell whether you are looking at local MAC addressing, IP addressing, TCP/UDP ports, or application behavior . Common trap: confusing a local switching issue (frames not forwarding on one segment) with a routed-path or application issue. Identifying the PDU layer first keeps escalations accurate and lets you save the right capture for the next tier.
How Addresses Behave Across the Path
The single most testable idea in this section is which addresses change and which stay constant as data crosses a routed network. Put the two layers side by side: the IP packet's source and destination addresses stay the same end to end (barring NAT at a boundary), while the frame's source and destination MAC addresses change at every router hop .
A laptop sending to a remote server keeps the server's IP as the destination the whole way but addresses each frame only to the next device on its own segment, first to the default gateway's MAC, then the router re-addresses the frame to the next router, and so on until the final router addresses the last frame to the server's MAC.
Walk a concrete three-segment path to lock this in:
Laptop to Router A: destination IP = server, destination MAC = Router A's gateway interface.
Router A to Router B: same destination IP = server, destination MAC = Router B's incoming interface; Router A built a brand-new frame.
Router B to server: same destination IP = server, destination MAC = the server's NIC; Router B built another new frame.
The Address Resolution Protocol (ARP) is what lets a device learn the MAC that goes with the next-hop IP on its local segment, which is why ARP problems show up as "I have an IP and a gateway but still cannot reach anything." Ports add a third constant: the destination port (for example 443 for HTTPS) identifies the service and normally stays fixed, while the client's source port is a high random number the OS uses to track the reply.
When you read a capture, ask three quick questions in order: Are the MAC addresses local-segment values or do they point at a gateway? Do the IP addresses match the true source and destination I expect? Do the ports match the service? Answering those tells you immediately whether a fault is local switching, routing, or application, and that triage is precisely what CCST capture-interpretation items reward.