Network applications, functions and services

Why this matters

The previous lesson covered appliances — boxes that forward or filter. This one covers the rest of objective 1.2: the wireless infrastructure, and a set of functions that are not boxes at all. A VPN is not a device. QoS is not a device. TTL is a field in a header.

That distinction is the point. CompTIA groups them here because each is something a network provides, regardless of what hardware provides it, and exam questions phrase them as capabilities rather than products.

The lesson

Access points and controllers

An access point (AP) bridges between wireless clients and the wired network. It is a layer 2 device: it takes 802.11 frames from the air and puts Ethernet frames on the wire. An AP is not a router, and calling the box your ISP supplied "the router" hides the fact that it is a router, a switch and an AP in one case.

APs come in two management styles, and the distinction is examined.

An autonomous (or "fat") AP holds its own complete configuration — SSIDs, security, channel, power. Fine for one or two. At thirty, every change means thirty logins, and nothing coordinates channel selection between neighbours.

A lightweight (or "thin") AP holds almost no configuration and is managed by a wireless LAN controller (WLC). The controller pushes configuration, assigns channels and power levels centrally so APs do not interfere with each other, and coordinates roaming so a client moving across a building stays associated without re-authenticating from scratch. It also gives you one place to see every client and every AP.

The exam cue is scale: a handful of APs, autonomous is fine; a campus, you want a controller. Controllers may be a hardware appliance, a VM, or cloud-hosted.

Content delivery network (CDN)

A CDN is a geographically distributed set of caching servers that hold copies of content close to users. A request for a large file or a video is served from a nearby edge node rather than the origin server, possibly thousands of kilometres away.

Three benefits, and the exam usually asks for the first:

• Lower latency, because the round trip is shorter. This is the primary answer.
• Less load on the origin, because most requests never reach it.
• Resilience, including absorbing traffic spikes and some denial-of-service volume, because the edge fleet is large.

If a scenario says users in another region complain a site is slow while local users are fine, and the content is static, a CDN is the intended answer.

Virtual private network (VPN)

A VPN creates an encrypted tunnel across an untrusted network — usually the internet — so traffic inside it is private and looks as though it originated on the far network.

Two deployment shapes:

Remote access VPN connects a single user's device back to the corporate network. The user runs a client; the far end is a VPN concentrator or firewall.

Site-to-site VPN connects two networks permanently, typically firewall to firewall, so that users at either end reach the other without running anything themselves.

One more distinction worth having, because it is a common question:

Full tunnel sends all of the client's traffic through the VPN, including its internet browsing. More secure and more inspectable, at the cost of backhauling traffic that did not need to go there.

Split tunnel sends only corporate-bound traffic through the tunnel and lets everything else go direct. Faster and cheaper on bandwidth, but the device is simultaneously on the corporate network and the open internet, which is exactly the exposure security teams dislike.

Quality of service (QoS)

QoS is a set of mechanisms for treating some traffic better than other traffic when there is not enough bandwidth for all of it.

It matters because applications fail differently. A file download that takes a few seconds longer is fine. A voice call with 200 ms of jitter is unusable. QoS lets you protect the traffic that cannot absorb delay.

The mechanisms, in the order they usually appear:

• Classification and marking. Identify traffic and tag it — DSCP in the IP header at layer 3, CoS in the 802.1Q tag at layer 2. Marking should happen as close to the source as possible.
• Queuing. Give each class its own queue and service them by policy, so voice is not stuck behind a backup job.
• Policing and shaping. Both limit a class to a rate. Policing drops what exceeds it; shaping buffers and releases it more slowly. Shaping is gentler on TCP and adds delay; policing is harsher and does not.

The exam framing is nearly always voice or video quality on a congested link.

QoS only helps at a congestion point, and only on links you control. On an uncongested link it changes nothing, and across the public internet your markings are typically ignored or rewritten. A question offering "enable QoS" for a problem on the internet side is usually the wrong answer.

Time to live (TTL)

TTL is an eight-bit field in the IPv4 header, set by the sender and decremented by one at every router. When it reaches zero the packet is discarded and the router sends back an ICMP Time Exceeded message.

It exists to stop packets circulating forever when a routing loop forms. Without it a loop would fill a link with the same packets until the link died.

Two things follow, and both are examined:

Traceroute is built on it. Send a packet with TTL 1 and the first router replies with Time Exceeded, revealing itself. Send TTL 2 and the second router replies. Increment until the destination answers, and you have the path.

TTL hints at the operating system. Common initial values are 64 (Linux, macOS), 128 (Windows) and 255 (many network devices). A ping reply with TTL 122 suggests a Windows host six hops away.

IPv6 renamed the same field hop limit, which is a more honest name — it has always counted hops, never seconds.