Field notes
Blog
Articles on networking, security and the internet.
CIDR and subnet mask: How to read /24, /26 and /28?
Calculate the network limit before scanning a range of addresses. CIDR notation is used to identify addresses within the same subnet and reduce unnecessary scanning.
Results: 54
Private IP ranges: addresses 10, 172 and 192.168
Separating local addresses from public internet addresses is the first step when preparing inventory and investigating routing problems. Not every address starting with 172 is private.
DHCP lease duration and changing device addresses
It is not always a malfunction that a device found yesterday uses a different IP today. Understanding the DHCP lease mechanism prevents confusion between device ID and address.
169.254 mean? Troubleshoot DHCP issue step by step
If the computer receives an IPv4 address starting with 169.254, this may indicate that it is not receiving the expected DHCP configuration. Examine the link layer first, then address distribution.
How to verify IP conflict?
Intermittent access and changing MAC records for the same IP may suggest address conflict. Check the recording times and the design of the network before jumping to a permanent conclusion.
What happens if the default gateway is incorrect?
If the internet does not turn on while the local printer is working, it may be related to the gateway problem. You can narrow down the cause by separately testing local communication and traffic sent to other networks.
Reading ARP table with device inventory
The ARP table provides useful clues about IPv4 neighbors; however, it is not a complete list of all devices on the network. Separate cache logging and current availability.
IPv6 addresses: link-local, global and loopback
It is normal to see more than one IPv6 address on an adapter. Knowing the scope of the address helps you understand which target can be reached through which interface.
Why doesn't IPv6 neighbor discovery use ARP?
Porting discovery assumptions that worked for IPv4 to the IPv6 network produces incomplete results. Neighbor discovery and the size of the address space require a different approach.
How to understand CGNAT? Difference between WAN address and visible IP
If the WAN address on the router and the public IP the website points to are different, there may be some address translation involved. This comparison is an important clue for port forwarding problems.
A, AAAA, CNAME and MX: Separate DNS records
DNS is not just about translating the domain name into an IP address. Querying different record types separately avoids confusing web and email issues.
DNS TTL: why is the change not visible immediately?
After changing the DNS record, not everyone may see the same result at the same time. TTL and cache layers are essential parts of planning migration.
NXDOMAIN, SERVFAIL and timeout are not the same thing
Recording the exact type of DNS error changes the resolution. Not being able to find a name, not being able to answer the server, and not getting a response at all are different situations.