Appendix C
Numbers to Memorize
Every number below has appeared in CCNA exam questions. Review this page the night before the exam.
Well-known port numbers
| Protocol | Port(s) | Transport |
|---|---|---|
| FTP | 20 (data), 21 (control) | TCP |
| SSH | 22 | TCP |
| Telnet | 23 | TCP |
| SMTP | 25 | TCP |
| DNS | 53 | UDP (queries) and TCP (zone transfers, large replies) |
| DHCP | 67 (server), 68 (client) | UDP |
| TFTP | 69 | UDP |
| HTTP | 80 | TCP |
| POP3 | 110 | TCP |
| NTP | 123 | UDP |
| SNMP | 161 (agent), 162 (traps to manager) | UDP |
| HTTPS | 443 | TCP |
| Syslog | 514 | UDP |
| IMAP | 143 (993 with TLS) | TCP |
| LDAP | 389 (636 with TLS) | TCP |
| RADIUS | 1812 (authentication), 1813 (accounting); legacy 1645/1646 | UDP |
| TACACS+ | 49 | TCP |
| RDP | 3389 | TCP |
| NETCONF | 830 | TCP (over SSH) |
| CAPWAP | 5246 (control), 5247 (data) | UDP |
| DHCPv6 | 546 (client), 547 (server) | UDP |
| SMB | 445 | TCP |
| ISAKMP/IKE | 500 (4500 with NAT-T) | UDP |
| OSPF | IP protocol 89 (no port) | IP |
| EIGRP | IP protocol 88 (no port) | IP |
| ICMP | IP protocol 1 | IP |
| TCP / UDP | IP protocol 6 / 17 | IP |
| ESP / AH | IP protocol 50 / 51 | IP |
Administrative distance
| Route source | AD |
|---|---|
| Connected interface | 0 |
| Static route | 1 |
| EIGRP summary route | 5 |
| External BGP (eBGP) | 20 |
| Internal EIGRP | 90 |
| IGRP | 100 |
| OSPF | 110 |
| IS-IS | 115 |
| RIP | 120 |
| EIGRP external | 170 |
| Internal BGP (iBGP) | 200 |
| Unknown / unreachable | 255 (route not installed) |
Spanning Tree values
| Item | Value |
|---|---|
| Default bridge priority | 32768 (plus VLAN ID as extended system ID) |
| Priority increments | Multiples of 4096 (0 to 61440) |
root primary sets priority |
24576 (or 4096 below the current root if lower) |
root secondary sets priority |
28672 |
| Default port priority | 128 (range 0-240 in steps of 16) |
| Hello timer | 2 seconds |
| Max age | 20 seconds |
| Forward delay | 15 seconds (listening) + 15 seconds (learning) |
| 802.1D convergence | Up to 50 seconds (20 + 15 + 15) |
| Cost: 10 Mbps | 100 |
| Cost: 100 Mbps | 19 |
| Cost: 1 Gbps | 4 |
| Cost: 10 Gbps | 2 |
| Cost: 100 Gbps (long method) | 200 (long method also uses 20,000 for 1 Gbps and 2,000 for 10 Gbps) |
| 802.1D port states | Blocking, Listening, Learning, Forwarding (plus Disabled) |
| 802.1w (RSTP) port states | Discarding, Learning, Forwarding |
| RSTP port roles | Root, Designated, Alternate, Backup |
| STP multicast MAC | 0180.C200.0000 |
| Err-disable recovery default | 300 seconds |
OSPF
| Item | Value |
|---|---|
| Hello / dead (broadcast, point-to-point) | 10 s / 40 s |
| Hello / dead (NBMA, point-to-multipoint) | 30 s / 120 s |
| AllSPFRouters multicast | 224.0.0.5 (IPv6 FF02::5) |
| AllDRouters multicast | 224.0.0.6 (IPv6 FF02::6) |
| IP protocol number | 89 |
| Default reference bandwidth | 100 Mbps (cost = 100 Mbps / interface bandwidth) |
| Cost: FastEthernet and faster (default reference) | 1 |
| Cost: 10 Mbps Ethernet | 10 |
| Cost: T1 (1.544 Mbps) | 64 |
| Default interface priority | 1 (0 = never DR/BDR; 255 = highest) |
| Backbone area | Area 0 |
| Neighbor states (in order) | Down, Init, 2-Way, ExStart, Exchange, Loading, Full |
| Router ID selection | Manual router-id, then highest loopback IP, then highest active physical IP |
| Must match to form adjacency | Area ID, hello/dead timers, subnet/mask, authentication, MTU (for Full), network type, stub flags; router IDs must be unique |
First hop redundancy protocols
| Item | HSRP | VRRP | GLBP |
|---|---|---|---|
| Standard | Cisco proprietary | Open (RFC 5798) | Cisco proprietary |
| Virtual MAC (v1 / v2) | 0000.0C07.ACxx / 0000.0C9F.Fxxx | 0000.5E00.01xx | 0007.B400.xxyy |
| Multicast address | 224.0.0.2 (v1), 224.0.0.102 (v2) | 224.0.0.18 | 224.0.0.102 |
| Transport | UDP 1985 | IP protocol 112 | UDP 3222 |
| Default priority | 100 | 100 | 100 |
| Hello / hold | 3 s / 10 s | 1 s advertisement / about 3 s | 3 s / 10 s |
| Preempt by default | No | Yes | No (for AVG) |
| Group range | 0-255 (v1), 0-4095 (v2) | 1-255 | 0-1023 |
| Roles | Active / Standby | Master / Backup | AVG / AVF (load balancing) |
Syslog severity levels
| Level | Name | Mnemonic word |
|---|---|---|
| 0 | Emergencies | Every |
| 1 | Alerts | Awesome |
| 2 | Critical | Cisco |
| 3 | Errors | Engineer |
| 4 | Warnings | Will |
| 5 | Notifications | Need |
| 6 | Informational | Ice cream |
| 7 | Debugging | Daily |
Link up/down messages are level 3 (LINK-3-UPDOWN) and line protocol changes are level 5 (LINEPROTO-5-UPDOWN). Default console and buffer level is 7 (debugging); default trap level for a syslog server is 6 (informational).
QoS markings
| Item | Value |
|---|---|
| CoS (802.1p) field | 3 bits in the 802.1Q tag; values 0-7 |
| IP Precedence | 3 bits of ToS byte; values 0-7 |
| DSCP field | 6 bits of the ToS/Traffic Class byte; values 0-63 |
| Default (best effort) | DSCP 0 (BE) |
| Expedited Forwarding (voice) | DSCP 46 (EF) |
| Class Selector | CS0 = 0, CS1 = 8, CS2 = 16, CS3 = 24, CS4 = 32, CS5 = 40, CS6 = 48, CS7 = 56 |
| Assured Forwarding | AF11 = 10, AF21 = 18, AF31 = 26, AF41 = 34 (AFxy value = 8x + 2y) |
| Video (interactive) | AF41 (34) commonly; CS4 (32) |
| Call signaling | CS3 (24) |
| Voice bearer requirements | One-way delay <= 150 ms, jitter <= 30 ms, loss <= 1% |
| Voice queue | LLQ (priority queue) for EF traffic |
VLAN ranges
| Range | Meaning |
|---|---|
| 0 and 4095 | Reserved, cannot be used |
| 1 | Default VLAN; all ports belong to it initially; cannot be deleted |
| 2-1001 | Normal-range VLANs (user configurable) |
| 1002-1005 | Reserved for legacy Token Ring and FDDI; cannot be deleted |
| 1006-4094 | Extended-range VLANs (require VTP transparent or VTPv3 on older platforms) |
| 802.1Q tag | 4 bytes inserted in the frame: 2-byte TPID 0x8100 + 3-bit PCP + 1-bit DEI + 12-bit VLAN ID |
| Max frame with tag | 1522 bytes (1518 + 4) |
| Default native VLAN | 1 |
ACL number ranges
| Range | Type |
|---|---|
| 1-99 | Standard IPv4 |
| 100-199 | Extended IPv4 |
| 1300-1999 | Standard IPv4 (expanded range) |
| 2000-2699 | Extended IPv4 (expanded range) |
| Named ACLs | Any name; standard or extended |
| IPv6 ACLs | Always named; implicit permit icmp any any nd-na, permit icmp any any nd-ns, then deny ipv6 any any |
Placement rule: standard ACLs as close to the destination as possible; extended ACLs as close to the source as possible. One ACL per protocol, per direction, per interface.
IPv6 prefixes and addresses
| Prefix / address | Meaning |
|---|---|
| 2000::/3 | Global unicast |
| FC00::/7 | Unique local (FD00::/8 in practice) |
| FE80::/10 | Link-local |
| FF00::/8 | Multicast |
| FF02::1 | All nodes |
| FF02::2 | All routers |
| FF02::5 / FF02::6 | OSPFv3 routers / DRs |
| FF02::A | EIGRP for IPv6 routers |
| FF02::1:2 | All DHCPv6 relay agents and servers |
| FF02::1:FFxx:xxxx | Solicited-node multicast |
| ::1 | Loopback |
| :: | Unspecified |
| ::/0 | Default route |
| 2001:DB8::/32 | Documentation |
| Typical LAN prefix | /64 |
| Typical site allocation | /48 |
| Address / hextet / nibble | 128 bits / 16 bits / 4 bits |
| Minimum IPv6 MTU | 1280 bytes |
| IPv6 header size | 40 bytes (IPv4 is 20 bytes minimum) |
| Neighbor Discovery messages | RS (ICMPv6 133), RA (134), NS (135), NA (136), Redirect (137) |
Wireless numbers
| Item | Value |
|---|---|
| CAPWAP ports | UDP 5246 (control), UDP 5247 (data) |
| 2.4 GHz non-overlapping channels | 1, 6, 11 (channels are 5 MHz apart, 22 MHz wide) |
| 2.4 GHz channels | 1-11 (US), 1-13 (most of the world), 14 (Japan, 802.11b only) |
| 5 GHz channels | 20 MHz wide and non-overlapping; about 24-25 usable in the US (36 through 165) depending on regulatory rules; can bond to 40/80/160 MHz |
| 6 GHz (Wi-Fi 6E) | 59 20 MHz channels in the US (1,200 MHz of spectrum) |
| 802.11 standards | 802.11a (5 GHz, 54 Mbps), b (2.4 GHz, 11 Mbps), g (2.4 GHz, 54 Mbps), n (Wi-Fi 4, both bands, 600 Mbps), ac (Wi-Fi 5, 5 GHz, 6.9 Gbps), ax (Wi-Fi 6/6E, 2.4/5/6 GHz, 9.6 Gbps) |
| WPA2 encryption | AES-CCMP (WPA used TKIP with RC4) |
| WPA3 encryption | AES-GCMP, SAE replaces PSK authentication, PMF required |
| WPA3-Enterprise 192-bit mode | GCMP-256 |
| 802.1X roles | Supplicant (client), Authenticator (AP/switch), Authentication server (RADIUS) |
| PSK length | 8-63 ASCII characters (or 64 hex) |
| WLC dynamic interface | One per WLAN/VLAN mapping; management interface used for CAPWAP |
Other numbers worth memorizing
| Item | Value |
|---|---|
| Ethernet frame | 64 bytes minimum, 1518 bytes maximum (1522 with 802.1Q); 1500-byte default MTU |
| MAC address | 48 bits (6 bytes); first 24 bits are the OUI |
| IPv4 address / IPv6 address | 32 bits / 128 bits |
| TCP header / UDP header | 20 bytes minimum / 8 bytes |
| TCP three-way handshake | SYN, SYN-ACK, ACK |
| TCP window / sequence fields | 16 bits / 32 bits |
| TTL default (Cisco) | 255 |
| DHCP DORA | Discover, Offer, Request, Acknowledge |
| DHCP lease default (IOS server) | 1 day |
| CDP timer / holdtime | 60 s / 180 s |
| LLDP timer / holdtime | 30 s / 120 s |
| MAC address table aging | 300 seconds (5 minutes) |
| ARP cache timeout (IOS) | 4 hours (14400 s) |
| NTP stratum range | 0 (reference clock) to 15 usable; 16 = unsynchronized |
| SNMP versions | v1 and v2c use communities; v3 adds authentication and encryption (noAuthNoPriv, authNoPriv, authPriv) |
| PoE standards | 802.3af (PoE, 15.4 W at PSE, 12.95 W at PD), 802.3at (PoE+, 30 W / 25.5 W), 802.3bt (Type 3: 60 W, Type 4: 90 W) |
| Cable categories | Cat5e 1 Gbps at 100 m; Cat6 10 Gbps at 55 m; Cat6a 10 Gbps at 100 m |
| Fiber | Multimode: 850/1300 nm, LED/VCSEL, hundreds of meters; single-mode: 1310/1550 nm, laser, tens of kilometers |
| EtherChannel | Up to 8 active links (LACP allows 8 more in standby); max 16 in the group |
| Port security violation modes | Protect (drop, no log), Restrict (drop, log, counter), Shutdown (err-disable, default) |
| Configuration register | 0x2102 normal; 0x2142 bypass startup-config (password recovery) |
| Class A / B / C first octets | 1-126 / 128-191 / 192-223 |
| RFC 1918 | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 |
| APIPA | 169.254.0.0/16 |
| Cisco Catalyst Center | Formerly DNA Center; SD-Access uses VXLAN (data), LISP (control), TrustSec/SGT (policy) |
| HTTP status codes | 200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Server Error |