OSI Model and IPv4 Subnetting Cheat Sheet for Network+ and Security+
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
The OSI model, TCP versus UDP and IPv4 subnetting underpin a large share of Network+ questions and many networking scenarios on Security+. This cheat sheet gives the seven layers with their data units and devices, a TCP and UDP comparison, a CIDR table with masks and host counts, the private and special address ranges, and a worked subnetting example. The address ranges follow RFC 1918 and RFC 3927. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
How to Use This Cheat Sheet
Network+ and the networking-heavy parts of Security+ lean on the OSI model, TCP versus UDP and IPv4 subnetting. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
The OSI Model
A common mnemonic from layer 7 down to 1 is All People Seem To Need Data Processing, and from layer 1 up it is Please Do Not Throw Sausage Pizza Away.
| Layer | Name | PDU | Examples | Devices and notes |
|---|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, SSH, FTP | What the user's software talks to |
| 6 | Presentation | Data | Encoding, compression and encryption (TLS is often placed here, though it does not map cleanly to one OSI layer) | Translates and formats data |
| 5 | Session | Data | Session setup and teardown, RPC | Manages conversations between applications |
| 4 | Transport | Segment (TCP) or datagram (UDP) | TCP, UDP, ports | End-to-end delivery, port numbers, stateful firewalls |
| 3 | Network | Packet | IP, ICMP, routing | Routers, layer 3 switches, IP addresses |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, MAC addresses, VLANs | Switches, bridges, access points |
| 1 | Physical | Bits | Copper, fiber, radio signals | Cables, hubs, repeaters, network interface hardware |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
TCP Versus UDP
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented, three-way handshake (SYN, SYN-ACK, ACK) | Connectionless |
| Reliability | Acknowledgments, retransmission and ordering | None built in |
| Speed and overhead | Slower, more overhead | Faster, less overhead |
| Typical uses | Web, email, file transfer, remote shell | DNS queries, DHCP, streaming, VoIP, NTP |
IPv4 Subnetting Quick Reference
To find the number of hosts, use 2 to the power of the host bits minus 2. A /26 leaves 6 host bits, so 2 to the 6th is 64 addresses and 62 usable hosts, because the first address is the network and the last is the broadcast.
| CIDR | Subnet mask | Total addresses | Usable hosts | Block size (last octet) |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Not applicable |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Not applicable |
| /24 | 255.255.255.0 | 256 | 254 | 256 |
| /25 | 255.255.255.128 | 128 | 126 | 128 |
| /26 | 255.255.255.192 | 64 | 62 | 64 |
| /27 | 255.255.255.224 | 32 | 30 | 32 |
| /28 | 255.255.255.240 | 16 | 14 | 16 |
| /29 | 255.255.255.248 | 8 | 6 | 8 |
| /30 | 255.255.255.252 | 4 | 2 | 4 |
A /31 is used for point-to-point links where both addresses are usable, and a /32 identifies a single host.
Worked Example
Question: what is the network, broadcast address and usable range for 192.168.10.77/26?
Block size
A /26 has a block size of 64 in the last octet, so the blocks start at 0, 64, 128 and 192.
Network address
77 falls in the 64 to 127 block, so the network address is 192.168.10.64.
Broadcast address
The last address in the block is 192.168.10.127.
Usable hosts
192.168.10.65 through 192.168.10.126, which is 62 hosts.
Special IPv4 and IPv6 Ranges
| Range | Meaning |
|---|---|
| 10.0.0.0/8 | Private (RFC 1918) |
| 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) | Private (RFC 1918) |
| 192.168.0.0/16 | Private (RFC 1918) |
| 169.254.0.0/16 | Link-local, also called APIPA, assigned when DHCP fails (RFC 3927) |
| 127.0.0.0/8 | Loopback, for example 127.0.0.1 |
| 224.0.0.0/4 | Multicast |
IPv6 uses 128-bit addresses written in hexadecimal.
| IPv6 prefix | Meaning |
|---|---|
| ::1 | Loopback |
| fe80::/10 | Link-local |
| fc00::/7 | Unique local (private-style) addresses |
| 2000::/3 | Global unicast |
| ff00::/8 | Multicast |
Address Classes
Classful addressing is largely historical but still appears in questions: Class A starts at 1 to 126, Class B at 128 to 191, Class C at 192 to 223, Class D (multicast) at 224 to 239, and 127 is reserved for loopback.
Where This Fits in Your Study
These topics map to Network+ objectives 1.1, 1.4 and 1.7. See our Network+ objectives explained for the full list, and our guide to which CompTIA certification to take first if you are deciding between Network+ and Security+. DD Academy covers both exams with flashcards and practice questions, free to start on iPhone and the web.
The bottom line
Learn the layers and what lives at each, remember the hosts formula and the block-size method, and practice subnetting until it is automatic. A few worked examples a day for a week will make most subnet questions routine.
Frequently asked questions
What are the seven layers of the OSI model?
From top to bottom: Application, Presentation, Session, Transport, Network, Data Link and Physical. They are often numbered 7 down to 1. Each layer has its own protocols, data units and devices.
At which OSI layer do routers and switches operate?
Routers operate at layer 3, the Network layer, using IP addresses. Standard switches operate at layer 2, the Data Link layer, using MAC addresses, while layer 3 switches also route.
How do I calculate usable hosts in a subnet?
Use 2 to the power of the host bits minus 2. The two addresses removed are the network address and the broadcast address. For example, a /26 has 6 host bits, so 64 minus 2 gives 62 usable hosts.
What are the private IPv4 ranges?
RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16. Addresses in these ranges are not routed on the public internet.
What is an APIPA address?
An address in 169.254.0.0/16 that a host assigns itself when it cannot get one from DHCP. It is defined in RFC 3927 as the IPv4 link-local range and allows only local communication.
What is the difference between TCP and UDP?
TCP is connection-oriented and reliable, using a three-way handshake, acknowledgments and retransmission. UDP is connectionless and faster with less overhead, and is used for DNS queries, streaming and similar traffic.
What is the PDU at each layer?
Layer 1 uses bits, layer 2 frames, layer 3 packets, and layer 4 segments for TCP or datagrams for UDP. Layers 5 through 7 are generally called data.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
