Why Networking Terminology Matters

Enterprise IT networks run on a dense vocabulary of acronyms and protocol names, and getting them right is not academic pedantry — a network engineer who conflates a VLAN with a subnet, or confuses OSPF areas with BGP autonomous systems, will design broadcast domains and routing policies that do not do what was intended. Vendor documentation, IEEE and IETF standards, and certification exams (CCNA, CCNP, Network+) all assume a working command of this vocabulary, and job postings, RFPs, and design reviews are written in it.

This glossary covers 55 of the most important terms spanning switching, routing, WAN architecture, security, and network operations, organized alphabetically with the standards body or RFC where each term is formally defined. It is written for practicing engineers, IT students, and anyone preparing for a networking certification.

A

ACL (Access Control List) — Cisco IOS / RFC concept
An ordered list of permit/deny rules applied to an interface that filters traffic based on source/destination IP address, port number, or protocol. Standard ACLs filter on source address only; extended ACLs filter on source, destination, protocol, and port. ACLs are processed top-down with an implicit deny at the end, so rule order matters.
ARP (Address Resolution Protocol) — RFC 826
The protocol that maps a known IPv4 address to the corresponding MAC address on a local network segment. A host broadcasts an ARP request ("who has this IP?") and the owner replies unicast with its MAC address, which is then cached in the local ARP table. ARP operates only within a broadcast domain — it does not cross routers.
AS (Autonomous System) — RFC 1930
A collection of IP networks under the administrative control of a single organization that presents a common routing policy to the internet, identified by a unique AS number (ASN). BGP is the protocol used to exchange routes between autonomous systems; each ISP, large enterprise, and cloud provider typically operates its own AS.
Aggregation Layer — data center design term
The middle tier in a traditional three-tier data center network architecture (access-aggregation-core), where access-layer switches uplink and where Layer 2/Layer 3 boundary functions, spanning tree, and policy enforcement commonly occur. In modern leaf-spine fabrics this tier is largely eliminated in favor of a flatter two-tier design.

B

BGP (Border Gateway Protocol) — RFC 4271
The path-vector routing protocol that exchanges routing information between autonomous systems and forms the backbone of internet routing. BGP selects routes based on attributes like AS-path length, local preference, and MED rather than a simple metric, and it is also used internally in large enterprise and data center networks (iBGP, or BGP as an underlay/overlay protocol in EVPN fabrics).
Broadcast Domain — Ethernet/IEEE 802.3 concept
The set of devices that receive a broadcast frame (destination MAC FF:FF:FF:FF:FF:FF) sent by any member of the set. A Layer 2 switch forwards broadcasts to every port in the same VLAN; a router does not forward broadcasts between VLANs/subnets. VLANs exist largely to keep broadcast domains small and contain broadcast traffic.
BPDU (Bridge Protocol Data Unit) — IEEE 802.1D
The control frame exchanged between switches running Spanning Tree Protocol to elect a root bridge and calculate the loop-free topology. BPDU Guard is a common access-port protection feature that disables a port if it unexpectedly receives a BPDU, preventing an unauthorized switch from participating in the spanning tree.

C

CIDR (Classless Inter-Domain Routing) — RFC 4632
The addressing scheme that replaced rigid class A/B/C network boundaries with variable-length subnet masks expressed in slash notation (e.g., 10.0.0.0/22). CIDR allows route summarization (aggregating multiple smaller networks into one advertised prefix) and efficient allocation of address space in blocks matched to actual need.
Convergence — routing/switching term
The time it takes a network to reach a stable, loop-free forwarding state after a topology change (a link failure, a new route, a switch reboot). Fast convergence is a key design goal — Spanning Tree Protocol's legacy 30-50 second convergence prompted the development of Rapid STP (802.1w) and, in modern fabrics, protocols with sub-second convergence.
Core Layer — data center/campus design term
The high-speed backbone tier of a network whose sole job is fast, reliable packet switching between aggregation or distribution blocks — it should not perform packet manipulation, filtering, or policy enforcement, which belongs at the edge. Core switches are chosen primarily for throughput, low latency, and redundancy.

D

DHCP (Dynamic Host Configuration Protocol) — RFC 2131
The protocol that automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to hosts joining a network, using the DORA process (Discover, Offer, Request, Acknowledge). DHCP relay (RFC 1542, ip helper-address on Cisco gear) forwards DHCP broadcasts across router boundaries to a centralized server.
DNS (Domain Name System) — RFC 1035
The distributed, hierarchical naming system that resolves human-readable hostnames to IP addresses. Enterprise networks typically run internal DNS servers for private namespace resolution and forward external queries to public resolvers, with DNS being a frequent target for both misconfiguration outages and security attacks (DNS tunneling, cache poisoning).
Default Gateway — IP routing concept
The router interface a host sends traffic to when the destination is outside its own subnet. Misconfigured default gateways are among the most common causes of "can reach local devices but not the internet" trouble tickets.

E

EIGRP (Enhanced Interior Gateway Routing Protocol) — RFC 7868
A Cisco-originated (later opened as an IETF informational RFC) advanced distance-vector routing protocol that uses the DUAL algorithm for fast, loop-free convergence and composite metrics based on bandwidth and delay. Common in Cisco-centric enterprise networks as an alternative to OSPF.
EtherChannel / Link Aggregation — IEEE 802.3ad / 802.1AX
The bundling of multiple physical Ethernet links into a single logical link for increased bandwidth and redundancy. LACP (Link Aggregation Control Protocol) is the standards-based negotiation protocol; PAgP is the older Cisco-proprietary equivalent. A properly configured bundle load-balances traffic across member links using a hash of source/destination address or port.
Edge Router — WAN architecture term
The router at the boundary of an enterprise network that connects to an ISP, MPLS carrier, or the public internet, typically running BGP with the provider and enforcing perimeter routing policy.

F

Firewall (Next-Generation Firewall, NGFW) — industry term
A security device or function that enforces policy on traffic crossing a network boundary. A traditional stateful firewall filters on IP/port/protocol and connection state; a next-generation firewall adds deep packet inspection, application awareness, intrusion prevention, and identity-based policy in a single platform.
FHRP (First Hop Redundancy Protocol) — generic term (HSRP, VRRP, GLBP)
A protocol family that provides a redundant, highly available default gateway to hosts by presenting a virtual IP address shared across two or more routers. HSRP (Cisco, RFC 2281) and VRRP (open standard, RFC 5798) are the most common implementations; if the active/master router fails, a standby takes over the virtual IP transparently to end hosts.

G

GRE (Generic Routing Encapsulation) — RFC 2784
A tunneling protocol that encapsulates a wide variety of network layer protocols inside point-to-point virtual links over an IP network. GRE itself provides no encryption, so it is frequently paired with IPsec to build secure site-to-site tunnels.

H

HSRP (Hot Standby Router Protocol) — RFC 2281 (Cisco)
See FHRP above. Cisco's proprietary first-hop redundancy protocol where routers in a group elect an active and standby router sharing a virtual IP and virtual MAC address for the default gateway.

I

IPsec (Internet Protocol Security) — RFC 4301
A suite of protocols that authenticates and encrypts IP packets, used to build secure VPN tunnels between sites or between a client and a network. IPsec operates in transport mode (payload only) or tunnel mode (entire original packet encapsulated), and uses IKE (Internet Key Exchange) to negotiate security associations.
IPv6 — RFC 8200
The 128-bit successor to IPv4's 32-bit address space, providing effectively unlimited address availability and built-in features like stateless address autoconfiguration (SLAAC) and simplified header processing. Enterprise adoption has been gradual, often via dual-stack deployment running IPv4 and IPv6 concurrently during transition.
IS-IS (Intermediate System to Intermediate System) — ISO/IEC 10589
A link-state interior gateway protocol similar in concept to OSPF but originally designed for the OSI protocol stack and now widely used for IP routing in large service-provider and data-center backbones because of its protocol-agnostic extensibility.

J

Jitter — network performance metric
The variation in packet arrival delay over time. Real-time traffic like VoIP and video conferencing is highly sensitive to jitter — even with acceptable average latency, high jitter causes choppy audio and requires a jitter buffer to smooth playback, at the cost of added delay.
Jumbo Frame — Ethernet term
An Ethernet frame larger than the standard 1500-byte MTU, commonly 9000 bytes, used in storage and data center networks (iSCSI, NFS, vMotion traffic) to reduce per-packet overhead and CPU interrupts for large sequential transfers. All devices in the path must support the same jumbo MTU or fragmentation/black-holing occurs.

L

LACP (Link Aggregation Control Protocol) — IEEE 802.1AX (formerly 802.3ad)
The standards-based protocol that negotiates and maintains a link aggregation group (LAG/EtherChannel) between two devices, detecting misconfiguration and automatically adjusting the bundle if a member link fails.
Latency — network performance metric
The time it takes a packet to travel from source to destination, typically measured round-trip in milliseconds. Latency is bounded by physical distance (propagation delay through fiber, roughly 5 microseconds per kilometer), queuing delay at congested devices, and processing delay — no amount of bandwidth upgrade reduces the propagation component.
Leaf-Spine Architecture — data center design term
A two-tier data center fabric where every leaf switch connects to every spine switch, providing consistent low-latency, non-blocking bandwidth between any two servers regardless of which leaf they attach to. This design has largely replaced the traditional three-tier access-aggregation-core model for east-west traffic-heavy data centers.
LLDP (Link Layer Discovery Protocol) — IEEE 802.1AB
A vendor-neutral protocol that lets network devices advertise their identity and capabilities to directly connected neighbors, used for network discovery, topology mapping, and troubleshooting. CDP is Cisco's older proprietary equivalent.

M

MAC Address (Media Access Control Address) — IEEE 802
The 48-bit hardware address burned into (or virtually assigned to) a network interface, used for Layer 2 forwarding within a broadcast domain. The first 24 bits identify the manufacturer (the OUI, Organizationally Unique Identifier); the remaining 24 bits are device-specific.
MPLS (Multiprotocol Label Switching) — RFC 3031
A WAN forwarding technique that attaches short labels to packets so routers can switch traffic based on the label rather than performing a full routing table lookup at every hop, enabling traffic engineering and QoS differentiation. MPLS VPNs (Layer 3 VPN via RFC 4364) are a common enterprise WAN transport, though SD-WAN has displaced much of this use case.
MTU (Maximum Transmission Unit) — link-layer parameter
The largest packet size, in bytes, that a given link can forward without fragmentation. Standard Ethernet MTU is 1500 bytes; mismatched MTU across a path is a classic cause of intermittent, size-dependent connectivity failures ("black hole" issues) especially with tunneling protocols that add encapsulation overhead.

N

NAT (Network Address Translation) — RFC 3022
The technique of rewriting source and/or destination IP addresses as traffic crosses a router, most commonly used to allow many private (RFC 1918) addresses to share one or a few public IP addresses. PAT (Port Address Translation, or NAT overload) additionally rewrites port numbers so many internal hosts can share a single public address simultaneously.
NTP (Network Time Protocol) — RFC 5905
The protocol that synchronizes device clocks across a network to a common reference time, typically accurate to within milliseconds. Accurate, synchronized time is a prerequisite for correlating logs across devices during troubleshooting and incident response, and for certificate validation.

O

OSPF (Open Shortest Path First) — RFC 2328 (v2, IPv4) / RFC 5340 (v3, IPv6)
A link-state interior gateway protocol that builds a complete topology map of the network via Dijkstra's shortest-path-first algorithm and organizes large networks into areas connected through a backbone (Area 0) to bound the size of the link-state database and limit the scope of recalculation after a change.
OUI (Organizationally Unique Identifier) — IEEE registry
The first three bytes of a MAC address, assigned by the IEEE to a specific manufacturer, allowing tools to identify device vendor from a MAC address alone — useful in network inventory and rogue-device detection.

P

PoE (Power over Ethernet) — IEEE 802.3af/at/bt
The delivery of DC power to a device over the same twisted-pair Ethernet cable that carries data, eliminating the need for a separate power supply at devices like IP phones, wireless access points, and IP cameras. 802.3af (PoE) supplies up to 15.4W, 802.3at (PoE+) up to 30W, and 802.3bt (PoE++/UPOE) up to 90-100W at the source.
Port Security — switch security feature
A Layer 2 access-port feature that restricts the number and/or identity of MAC addresses allowed on a port, taking a configured action (protect, restrict, or shutdown) when a violation occurs — a common defense against unauthorized devices and MAC flooding attacks.
Private VLAN (PVLAN) — switching feature
A mechanism that subdivides a single VLAN into isolated sub-domains (community and isolated ports) that cannot communicate with each other at Layer 2 even though they share the same subnet, commonly used in multi-tenant or shared-services environments to prevent lateral movement.

Q

QoS (Quality of Service) — IEEE 802.1p / DiffServ RFC 2474
The set of techniques (classification, marking, queuing, policing, shaping) that prioritize latency- and jitter-sensitive traffic (voice, video) over less time-sensitive traffic (bulk file transfer) when a link is congested. DSCP (Differentiated Services Code Point) markings in the IP header carry the priority classification end-to-end.

R

RADIUS (Remote Authentication Dial-In User Service) — RFC 2865
An AAA (Authentication, Authorization, Accounting) protocol widely used for centralized authentication of network access — VPN logins, 802.1X wired/wireless port authentication, and administrative device login. TACACS+ is a similar Cisco-favored alternative, most often used for device administration rather than network access.
RIP (Routing Information Protocol) — RFC 2453
An early distance-vector routing protocol that uses hop count (maximum 15) as its metric. Largely obsolete in modern enterprise networks due to slow convergence and the hop-count limitation, but still seen in legacy or very small networks.
RSTP (Rapid Spanning Tree Protocol) — IEEE 802.1w
An evolution of the original 802.1D Spanning Tree Protocol that reduces convergence time from 30-50 seconds to a few seconds by introducing new port roles (alternate, backup) and a proposal/agreement handshake between switches.

S

SD-WAN (Software-Defined Wide Area Network) — industry term
An architecture that abstracts WAN connectivity across multiple transport types (MPLS, broadband internet, LTE/5G) under centralized, policy-driven control, dynamically steering application traffic over the best available path based on real-time performance measurements rather than static routing.
SNMP (Simple Network Management Protocol) — RFC 3411-3418 (SNMPv3)
The standard protocol for monitoring and managing network devices — polling device statistics (SNMP GET) and receiving unsolicited alerts (SNMP traps). SNMPv3 added authentication and encryption that earlier versions (v1/v2c, which send community strings in cleartext) lacked, and v3 should be preferred in any modern deployment.
SSID (Service Set Identifier) — IEEE 802.11
The human-readable name of a wireless network that clients see when scanning for available networks. A single access point can broadcast multiple SSIDs, each mapped to a different VLAN, to segment traffic (e.g., corporate, guest, IoT) over shared radio hardware.
STP (Spanning Tree Protocol) — IEEE 802.1D
The protocol that prevents Layer 2 loops in a switched network with redundant physical paths by electing a root bridge and placing all but one loop-free path per segment into a blocking state, while keeping the redundant links available as a fast failover if the active path fails.
Subnet Mask — IP addressing concept
A 32-bit value that divides an IP address into a network portion and a host portion, determining how many hosts a given subnet can contain and which addresses belong to the local network versus need to be routed. Expressed either in dotted-decimal (255.255.255.0) or CIDR prefix-length (/24) notation.

T

TCP (Transmission Control Protocol) — RFC 793 (updated by RFC 9293)
The connection-oriented, reliable transport protocol that establishes a session via a three-way handshake (SYN, SYN-ACK, ACK), guarantees in-order delivery, and retransmits lost segments. Used for applications where reliability matters more than raw speed — HTTP, file transfer, database connections.
Trunk Port — IEEE 802.1Q
A switch port configured to carry traffic for multiple VLANs simultaneously between switches (or a switch and a router/hypervisor), tagging each frame with a VLAN ID in the 802.1Q header so the receiving device knows which VLAN the frame belongs to. Contrasted with an access port, which carries traffic for exactly one VLAN and does not add tags.

U

UDP (User Datagram Protocol) — RFC 768
The connectionless, best-effort transport protocol with no handshake, acknowledgment, or retransmission — lower overhead and lower latency than TCP but no delivery guarantee. Used for DNS queries, streaming media, VoIP, and other latency-sensitive applications where the application layer, not the transport layer, handles any needed reliability.
Underlay / Overlay — data center networking terms
The underlay is the physical IP routing infrastructure connecting devices (often built with OSPF, IS-IS, or eBGP between leaf and spine switches); the overlay is a virtual network built on top of it (VXLAN, for example) that provides Layer 2 adjacency or tenant isolation without requiring the underlay to know about individual tenant networks.

V

VLAN (Virtual Local Area Network) — IEEE 802.1Q
A logical subdivision of a physical switched network into separate broadcast domains, allowing traffic segmentation (by department, function, or security zone) without requiring separate physical switches. Each VLAN is typically mapped to its own IP subnet, with inter-VLAN routing handled by a Layer 3 switch or router.
VPN (Virtual Private Network) — general term
An encrypted, authenticated tunnel that extends a private network across a public or untrusted network, used for site-to-site connectivity (IPsec) or remote user access (IPsec or SSL/TLS-based clients). VPNs provide confidentiality and integrity but do not by themselves guarantee bandwidth or latency.
VRF (Virtual Routing and Forwarding) — routing concept
A technology that allows multiple independent routing tables to coexist on a single router or switch, enabling logical separation of routing domains (for example, separating guest, corporate, and OT traffic) on shared physical infrastructure without the traffic being able to route between them unless explicitly permitted.
VRRP (Virtual Router Redundancy Protocol) — RFC 5798
The open-standard equivalent of HSRP, providing first-hop router redundancy via an elected master and one or more backup routers sharing a virtual IP address.
VXLAN (Virtual Extensible LAN) — RFC 7348
An overlay encapsulation protocol that tunnels Layer 2 Ethernet frames inside Layer 4 UDP packets, extending Layer 2 adjacency across a routed Layer 3 underlay and supporting up to 16 million logical segments (versus 4094 for traditional 802.1Q VLANs) — the standard overlay technology in modern leaf-spine data center fabrics, often paired with EVPN as the control plane.

W

WAN (Wide Area Network) — general term
A network that spans a large geographic area connecting multiple sites, typically leased from a carrier (MPLS, dedicated internet access) or built over broadband/SD-WAN transport, as distinct from a LAN (Local Area Network) confined to a single site or building.
Wi-Fi 6 / 6E (802.11ax) — IEEE 802.11ax
The wireless standard that introduced OFDMA (allowing an access point to serve multiple clients in a single transmission), higher-order modulation (1024-QAM), and target wake time for improved device battery life. Wi-Fi 6E extends operation into the 6 GHz band, adding substantial interference-free spectrum unavailable to older devices.

Z

Zero Trust Network Access (ZTNA) — NIST SP 800-207
A security model built on the principle "never trust, always verify" — access to any resource is granted based on continuously verified identity, device posture, and context rather than network location, replacing the older model where anything inside the corporate perimeter was implicitly trusted. Enterprise adoption typically replaces or supplements traditional VPN remote access with per-application, identity-aware access brokers.