My new study habits for CCNP and beyond

MrBrian

This may be helpful for some, and for others a no-brainer. I'm currently going for the ROUTE exam and am taking my time and soaking it up.. I'm enjoying and respecting the process, if you will. I've gone from reading and highlighting a lot, to now labbing a lot. However, I always end up trying to doing a lab, say multiple redistribution points for example, and start questioning everything.. I will wonder how ios knows to make the ospf an E2 route, or what made it give the external eigrp an AD of 170 when I redistributed. I mean I know it's coming when I'm configuring it, but basically wondering other than what the book says, how is it really happening?

This is when I started looking up all the protocols headers and examining all the fields. I mean once you look at the headers, you can clearly see what the protocols can possibly send.. there's only so much. And now it's getting addicting lol. After some research on EIGRP, for example, I can now clearly see the EIGRP TLV's, which come after the header.. and the first field is Type, and a Type of 0x0103 will mean external routes. So this is what will be set when we redistribute routes into EIGRP, and that's how IOS knows and displays for us. This additional info is huge for me. It's because I get annoyed when I remember something so much, and even see it happen when I lab, but don't know exactly how it happens. I will say it's allowed me to grasp it so much better now. So now I examine all the protocols fully. I still got a ways to go, and I'm realizing that doing this is gonna push my test date back some time lol. I'm fine with that though. I'm not really in a hurry to test on it.. it will come in time.

What I'm trying to get at, is that examining all the protocol fields can be really helpful to push the understanding along for those that need it (like me). I would recommend it for anyone trying to get that edge with their understanding. Ok, some will say duh! That's nothing new!! Right, lol? However, I was never doing things this way.. and I'm sure a lot aren't. I think it's the next step in my professional development in networking.

Bl8ckr0uter

I would say alot of people get into Networking without spending a lot of time looking at packets/studying TCPIP. In fact, most network engineers I know don't look at packets at all. I would say this is a very good idea!

pham0329

That's a great idea. I went through the same thing with the different OSPF LSA types. While I memorize everything from the book, there were questions I had that wasn't answered in the book. Reading about the LSAs types is one thing, but seeing the actual content of the LSA and their headers in Wireshark is totally different. For some reason, information sinks in much quicker when I see the actual packet.

alan2308

When I took the Networking Academy classes, a good majority of the first semester was spent in Wireshark looking at packets, and the same is true for a few of the security classes that I also took. It can be quite boring and mundane, but it's so beneficial.

SteveO86

Bl8ckr0uter wrote: »

I would say alot of people get into Networking without spending a lot of time looking at packets/studying TCPIP. In fact, most network engineers I know don't look at packets at all. I would say this is a very good idea!

Totally agree with you, taking a quick look at the packets can quickly tell why something is happening.

alan2308 wrote: »

When I took the Networking Academy classes, a good majority of the first semester was spent in Wireshark looking at packets, and the same is true for a few of the security classes that I also took. It can be quite boring and mundane, but it's so beneficial.

I suppose it could be boring but it has come in very handy for me on many occasions, trust me.


It's definitely a good habit, I would get familiar with looking at the debug logs as well.

Bl8ckr0uter

alan2308 wrote: »

When I took the Networking Academy classes, a good majority of the first semester was spent in Wireshark looking at packets, and the same is true for a few of the security classes that I also took. It can be quite boring and mundane, but it's so beneficial.

To tell you the truth, I am enjoying the Wireshark book more than any other networking book I have ever read because it is so very useful and to me, extremely fun. Like it is crazy how much info you can gleam about a network just form using nmap/wireshark/other tools

I think part of the issue is Cisco doesn't teach TCP/IP or packet analysis. I am glad to hear you guys went over packets in the NetCad as I have talked to a few folks and they have not said the same thing. Good to hear they are coming along.

mattau

this is what I do. its pushed my route exam back substantially but it helps gain a better understanding of the material. looking at the LSA types, the election and the BGP open messages in wireshark does wonders. No way i could read out of a book only without seeing it first hand.

MrBrian

Bl8ckr0uter wrote: »

To tell you the truth, I am enjoying the Wireshark book more than any other networking book I have ever read because it is so very useful and to me, extremely fun.

I think I may pick that book up. You're talking about the Chappell book, yea? I know how to use wireshark in a basic sense, and use it often, but I can only imagine that there's far more to it. And with the book being so highly rated, I'm sure that's the case. The only thing is it's fairly pricey being about 80$.. but it would be a good pickup for the home library.

Bl8ckr0uter

MrBrian wrote: »

I think I may pick that book up. You're talking about the Chappell book, yea? I know how to use wireshark in a basic sense, and use it often, but I can only imagine that there's far more to it. And with the book being so highly rated, I'm sure that's the case. The only thing is it's fairly pricey being about 80$.. but it would be a good pickup for the home library.

Yep that's the one. It is pretty good.

Forsaken_GA

Bl8ckr0uter wrote: »

I think part of the issue is Cisco doesn't teach TCP/IP or packet analysis. I am glad to hear you guys went over packets in the NetCad as I have talked to a few folks and they have not said the same thing. Good to hear they are coming along.

Honestly, packet analysis isn't that important to network engineers. Most of the time, we don't give a flip what's in the packet, just that it transits from point of origin to point of destination, and if you're properly using netflow, that's usually good enough to give you the heads up on what's going on as far as packet flow.

With that being said, yes, every neteng should be able to sniff and dissect packets if needed. I've been able to find some really weird problems doing so, most commonly finding issues with asymetric routing and reverse path forwarding checks, but on the whole, I do not spend that much time sniffing packets. We have security analysts for that.

CheesyBread

I read the practical analysis using wireshark book before my CCNA exam and I think it really filled in a lot of holes

cisco_trooper

MrBrian,

'I am quite excited to hear you are doing this. I did the same thing when I was studying for the BSCI exam some time ago. Needless to say I knocked em dead with my routing knowledge in technical interviews. Keep it up and it will pay off more than you can imagine. You will be leaving your peers behind in short order. Trust me on this one.