📚 Network Fundamentals Crash Course | 网络基础考点精讲
Networks form the backbone of modern computing, enabling devices to communicate, share resources, and access the internet. In the OCR A-Level Computer Science syllabus, understanding the fundamentals of networking is essential for grasping how data moves across the world, how reliability is achieved, and how networks are structured to meet different needs. This crash course distills the key concepts, protocols, and hardware that appear in typical exam questions, from topologies to TCP/IP layering, giving you a concise yet thorough revision resource.
网络是现代计算的支柱，使设备能够通信、共享资源并访问互联网。在 OCR A-Level 计算机科学考纲中，理解网络基础对于掌握数据如何在全球流动、如何实现可靠性以及网络如何根据不同需求进行结构化设计至关重要。本考点精讲提炼了常见考题中涉及的关键概念、协议和硬件，从拓扑结构到 TCP/IP 分层，为你提供一份简明而全面的复习资料。
1. Network Types and Scale | 网络类型与规模
A Local Area Network (LAN) covers a small geographical area, such as a single building or campus, and is typically owned and managed by a single organisation. LANs offer high data transfer rates and low latency because the infrastructure, often Ethernet-based, is confined to a limited number of devices connected via switches or wireless access points.
局域网 (LAN) 覆盖较小的地理范围，如单一建筑或校园，通常由单一组织拥有和管理。由于基础设施（通常基于以太网）仅限于通过交换机或无线接入点连接的有限设备，因此局域网提供高数据传输速率和低延迟。
A Wide Area Network (WAN) spans cities, countries, or continents, connecting multiple LANs through leased telecommunication lines, fibre optics, or satellite links. The internet is the largest WAN, and businesses often use Virtual Private Networks (VPNs) to securely extend their LANs over public WAN infrastructure.
广域网 (WAN) 跨越城市、国家或大陆，通过租用的电信线路、光纤或卫星链路连接多个局域网。互联网是最大的广域网，企业常使用虚拟专用网络 (VPN) 在公共广域网基础设施上安全地延伸其局域网。
Personal Area Networks (PANs) operate within a range of a few metres, commonly using Bluetooth or USB connections. They allow devices such as smartphones, laptops, and wearables to communicate without complex infrastructure. A Metropolitan Area Network (MAN) lies between LAN and WAN, covering a city or large campus with high-speed connections, often using technologies like Metro Ethernet.
个人域网 (PAN) 覆盖范围为数米，通常使用蓝牙或 USB 连接。它们让智能手机、笔记本电脑和可穿戴设备等无需复杂基础设施即可通信。城域网 (MAN) 介于局域网和广域网之间，覆盖城市或大型园区，使用城域以太网等技术提供高速连接。
2. Network Topologies | 网络拓扑结构
A star topology connects every device to a central switch or hub. This design simplifies troubleshooting because a single cable failure only affects the connected node, not the rest of the network. However, the central device becomes a single point of failure; if it goes down, the entire network stops functioning.
星型拓扑将所有设备连接到中央交换机或集线器。这种设计简化了故障排除，因为单根电缆故障仅影响所连节点，不影响网络其余部分。然而，中央设备成为单点故障；如果它宕机，整个网络将停止运行。
In a bus topology, all devices share a single backbone cable, with terminators at each end to absorb signals and prevent reflection. It is cheap and easy to install for small networks but suffers from collisions and limited bandwidth. A break in the backbone brings the whole segment down.
在总线拓扑中，所有设备共享一根主干电缆，两端配有终端电阻以吸收信号并防止反射。对于小型网络，它成本低且易于安装，但存在冲突和带宽限制。主干断裂会导致整个网段瘫痪。
A ring topology connects each device to two others, forming a closed loop where data travels in one direction. Token Ring networks used a token-passing mechanism to prevent collisions. While fair in access, a single node or link failure can disable the entire ring unless dual-counter-rotating rings are employed.
环型拓扑将每台设备与另外两台相连，形成一个闭合环路，数据单向传输。令牌环网络使用令牌传递机制来避免冲突。虽然访问公平，但单个节点或链路故障可能导致整个环瘫痪，除非采用双反向旋转环。
A mesh topology provides multiple redundant paths between nodes. In a full mesh, every device connects to every other device, offering maximum resilience and fault tolerance at a high cost. Partial mesh strikes a balance, often used in backbone networks and WANs where reliability is critical.
网状拓扑在节点之间提供多条冗余路径。在全网状中，每台设备与其他所有设备相连，以高成本提供最大的弹性和容错能力。部分网状则在平衡成本的同时保证可靠性，常用于骨干网和对可靠性要求高的广域网。
3. Networking Hardware | 网络硬件
A Network Interface Card (NIC) provides a device with a physical connection to the network, operating at the data link layer. Each NIC has a unique MAC address burned into its ROM, allowing it to be identified on the local segment. Wired NICs typically use RJ45 connectors, while wireless NICs use antennas to transmit radio signals.
网络接口卡 (NIC) 为设备提供到网络的物理连接，工作在数据链路层。每块 NIC 都有一个唯一的 MAC 地址固化在 ROM 中，使其在本地网段被识别。有线 NIC 通常使用 RJ45 连接器，无线 NIC 则使用天线传输无线电信号。
Switches operate at the data link layer and intelligently forward frames only to the specific port where the destination device resides, using a MAC address table. This reduces unnecessary traffic and collisions, creating separate collision domains for each port. Modern switches can also operate at higher layers, offering VLAN and basic routing capabilities.
交换机工作在数据链路层，利用 MAC 地址表智能地将帧仅转发到目标设备所在的特定端口。这减少了不必要的流量和冲突，为每个端口创建独立的冲突域。现代交换机还能在更高层工作，提供 VLAN 和基本路由功能。
Routers work at the network layer, forwarding packets between different networks based on logical IP addresses. They maintain routing tables built via static configuration or dynamic routing protocols such as OSPF and BGP. Routers also perform NAT, firewalling, and Quality of Service (QoS) management.
路由器工作在网络层，根据逻辑 IP 地址在不同网络之间转发数据包。它们通过静态配置或动态路由协议（如 OSPF 和 BGP）维护路由表。路由器还具备 NAT、防火墙和服务质量 (QoS) 管理功能。
A hub, now largely obsolete, operates at the physical layer, repeating incoming signals to all ports without any filtering. This creates a single collision domain and wastes bandwidth. Wireless Access Points (WAPs) bridge wireless clients to the wired infrastructure, often integrating switch and router functions in consumer devices.
集线器现已基本被淘汰，工作在物理层，将传入信号不加过滤地重复发送到所有端口。这产生单一冲突域并浪费带宽。无线接入点 (WAP) 将无线客户端桥接到有线基础设施，在消费级设备中常集成交换机和路由器功能。
4. The TCP/IP Protocol Suite | TCP/IP 协议族
The TCP/IP model is a four-layer framework that standardises network communication. From bottom to top, the layers are: Network Access (Link), Internet, Transport, and Application. Unlike the OSI model, which has seven layers, TCP/IP is more practical and directly maps to real-world protocols.
TCP/IP 模型是一个四层框架，标准化了网络通信。从下到上依次为：网络接入层（链路层）、互联网层、传输层和应用层。与具有七层的 OSI 模型不同，TCP/IP 更实用，直接映射到实际协议。
The Network Access layer handles the physical transmission of data and framing, covering technologies such as Ethernet and Wi-Fi. The Internet layer, dominated by the Internet Protocol (IP), is responsible for logical addressing and routing packets across multiple networks. IP is connectionless and does not guarantee delivery.
网络接入层处理数据的物理传输和成帧，涵盖以太网和 Wi-Fi 等技术。以网际协议 (IP) 为主导的互联网层负责逻辑寻址和跨多个网络路由数据包。IP 是无连接的，不保证交付。
The Transport layer provides end-to-end communication services. TCP (Transmission Control Protocol) offers a reliable, connection-oriented channel with error recovery and flow control. UDP (User Datagram Protocol) provides a lightweight, connectionless service without guarantees, suitable for real-time applications like VoIP and streaming.
传输层提供端到端的通信服务。TCP（传输控制协议）提供可靠、面向连接的通道，具备错误恢复和流量控制功能。UDP（用户数据报协议）提供轻量级、无连接服务，不保证交付，适用于 VoIP 和流媒体等实时应用。
The Application layer encompasses high-level protocols that directly interact with user applications: HTTP/HTTPS for web browsing, SMTP/IMAP for email, FTP for file transfer, and DNS for name resolution. These protocols rely on the lower layers to handle data transport and routing.
应用层包含直接与用户应用程序交互的高层协议：用于网页浏览的 HTTP/HTTPS、电子邮件的 SMTP/IMAP、文件传输的 FTP、以及域名解析的 DNS。这些协议依赖下层处理数据传输和路由。
5. TCP vs UDP | TCP 与 UDP 对比
TCP establishes a virtual connection using a three-way handshake (SYN, SYN-ACK, ACK) before data transfer. It numbers each byte and expects acknowledgements; if a segment is lost, TCP retransmits it. Flow control via a sliding window and congestion control algorithms prevent the sender from overwhelming the receiver or network.
TCP 在数据传输前使用三次握手（SYN、SYN-ACK、ACK）建立虚拟连接。它对每个字节进行编号并期望确认；如果报文段丢失，TCP 会重传。通过滑动窗口和拥塞控制算法进行流量控制，防止发送端超出接收端或网络能力。
UDP dispenses with handshaking, acknowledgements, and retransmissions. Packets, called datagrams, may arrive out of order, be duplicated, or be lost without notice. This minimal overhead reduces latency, making UDP ideal for DNS queries, online gaming, and live video where occasional data loss is acceptable compared to delay.
UDP 省去了握手、确认和重传。数据报可能乱序到达、重复或无声丢失。这种最小开销降低了延迟，使得 UDP 非常适合 DNS 查询、在线游戏和直播视频，在这些场景中偶尔的数据丢失相比延迟是可接受的。
For stateful applications like web browsing and file transfers, TCP’s reliability is essential. UDP’s simplicity enables multicast and broadcast transmission, which TCP cannot efficiently perform. Many modern protocols, such as QUIC, build on UDP to add selective reliability without compromising speed.
对于网页浏览和文件传输等有状态应用，TCP 的可靠性至关重要。UDP 的简洁性使其能够支持组播和广播传输，而 TCP 无法高效实现。许多现代协议，例如 QUIC，基于 UDP 增加了选择性可靠性，同时不牺牲速度。
6. IP Addressing and Subnetting | IP 地址与子网划分
IPv4 uses 32-bit addresses, typically written in dotted-decimal notation (e.g., 192.168.1.10). It supports approximately 4.3 billion unique addresses, which are now exhausted. Private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are reserved for internal networks and are not routable on the public internet.
IPv4 使用 32 位地址，通常以点分十进制表示（例如 192.168.1.10）。它支持约 43 亿个唯一地址，现已耗尽。私有地址段（10.0.0.0/8、172.16.0.0/12、192.168.0.0/16）保留用于内部网络，不可在公共互联网上路由。
Subnetting divides a larger network into smaller subnetworks by borrowing bits from the host portion of the address to create a subnet mask. For example, a /24 mask (255.255.255.0) leaves 8 bits for hosts, supporting 254 usable addresses. Classless Inter-Domain Routing (CIDR) notation expresses the mask as a suffix, enabling flexible allocation.
子网划分通过从地址的主机部分借位来创建子网掩码，从而将大网络划分为更小的子网。例如，/24 掩码（255.255.255.0）留下 8 位给主机，可容纳 254 个可用地址。无类别域间路由 (CIDR) 以斜线后缀表示掩码，实现了灵活分配。
IPv6 was developed to address the exhaustion of IPv4, using 128-bit addresses expressed as eight groups of four hexadecimal digits. It provides a virtually unlimited address space, simplified packet headers, and built-in features like IPsec support and auto-configuration. Transition mechanisms such as dual-stack and tunnelling are used alongside IPv4.
IPv6 为应对 IPv4 的枯竭而开发，使用 128 位地址，表示为八组四位十六进制数。它提供了几乎无限的地址空间、简化的数据包头以及内置功能，如 IPsec 支持和自动配置。双栈和隧道等过渡机制与 IPv4 并行使用。
7. The Domain Name System (DNS) | 域名系统 (DNS)
DNS translates human-readable domain names (e.g., http://www.example.com) into machine-readable IP addresses. It operates as a distributed, hierarchical database, with root servers at the top, followed by Top-Level Domain (TLD) servers (.com, .org, .uk) and authoritative name servers for individual domains.
DNS 将人类可读的域名（例如 http://www.example.com）转换为机器可读的 IP 地址。它以一个分布式、层级化的数据库运作，顶端为根服务器，其次是顶级域 (TLD) 服务器（.com、.org、.uk）以及各个域的权威名称服务器。
A typical DNS resolution involves a recursive query from a client to a local resolver, which may iteratively query root, TLD, and authoritative servers to obtain the answer. Caching at various levels speeds up repeated lookups and reduces load on the infrastructure. Resource Records (RRs) like A (IPv4), AAAA (IPv6), MX (mail exchange), and CNAME (canonical name) store different mapping types.
典型的 DNS 解析涉及客户端向本地解析器发起递归查询，解析器可能迭代查询根服务器、顶级域服务器和权威服务器以获取答案。各级缓存加快了重复查询速度并减轻了基础设施负载。资源记录 (RR) 如 A（IPv4）、AAAA（IPv6）、MX（邮件交换）和 CNAME（规范名称）存储不同类型的映射。
DNS security extensions (DNSSEC) add digital signatures to DNS data, preventing spoofing and cache poisoning. Despite its robustness, DNS can become a target for DDoS attacks and tunnelling exploits, making monitoring and redundancy crucial.
DNS 安全扩展 (DNSSEC) 为 DNS 数据添加数字签名，防止欺骗和缓存投毒。尽管 DNS 很健壮，它仍可能成为 DDoS 攻击和隧道攻击的目标，因此监控和冗余至关重要。
8. Network Security Fundamentals | 网络安全基础
Firewalls enforce security policies by filtering incoming and outgoing traffic based on predefined rules. Packet-filtering firewalls inspect IP headers and TCP/UDP ports, while stateful firewalls keep track of active connections to make more informed decisions. Application-layer firewalls can analyse the actual content of traffic, blocking malicious payloads.
防火墙通过基于预定义规则过滤进出流量来实施安全策略。包过滤防火墙检查 IP 报头和 TCP/UDP 端口，而状态感知防火墙跟踪活跃连接，做出更明智的决策。应用层防火墙可以分析流量的实际内容，阻止恶意负载。
Encryption protects confidentiality by converting plaintext into ciphertext using algorithms like AES and RSA. Symmetric encryption uses a single key for both encryption and decryption, while asymmetric encryption uses a key pair (public and private). SSL/TLS protocols secure web traffic by establishing an encrypted tunnel after a handshake that authenticates the server and optionally the client.
加密通过使用 AES 和 RSA 等算法将明文转换为密文来保护机密性。对称加密使用单一密钥进行加解密，而非对称加密使用一对密钥（公钥和私钥）。SSL/TLS 协议在握手过程验证服务器（可选地验证客户端）后建立加密隧道来保护网络流量。
Authentication verifies the identity of users or devices. Passwords, biometrics, and multi-factor authentication (MFA) combine something you know, you have, and you are. In networking, protocols like 802.1X provide port-based network access control, ensuring only authorised devices connect to a LAN or wireless network.
身份认证验证用户或设备的身份。密码、生物特征和多因素认证 (MFA) 结合了你知道的、你拥有的和你是什么的因素。在网络中，802.1X 等协议提供基于端口的网络访问控制，确保只有经过授权的设备才能连接到局域网或无线网络。
9. Virtual Networks: VLANs and VPNs | 虚拟网络：VLAN 与 VPN
A Virtual LAN (VLAN) segments a physical network switch into multiple logical broadcast domains. Devices in different VLANs cannot communicate directly at Layer 2, even if connected to the same switch; traffic must pass through a router or a Layer 3 switch. VLANs improve security, reduce broadcast traffic, and simplify network management.
虚拟局域网 (VLAN) 将物理网络交换机分割为多个逻辑广播域。即使连接到同一台交换机，不同 VLAN 中的设备也无法在第二层直接通信；流量必须经过路由器或三层交换机。VLAN 提高了安全性，减少了广播流量，并简化了网络管理。
VLAN tagging follows the IEEE 802.1Q standard, which inserts a 4-byte tag into the Ethernet frame containing the VLAN ID. Trunk links between switches carry frames from multiple VLANs, using the tags to maintain separation. This allows a single physical infrastructure to support many isolated logical networks.
VLAN 标记遵循 IEEE 802.1Q 标准，它在以太网帧中插入一个 4 字节的标签，其中包含 VLAN ID。交换机之间的中继链路承载来自多个 VLAN 的帧，利用标签保持隔离。这使得单一物理基础设施能够支持许多隔离的逻辑网络。
A Virtual Private Network (VPN) creates an encrypted tunnel over an untrusted network, such as the internet. Remote users can securely access the corporate LAN as if they were physically present. Common VPN protocols include IPsec (often used for site-to-site VPNs), SSL/TLS (browser-based remote access), and WireGuard for modern lightweight implementations.
虚拟专用网络 (VPN) 在不安全的网络（如互联网）上创建加密隧道。远程用户可以安全地访问公司局域网，如同物理连接一样。常见的 VPN 协议包括 IPsec（常用于站点到站点 VPN）、SSL/TLS（基于浏览器的远程访问）以及用于现代轻量级实现的 WireGuard。
10. Network Standards and Organisations | 网络标准与组织
The Internet Engineering Task Force (IETF) develops and promotes voluntary Internet standards, publishing them as Request for Comments (RFC) documents. Protocols such as TCP, IP, HTTP, and SMTP are described in these RFCs, which ensure interoperability across diverse hardware and software.
互联网工程任务组 (IETF) 制定并推广自愿性互联网标准，以请求评论 (RFC) 文档的形式发布。TCP、IP、HTTP 和 SMTP 等协议在这些 RFC 中描述，确保了不同硬件和软件之间的互操作性。
The Institute of Electrical and Electronics Engineers (IEEE) maintains the 802 family of standards for LANs and MANs. Key examples include IEEE 802.3 (Ethernet), 802.11 (Wi-Fi), and 802.1Q (VLAN tagging). These standards define physical and data link layer specifications, enabling equipment from different vendors to work together seamlessly.
电气与电子工程师协会 (IEEE) 维护用于局域网和城域网的 802 系列标准。关键示例包括 IEEE 802.3（以太网）、802.11（Wi-Fi）和 802.1Q（VLAN 标记）。这些标准定义了物理层和数据链路层的规范，使来自不同厂商的设备能够无缝协作。
Other notable bodies include ICANN (Internet Corporation for Assigned Names and Numbers), which coordinates IP address allocation and DNS management, and the World Wide Web Consortium (W3C), which develops web standards. For OCR candidates, remembering the roles of IETF and IEEE is particularly important, as they frequently appear in exam questions on protocol layers and Ethernet technologies.
其他值得注意的机构包括 ICANN（互联网名称与数字地址分配机构），负责协调 IP 地址分配和 DNS 管理，以及万维网联盟 (W3C)，负责制定网络标准。对于 OCR 考生，记住 IETF 和 IEEE 的作用尤为重要，因为它们常在关于协议分层和以太网技术的考题中出现。
11. Packet Switching and Circuit Switching | 分组交换与电路交换
Packet switching breaks data into discrete packets, each containing source and destination addresses, sequence numbers, and payload. Packets are routed independently through the network, possibly taking different paths, and are reassembled at the destination. This method offers efficient use of network capacity and robustness to link failures, forming the basis of the internet.
分组交换将数据分割成离散的数据包，每个包包含源地址、目的地址、序列号和有效载荷。数据包在网络中独立路由，可能通过不同路径，并在目的地重组。这种方法能够高效利用网络容量，并对链路故障具有鲁棒性，构成了互联网的基础。
Circuit switching establishes a dedicated physical communication path between two endpoints before data transfer begins, as in traditional telephone networks. The circuit remains reserved for the entire duration of the call, guaranteeing constant bandwidth and predictable latency, but the reservation leads to underutilisation when no data is being sent.
电路交换在数据传输开始前在两个端点之间建立专用的物理通信路径，如传统电话网络。电路在整个通话期间保持预留状态，保证了恒定的带宽和可预测的延迟，但在无数据发送时会导致利用率不足。
Key comparisons for the exam: packet switching is connectionless, resource-efficient, and handles bursty data well; circuit switching is connection-oriented, provides quality guarantees, but wastes resources during silence. Modern voice calls often use VoIP, which is packet-switched, marking a shift away from legacy circuit-switched telephony.
考试中的关键对比：分组交换是无连接的，资源利用率高，能很好处理突发数据；电路交换是面向连接的，提供质量保证，但在静默期浪费资源。现代语音通话通常使用 VoIP，属于分组交换，标志着从传统电路交换电话系统的转变。
12. Network Troubleshooting Tools | 网络故障排查工具
ping tests reachability by sending ICMP Echo Request messages and waiting for Echo Replies. It measures round-trip time and packet loss, making it the first tool to use when checking basic connectivity between devices. A successful ping confirms that both hosts are properly addressed and that routing, at least in one direction, works.
ping 通过发送 ICMP 回显请求消息并等待回显应答来测试可达性。它测量往返时间和数据包丢失率，是检查设备之间基本连通性时的首选工具。成功的 ping 确认了两台主机地址配置正确，并且至少一个方向的路由正常工作。
traceroute (or tracert on Windows) maps the path packets take to a destination by sending probe packets with incrementing Time-To-Live (TTL) values. Each router along the path responds with an ICMP Time Exceeded message, revealing its IP address and the latency to that hop. This helps pinpoint where delays or failures occur.
traceroute（或 Windows 上的 tracert）通过发送具有递增生存时间 (TTL) 值的探测包，绘制数据包到达目的地的路径。沿途每台路由器都回复 ICMP 超时消息，显示其 IP 地址和到该跳的延迟。这有助于定位延迟或故障发生的位置。
ipconfig/ifconfig displays a device’s IP configuration, including IP address, subnet mask, default gateway, and DNS servers. It is essential for verifying that the network interface is correctly configured and for diagnosing DHCP issues. The nslookup tool queries DNS servers directly to resolve hostnames, testing name resolution independently from browsers.
ipconfig/ifconfig 显示设备的 IP 配置，包括 IP 地址、子网掩码、默认网关和 DNS 服务器。它对于验证网络接口配置是否正确以及诊断 DHCP 问题至关重要。nslookup 工具直接查询 DNS 服务器来解析主机名，独立于浏览器测试名称解析功能。
Wireshark is a packet analyser that captures and displays network traffic in real time. It allows deep inspection of protocol headers and payloads, making it invaluable for debugging application-layer issues, detecting security threats, and understanding protocol behavior. For the OCR exam, recognising the purposes of these tools and interpreting their typical outputs is often assessed.
Wireshark 是一款数据包分析器，可以实时捕获和显示网络流量。它允许深入检查协议头和有效载荷，对于调试应用层问题、检测安全威胁和理解协议行为非常重要。在 OCR 考试中，经常考查识别这些工具的目的并解释其典型输出。
Published by TutorHao | OCR A-Level Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导