Forem: TAKUMI SUGATA

Understanding Loopback Adapter Through Its Structure

TAKUMI SUGATA — Mon, 04 May 2026 04:09:48 +0000

Introduction

While studying for CompTIA Network+, I couldn't grasp what a Loopback Plug actually does. I understood that it was used for testing, but had no idea how it worked in practice. As a result, I kept getting questions about it wrong. Once I understood the structure behind it, everything clicked. So I decided to write it down.

What is NIC

NIC stands for Network Interface Card.
A NIC is a component inside a computer that enables it to connect to a network.

Familiar example

Computer = Human beings
NIC      = Ears and mouth

Without ears, we cannot hear voice.
Without mouth, we cannot convey voice.

Similar to these example, computers cannot receive and send signal without NIC.

Physical position

NIC is built-in computers.
The visible part is the port where you plug in a LAN cable - the RJ-45 port.

PC's back or sides
┌───────────────────────────────┐
│  [USB] [USB] [RJ-45] [HDMI]   │
└───────────────────────────────┘
                  ↑
              NIC port
     The hole to insert LAN cable

The role for NIC

1. Electric signal ↔ Digital data
　→ It transfer electric signal in Network to the data that computers can read

2. MAC address management
　→ Each NIC has a unique identifier called a MAC address
　→ The only number in the world

3. Control for sending and receiving
　→ It controls the timing for sending and receiving data

Relationship with OSI reference model

Layer 2  Data Link ← Management for MAC address
Layer 1  Physical  ← Sending and receiving electric signal

NIC involves in both Physical and Data Link layers.

What is Lookback Plug

A loopback Plug is a dedicated testing tool used to verify whether a NIC is functioning correctly.

Normally, other devices is needed to connect to Network, but lookback plug enables us to test for NIC without cables or other devices.

Normal connection：
PC → cable → switch → the other PC

Loopback Plug：
PC → signal loops back to itself → received by itself

Kinds

There are two types in Lookback Plug.

1. RJ-45 Loopback Plug（ for copper wire cables）
2. Fiber Loopback（ for optical fiber）

The structure of RJ-45 Lookback Plug

Inside the RJ-45 connector, the sending pins (TX) and receiving pins (RX) are directly connected.

【RJ-45 Loopback Plug （front）】

┌───────────────────────────────────────────────┐
│  1     2     3     4     5     6     7     8  │
│  TX   TX    RX  　  　         RX      　  　  │
└───────────────────────────────────────────────┘
     │     │ │                   │
     │     └ │ ──────────────────┘    
     └───────┘
    （Connect TX to RX）

The sent signal loops back inside the plug and returns to the receiving pin.

The structure of Fiber Lookback

The Fiber Loopback connects the TX and RX ports using an external cable.

【Fiber Loopback structure】

        ┌────────────────┐
        │                │
   TX ──┤ >>>>>>>>>>>>>> ├── RX
        │ Electric fiber │
        └────────────────┘

   Sent electric signal turn around to the receiving port

【Connector （front）】

  送信側          受信側
┌──────┐   ┌──────┐
│ [TX] │~~~│ [RX] │
│ port │   │ port │
└──────┘   └──────┘
   └──────────┘
Connect with loop cable

What is the test purpose with those adapters

Insert Loopback Plug to NIC port
　↓
Test tools send a signal
　↓
TX （sending pin） sends a signal
　↓
The signal turn around to RX (Receiving pin) within Loopback Plug 
　↓
The same signal comes back
　↓
✓ If it returns → NIC・ port is normal
✗ If it doesn't return → NIC・ port has problems

What specifically can we learn

✓ What we can know：
・Whether NIC can send and receive signal
・Whether physical port breaks
・Whether NIC itself is normal without cables

✗ What we cannot know：
・Cable issues
・Switch issues
・IP address settings issues
・Internet connection issues

How to use in troubleshooting

When PC cannot connect to Network, lookback plug is used to isolate the problems.

Step 1：Test with Loopback Plug
　→ failed → NIC・ port is the cause of problem
　→ success → NIC・ port is not the cause of problem

Step 2：Test with cable
　→ failed → cable is the cause of problem
　→ success → cable is not the cause of problem

Step 3：Test with switch
　→ failed → switch is the cause of problem
　→ success → network settings is the cause of problem

** Isolating the root cause step by step** is the fundamental approach to troubleshooting.

Relationship with OSI reference model

Lookback plug is used for test in *Physical layer (Layer 1) *.

Layer 7  Application    │
Layer 6  Presentation │  Not subjecting to testing
Layer 5  Session           │
Layer 4  Transport       │
Layer 3  Network         │
Layer 2  Data Link        │
─────────────────────────────
Layer 1  Physical     ← Subjecting to testing with Loopback Plug
─────────────────────────────

The standard approach is to confirm Physical Layer first, then work upward through each layer.

Summary

NIC = Computer's components to connect to network
　→ NIC port for LAN cable inserting
　→ Involves in Physical and Data Link layers

Loopback Plug = Plug for testing whether NIC port is normal
　→ Sent signal turn around itself
　→ Kinds：RJ-45・Fiber
　→ What it can test： Physical normalcy in NIC・ port
　→ What it cannot test： cable・ switch・ settings problems
　→ OSI層：Only Physical Layer （Layer 1）

Conclusion

I used to struggle with Loopback Plug because I didn't even know what a NIC was in the first place.
Not knowing what NIC was made it impossible to understand what the plug was actually testing.
Once I understood NIC first and then the structure of the Loopback Plug, everything fell into place.

Understanding Mobile Generation with Netflix

TAKUMI SUGATA — Sat, 02 May 2026 05:10:11 +0000

Introduction

While studying for CompTIA Network+, I couldn't totally remember each speed for mobile generations; 3G・4G・5G.

The numbers alone meant nothing to me - I had no way to visualize what they actually felt like. Once I matched each generation's speed to Netflix streaming quality, everything clicked.

What is Theoretical Max and Typical Speed

There are two kinds of the speed in mobile communication.

Theoretical Max（ Theoretical value）
　→ The max speed under the ideal condition
　→ No obstacles, directly beside the base station, no congestion

Typical Speed（ Typical value）
　→ The average speed in the actual use environment
　→ Inside buildings, far from base station, congestion

The reason why each speed is different

Radio waves interference
　→ Buildings ・ walls ・ obstacles weak signal

Distance from base station
　→ The farther the base station, the weaker the signal

Number of simultaneous connection
　→ Many users sharing the same base station causes speed to be distributed across all connections

Frequency band
　→ 5G, use high frequency (millimeter wave) , is fast, but short range

Understanding familiar example

Theoretical Max = The maximum speed achieved by driving on a highway with no traffic, no traffic lights, and no obstacles

Typical Speed   = The actual average speed in commuting rushing hours

Even the highest-performing standard is affected by factors such as interference, distance, and the number of simultaneous connections.

The speed of each mobile generation

Generation	Theoretical Max	Typical Speed
3G	2Mbps	384Kbsp〜2Mbps
4G（LTE）	1Gbps	30〜150Mbps
5G	20Gbps	100Mbps〜3Gbps

Imagine in Netflix

I know it is too hard to think of the just numbers, so I gave an example about Netflix.

the standard number

Watch Netflix HD videos = Need approximately 5Mbps
Watch Netflix 4K videos = Need approximately 25Mbps

3G (Typical Speed：384Kbps〜2Mbps）

・Netflix HD → Impossible（ Need 5Mbps, but not stable）
・YouTube (low video quality) → Just barely
・Send message → No problem
・Google search → A bit slower

Downloading time for a 1GB file : about 20 minutes ～ 1 hour

This generation spread in 2000s was the first standard that enabled smartphone internet access, but it is no longer in use today.

4G LTE (Typical Speed：30〜150Mbps)

・Netflix HD → Comfortable（ Enough by 5Mbps）
・Netflix 4K → Limited (Need 25Mbps, just barely reached) 
・Video call → Comfortable
・Downloading huge size application → A few minute

Downloading time for a 1GB file : about 3 minutes ～ 7 minutes

LTE stands for Long Term Evolution
This is the most common standard in today's world.

5G（Typical Speed：100Mbps〜3Gbps）

・Netflix 4K → No problem at all - overwhelmingly faster than the required 25Mbps
・8K Video → Possible
・Simultaneously connection with multiple devices → Comfortable
・Downloading 1GB size application → tens of seconds

Downloading time for a 1GB file : about 10 seconds ～ 1 minute

The theoretical maximum of 5G is 20 times faster than of 4G.
But, typical value highly depends on the environments.
This technology is expected to use in the field for IoT, automatic device and smart city.

Array of these three generation

Downloading time of 1GB：
3G  → about 20 minutes 〜 an hour
4G  → about 3 〜 7 minutes
5G  → about 10 seconds 〜1 minute

Features of each generation

・Spread in 2000's 
・This is the generation for the first time in smartphone use with Internet
・No service in today's world

4G LTE

・LTE = Long Term Evolution
・Main communication standard in today's world
・Video streaming is comfortable in this generation
・The most common standard over the world

・Theoretical value is as 20 times as 4G
・Simultaneously connection is as 100 times as 4G
・Latency is approximately 1/30th of 4G (about 1ms)
・Expected to use in the area of IoT ・ automatic drive ・ smart city

Summary

Generation	Theoretical Max	Typical Speed	Netflix HD	Netflix 4K
3G	2Mbps	384Kbps〜2Mbps	✗	✗
4G LTE	1Gbps	30〜150Mbps	✓	△
5G	20Gbps	100Mbps〜3Gbps	✓	✓

How to memorize

It is important to memorize that relative speed in each generation rather than detailed numbers

3G  = Mbps unit（ Cannot totally watch Netflix HD）
4G  = tens Mbps（ Comfortable to watch Netflix HD ・limited to watch 4K video）
5G  = Hundreds of Mbps 〜 Gbps（ Netflix 4K with no issues）

Conclusion

I used to struggle with memorizing the speeds for each generation.
Once I connected them to real-world download times, everything fell into place.
Attaching numbers to real experiences makes them far easier to retain.

Understanding the Evolution of CAT Standards Makes Memorization Unnecessary.

TAKUMI SUGATA — Wed, 29 Apr 2026 04:39:20 +0000

Introduction

While studying for CompTIA Network+, I couldn't remember CAT standards in LAN cable field.
The sheer number of specification made it difficult to answer related questions confidently.
Once I understand how each standard evolved from the previous one, everything clicked.

What is CAT standards

LAN cable has CAT (Category) standards, which shows that higher number perform better.
Understanding the logic behind each standard is more effective than memorizing numbers.

Why higher standard accelerates speed

LAN cables consist of 8 copper wires. Trying to increase signal speed introduced two key challenges.

Problem 1：Crosstalk
Receive electrical interference from the adjacent copper cables
→ Signal degrades

Problem 2：Attenuation 
Longer distance weakens signal
→ Not be able to reach

The higher standards are designed to solve these problems.

What is the solution in each evolution stages

CAT5 → CAT5e

Problem： Frequent Crosstalk
Solution： Twist Copper cables
Result：100Mbps → 1Gbps

Twisting has an advantage to solve signal interference.

Rough twisting → More interference → slower
Fine twisting → Less interference → faster

e shows Enhanced .

CAT5e → CAT6

Problem： Pushing beyond 1Gbps increases susceptibility to Crosstalk
Solution： Introduce spine in a center of the cable and more twist
Result：1Gbps → 10Gbps
※10Gbps reaches under 55 meters

** Why CAT6 cannot reach over 55 meters in using 10Gbps

Faster signal = Increase electrical interference
　↓
Longer distance can degrade the signal due to accumulation of interference
　↓
Over 55m cannot retain the speed of 10Gbps

Without shielding, the cable is susceptible to outside interference.

CAT6 → CAT6a

Problem：CAT6 cannot reach over 55m in 10Gbps
Solution： Wrap the cable by shield (metal shroud), which blocks outer interference
Result：55m (10Gbps) → 100m

Without shield（CAT6）
→Influenced by outer electric devices 
→Longer distance degrades signal

With shield（CAT6a）
→Block outer interference
→Retain longer distance at 10Gbps

a shows Augmented .

CAT6a → CAT7

Problem：CAT6a still has interference at high frequencies between wire pairs 
Solution：Wrap each individual wire pair with its own shield
Result：Crosstalk between pairs reduced to nearly zeeo

The difference between CAT6a and CAT7 lies in the shielding structure.

CAT6a：
┌─────────────────────────────────────┐
│ Whole Shield                        │
│  ○ ○ ○ ○（The pair without shield） │
└─────────────────────────────────────┘

CAT7：
┌───────────────────────────────────┐
│ Whole Shield                      │
│ [○][○][○][○]（Individual shield ）│
└───────────────────────────────────┘

CAT7 → CAT8

Problem： Lacking with 10Gbps for data center
Solution： Enforce the quality of copper cables and shield
Result：10Gbps → 40Gbps, but reach just 30m

The reason why CAT8 can reach just 30m

High speed signal (40Gbps)
　↓
High electrical interference 
　↓
Shield cannot function to retain the signal strength for long distance
　↓
Use under 30m

CAT8 is designed for connecting to server racks inside data center.

Server rack A ──── 30m ────→ Server rack B
　↓
The length is enough for data center 
　↓
It prioritize the speed rather than distance

Why CAT5-CAT6a are the length of 100m

This is the reason for the designed standard.

The typical distance from one end of an office floor to the other is approximately 100m.
Ethernet standard is designed for architectural standard.

The edge of the office ──── 100m ────→ Server room
　↓
Ethernet standard can cover them
　↓
CAT5〜CAT6a = 100m

Understanding whole structure

Need for fast speed
　↓
Problem for interference and attenuation
　↓
Solution①：more twisted（CAT5e・CAT6）
Solution②：cover with whole shield（CAT6a）
Solution③：cover each pair with individual shield（CAT7）
Solution④：enhance the quality of materials and structure（CAT8）
　↓
The faster the speed, the greater the interference challenges become.
　↓
The limited distance for the fastest speed（CAT8の30m）

Summary

Standard	Speed	Distance	Improvement	Use case
CAT5	100Mbps	100m	Normal structure	Traditional environment
CAT5e	1Gbps	100m	Twist Copper cables	Household・Office
CAT6	10Gbps	55m※	Introduce spine in a center of the cable	Enterprise office
CAT6a	10Gbps	100m	Wrap whole cable by shield	Data center
CAT7	10Gbps	100m	Wrap the individual cable by shield	High performance enterprise network
CAT8	40Gbps	30m	Enforce the quality of copper cables and shield	Inside data center

※CAT6: 10Gbps can reach 55m, but 1Gbps can reach 100m.

Key numbers from the exam

CAT6  = 10Gbps → 55m (not 100m)
CAT6a = 10Gbps → 100m
CAT8            → 30m
All others      → 100m

Conclusion

I used to struggle with these questions.
Each standard exists to solve a specific interference problem.
Once you understand that evolution, the numbers take care of themselves

Just Choose by Distance — A Simple Guide to Understanding Transceiver and Fiber Cable Compatibility

TAKUMI SUGATA — Mon, 27 Apr 2026 22:36:13 +0000

Introduction

While studying for CompTIA network+, I couldn't grasp the relationships between Transceiver and Fiber cable.
I could memorize 10GBase-SR uses MMF, but I didn't understand what is that.

Once I understood the structure, everything cleared up. So I decided to write it down.

Why optical fiber is needed

In my last post, I introduced LAN cables (copper cables), which have a limited range.

LAN cable → Max 100m
Optical fiber  → A few kilometers to tens of kilometers

In an office use, it is enough to use LAN cable.
However, optical fiber is necessary for connections inside data centers or between remote locations over long distances.

What is Transceiver

Switches and routers handle electrical signals internally.
On the other hand, Optical fiber connects with optical signal.

Electrical signal → Transceiver → Optical signal → Fiber Cable → Transceiver → Electrical

A Transceiver is a small module that plugs into a dedicated port called an SFP slot, found on switches and routers.


Switch
┌────────────────────────────────────┐
│ Port1  Port2  Port3  [SFP slot]    │
└────────────────────────────────────┘
                           ↑
                 Transceiver's port

3 parts for connection

There are 3 essential parts involved in this type of connection.

1. Transceiver （Exchange module）
    This is inserted to Switch's SFP slot
    This plays a role for conversion between electric and light

2. Fiber Cable （Optical fiber cable）
    This is a cable itself to connect between Transceivers
    There are two kinds of MMF or SMF

3. Switch or Router 
    These devices have a dedicated port for Transceiver

It is important to know that a single Transceiver alone is not enough- you need one at each end.

Switch A                                 Switch B
┌────────────┐                           ┌────────────┐
│ [SFP slot] │                           │ [SFP slot] │
│ Transceiver├─────── Fiber Cable ───────┤Transceiver │
└────────────┘                           └────────────┘ 
　↑                                        ↑
Electrical signal → Optical signal      Optical signal → Electrical signal

Understanding by familiar analogy

Transceiver is like HDMI conversion adapter for smartphone.

Smartphone （USB-C）
　↓
Conversion adapter （USB-C → HDMI）← Transceiver
　↓
HDMI cable ← Fiber Cable
　↓
Conversion adapter （HDMI → other terminal）← another Transceiver
　↓
TV

Just as a smartphone can only handle USB-C natively, it can connect to an HDMI cable through an adapter. In the same way, a switch can connect to optical fiber through a Transceiver.

Fiber cable type

There are two types of optic fiber cables; MMF and SMF.

MMF (Multi-Mode Fiber)

Inside this cable, light proceeds with reflecting many times.

Images of cross section of the cable 

　　↗ ↘ ↗ ↘
→　　　　　　　→（Proceed with reflection）
　　↘ ↗ ↘ ↗

The more reflections occur, the more the signal degrades.

Features
・Thick core（50〜62.5μm）
・For short distance（〜about 300m）
・Cheap
・Use in data center

SMF (Single-Mode Fiber)

Inside this cable, light travels in a single straight path without reflection.

Images of cross section of the cable 
→→→→→→→→→→→→（Proceed straightly）

This type of the cable is more stable, which makes it possible to use for long distance.

Features
・Thin core（9μm）
・For long distance（〜10km以上）
・Expensive
・Use between bases

What is 10GBase-SR and 10GBase-LR

Transceiver has two kinds of SR and LR.
Understanding the naming structure eliminates the need for memorization.

10G  Base  SR
 │    │    │
 │    │    └ S = Short （Short distance）/ L = Long （Long distance）
 │    │      R = Fiber （Optic fiber）
 │    └ Baseband transmission
 └ 10Gbps（Communication speed）

Standard	Transceiver	Fiber Cable	Distance
10GBase-SR	SR compatible module	MMF	〜300m
10GBase-LR	LR compatible module	SMF	〜10km

The concept of how to use them differently

It is essential to understand that Transceiver and Fiber Cable must always be selected as a matching set.

✓ SR compatible Transceiver + MMF → correct
✗ SR compatible Transceiver + SMF → no function

Decision making orders↓

1. Decide distance
　 → short distance （inside data center） or long distance （between bases）

2. Select Transceiver
　 → short distance = SR / long distance = LR

3. Match Fiber Cable
　 → SR = MMF / LR = SMF

Big picture

【short distance: e.g. inside data center】

Switch A
　└ SFP slot
　　　└ Transceiver（10GBase-SR）
　　　　　└ MMF（〜300m）
　　　　　　　└ Transceiver（10GBase-SR）
　　　　　　　　　└ SFP slot
　　　　　　　　　　　└ Switch B

【long distance ：e.g. between bases】

Switch in Tokyo office
　└ SFP slot
　　　└ Transceiver（10GBase-LR）
　　　　　└ SMF（〜10km）
　　　　　　　└ Transceiver（10GBase-LR）
　　　　　　　　　└ SFP slot
　　　　　　　　　　　└ Switch in Osaka office

Conclusion

I used to struggle with memorizing these concepts because I lacked a deep understanding of the structure. Transceiver and Fiber Cable are completely separate components. Once you understand that the choice is driven by distance requirements, everything falls into place.

I finally understood the types of LAN cables by focusing on how they actually work.

TAKUMI SUGATA — Sun, 26 Apr 2026 05:15:42 +0000

Introduction

While studying for CompTIA Network+, I couldn't memorize the types of LAN cables and their use cases. Every time I faced these questions in mock tests, I got them wrong because of the complexity. Understanding the structure behind them cleared things up, so I decided to write it down.

What is LAN cable

LAN cable is the cable that connects between computers and network devices physically. The official name is Ethernet cable.

The connectors attached to both ends of the cable are called RJ-45, and each consists of 8 thin wires (pins).

What is a pin

There are 8 thin copper cables inside LAN cable.
These wires, called pins, are each numbered from 1 to 8. Understanding that there are TX (send) and RX (receive) pins is the key to understanding why different cable types exist.

Cross section of RJ-45 connector (8 pins)

┌────────────────────────┐
│ 1  2  3  4  5  6  7  8 │
└────────────────────────┘

4 pins are used to send and receive data.

No 1 & 2 pin →  send data (TX)
No 3 & 6 pin →  receive data (RX)

As a premise, there are TX and RX, which makes us easy to understand the type of LAN cable.

Why we need each type of cables

This is main part of this post.
In the data transfer, both sending and receiving sides are needed.

Device A - sending pin (TX)  → Device B - receiving pin (RX) 
Device B - sending pin (TX)  → Device A - receiving pin (RX)

This TX → RX combination is what makes communication possible.

Cable type

■Straight-Through

This is the cable that pin at both ends are set at the same order.
This cable is used to connect between different devices.

One end          the other end 
No 1 pin  ─────→ No 1 pin
No 2 pin  ─────→ No 2 pin
No 3 pin  ─────→ No 3 pin
…

Why this is used to connect different devices

This is an example of different devices (PC and Switch) ;

PC is designed to send data at No 1 and 2 pins
Switch is designed to receive data at No 1 and 2 pins

PC and Switch are initially designed to transfer data at reverse pins.
Because of this design difference, using a Straight-Through cable naturally results in a proper TX → RX connection between different devices.

So, it is just to use Straight-Through for sending and receiving data at different devices due to each structure.

PC : TX (No 1 and 2) ──→ Switch : RX (No 1 and 2)
Switch : TX (No 3 and 6) ──→ PC : RX ( No 3 and 6)

Use case

This type of cable is used to connect to different types of devices.

PC → Switch
PC → HUB
Router → Switch

■Crossover

This is the cable that pin at both ends are set at crossed order.
This cable is used to connect between the same type of devices.

One end          the other end 
No 1 pin  ─────→ No 3 pin
No 2 pin  ─────→ No 6 pin
No 3 pin  ─────→ No 1 pin
No 6 pin  ─────→ No 2 pin
…

Why this is used to connect the same type of devices

This is an example of the same type of devices (PCs) ;

Both PC-A and PC-B are the same design to send data at No 1 and 2 pins.

If we use Straight-Through cable;

PC-A : TX (No 1 and 2) ──→ PC-B : TX (No 1 and 2)
　→ Both devices end up connected on the sending side, so neither can receive data. 
　→ No connection

Therefore, the cable designed crossed pins is needed in this situation.

PC-A : TX (No 1 and 2) ──→ PC-B : RX (No 3 and 6)
PC-B : TX (No 3 and 6) ──→ PC-A : RX (No 1 and 2)

This is the role of crossover cable.

Use case

This type of cable is used to connect to the same type of devices.

PC → PC
Switch → Switch
Router → Router

■Rollover

This is the cable that pins are reversed totally.
This is also called Console cable.

One end          the other end 
No 1 pin  ─────→ No 8 pin
No 2 pin  ─────→ No 7 pin
No 3 pin  ─────→ No 6 pin
…

This is not for data transfer but for managing or configuring devices.

Use case

PC → Router's console port
PC → Switch's console port

What is console port

First of all, we need to understand what console port is.
This is the physical connecting port attached at Router or Switches.

Router's main body
┌───────────────────────┐
│ [LAN] [WAN] [Console] │
└───────────────────────┘
                ↑
This is the console port, which is used to connect by Rollover cable

Why the connection used by console port is needed

Normal networking connection（ via LAN）
　→ no connection without IP address settings

Console connection
　→ connection without IP address settings 
　→ use for initial settings or recovery for mechanical issues

Whether you are setting up a device for the first time or have misconfigured it and lost network access, the console port allows you to access the device directly.

Summary

Cable	Pin's array	Use case	Key words
Straight-Through	Same order	Different devices	Different = Straight
Crossover	Crossed order	Same devices	Same = Cross
Rollover	Reversed order	Console access	Only for setting

Additional Tips

Most modern NICs (Network Interface Cards) and switches come with Auto-MDI/MDIX built in. This feature allows devices to connect even if the wrong cable type is used.

Therefore, these function makes us possible to connect with incorrect cables.
However, in the exam of CompTIA Network +, we have to understand each type of cables and those use cases.

Conclusion

I used to struggle with these questions when I tried to rely on memorization alone.
Once I grasped how TX and RX pins work, everything fell into place.

Why Does Level 0 Mean the Most Severe? Understanding Syslog Severity Levels

TAKUMI SUGATA — Thu, 23 Apr 2026 22:59:22 +0000

Introduction

While studying for CompTIA Network+, I couldn't totally grasp the severity levels in Syslog. There are 8 levels (0 to 7), and what made it even harder was that a smaller number means higher severity - which felt completely counterintuitive.

Once I connected it to practical use cases, everything clicked. So I decided to write it down.

What is Syslog

Firstly, let's understand what Syslog is. It is a protocol used by network devices to send and receive log message.

If errors happen in routers or switches, it can centrally manage the log information by collecting in Syslog server.

routers ──→
switches ──→ Syslog server (manage network device logs)
servers ──→

Why central management is needed

Without a Syslog server, engineers have to log in to each network device individually to check logs when an issue occurs. This increases the risk of oversight and makes it harder to identify the root cause quickly.

However, Syslog server is useful in case of that because it collects logs from multiple network devices in chronological order. An engineer is able to pursue a chain of system failures like below.
" 8 p.m. Level 2 error happens at a router, two minutes later Level 3 error happens at a switch. "

Protocol structure

Most network devices have a built-in function to send logs.

NW devices (Router・Switch)
　└ Attached a function sends Syslog 
　　　↓ Sending Port : UDP 514
Syslog server (Receiving・Accumulating・Visualization)

Role	Name	Example
Sending side	Syslog clients / Generator	Router ・ Switch
Receiving side	Syslog server / Collector	Splunk・Graylog

Port Number

Protocol	Port	Features
UDP 514	Default	Lightweight ・Fast・No delivery guarantee
TCP 514	Partial use	Delivery guaranteed ・ Reliable
TCP 6514	TLS encryption	Secure sending

In a CompTIA Network+ exam, memorizing UDP 514 is enough.

The reason why UDP is used is that common systems focus to prioritize the speed and light weight in spite of the lack of some logs.

What is Severity Level

Syslog message has 8 Level severity.

It is important to know Smaller number is more severe.

Level	Name	Meaning	Example
0	Emergency	Whole system is down	OS crash
1	Alert	Need to instant handle	Just before memory exhaustion
2	Critical	Severe error	Hardware issue
3	Error	Error occurance	Interface down
4	Warning	Warnings	High disk usage
5	Notice	Normal but need to beware	Configuraion change
6	Informational	Common information	User login
7	Debug	Detail for debug	Detailed trace for Packet

Why Number zero is the most severe

The numbering confused me at first because it feels counterintuitive.

In a computer field, it is common that Number 0 regards as a top priority.
Syslog follow this concept as well.

An imagination of thermometer can provide easy understanding.

0 Emergency  ← 🔥 The hottest（Unless instant solution, the system die）
1 Alert
2 Critical
3 Error
4 Warning
5 Notice
6 Informational
7 Debug       ← 🧊 The coldest（A detailed log for a developer）

Practical use is below

Level 0 Emergency → Even midnight, engineers need to handle 
Level 7 Debug     → Engineers glance at it over a cup of coffee

The higher number, the more calm

Memorization

Every Awesome Cisco Engineer Will Need Iced Drink

Word	Level	Name
Every	0	Emergency
Awesome	1	Alert
Cisco	2	Critical
Engineer	3	Error
Will	4	Warning
Need	5	Notice
Iced	6	Informational
Drink	7	Debug

Practical use

Set a policy

First of all, we have to set a policy that which severity level are needed to send to Syslog server.

Production environment → Over Level 3（Error）
Development environment → All of Level 7（Debug）

If all levels are forwarded to the Syslog server, the sheer volume of logs can make it easy to overlook critical ones. Therefore, it is common to set a limited policy in production environment.

Consider accumulation and correspondence

Level 0〜2 → Immediate response
Level 3〜4 → Confirm it until next business day
Level 5〜7 → Confirm it in regular review

Point to note about UDP

UDP is the port that prioritizes speed rather than secure and trust, therefore it is not guaranteed to reach to the destination correctly. With UDP, in case of network issue, the log may not send to Syslog server.

On the other hand, because TCP or TLS is more trustable protocol, they are used in more important system such as production environment.

Conclusion

The counterintuitive numbering - where a smaller number means higher severity - combined with eight levels to memorize, made this topic one of the hardest to grasp.

The mnemonic and thermometer analogy make it easier to remember. Connecting it to practical use cases accelerates understanding even further.

Stop Memorizing the PDU names — Understand It Like Amazon Delivery

TAKUMI SUGATA — Wed, 22 Apr 2026 22:35:15 +0000

Introduction

While studying for CompTIA Network+, I couldn't totally grasp the PDU names in the OSI model. I could memorize them, but I never understood why the names are what they are.

One day, while ordering some items on Amazon, it hit me — the ordering process maps perfectly to the OSI model. So I decided to write it down.

What is OSI model

The OSI model is a framework that divides network communication into 7 layers. Separating responsibilities by layer makes it easier to identify which layer is causing a problem.

Layer	Name
7	Application
6	Presentation
5	Session
4	Transport
3	Network
2	Data Link
1	Physical

Note: This mnemonic goes from Layer 1 to 7 (bottom to top).
Physical → Data Link → Network → Transport → Session → Presentation → Applicaion

What is PDU

PDU (Protocol Data Unit) is the name given to data at each layer. Each time data passes through a layer, it gets a new name.

Layer	PDU name
7–5	Data
4	Segment
3	Packet
2	Frame
1	Bit

We can memorize them:
" Do Some People Fear Birthdays?"

Data → Segment → Packet → Frame → Bit

What is Encapsulation and Decapsulation

-Encapsulation: The process of adding headers to data as it moves down the layers (sender side).
-Decapsulation: The process of removing headers from data as it moves up the layers (receiver side).

We can memorize them:

-En = put in an envelope → Top to Bottom (7-1), adding header when sending.
-De = take out of the envelope → Bottom to Top (1-7), removing header when receiving.

Understand the concept with Amazon ordering

This section is the main part of this article.
When I think about Amazon ordering process - from ordering items to delivering them, I could understand them easily.

Layer 7-5 (Data) - Items themselves

Data represents the items we ordered in Amazon.
T-shirts, gadgets, or other items stays in Amazon warehouse.
It is not wrapped yet.

Layer 4 (Segment) - Dividing and Numbering them

It can be difficult to deliver them, if the order consists of multiple items.
Therefore, we need to divide into small portion and numbering them 1,2,3…

Without numbers, it would be impossible to identify which piece is missing if they arrive out of order.

Layer 3 (Packet) - Putting in boxes and Labeling them

In this process, divided items are put into boxes and labeling each of them.
Labels show the destination address about receiver (IP address).
The multiple boxes come to do have same address labels.

The labels are useful to determine routes to deliver.

Layer 2 (Frame) - Adding relay labels about next delivering center to Boxes

The destination address (IP address) always stays the same, but the package doesn't travel directly to the final destination -it goes through multiple delivery centers along the way.

The actual delivering process is going through many delivering center in each locations until completing delivering, and relay labels, shows destination center, are replaced each time.
This label is the Frame (MAC Address).

-Destination address label (IP Address) = Final destination = stays same
-Relay label (MAC Address) = Next center destination = replaced whenever the items go through delivering center

Layer 1 (Bit) - Transporting

Actually, those boxes are transported physically by track.
Items go through cables or wireless as electrical or light signal (0,1) .
Ultimately, any data are exchanged to 0 and 1.

Conclusion

[Sending side: Encapsulation]
Items (Data)
↓ Dividing and numbering
Segments
↓ Labeling with destination address (IP Address)
Packets
↓ Labeling with next delivery center (MAC Address)
Frames
↓ Physical transport
Bits → Network

[Receiving side: Decapsulation]
Bits ← Network
↓ Removing relay labels at each delivery center
Frames → Packets → Segments
↓ Reassembling and unpacking
Items (Data)