TSSR module 2: networks, the heart of the job

Day 15 · 17/11 — The OSI model and the TCP/IP model

Goal: draw both models from memory and place each common protocol in its layer.

Theory 1/2: why layers

A network mixes cables, cards, addresses and applications. Splitting the problem into layers lets each one talk only to its neighbours: you swap Wi-Fi for fibre without touching the browser. Two models share the vocabulary:

• The OSI model, published by ISO in 1984 (standard ISO 7498): seven layers, a reference to reason and troubleshoot with.
• The TCP/IP model, the one that won in practice: it comes from the work of Vint Cerf and Bob Kahn (1974), and ARPANET switched to it on 1 January 1983. Four layers.

Theory 2/2: the layers and their protocols

A mnemonic from layer 1 to 7: Please Do Not Throw Sausage Pizza Away (Physical, Data link, Network, Transport, Session, Presentation, Application).

Practice (30 min)

1. On a blank sheet, draw the seven OSI layers on the left and the four TCP/IP layers on the right, with how they match.
2. Place in the right layer: HTTP, TCP, IP, Ethernet, DNS, UDP, ARP, Wi-Fi, SSH, ICMP, optical fibre.
3. Compare with the table; correct in red.
4. Start again on a new sheet without looking, until a drawing has no red.

Recap (10 min)

Three lines: why we split into layers, what layer 3 does, what layer 4 does. Then recite the layers from 7 to 1.

Day 16 · 18/11 — Encapsulation, PDUs, frames, packets, segments

Goal: follow data down the layers when sending and up again when receiving, and see it in Wireshark.

Theory 1/2: encapsulation

When sending, each layer adds its header in front of the data from the layer above: encapsulation. When receiving, each layer reads and strips its header: decapsulation. A layer's unit of data is a PDU (Protocol Data Unit):

• layer 4: segment (TCP) or datagram (UDP), with source and destination ports;
• layer 3: packet, with source and destination IP addresses and the time to live (TTL);
• layer 2: frame, with MAC addresses and an error check (FCS) at the end;
• layer 1: bits.

Theory 2/2: ping, ICMP and TTL

ping sends ICMP "echo request" messages and waits for "echo replies". ICMP travels straight inside IP, with no TCP or UDP, so no port. A packet's TTL drops by 1 at each router; at 0 the packet is dropped and the router sends back an ICMP "time exceeded" message. That is what traceroute relies on.

Practice (30 min)

1. Start Wireshark, pick your active network card, start capturing.
2. In a terminal: ping -c 4 debian.org (Linux) or ping debian.org (Windows).
3. Stop the capture, type the filter icmp.
4. Click a request. In the middle pane, expand each level: Frame (layer 1), Ethernet II (source and destination MAC), Internet Protocol (source and destination IP, TTL), ICMP (type 8 for the request, 0 for the reply).
5. Note in the notebook the two MAC addresses, the two IP addresses and the reply's TTL.

Recap (10 min)

Draw a frame holding a packet holding a segment, with what each header carries. Then redo the capture without notes.

Day 17 · 19/11 — IPv4: classes, mask, network and host, CIDR

Goal: for an address and a mask, find the network, the broadcast and the number of hosts.

Theory 1/3: the address and the mask

An IPv4 address is 32 bits, written as four decimal bytes: 192.0.2.77. The mask says which part names the network (the bits at 1) and which part names the host (the bits at 0). The mask 255.255.255.0 is also written /24: twenty-four bits at 1. That is CIDR notation (Classless Inter-Domain Routing), introduced in 1993 (RFC 1519, today RFC 4632).

Theory 2/3: network, broadcast, hosts

• Network address: all host bits at 0. For 192.0.2.77/24: 192.0.2.0.
• Broadcast address: all host bits at 1: 192.0.2.255.
• Usable hosts: 2^{host bits} − 2. For a /24: 2⁸ − 2 = 254.

Quick method when the prefix cuts a byte: the block size is 256 minus the mask's value in that byte. For a /26 the mask ends in 192, the block size is 64: networks start at 0, 64, 128, 192. 192.0.2.77/26 falls in the 64 block: network 192.0.2.64, broadcast 192.0.2.127.

Theory 3/3: classes and reserved ranges

Before CIDR, the first byte set the class and therefore the mask: class A from 1 to 126 (/8), B from 128 to 191 (/16), C from 192 to 223 (/24), D from 224 to 239 (multicast), E beyond (reserved). Classes no longer drive routing, but the vocabulary stays. The 127 range is reserved for loopback (127.0.0.1). RFC 1918 (1996) reserves three private ranges, not routed on the Internet: the 10/8 block, the 172.16/12 block and the 192.168/16 block.

Practice (30 min)

Ten identification exercises, by hand. For each: network address, broadcast address, first and last usable address, number of hosts.

1. 192.0.2.10/24
2. 192.0.2.200/25
3. 198.51.100.77/26
4. 198.51.100.130/27
5. 203.0.113.45/28
6. 203.0.113.99/29
7. 192.0.2.250/30
8. 198.51.100.1/23
9. 203.0.113.17/28
10. 192.0.2.129/26

Check with ipcalc in the Debian VM (sudo apt install ipcalc, then ipcalc 192.0.2.200/25).

Recap (10 min)

Write the block-size method in three lines, then redo exercises 4 and 7 without notes.

Day 18 · 20/11 — Subnetting 1/2: the method

Goal: split a network into equal subnets, with a written method you will follow every time.

Theory 1/2: borrowing bits

Subnetting means borrowing host bits to make network bits. Each borrowed bit doubles the number of subnets and halves their size.

1. How many subnets? Find n such that 2ⁿ ≥ the number wanted.
2. New prefix = old prefix + n.
3. Block size = 256 − the mask's value in the byte that is cut (or 2^{host bits left} in that byte).
4. List the subnets block by block; each runs from its network address to (next − 1), which is its broadcast.

Example: 192.0.2.0/24 into 4 subnets. 2² = 4, so n = 2 and /26. Mask 255.255.255.192, block size 64: .0, .64, .128, .192, with 62 hosts each.

Theory 2/2: splitting by host count

Often the question starts from the number of hosts: "50 workstations per department". Find the smallest h such that 2^h − 2 ≥ 50: h = 6 (62 hosts), so prefix 32 − 6 = /26. When needs differ between departments, you cut different sizes starting with the largest: that is VLSM (variable-length subnet masks).

Practice (30 min)

Ten guided splits: write the four steps of the method for each one.

1. 192.0.2.0/24 into 2 subnets.
2. 192.0.2.0/24 into 8.
3. 198.51.100.0/24 into 16.
4. 203.0.113.0/24 into 3 (how many do you really get?).
5. 198.51.100.0/25 into 4.
6. 192.0.2.0/24 into subnets of 30 hosts.
7. 203.0.113.0/24 into subnets of 12 hosts.
8. 198.51.100.0/24 into subnets of 100 hosts.
9. Point-to-point links (2 hosts) in 192.0.2.0/26: how many?
10. VLSM in 203.0.113.0/24: one department of 100, one of 50, one of 20, two links of 2.

Recap (10 min)

Copy out the four-step method from memory, then redo split 2 without notes.

Day 19 · 21/11 — Subnetting 2/2: timed training

Goal: split on your own, without a calculator, in under five minutes per exercise.

Theory (20 min): the reflexes

Speed comes from a few tables known by heart:

Block size + mask value = 256; hosts = block size − 2. To find an address's network: the largest multiple of the block size less than or equal to the byte. The broadcast: network + block size − 1.

Practice (30 min)

Ten splits on your own, stopwatch running, goal under 5 minutes each. For each, list every subnet with network, usable range and broadcast.

1. 198.51.100.0/24 into 4.
2. 203.0.113.0/24 into 8.
3. 192.0.2.0/24 into subnets of 14 hosts (the first four).
4. 198.51.100.128/25 into 4.
5. 203.0.113.0/26 into 4.
6. 192.0.2.0/24: one department of 60, one of 28, one of 10.
7. Network and broadcast of 198.51.100.93/27.
8. Network and broadcast of 203.0.113.201/29.
9. 192.0.2.64/26 into /30 links: the first three.
10. 198.51.100.0/23 into 4.

Note each time. Over 5 minutes, redo it tomorrow at the start of the session.

Recap (10 min)

Copy the /25 to /30 table from memory. It is the most useful table of the job.

Day 20 · 22/11 — IPv6: format, address types, autoconfiguration

Goal: read and shorten an IPv6 address, and recognise its types.

Theory 1/2: the format

IPv4 offers only about 4.3 billion addresses; IPv6, specified in 1998 (RFC 2460) and finalised in 2017 (RFC 8200), offers 2¹²⁸. An IPv6 address is written as eight groups of four hexadecimal digits separated by :. Two shortening rules (RFC 5952):

1. drop the leading zeros of each group: 0db8 → db8, 0000 → 0;
2. replace one single run of zero groups, the longest, with ::.

2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. A local IPv6 network is almost always a /64: 64 bits of prefix, 64 bits of interface identifier.

Theory 2/2: types and autoconfiguration

• Global unicast (2000::/3): routable on the Internet. 2001:db8::/32 is reserved for documentation.
• Link-local (fe80::/10): present on every interface, valid on the link only.
• Unique local (fc00::/7, in practice fd00::/8): the counterpart of private addresses.
• Multicast (ff00::/8): IPv6 has no broadcast; it uses multicast.
• Loopback: ::1.

With SLAAC (stateless address autoconfiguration, RFC 4862), the router announces the network prefix and each machine builds its own address. ARP is replaced by NDP, the neighbour discovery protocol.

Practice (30 min)

1. Shorten these five addresses: 2001:0db8:0000:0000:0001:0000:0000:0001; 2001:0db8:00a0:0000:0000:0000:0000:0000; fe80:0000:0000:0000:020c:29ff:fe12:3456; 2001:0db8:0001:0002:0003:0004:0005:0006; 0000:0000:0000:0000:0000:0000:0000:0001.
2. Do the reverse: write 2001:db8::a:0:1 out in full.
3. In the Debian VM: ip -6 addr. Find the interface's link-local address and its prefix.

Recap (10 min)

Three lines: the two shortening rules, three address types with their prefix, what SLAAC does.

Day 21 · 23/11 — Ethernet, MAC addresses, switch, VLAN

Goal: understand how a switch forwards, and build two VLANs joined by a trunk in Packet Tracer.

Theory 1/2: Ethernet and the switch

Ethernet was born at Xerox PARC in 1973 (Bob Metcalfe) and standardised by the IEEE as 802.3. Each card has a 48-bit MAC address, written in hexadecimal (00:1a:2b:3c:4d:5e); the first 24 bits identify the maker (OUI). A switch learns which port each source MAC address sits behind and fills its MAC table. It then sends each frame only out of its destination's port; an unknown destination or a broadcast (ff:ff:ff:ff:ff:ff) goes out of every port.

Theory 2/2: VLANs

A VLAN splits a switch into several separate logical networks: a broadcast does not leave its VLAN. An access port belongs to one VLAN. A trunk port carries several VLANs between two switches by tagging each frame with its VLAN number (IEEE 802.1Q). To go from one VLAN to another you need a router or a layer 3 switch.

Practice (30 min) — Packet Tracer

1. Place two 2960 switches joined by a straight-through cable (ports Gi0/1), and four PCs: two per switch.
2. On each switch, in the CLI:

   enable
   configure terminal
   vlan 10
    name ACCOUNTS
   vlan 20
    name WORKSHOP
   interface fa0/1
    switchport mode access
    switchport access vlan 10
   interface fa0/2
    switchport mode access
    switchport access vlan 20
   interface gi0/1
    switchport mode trunk
   end
   show vlan brief
   show interfaces trunk

3. Address the PCs: VLAN 10 in 192.0.2.0/24, VLAN 20 in 198.51.100.0/24.
4. Check: a VLAN 10 PC reaches the other VLAN 10 PC across the trunk; it does not reach VLAN 20.
5. Look at the MAC table: show mac address-table.

Recap (10 min)

Three lines: how the switch learns, access versus trunk, why two VLANs cannot talk without a router.

Day 22 · 24/11 — ARP: from IP address to MAC address

Goal: explain how a machine finds its neighbour's MAC, and read an ARP table.

Theory (20 min)

To send a packet on the local network you need the destination's MAC address; you only know its IP. ARP (Address Resolution Protocol, RFC 826, 1982) makes the link:

1. the machine broadcasts "Who has 192.0.2.20? Tell 192.0.2.10" to ff:ff:ff:ff:ff:ff;
2. only the machine holding that IP replies, directly, with its MAC;
3. the sender keeps the mapping for a few minutes in its ARP cache.

If the destination is on another network, the machine does not look for its MAC: it looks for its gateway's, and hands it the packet. ARP does not check who answers: an attacker can announce a false mapping (ARP poisoning). IPv6 replaces ARP with NDP.

Practice (30 min)

1. In the Debian VM: ip neigh. Note the entries and their state (REACHABLE, STALE…).
2. Flush the interface's cache: sudo ip neigh flush dev <interface> (the name comes from ip link).
3. Start Wireshark with the filter arp, then ping the gateway: watch the broadcast request and the reply.
4. On Windows: arp -a, compare the gateway's MAC as seen from both VMs.

Recap (10 min)

Draw the ARP exchange as two arrows, with each message's addresses. Then redo step 3 without notes.

Day 23 · 25/11 — Routing: routing table, gateway, static routes

Goal: read a routing table, and join two networks with static routes.

Theory 1/2: the routing decision

A router joins networks. For each packet it looks up its routing table: a list of destinations (network/prefix), each with the next hop or the outgoing interface. It picks the most specific matching route, the one with the longest prefix. The default route (0.0.0.0/0) catches everything else. A PC's default gateway is nothing but its default route.

Theory 2/2: static versus dynamic

A static route is written by hand: simple and predictable, but it does not adapt to a failure. Dynamic protocols (RIP, OSPF, BGP between operators) exchange routes automatically. On a small network, a few static routes are enough.

Practice (30 min) — Packet Tracer

1. Place two 2911 routers (R1, R2), joined by their Gi0/1 ports. Behind each, a switch and a PC.
2. Addressing: R1's LAN in 192.0.2.0/24 (R1 = .1), R2's LAN in 198.51.100.0/24 (R2 = .1), the R1-R2 link in 203.0.113.0/30 (R1 = .1, R2 = .2).
3. On R1:

   enable
   configure terminal
   interface gi0/0
    ip address 192.0.2.1 255.255.255.0
    no shutdown
   interface gi0/1
    ip address 203.0.113.1 255.255.255.252
    no shutdown
   ip route 198.51.100.0 255.255.255.0 203.0.113.2
   end
   show ip route

4. Do the same on R2, with the return route to 192.0.2.0/24 via 203.0.113.1.
5. Give each PC its address and gateway, then ping from one LAN to the other. If it fails, look for the missing return route: it is the most common fault.

Recap (10 min)

Three lines: the longest-prefix rule, what a gateway is, why a route is needed in each direction.

Day 24 · 26/11 — DHCP: DORA and reservations

Goal: tell the four DHCP messages and configure a DHCP server.

Theory (20 min)

DHCP (RFC 2131, 1997), BOOTP's successor, hands out an IP address, a mask, a gateway and DNS servers automatically, for a limited time: the lease. The four-step exchange is remembered as DORA:

1. Discover: the client, with no address, broadcasts "is there a DHCP server?";
2. Offer: the server offers an address;
3. Request: the client asks for the offered address (by broadcast, so other servers know it has chosen);
4. Ack: the server confirms and the lease begins.

The client uses UDP port 68, the server port 67. A reservation always gives the same address to a MAC address: handy for a printer. Since Discover is a broadcast, it does not cross a router; a DHCP relay (ip helper-address on Cisco) forwards it to a server on another network.

Practice (30 min) — Packet Tracer

1. Take the day 23 lab. On R1, create a pool for its LAN:

   configure terminal
   ip dhcp excluded-address 192.0.2.1 192.0.2.10
   ip dhcp pool LAN1
    network 192.0.2.0 255.255.255.0
    default-router 192.0.2.1
    dns-server 192.0.2.53
   end

2. Switch the PC on R1's LAN to DHCP (Desktop → IP Configuration → DHCP): it should get 192.0.2.11.
3. In Simulation mode, filter on DHCP and request again: watch the four DORA messages go by.
4. On R1: show ip dhcp binding.

Recap (10 min)

Write DORA with who sends what, broadcast or not. Then recreate the pool without notes.

Day 25 · 27/11 — DNS: resolution and records

Goal: follow a DNS resolution end to end and query real domains.

Theory 1/2: resolution

DNS turns names into addresses. Paul Mockapetris designed it in 1983; its reference specifications are RFC 1034 and 1035 (1987). The system is a tree: the root ., then the top-level domains (.org, .fr), then the domains. Your machine asks a resolver (your router's or your network's), which does the work: it asks a root server, which points it to the top-level domain's servers, which point it to the domain's authoritative servers, which give the answer. The resolver caches it for its time to live (TTL). Queries mostly use UDP on port 53.

Theory 2/2: records

• A: name → IPv4 address; AAAA: name → IPv6 address.
• CNAME: an alias to another name.
• MX: the domain's mail server, with a priority.
• NS: the domain's authoritative servers.
• Also: PTR (address → name, reverse resolution), TXT (free text, used for example by SPF).

Practice (30 min)

1. In the Debian VM: sudo apt install dnsutils.
2. On five real domains of your choice (for example debian.org, wikipedia.org, kernel.org…), query:

   dig debian.org A +short
   dig debian.org AAAA +short
   dig debian.org MX +short
   dig debian.org NS +short
   dig www.wikipedia.org CNAME +short

3. Run dig +trace debian.org: you see the walk root → .org → the domain's servers.
4. On Windows: nslookup -type=MX debian.org.
5. Table in the notebook: domain, A, AAAA, MX, NS.

Recap (10 min)

Draw the full resolution as four arrows. Recite the A, AAAA, CNAME, MX, NS types and their role.

Day 26 · 28/11 — NAT and PAT: private addressing and translation

Goal: explain why a whole private network goes out through one public address, and configure it.

Theory (20 min)

RFC 1918 private addresses are not routed on the Internet. NAT (Network Address Translation, described in RFC 1631 in 1994) replaces them on the way out with a public address. Three forms:

• Static NAT: one private address ↔ one public address, fixed (to publish a server).
• Dynamic NAT: a pool of public addresses shared on demand.
• PAT (or NAT overload, "masquerade" on Linux): every machine shares one public address; the router tells them apart by the source port, which it rewrites and keeps in its translation table. That is what your home router does.

Cisco vocabulary: inside local (the PC's private address), inside global (the public address standing for it). NAT extended IPv4's life, at a cost: an incoming connection does not know which machine to go to without port forwarding.

Practice (30 min) — Packet Tracer

In the lab, R1's LAN plays the private network. The R1-R2 link plays the Internet; R2 plays the remote server.

1. On R1:

   configure terminal
   access-list 1 permit 192.0.2.0 0.0.0.255
   interface gi0/0
    ip nat inside
   interface gi0/1
    ip nat outside
   ip nat inside source list 1 interface gi0/1 overload
   end

2. Remove R2's route to 192.0.2.0/24 (no ip route ...): R2 no longer knows the "private" network.
3. Ping R2 from the PC: it still answers, thanks to NAT.
4. On R1: show ip nat translations. Find inside local and inside global.

Recap (10 min)

Three lines: why NAT exists, static versus PAT, what the translation table holds.

Day 27 · 29/11 — Wi-Fi: 802.11, channels, WPA2 and WPA3

Goal: analyse your own Wi-Fi network: band, channel, signal, security.

Theory 1/2: standards and channels

The IEEE 802.11 family dates from 1997; the Wi-Fi Alliance later gave it marketing numbers: Wi-Fi 4 (802.11n), Wi-Fi 5 (802.11ac), Wi-Fi 6 and 6E (802.11ax), Wi-Fi 7 (802.11be). Three bands:

• 2.4 GHz: good range, little room; in Europe only channels 1, 5, 9 and 13 (or 1, 6, 11) do not overlap at 20 MHz.
• 5 GHz: many more channels, more throughput, less range.
• 6 GHz (Wi-Fi 6E and 7): even more room, shorter range.

Signal is measured in dBm, a negative value: −50 dBm is excellent, −70 dBm fair, below −80 dBm the connection gets fragile.

Theory 2/2: security

WEP (1997) has been broken since the early 2000s; WPA was an emergency fix. WPA2 (2004, AES encryption) is still widespread; WPA3 (2018) replaces the key exchange with SAE, which resists offline dictionary attacks. In companies, "Enterprise" mode authenticates each user (802.1X, a RADIUS server) instead of a shared key.

Practice (30 min)

1. On Windows: netsh wlan show interfaces: note the SSID, band, channel, signal (in %), authentication type.
2. On Linux with NetworkManager: nmcli dev wifi list: note the neighbouring networks, their channel and signal.
3. Find the neighbouring networks sharing your channel on 2.4 GHz.
4. Take three readings in three rooms; write them down.
5. In your router's interface, check the security mode. Change nothing without noting the current settings.

Recap (10 min)

Three lines: the three bands and their trade-off, what −70 dBm means, why WPA3.

Day 28 · 30/11 — Module 2 review: troubleshooting

Goal: troubleshoot a connection layer by layer with the basic commands, then answer your own 40-question quiz.

Theory (20 min): bottom up

1. My configuration: ip a and ip route (Linux), ipconfig /all (Windows); ifconfig is the ancestor, still found on older systems. Do I have an address, the right mask, a gateway? A 169.254 address on Windows means DHCP did not answer.
2. My loopback: ping 127.0.0.1.
3. My gateway: ping it.
4. An outside IP: ping a known public address.
5. A name: ping debian.org. If the IP works and the name does not, it is DNS: dig or nslookup.
6. The path: traceroute (Linux) or tracert (Windows) shows where it stops.

Practice (30 min)

1. Run the six steps on your Debian VM and your Windows VM, and note each result.
2. Create a fault on purpose in the Debian VM: remove the gateway (sudo ip route del default), then run the method again and find the step that breaks. Reboot the VM to return to normal.
3. A 40-question quiz you write yourself: at least two questions per session of the module, ten of them subnet calculations. Answer without notes, correct with your notebook.

Recap (10 min)

Count your score. The topics you missed come back on day 55.