HacKSU Workshop00:00-01:00 HacKSU

Basic
Networking

What happens when your laptop sends data?

Your laptop

Local network

Internet

HacKSU · Slides + hardware · About one hour

Basics01:00-02:00 HacKSU

Start with the equipment

Catalyst 3560

48 × 10/100 PoE ports.
4 SFP slots, no modules.

TP-Link switch

5-port Gigabit desktop switch.
Extend the wired network.

GL.iNet AC1200

Wireless travel router.
Show DHCP and a default gateway.

PoE powers compatible devices over Ethernet. All Catalyst demo links use copper Fast Ethernet ports.

Basics02:00-04:00 HacKSU

Hub, switch, router

Hub · layer 1

Repeats signals to other ports.

Shared bandwidth and collision domain.

Switch · layer 2

Learns source MAC addresses.

Forwards frames within a VLAN.

Router · layer 3

Uses IP routes to choose a next hop.

Connects different IP networks.

An unmanaged switch is still a switch. A home router often combines several functions.

Basics04:00-05:00 HacKSU

Networking vendors

Vendor	Names to recognize	Examples of what they make
Cisco	Catalyst	Enterprise switches, including our 3560
Ubiquiti	UniFi	Gateways, switches, and Wi-Fi access points
HPE Aruba Networking	CX switches, APs	Campus and branch wired/wireless networks
TP-Link	Omada	Business networking; also desktop switches like ours
GL.iNet	Travel routers	Portable Wi-Fi routers, including our AC1200

Shared protocols, different management tools. Check the model’s features, licensing, and support.

Basics05:00-08:00 HacKSU

OSI: where would you look?

Layer	What it helps explain	Example question
7 · Application	Application protocols	Did the HTTP request succeed?
6 · Presentation	Data representation	Can the data be decoded?
5 · Session	Conversation management	Is the conversation maintained?
4 · Transport	TCP, UDP, ports	Can the service be reached?
3 · Network	IP and routing	Is there a route?
2 · Data link	Frames and local delivery	Is the peer on this VLAN?
1 · Physical	Signals and link	Is the cable connected?

Use the layers to narrow a problem. Real software does not always divide neatly into seven parts.

Basics08:00-09:00 HacKSU

TCP/IP uses fewer layers

TCP/IP model	Approximate OSI mapping	Examples
Application	5-7	HTTP, DNS, DHCP
Transport	4	TCP, UDP
Internet	3	IPv4, IPv6, ICMP
Link	1-2	Ethernet, Wi-Fi

TCP/IP names the protocol suite. It does not mean every packet uses TCP.

Basics09:00-10:00 HacKSU

Data travels inside other data

Ethernet frame

IP packet

TCP segment

Application data

On a routed Ethernet path, each router builds a new link-layer frame for the next hop.

Basics10:00-12:00 HacKSU

Three different addresses

MAC address

Local link-layer delivery.

02:00:00:00:00:0a

IP address

Network-layer addressing.

192.168.50.10

TCP / UDP port

A transport endpoint.

TCP 443

Examples only. A transport port is not a physical socket on the switch.

Local delivery12:00-14:00 HacKSU

How does a switch learn?

Host A

Port 1 · switch · Port 2

Host B

When a frame arrives	What the switch does
Source is A, arriving on port 1	Learn A → port 1 in this VLAN
Destination B is not learned yet	Flood to eligible other ports in this VLAN
B replies through port 2	Learn B → port 2; forward toward A

Learn from the source. Forward using the destination. The switch does not need to know the hosts’ IP addresses.

Basics14:00-16:00 HacKSU

What does /24 actually mean?

Host A: 192.168.50.10/24 · Mask: 255.255.255.0

Destination	Network with this /24	Decision for A
`192.168.50.20`	`192.168.50.0/24`	On the local subnet
`192.168.51.20`	`192.168.51.0/24`	Needs a route beyond the subnet

The first 24 bits identify this network; eight bits remain.
Here, .0 is the network address and .255 is the broadcast address.
A looks at its routes to choose an outgoing interface and next hop.

This example uses a /24. Matching the first three octets is not a general rule for every prefix length.

Local delivery16:00-18:00 HacKSU

ARP: from an IPv4 address to a MAC

1 · Ask locally

A broadcasts: “Who has 192.168.50.20?”

Ethernet destination:
ff:ff:ff:ff:ff:ff

2 · B replies

B supplies its MAC address, normally in a unicast reply to A.

A caches the IP → MAC mapping.

3 · Send the data

A can address an Ethernet frame to B’s MAC.

The IP packet still targets 192.168.50.20.

Host ARP cache: IP → MAC. Switch forwarding table: MAC + VLAN → port. They solve different problems.

Routed delivery18:00-20:00 HacKSU

Remote IP, local next hop

Host A
192.168.50.10/24

Gateway
192.168.50.1

Remote host
192.168.51.20

On A’s Ethernet link

IP destination: the remote host.

Ethernet destination: the gateway’s MAC, resolved with ARP.

At the router

Choose a route and next hop.

Build a new link-layer frame for the outgoing link.

Illustrative gateway, not the offline lab setup. Ordinary routing preserves the destination IP; NAT can rewrite it.

Basics20:00-23:00 HacKSU

IPv6: the same job, more space

IPv4

32-bit addresses

192.168.50.10

ARP on the local Ethernet link.

IPv6

128-bit addresses

2001:db8::10

Neighbor Discovery instead of ARP.

IPv6 has multicast, but no broadcast.
Dual stack means using IPv4 and IPv6 together.
A link-local address does not prove internet connectivity.

Basics23:00-24:00 HacKSU

TCP and UDP

TCP

Reliable, ordered byte stream.

Acknowledgments, retransmission, flow and congestion control.

Connections can still fail.

UDP

Independent datagrams.

No built-in delivery or ordering guarantee.

Applications can add reliability.

Neither is “always faster.” HTTP/3 uses QUIC over UDP.

Transport24:00-26:00 HacKSU

TCP: establish, acknowledge, recover

Connection setup	Direction	Purpose
SYN	Client → server	Start a connection; announce an initial sequence number
SYN + ACK	Server → client	Acknowledge the client; announce the server’s sequence number
ACK	Client → server	Acknowledge the server

Sequence numbers identify positions in the byte stream.
Acknowledgments and retransmission let TCP recover from loss.
A connection uses both IP addresses and both transport ports.

TCP does not encrypt traffic. A successful handshake does not prove an application request will succeed.

Basics26:00-27:30 HacKSU

DHCP: how a host gets its settings

Discover
Client asks

Offer
Server proposes

Request
Client selects

ACK
Server confirms

A typical initial DHCPv4 exchange is called DORA.
A lease can supply an IPv4 address, mask, gateway, and DNS servers.
The host renews its lease; the settings are not necessarily permanent.

The wired demo uses static settings. The GL.iNet router will show the DHCP-configured case.

Application services27:30-30:00 HacKSU

DNS: a name is not a route

Application asks
for a name

Local cache /
DNS resolver

DNS records
A / AAAA

Resolve the name

A records supply IPv4 addresses; AAAA records supply IPv6 addresses.

Cached answers can be reused until their TTL expires.

Then connect

The host still needs a route and next-hop delivery.

The transport connection and application request can fail separately.

DHCP configures the host. DNS resolves names. Neither guarantees that a website will load.

Basics30:00-32:00 HacKSU

DSL and cable

DSL

Access over telephone copper.

Distance and line quality matter.

Uses a DSL modem.

Cable

Coaxial access, often with fiber in the provider network.

Shared capacity and provisioning matter.

Uses a cable modem.

These are ways to reach the provider. Both carry IP traffic.

Basics32:00-35:00 HacKSU

Fiber and cellular

Fiber

Optical signals over fiber.

An optical network terminal serves many home deployments.

Sharing and upload rates depend on service.

Cellular

Radio access through a carrier.

Coverage, spectrum, congestion, and plan limits matter.

Supports mobile connections.

Hotspot: laptop → Wi-Fi → hotspot → cellular → carrier.

Basics35:00-36:00 HacKSU

The whole path sets the limit

TP-Link
Gigabit switch

Copper link
100 Mb/s maximum

Catalyst 3560
Fast Ethernet port

The Gigabit switch cannot make a Fast Ethernet port faster.

Check negotiated speed. Throughput is lower than the link rate; the empty SFP slots are unused.

Live demo · 12 minutes total36:00-38:00 HacKSU

Demo 1: no internet required

Host A
.10/24

Ethernet switch

Host B
.20/24

Presenter: physical Catalyst. You: two PCs + a 2960 in Packet Tracer.

Open your prepared network: 192.168.50.0/24, no gateway or DNS. Companion lab (.md) · Watching or pairing is fine.

Live demo · observe38:00-42:00 HacKSU

Generate traffic. Read the tables.

Presenter · hardware

Windows host

ipconfig /all
ping -n 4 192.168.50.20
arp -a

Catalyst console

show mac address-table dynamic

You · Packet Tracer

PC command prompt

ipconfig
ping 192.168.50.20
arp -a

Switch CLI

enable
show mac address-table

Checkpoint: ping replies, a peer ARP entry, and learned switch MACs. Animation is optional.

Live demo · move a cable42:00-45:00 HacKSU

One port can lead to many hosts

Host A

Catalyst

Unmanaged switch

Host B

Move B behind the unmanaged switch.
Use one inter-switch cable, then send traffic again.
Find B’s MAC on the Catalyst’s uplink port.

Packet Tracer extension: use a second 2960 for the forwarding role. Watch first if still on the ping checkpoint.

Live demo · failure and recovery45:00-48:00 HacKSU

Unplug it. What changes?

ping -t 192.168.50.20

# Stop with Ctrl+C

Unplug B’s cable and observe the result.
Reconnect it and wait for recovery.
Check the link LEDs and cached table entries.

Packet Tracer: disconnect/reconnect B’s simulated cable, then repeat a plain ping. Leave your real laptop settings alone.

Live demo · optional replacement slot48:00-53:00 HacKSU

Demo 2: inspect the travel router

Laptop

Wi-Fi

GL.iNet
LAN gateway

ipconfig /all
route print

Find the DHCP-assigned address and default route. A local gateway can exist without internet access.

Basics53:00-56:00 HacKSU

Local ping works. A website does not.

What would you check next?

What we know

The two local hosts exchanged ICMP traffic.

What we still need

A path beyond the subnet, name resolution, and a working application connection.

Give the audience a minute to propose checks before advancing.

Basics56:00-57:00 HacKSU

Troubleshoot one part at a time

Check the relevant link and adapter configuration.
Check the gateway and route to the destination.
Check DNS resolution.
Check the transport connection and application response.

A failed ping alone does not prove a device or website is down.

Recap57:00-60:00 HacKSU

Follow the path.

MAC addresses deliver on a local link.
IP addresses and routes connect networks.
TCP / UDP ports identify transport endpoints.

Which part would you like to see again?

HacKSU · hacksu.com

Appendix · not extra timeOptional · replaces demo 2 HacKSU

Port security

Idea

Limit source MAC addresses on a supported access port.

Swap A for B and inspect violations.

Dedicated lab port only

switchport mode access
switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict

Rehearse on the exact model. Restrict drops unauthorized source traffic. MAC limits are not strong authentication.

Appendix · not extra timeOptional · discussion only HacKSU

EtherChannel

Compatible switch

Two member links
One logical bundle

Compatible peer

LACP can negotiate membership at both ends.
Several flows can share aggregate capacity.
A single flow usually stays on one member link.

Use two compatible Packet Tracer switches for an optional simulation. Do not improvise parallel physical links.

ReferencesReference HacKSU

Sources and further reading

Cisco references cover specific releases. Confirm support on the actual demo switch.