Speaker Notes - Basic Networking

Run of show

00:00-05:00	Hook, equipment, and vendors
05:00-10:00	OSI, TCP/IP, encapsulation
10:00-20:00	Addresses, MAC learning, subnet decisions, ARP, routing
20:00-23:00	IPv6 notation and local discovery
23:00-30:00	TCP/UDP, handshake, DHCP, DNS
30:00-36:00	Internet access technologies and link limits
36:00-48:00	Local hardware demo and Packet Tracer follow-along
48:00-53:00	Travel router or rehearsed port security
53:00-60:00	Recap and questions

Before attendees arrive

Confirm model, console access, three lab ports in one VLAN, two Ethernet hosts, adapters, and cables.
Use an isolated network. Record existing settings. A: 192.168.50.10/24; B: 192.168.50.20/24. No wired gateway or DNS.
Check subnet conflicts, link forwarding, and narrowly scoped ICMP permissions. Do not disable firewalls globally.
Rehearse both hosts and save actual output privately as backup. Hardware commands are examples until verified.
Distribute labs/packet-tracer.md before the session. Attendees should install, sign in, and build the two-PC/2960 starter beforehand. The app steps need rehearsal; no prebuilt .pkt is supplied.
Keep exactly one inter-switch cable. Confirm the GL.iNet model, router mode, LAN subnet, and local DHCP. Keep this network separate from the wired lab.
If behind schedule, shorten the access overview and skip demo 2. Preserve questions. Give failures at most 60 seconds.
Explain concepts from 00:00 to 36:00. Keep the hardware demonstrations and attendee follow-along together from 36:00 to 53:00, then recap and questions. Do not return to new lecture topics between demonstrations.

Slide 100:00-01:00

Basic Networking

Welcome both beginners and people who have configured networks. Ask who has used ping and who has used a switch console.
The aim is to explain an actual path using the equipment on the table. There is no subnet arithmetic quiz.

Slide 201:00-02:00

Start with the equipment

Show the TP-Link 5-port Gigabit desktop switch, GL.iNet AC1200 wireless travel router, and Catalyst 3560. The Catalyst has 48 copper 10/100 Fast Ethernet PoE ports and four SFP slots. No SFP modules are available. PoE supplies compatible endpoints; no powered endpoint is confirmed.
Two hosts and any Ethernet adapters must be confirmed. All Catalyst demo connections use copper Fast Ethernet ports. Check negotiated speed and duplex during rehearsal. AC1200 alone does not identify the GL.iNet model.

Slide 302:00-04:00

Hub, switch, router

There is no physical hub in this inventory. Describe the shared-medium behavior rather than claim to show it.
Switches also flood broadcasts and unknown unicasts within the VLAN. Avoid saying they always send to exactly one port.
The 3560 is a multilayer switch family; routing depends on software/features and configuration. Keep it in a switching role for this demo. The GL.iNet provides the router, access point, DHCP, NAT, and firewall example in router mode.

Slide 404:00-05:00

Networking vendors

Spend one minute recognizing names, not ranking brands. Cisco Catalyst is on the table; UniFi is Ubiquiti’s networking family; HPE Aruba Networking offers campus and branch wired/wireless products.
TP-Link makes both desktop switches and Omada business products. Do not imply our unmanaged switch is an Omada device. GL.iNet connects the vendor discussion to the travel router on the table.
Shared Ethernet and IP protocols let compatible equipment interoperate. Management, feature support, licensing, and support vary by model and family. A vendor name alone does not determine capabilities.
Vendor names link to primary sources. Keep purchasing questions for discussion afterward. The opening device explanation now takes two minutes to preserve the one-hour schedule.

Slide 505:00-08:00

OSI: where would you look?

Start at the bottom with a cable, then move upward. Do not ask the audience to memorize all seven names.
Contrast an unplugged cable, a missing route, and an HTTP error. Similar symptoms at the browser can have different causes.
Use one failure at a time: no link light suggests checking cable and port state; an incorrect prefix or route is a network-layer concern; a reachable TCP service returning an HTTP error points upward. Symptoms can overlap, so this is a map for investigation rather than proof from a single signal.

Slide 608:00-09:00

TCP/IP uses fewer layers

This is the four-layer teaching model. Some materials split the link layer into physical and data link.
The mapping is approximate. Keep attention on what each layer does.
A DNS message using UDP still belongs to the TCP/IP suite. Ask attendees to place Ethernet, IPv4, TCP, and HTTP into the four-layer model. Keep the mapping brief so the worked delivery examples have time.

Slide 709:00-10:00

Data travels inside other data

Trace an HTTP-over-TCP example downward into a signal and upward on the receiver. This is one example, not all web traffic.
In ordinary routing the destination IP stays the same while Ethernet addresses change by hop. TTL or hop limit changes too; NAT can rewrite IP addresses and ports.
The application supplies data, TCP adds transport information, IP adds network addressing, and Ethernet adds local source/destination information. The receiver interprets the layers in reverse. This is an HTTP-over-TCP example, not a claim that all web traffic uses TCP.

Slide 810:00-12:00

Three different addresses

A MAC address can be assigned or randomized. It is not permanent identity or strong authentication.
A host can have multiple interfaces and IP addresses. TCP and UDP have separate port spaces.
Ethernet MAC addresses commonly use six octets, written as hexadecimal pairs. Compare that local forwarding identifier with a routable IP destination and a TCP/UDP port identifying a transport endpoint. All examples are illustrative; a MAC can be reassigned or randomized.

Slide 912:00-14:00

How does a switch learn?

Use an initially unknown B as the example. A sends through port 1, so the switch learns A’s source MAC in that VLAN. It looks up B’s destination MAC separately. If B is unknown, it floods to eligible other ports rather than somehow knowing the right wire.
B’s reply arrives through port 2, teaching B’s location. A is now known, so the reply can be forwarded toward A. Learning entries age, and a source moving ports can update the learned path.
A hub repeats signals without building this forwarding table. The unmanaged TP-Link still performs MAC learning. These example port numbers are conceptual, not a claim about the exact Catalyst interface names.

Slide 1014:00-16:00

What does /24 actually mean?

IPv4 has 32 bits. A /24 reserves 24 bits for the prefix and leaves eight for the host portion; the dotted mask is 255.255.255.0. Compare each destination with A’s prefix: .50.20 is local, while .51.20 needs a route beyond that subnet.
For this ordinary /24, .0 names the subnet and .255 is the directed broadcast address. Do not assign those to the two lab hosts. Other prefix lengths behave differently, so matching three decimal octets is only a shortcut for this example.
Ask whether changing the switch alone would make .50.10/24 and .51.20/24 one subnet. It would not; addressing and routing still matter.

Slide 1116:00-18:00

ARP: from an IPv4 address to a MAC

A knows B’s IPv4 address but needs an Ethernet destination. With no cached mapping, A broadcasts an ARP request; B normally replies directly with its MAC. A can then transmit an IP packet in a frame addressed to B.
Point out two independent tables: the host’s ARP cache maps an on-link IPv4 address to a MAC, while the switch maps source MACs to VLAN ports. The switch learns from incoming frames, including ARP traffic.
ARP remains on the local link. For a remote IP destination, A resolves the gateway’s MAC instead of broadcasting a question across the internet. Repeated pings may reuse cached entries, which explains why the demo will not show an ARP request every time.

Slide 1218:00-20:00

Remote IP, local next hop

The gateway address here is illustrative. The offline demo deliberately has no gateway. First choose a route; when that route uses this gateway, ARP resolves the gateway’s local MAC.
The first frame targets the gateway MAC while the enclosed IP packet targets 192.168.51.20. The router examines the IP destination, chooses its outgoing route, decrements TTL, and constructs new link-layer framing.
For ordinary routing, distinguish the continuing IP destination from link addresses that change by hop. NAT is a separate rewriting operation often combined with routing in home and travel routers. The gateway still needs a usable onward route; its existence does not guarantee delivery.

Slide 1320:00-23:00

IPv6: the same job, more space

The 2001:db8:: example is reserved for documentation. Show hexadecimal groups and compressed zeros briefly.
IPv6 link-local addresses use fe80::/10. Neighbor Discovery uses ICMPv6 for functions including neighbor and router discovery.
IPv6 is not automatic encryption. Do not promise that the travel router or any upstream supports global IPv6.
Expand 2001:db8::10 to 2001:db8:0:0:0:0:0:10. Double colon compresses a run of zero groups and may appear only once in an address. The larger space changes notation and address management, not the need for local delivery and routes.
Contrast Neighbor Discovery using ICMPv6 with IPv4 ARP. Link-local addresses support local communication but do not establish global reachability. Keep subnet arithmetic and the full IPv6 configuration process for follow-up questions.

Slide 1423:00-24:00

TCP and UDP

IP itself does not guarantee delivery. TCP manages a stream above it, not message boundaries.
Do not describe UDP as simply bad TCP. Datagrams and application-controlled behavior are useful in their own right.

Slide 1524:00-26:00

TCP: establish, acknowledge, recover

Walk the SYN, SYN+ACK, ACK exchange in order. Both sides synchronize sequence-number state before the usual application-data exchange. The diagram omits optional extensions and simultaneous open.
Sequence numbers track bytes. Acknowledgments report progress, and loss can trigger retransmission. Flow control protects receiver capacity; congestion control responds to network capacity. Neither makes a failed connection impossible.
IP addresses plus ports distinguish connections. TCP does not supply encryption or application success; HTTPS adds TLS, while HTTP/3 uses QUIC over UDP.

Slide 1626:00-27:30

DHCP: how a host gets its settings

Discover, Offer, Request, ACK is the common initial DHCPv4 exchange. A client starting without a lease can broadcast to find a server. The server supplies a lease and configuration options.
Leases expire and can be renewed; renewal does not always repeat all four initial messages. The router advertised by DHCP and the DNS resolver are different settings, even when one physical box performs both roles.
Connect this to the demo: the isolated Ethernet hosts use static settings, while the GL.iNet can supply automatic settings. A successful lease proves neither internet reachability nor working DNS. IPv6 uses different configuration mechanisms.

Slide 1727:30-30:00

DNS: a name is not a route

An application asks for a name. A local cache or configured recursive resolver can supply an answer; on a cache miss, a recursive resolver can consult other DNS servers. A and AAAA records provide IPv4 and IPv6 addresses.
DNS records can be reused while cached according to their TTL. A hostname can have multiple addresses. DNS does not choose the host’s Ethernet next hop or establish an application connection.
Walk the full story: obtain settings, resolve the name, choose a route, resolve the local next hop, then attempt the transport and application exchange. Those stages can fail independently. DNS is not limited to UDP, and an address response alone does not prove a website works.

Slide 1830:00-32:00

DSL and cable

Do not attach universal speed numbers to these technologies. Actual service depends on equipment, deployment, plan, and conditions.
The modem handles access signaling; routing is a separate function even when one box combines both.
The access medium is only one part of the path. Explain the distinction between a modem terminating access signaling and a router forwarding IP, even when the functions share a box. Neither technology replaces Ethernet/Wi-Fi inside the local network.

Slide 1932:00-35:00

Fiber and cellular

Fiber is not always dedicated or symmetric. Cellular is not the same link as Wi-Fi. The hotspot path on this slide is a conceptual example; the GL.iNet travel router is not assumed to contain a cellular modem.
Compare medium, mobility, deployment constraints, latency, and upload needs verbally. Avoid ranking technologies from one speed test.
Compare capacity with latency: bits per second describe rate, while latency describes delay. A high advertised rate does not promise low delay or high upload throughput. Fiber sharing and cellular radio conditions still matter; do not attach universal rankings or benchmark numbers.

Slide 2035:00-36:00

The whole path sets the limit

The presenter confirmed all 48 Catalyst copper ports are 10/100 Fast Ethernet. The link from the TP-Link therefore supports at most 100 Mb/s, even though the TP-Link supports Gigabit. Check show interfaces status for the actual negotiated speed and duplex. The four SFP slots remain unused without modules.
Other traffic, protocol overhead, host performance, and radio conditions can reduce throughput further.

Slide 2136:00-38:00

Demo 1: no internet required

Show the real cables before opening terminals. Use the isolated lab, never the campus network.
Confirm both hosts, same VLAN, static addressing, and scoped ICMP firewall permissions in rehearsal. Windows command examples follow.
The presenter stays on real equipment. Attendees open their prepared Packet Tracer network: two PCs and a 2960, with .10 and .20 in 192.168.50.0/24. No gateway or DNS is needed. Those without a working installation can watch or pair.
Point to the companion-lab link. Do not spend the 12-minute slot installing software or resolving Cisco account access. Ask attendees to predict whether local delivery needs internet access.

Slide 2238:00-42:00

Generate traffic. Read the tables.

Generate traffic from B as well if needed. Point out the Ethernet interface, address, prefix/mask, and physical address.
The switch learns source addresses from incoming frames. A known destination selects an egress port; an unknown one is flooded to eligible other VLAN ports.
Entries may already exist. Do not clear the whole MAC table for the presentation. Ping uses ICMP, not TCP.
If anything fails, spend at most 60 seconds, then use screenshots or text output saved from rehearsal. Do not fabricate output.
Pause briefly for attendees to run plain ping 192.168.50.20 and arp -a in a simulated PC prompt. On the simulated switch, use enable followed by show mac address-table. Do not assume Windows ping flags work in Packet Tracer.
The minimum attendee checkpoint is a successful ping, a peer ARP entry, and a learned switch MAC. Simulation Mode with ARP/ICMP filters and Capture / Forward is an optional extension; keep the physical console projected.

Slide 2342:00-45:00

One port can lead to many hosts

Disconnect B from the Catalyst first, then connect B to the unmanaged switch and add one uplink.
Wait for forwarding, ping, and inspect the MAC table. The source entry should move to the uplink after traffic arrives.
Never add a parallel cable to improvise a bundle. Unknown spanning-tree behavior is not a safe loop-prevention plan.
Attendees who are ready may add a second 2960 to represent the TP-Link forwarding role; it is not an exact model of the unmanaged device. Disconnect B’s original link first and use exactly one inter-switch link. Others should watch the hardware demo.

Slide 2445:00-48:00

Unplug it. What changes?

Unplug B, not the presenter’s console or display connection. Link negotiation and spanning tree can delay recovery.
Timeouts or unreachable messages vary with the host and state. Avoid promising exact output.
Tie the link failure back to OSI layer 1, then continue directly to the travel-router demonstration at minute 48.
Attendees can disconnect and reconnect B’s simulated cable, then retry a plain ping. They do not need to change real laptop networking or connect to the physical lab. Stop this checkpoint at minute 48; save unfinished simulation work for later.

Slide 2548:00-53:00

Demo 2: inspect the travel router

Finish the wired demo, disconnect the demo host from wired Ethernet, and join the GL.iNet Wi-Fi with automatic addressing. Rehearse router mode and local DHCP beforehand; keep the switch lab separate.
Inspect the actual DHCP server, assigned address, gateway, DNS settings, and route. Use observed values rather than a factory-default subnet. Router mode enables routing, DHCP, NAT, and firewall functions; access-point mode has a different role.
No upstream is needed to demonstrate local DHCP and the default route. A configured gateway does not prove internet access or demonstrate packet forwarding between networks. Only show a webpage if upstream access was separately rehearsed.
A rehearsed port-security demo or prepared Packet Tracer ARP/ping walkthrough may replace this five-minute slot. The earlier mobile hotspot is optional upstream hardware, not assumed part of this demo.

Slide 2653:00-56:00

Local ping works. A website does not.

Ask for a hypothesis and a check, not just a command. Local ping narrows the issue without identifying the cause.
Invite beginners to name a layer and experienced attendees to name a route, resolver, or service test.

Slide 2756:00-57:00

Troubleshoot one part at a time

Firewalls and policy can block ICMP while allowing an application. Conversely, a ping reply does not prove HTTP works.
There is no universal answer order for every outage. This is a useful starting process for the example.

Slide 2857:00-60:00

Questions

Protect the question slot. Optional appendix slides are available for questions, not extra required lecture time.
Afterward restore host addressing, Wi-Fi/VPN, scoped firewall rules, and original switch port settings. Verify restoration.

Slide 29Optional · replaces demo 2

Port security

This replaces minutes 48-53 only after rehearsal. Use console access and an unused host-facing lab port, not the uplink or an EtherChannel member.
Record the original configuration and enter the actual interface configuration context before these commands. Generate A traffic to learn its source, then swap in B before the secure address ages out.
Inspect show port-security interface with the actual interface name. Restrict should leave the port up while dropping unauthorized source traffic and recording violations.
For a previously unsecured port, no switchport port-security disables the feature. Restore the full original port configuration, verify ordinary traffic, and do not save temporary demo settings. See demos/README.md for setup and rollback.

Slide 30Optional · discussion only

EtherChannel

Two 100 Mb/s members do not normally make one flow run at 200 Mb/s. Hashing and platform capabilities determine distribution.
The TP-Link and GL.iNet are not confirmed compatible aggregation peers. Use a prepared Packet Tracer topology with two compatible switches for an optional simulation, or keep this conceptual. Do not add parallel cables to the physical lab.

Slide 31Reference

Sources and further reading

Source links require internet access; the deck, navigation, notes, logo, and diagrams are otherwise local.
Template: https://github.com/hacksu/HacKSU-Presentation-Template at commit 64f8d8e05d02bca1d09b2462683606781f6fa62a.