Packet Path Slides Unit: Packet Pathfinders
THE TCP/IP
MODEL
Unlocking the Layers of Digital Communication
PROTOCOL_ABSTRACTION_v1.0
The Postal Paradox
How does a letter get from New York to London without the person writing it knowing how to fly a plane or navigate the Atlantic?
"Abstraction allows us to focus on what needs to be done, not how the layer below does it."
What is a Protocol?
Definition
A standardized set of rules for formatting and processing data. Protocols allow different computers to communicate, regardless of hardware or software differences.
Key Components
Syntax (Format)
Semantics (Meaning)
Timing (Speed/Order)
The TCP/IP Stack
4
Application Layer
HTTP, SMTP, FTP
3
Transport Layer
TCP, UDP
2
Internet Layer
IP (IPv4, IPv6)
1
Network Access (Link)
Ethernet, Wi-Fi
Encapsulation: The Russian Doll
As data moves down the stack, each layer adds its own Header (metadata) to the data.
This is called Encapsulation.
At the Receiver:
Decapsulation happens—headers are stripped off one by one.
App Data
TCP Header + Data
IP Header + Data
Frame Header + Data
Postal Protocol Worksheet Postal Protocol Worksheet
Topic: TCP/IP Model & Abstraction
Name:
Date:
The Abstraction Challenge
In computer networking, abstraction allows each layer of a protocol stack to perform its specific job without knowing the details of how other layers work. In this activity, you will map the steps of sending a physical letter to the four layers of the TCP/IP model.
Part 1: The Analogy
Match each postal service step to the corresponding TCP/IP layer. Draw a line or write the letter next to the layer.
Application Layer
Transport Layer
Internet Layer
Network Access Layer
A. A truck carries mail bags between sorting facilities or a plane flies overseas.
B. You write a message in English, put it in an envelope, and seal it.
C. The post office looks at the ZIP code to decide which route the letter takes.
D. Ensuring the letter is numbered if it's part of a multi-page set to ensure order.
Part 2: Breaking the Layers
1. If the postal plane (Network Access) crashes, does the sender need to rewrite the letter in a different language? Why or why not?
2. Imagine you receive pages 1, 3, and 4 of a letter, but page 2 is missing. Which TCP/IP layer is responsible for detecting this and what should it do?
3. Define "Protocol Abstraction" in your own words. How does it make the internet more flexible and scalable?
Layer Logic Teacher Guide Layer Logic
Teacher Facilitation Guide | Lesson 1
Instructional Goal
Students often struggle with the abstract nature of the TCP/IP model. The goal of this lesson is to ground the concept in a physical world analogy (the postal service) and introduce the technical terms that define how the internet functions.
Key Learning Targets
Define "protocol" in a networking context.
Identify the four layers of the TCP/IP stack.
Explain how abstraction allows for modular technology.
Essential Vocabulary
Abstraction
Encapsulation
Payload
Header
Postal Protocol Answer Key
Layer
Matching Step
Application
B: You write a message in English...
Transport
D: Ensuring the letter is numbered...
Internet
C: Post office looks at the ZIP code...
Network Access
A: A truck carries mail bags...
Facilitation Tips & Discussion Prompts
?
Addressing Misconceptions
Misconception: Students often think the physical wire is the Internet Layer.
Reality: The physical wire/radio wave is the Network Access (Link) layer. The Internet Layer is purely logical (IP addresses and routing decisions). Use the analogy: the road is the wire, but the ZIP code on the map is the Internet Layer.
!
Deep Dive Question
"Why do we need different layers at all? Why not just have one giant program that handles everything from Wi-Fi to Facebook?"
Desired Response: Modularity. If we invent a new way to connect (like Starlink satellites), we only have to change the Network Access layer. The Application layer (Facebook) doesn't need to be redesigned.
Preview for Lesson 2
The next lesson involves a physical simulation of packet switching. Ensure you have blank note cards (to act as "packets") and clear tape ready.
Router Relay Activity Router Relay
Classroom Simulation: Packet Switching
Group Activity
Mission Objective
Transmit a fragmented data object (a shredded picture) across a "network" of students acting as routers. Each packet must take its own path, and the receiver must reassemble the original data.
Materials Needed
1 Image cut into 10 irregular "packets" (numbered 1-10 on the back).
Index cards (for recording "routing logs").
Clear tape (for reassembly).
Stopwatch.
Network Roles
S
Sender
Sends packets one-by-one to any adjacent router.
R
Routers (4-6 Students)
Forwards packets to another router closer to destination.
D
Destination
Collects and reassembles packets in correct order.
Operational Instructions
01
Fragmentation
The Sender numbers the back of each piece (1-10) and hands them one at a time to their nearest neighbor. Rule: You can only hold ONE packet at a time.
02
Dynamic Routing
Routers must pass packets. If your usual neighbor is "busy" (holding a packet), you MUST find an alternative path. Keep the traffic moving!
03
The Bottleneck
Midway through, the teacher will "down" one router (ask a student to sit down). The network must adapt and find a way around the failed node.
04
Reassembly
The Destination receiver tapes the image back together. Note: Packets may arrive out of order (e.g., 4, 1, 9, 3). This is normal!
Post-Simulation Reflection
Observation 1
How did the network react when one router went down?
Observation 2
Why is it important that packets are numbered?
Switching Strategies Handout Switching Strategies
Concept Comparison: Circuit vs. Packet Switching
Ref. CS-202
Feature Circuit Switching Packet Switching Connection Type Dedicated end-to-end path established before transmission. No pre-set path. Data is divided into chunks (packets). Resource Use Reserved for the duration of the session (even if silent). Dynamically shared. Links are used only when sending data. Failure Response If a link fails, the whole call is dropped. Packets are rerouted automatically around failed nodes. Efficiency Low (bandwidth is wasted during idle times). High (multiple users share the same infrastructure). Primary Use Case Traditional Landline Telephony. The Modern Internet, VoIP, Streaming.
Circuit Switching Analogy
Think of it like a railway line . Before the train leaves, all switches along the track are locked into place specifically for that train. No other train can use those tracks until the journey is over.
Packet Switching Analogy
Think of it like a highway system . Many different cars (packets) from different families (files) share the same road. If one exit is blocked, cars just take the next one and still reach their destination.
Why Packetize?
Resilience
If one packet is lost, you only need to resend that specific 1% of the file, not the whole thing.
Pipelining
Routers can begin forwarding the first packet of a file while the second is still arriving.
Priority
Small, urgent packets (like a DNS query) can "squeeze" in between larger file transfer packets.
Routing Race Answer Key Routing Race
Teacher Debrief & Guide | Lesson 2
Simulation Facilitation
The "Downed Router" Event
About 5 minutes into the activity, tap one student on the shoulder and say "You are a broken router." That student must put their hands behind their back and refuse any more packets.
The Lesson: Watch how the other students (routers) immediately look for a different neighbor. This demonstrates fault tolerance and redundancy .
Observing Out-of-Order Delivery
The receiver will likely get packet #7 before packet #2.
The Lesson: Ask the students why this happened. (Answer: Different paths have different levels of "congestion" or physical distance). This sets up the need for the Transport Layer's sequence numbers (Lesson 4).
Reflection Key
Question 1: How did the network react when one router went down?
Traffic was redirected. While there might have been a momentary "traffic jam" (congestion), the system didn't fail. This is the core strength of packet switching over circuit switching.
Question 2: Why is it important that packets are numbered?
Because packets don't always take the same path or arrive at the same time, the receiver needs a way to re-sequence them into the original file. Without numbers, the receiver wouldn't know where each "puzzle piece" goes.
Technical Discussion Points
Best Effort Delivery: Explain that IP is "connectionless." Routers just do their best to pass the packet forward; they don't guarantee it will actually arrive.Routing Tables: In the simulation, students use their eyes to see who is busy. In real routers, "Routing Tables" and protocols like OSPF or BGP decide the best path based on cost, speed, and congestion.Latency vs. Throughput: Discuss how a busy router (congestion) increases latency (the time it takes for one packet to travel), even if the throughput (total packets per second) remains high. Address Architect Slides 192.168.1.12001:0db8:85a3:0000:0000:8a2e:0370:7334172.16.254.110.0.0.1 192.168.1.12001:0db8:85a3:0000:0000:8a2e:0370:7334172.16.254.110.0.0.1 192.168.1.12001:0db8:85a3:0000:0000:8a2e:0370:7334172.16.254.110.0.0.1 192.168.1.12001:0db8:85a3:0000:0000:8a2e:0370:7334172.16.254.110.0.0.1
Unit: Packet Pathfinders
IP
ADDRESSING
IPv4 vs. IPv6 Architecture
The Great Address Exhaustion
In 2011, the world officially ran out of new IPv4 addresses.
4,294,967,296
Total possible IPv4 addresses. Not enough for 8 billion people and their phones, watches, and smart fridges.
RESERVED
RESERVED
RESERVED
NO ADDR LEFT
Anatomy of IPv4
192 . 168 . 1 . 25
Octet 1
11000000
Octet 2
10101000
Octet 3
00000001
Octet 4
00011001
32 Bits Total (4 Bytes)
The Solution: IPv6
Address Example:
2001:0db8:85a3:0000:0000:8a2e:0370:7334
Format
Hexadecimal (8 groups of 4 digits)
Size
128 Bits (4x longer than IPv4)
Capacity
340 Undecillion (Enough for every atom on Earth's surface!)
How Routers Read Addresses
Addresses aren't just random numbers. They are split into two parts, like a house address:
Network Portion
"The Street Name"
Host Portion
"The House Number"
192.168.1.25
Routers only look at the Network portion to forward data across the globe!
Hierarchy Hacker Worksheet Hierarchy Hacker
Topic: IPv4 and IPv6 Addressing
Name:
Date:
Part 1: IPv4 Analysis
Given the following IPv4 address, identify the network and host portions based on the provided subnet mask.
172.16.254.1
Subnet Mask: 255.255.0.0
Network Portion
Host Portion
Part 2: The Capacity Gap
Contrast the size and scale of the two protocols.
Bit Length
IPv4
IPv6
Total Addr
~4.3 Billion
340 Undecillion
Why did we switch to Hexadecimal for IPv6 instead of keeping the dotted-decimal format?
Part 3: IPv6 Shortcut Challenge
IPv6 addresses can be shortened by omitting leading zeros and using "::" for a single contiguous block of zeros. Shorten the following address:
2001:0db8:0000:0000:0000:ff00:0042:8329
Your Shortened Address
Critical Thinking
If IPv6 has so many addresses, why are we still using IPv4 at all? What are the challenges of switching the entire internet to a new addressing protocol?
IP Insights Cheat Sheet IP Insights
Protocol Reference Cheat Sheet
IPv4 Specs
Address Length 32 Bits
Notation Dotted Decimal
Total Possibilities 4.3 Billion
Example 192.168.0.1
IPv6 Specs
Address Length 128 Bits
Notation Hexadecimal
Total Possibilities 340 Undecillion
Example 2001:db8::1
Reserved Addresses
127.0.0.1
Loopback
Refers to your own computer (the "local host"). Used for testing.
192.168.x.x
Private IP
Used for local networks (home/school). Not visible to the public internet.
8.8.8.8
Public DNS
A famous public IP for Google's Domain Name System (DNS) servers.
IPv6 Compression Rules
1
Omit Leading Zeros
0db8 → db8
2
Double Colon (::)
0000:0000:0000 → ::
*Use only ONCE per address!
FULL:
fe80:0000:0000:0000:0202:b3ff:fe1e:8329
SHORT:
fe80::202:b3ff:fe1e:8329
Packet Pathfinders: Lesson 3 1 Octet = 8 Bits = 1 Byte
Reliability Rumble Slides Unit: Packet Pathfinders
RELIABILITY
RUMBLE
TCP vs. UDP: Speed vs. Accuracy
The Difference in Glitches
File/Email
If a single character in an email is lost, the message is corrupted.
"Accuracy is everything. Speed is secondary."
Live Stream
If a single pixel is lost in a live call, the video might stutter for a split second, but the show must go on.
"Speed is everything. Lost data is okay."
TCP: Transmission Control Protocol
Three-Way Handshake
TCP establishes a connection before sending data. It's like calling someone and waiting for them to say "Hello" before you start talking.
Error Checking
Guaranteed Delivery
Re-orders Packets
Sender: "SYN" (Sync?)
Receiver: "SYN-ACK" (Sync-Ack!)
Sender: "ACK" (Acknowledged!)
Connection Established
UDP: User Datagram Protocol
"Fire and Forget"
UDP doesn't care if you heard it. It just blasts data out as fast as possible.
Ideal for:
VOIP, Online Games, Streaming Video
No Handshake
Lower overhead = Much faster start.
No Retransmission
If a packet is lost, it's just gone. We don't wait for it.
The Trade-off
TCP
Reliable but Slower
UDP
Fast but Unreliable
Protocol Pick-em Worksheet Protocol Pick-em
Topic: Transport Protocols (TCP vs. UDP)
Name:
Date:
The Engineer's Dilemma
As a network engineer, you must decide which Transport Layer protocol is best for different applications. Remember: TCP is for when 100% accuracy is required. UDP is for when speed and low latency are prioritized over perfect delivery.
Scenario 1: Competitve FPS Gaming
"A player clicks 'Fire'. That data needs to reach the server instantly so the hit is registered. If a packet showing player movement is lost, the server can just wait for the next update in 1/60th of a second."
Selected Protocol
TCP
UDP
Justification
Scenario 2: Online Banking Transfer
"A customer transfers $5,000. If the packet containing the decimal point is lost or arrives out of order, the amount could be misinterpreted as $500,000."
Selected Protocol
TCP
UDP
Justification
Scenario 3: Streaming a Netflix Movie
"A user is watching a movie. They want high quality, but they don't want the movie to 'buffer' every 5 seconds. However, if a packet is lost, the video player usually buffers ahead so it can resend the lost data before the user notices."
Selected Protocol
TCP
UDP
Justification
Critical Synthesis
Explain why most file downloads (like a .zip file) use TCP, whereas voice-over-IP (like a Discord call) typically uses UDP.
TCP vs UDP Comparison Sheet The Transport Split
Core Reference: TCP vs. UDP
TCP
Reliable Delivery
Philosophy
Accuracy over all else. Every byte must arrive, in the right order.
Mechanism
Uses acknowledgments (ACKs) and sequence numbers. If a packet is lost, it is resent.
Key Features
Error-Free
Ordered Data
Congestion Control
UDP
Speed & Low Latency
Philosophy
Speed over all else. If data is lost, move on to the next piece.
Mechanism
No connection setup. No handshakes. Just "Fire and Forget."
Key Features
No Connection Lag
Lightweight Header
Constant Data Rate
Payload Efficiency
TCP Header
20 - 60 Bytes
UDP Header
8 Bytes
UDP is significantly more efficient for small, repetitive data bursts.
When to Use Which?
Use TCP if...
• Sending a .ZIP or .EXE file
• Loading a web page (HTTP)
• Sending an Email (SMTP)
• Accessing a Database
Use UDP if...
• Live Voice (Discord/Zoom)
• Multiplayer Game Updates
• DNS Requests
• Video Streaming (Live)
Sniffer Secrets Lab Sniffer Secrets Lab
Workshop: Analyzing Network Traffic Logs
Name:
Date:
Objective
In this workshop, you will step into the role of a network forensic analyst. Using a simulated packet log, you will identify metadata and reconstruct the sequence of a digital conversation.
Digital Evidence Log #402
No. Time Source IP Dest IP Protocol Info Summary 1 0.000 192.168.1.15 142.250.72.110 TCP SYN (Port: 443) Seq=0 2 0.015 142.250.72.110 192.168.1.15 TCP SYN, ACK Seq=0 Ack=1 3 0.016 192.168.1.15 142.250.72.110 TCP ACK Seq=1 Ack=1 4 0.050 192.168.1.15 142.250.72.110 HTTP GET /index.html HTTP/1.1 5 0.082 192.168.1.15 1.1.1.1 UDP DNS Standard Query (Port: 53)
Laboratory Analysis
1. Identify the Three-Way Handshake. Which packet numbers comprise the handshake?
2. What is the Private IP address of the local machine in this network?
3. Look at Packet #5. Based on the protocol and info provided, what service is the computer likely trying to use? Why does it use UDP instead of TCP for this?
4. Critical Observation: If Packet #2 was never received by the source (192.168.1.15), what would happen next? (Hint: Think about TCP reliability).
The Data Lifecycle
"Trace the path of a single packet from the user clicking a link to the website appearing."
1
Application Layer: Browser generates HTTP request.
2
3
4
Header Hunter Guide Header Hunter
Visual Guide to Packet Structure
Every packet is wrapped in "envelopes" called headers. Each layer of the TCP/IP model adds its own metadata fields to ensure the data reaches the right place and can be reassembled correctly.
The IP Header (Internet Layer)
Version
IHL
Type of Service
Total Length
Identification
Flags
Fragment Offset
TTL
Protocol
Header Checksum
Source IP Address (32 Bits)
Destination IP Address (32 Bits)
TTL (Time To Live)
A counter that prevents packets from circling the internet forever. Every router it hits subtracts 1. At 0, the packet is deleted.
Protocol Field
Identifies which protocol is waiting inside the packet (e.g., 6 = TCP, 17 = UDP).
The TCP Header (Transport Layer)
Source Port
Destination Port
Sequence Number (32 Bits)
Acknowledgment Number (32 Bits)
Data Offset / Flags
Window Size
Port Numbers
IP gets you to the house; Ports get you to the right room (e.g., Port 80 for Web, Port 25 for Email).
Sequence Number
Allows the receiver to put "puzzle piece" packets back in the correct order even if they arrive out of sequence.
Packet Pathfinders: Lesson 5 Packet Length = Header + Data
Packet Decoding Key Packet Decoding Key
Teacher Solution Guide | Lesson 5
Lab Analysis Answers
1. The Three-Way Handshake
Answer: Packets #1, #2, and #3.
Teacher Note: Students should identify that #1 is the initial connection request (SYN), #2 is the server's reply (SYN-ACK), and #3 is the client's confirmation (ACK). Data transmission only begins after these three steps.
2. Private IP Identification
Answer: 192.168.1.15
Teacher Note: Students should recognize the 192.168.x.x prefix as the standard for local/private network addresses discussed in Lesson 3.
3. DNS and UDP (Packet #5)
Answer: The service is DNS (Domain Name System), which translates web names (like google.com) into IP addresses. It uses UDP because it is a "one-and-done" request. If the request fails, it's faster to just send a new request than to establish a complex TCP connection.
4. Failure Handling
Answer: The source (192.168.1.15) would wait for a short period of time (a timeout) and then retransmit Packet #1. TCP requires an acknowledgment for every packet; if none arrives, it assumes the packet was lost.
The Data Lifecycle (Key)
1 Application Layer: Browser generates HTTP request.
2 Transport Layer: TCP adds sequence numbers and performs 3-way handshake.
3 Internet Layer: IP adds Source and Dest IP addresses for routing.
4 Network Access: Data is converted to electrical/radio signals and sent.
Unit Wrap-Up Question
"Now that we've seen how complex it is just to send a single packet, what is the most impressive thing about the internet?"
Discussion Goals: Steer the conversation toward scale and decentralization . Billions of packets are flying every second, crossing thousands of miles and dozens of routers, with no single "manager" in charge—just universal protocols (TCP/IP) making it work.
