DNS Hierarchy Slides DNS HIERARCHY
The Phonebook of the Internet
Lesson 01 // Sequence: Navigating Networks
The Millisecond Mystery
You type www.google.com and hit Enter.
Human Needs
"I want to see the search engine."
Names: google.com
Machine Needs
"I need an address to route this packet."
IP: 142.251.41.46
DNS is the system that connects the two.
THE DNS TREE
LEVEL 0
ROOT (.)
TOP LEVEL DOMAIN (TLD)
.com .org .edu .gov
AUTHORITATIVE NAMESERVER
google.com wikipedia.org mit.edu
SUBDOMAINS / HOSTS
mail.google.com en.wikipedia.org cs.mit.edu
The Recursive Quest
1
Resolver checks local cache. Empty? Ask Root.
2
Root Server says: "I don't know, but go ask the .com server."
3
TLD Server says: "I don't know, but ask the google.com Authoritative server."
4
Authoritative Server says: "I have that! The IP is 142.251.41.46."
Key Concept
RESOLVERS DO THE WORK, SERVERS GIVE THE DIRECTIONS.
DNS DETECTIVES
We are going to simulate this process. Some of you will be the Browsers, some the Resolvers, and others will hold the secret records of the Root, TLD, and Authoritative servers.
Step 1
Request a URL
Step 2
Hunt for the IP
Step 3
Deliver the data
DNS Detective Worksheet DNS Detective
Network Addressing & Routing // Lesson 01
Name:
Date:
MISSION BRIEF
The Internet is a distributed system. No single computer knows where everything is. To find a website, your computer must play a high-speed game of "telephone" across a hierarchy of servers. Today, you will trace that path.
1 Deconstructing the Request
Break down the following URL into its hierarchical components, working from right to left (the way DNS does).
www.learning.code.org
Top Level Domain (TLD)
Authoritative Domain
Subdomain / Host
2 The Lookup Path
Explain the role of each server in the resolution of shop.example.com.
ROOT SERVER
TLD SERVER (.com)
AUTHORITATIVE (example.com)
3 Caching vs. Resolution
If every single computer asked the Root Server for every URL every time, the internet would crash. How does DNS Caching solve this problem, and what is one potential drawback?
Simulation Log: The Quest for IP
Use this space to record the steps taken during the classroom simulation. Each time you "ask" a server, record who you asked and what they told you.
Hop Server Identity Question Asked Response / Pointer Received 1 2 3 4
FINAL REFLECTION
Why doesn't the Root Server just store all the IP addresses for every website on Earth? List two technical reasons why the hierarchical model is superior to a single giant list.
DNS Facilitation Guide Teacher Facilitation Guide
DNS Hierarchy Simulation // Lesson 01
Teacher Resource
Activity Goal
Students will role-play the recursive lookup process of the Domain Name System to understand why it is a distributed, hierarchical database.
Roles Needed
1 Resolver (per group)
1 Root Name Server
1 TLD Server (.com, .org, etc.)
1 Authoritative Server
Simulation Script
Step 1: The Request
Student (Browser) asks the Resolver:
"What is the IP address for www.example.com ?"
Step 2: The Root Query
Resolver asks the Root Server:
"Where can I find the .com top-level domain?"
Root Server responds:
"I don't know the IP for example.com, but I know the .com TLD server is at 192.5.6.30 . Go ask them."
Step 3: The TLD Query
Resolver asks the TLD Server (.com):
"Who is authoritative for example.com ?"
TLD Server responds:
"Ask the Authoritative server at 199.43.132.53 ."
Step 4: The Final Answer
Resolver asks the Authoritative Server:
"What is the IP for www.example.com ?"
Authoritative Server responds:
"The IP is 93.184.216.34."
Discussion Questions
• Why not a central list? If one computer held every address, what would happen if that computer went offline? (Single point of failure).
• Scale: How many new websites are created daily? How does hierarchy make it easier to add new addresses? (Delegation).
DNS Defense Slides DNS DEFENSE
Security, Spoofing, and Trust
Lesson 02 // Sequence: Navigating Networks
The Identity Crisis
Imagine typing bank.com. Your computer asks for the IP.
What if a hacker answers first?
They send you to their site, which looks identical to your bank.
https://mybank.com
PHISHING SITE
DNS Spoofing
The Cache Poison
DNS servers cache (save) results to speed things up.
If an attacker can inject a fake record into the cache, every user on that network will be sent to the wrong IP for days.
Site IP Address
google.com 142.251.41.46
bank.com 6.6.6.6 [SPOOFED]
wiki.org 103.102.166.224
Why is it vulnerable?
Clear Text
Standard DNS is unencrypted. Anyone on your Wi-Fi can see exactly what sites you are looking up.
No Auth
When a server gives a response, there is often no way to prove it is actually who they say they are.
Speed vs Sec
DNS was built for speed in the 80s. Encryption and verification add "latency" (lag).
The Solution: DNSSEC
DNS Security Extensions add digital signatures to records. It's like a wax seal on an envelope—if the seal is broken or missing, the browser doesn't trust the address.
AUTHENTICATION
INTEGRITY
The Great DNS Heist Worksheet The Great DNS Heist
Network Security // Case Study // Lesson 02
Name:
Incident Report: MyEtherWallet Attack
In 2018, attackers compromised the DNS records of a popular cryptocurrency wallet service. For several hours, users who typed in the correct URL were silently redirected to a server in Russia. This wasn't a "phishing" email; the users did everything right, but the infrastructure itself lied to them.
The Attack Mechanism: BGP Hijacking + DNS Spoofing
The attackers didn't hack the wallet's website. They hacked the pathway. By "poisoning" the DNS cache of Amazon's Route 53 service, they ensured that any computer asking for the address was given the wrong IP.
BY THE NUMBERS
$152,000+
Stolen in Ethereum
2 Hours
Duration of Attack
0
User Errors Made
Q1 Why is DNS spoofing more dangerous than a standard phishing email?
Q2 In this scenario, users saw a "Certificate Warning" in their browser. Many ignored it and clicked "Proceed anyway." Explain how an SSL/TLS certificate (HTTPS) provides a second layer of defense against DNS spoofing.
Q3 DNSSEC (DNS Security Extensions) uses "Digital Signatures." If MyEtherWallet had been using DNSSEC and the resolver supported it, how would the outcome of this attack have changed? DNS Security Checkpoint DNS Security Checkpoint
Quick Assessment // DNS Vulnerabilities & Defense
Student:
Score:
1. Which of the following best describes "DNS Cache Poisoning"?
Flooding a DNS server with so many requests that it crashes.
Deleting the root server records to make the internet inaccessible.
Injecting a fraudulent IP address into a resolver's memory to redirect traffic.
Encrypting DNS records so that only authorized users can read them.
2. True or False: DNS queries are typically encrypted.
TRUE
FALSE
Explain why this matters for user privacy:
3. Identify the "Missing Link" in the security chain.
Standard DNS provides speed but lacks identity verification . When a resolver receives a response, it assumes it's from the correct server.
Name the technology that adds Digital Signatures to DNS records to prevent spoofing:
4. How does "Time to Live" (TTL) affect a DNS attack?
Think about how long a poisoned record stays in memory.
Assessment Tool // Unit 1: Internet Infrastructure
Router Roadmaps Slides Router Roadmaps
Algorithms, Cost, and Pathfinding
Lesson 03 // Sequence: Navigating Networks
The Fastest Route
How does your GPS know that the longer road is actually faster?
Traffic Data
Distance isn't everything. Congestion, speed limits, and accidents change the "cost" of the path.
Network Routing
Routers do the same. They calculate the "cost" of sending a packet through various links in milliseconds.
The Algorithm Logic
1. Start at your node. Give it a cost of 0.
2. Check neighbors. Update their cost (Distance to here + Link cost).
3. Pick the lowest cost neighbor and repeat.
4. Continue until you've mapped the shortest path to all nodes.
A
B
C
D
Cost: 2
Cost: 5
Cost: 10
Cost: 1
Which path to D is cheaper?
Routing Factors
Latency
The time it takes for a packet to travel from point A to B.
Congestion
How much traffic is currently using a specific link.
Bandwidth
The maximum speed of the link (fiber optic vs satellite).
Financial Cost
Some connections are literally more expensive for the ISP to use.
Fault Tolerance
The internet is non-hierarchical and redundant. If one router fails, the algorithm immediately recalculates the next best path. The data still arrives.
Resilience by Design
Pathfinder Challenge Worksheet Pathfinder Challenge
Network Routing & Cost // Lesson 03
Name:
MISSION: Optimize the Route
You are the routing algorithm for a small metropolitan area network. Your goal is to move a packet from Server A to Client Z using the path with the lowest cumulative cost.
START A
B
C
D
E
END Z
COST: 4
COST: 8
COST: 12
COST: 2
COST: 1
COST: 5
COST: 3
COST: 9
COST: 6
Task 1: Calculate Paths
List three possible paths from A to Z and their total costs.
A -> B -> D -> Z Cost:
A -> C -> E -> Z Cost:
A -> B -> C -> E -> Z Cost:
Task 2: Identify the Winner
What is the Shortest Path (lowest cost)?
Task 3: Failure Recovery
If Link B-D fails (becomes infinite cost), what is the new optimal path?
Routing Logic & Dijkstra
1. Non-Hierarchical Routing
Unlike the DNS, which is a strict hierarchy (Root -> TLD -> Domain), Routing is mesh-based . How does this lack of hierarchy make the internet more resilient to physical damage (like a severed undersea cable)?
2. Defining "Cost"
In our map, "Cost" was just a number. In the real world, a router might see a path with 10 hops as "cheaper" than a path with 2 hops. List two reasons why a path with more "hops" might actually have a lower cost.
Reason A
Reason B
3. Decentralized Knowledge
No single router knows the entire map of the Internet. They only know their immediate neighbors and what those neighbors claim to be able to reach. This is called "Routing by Rumor." What is one danger of routers only knowing what their neighbors tell them?
Dijkstra's Table
Manually track the cost updates for the graph on page 1
Iteration Current Node Updated Costs (B, C, D, E, Z) Visit Next 1 A B: 4, C: 8 B 2 3 4
Web Weaving Slides Web Weaving
HTTP and the World Wide Web
Lesson 04 // Sequence: Navigating Networks
Internet vs Web
The Internet
The Hardware. The wires, cables, routers, and fiber optics that connect every device on Earth.
"The Tracks"
The Web
The Content. The collection of documents, images, and videos accessed via the HTTP protocol.
"The Trains"
Hypertext Transfer Protocol
GET
"Give me that file." Used to retrieve data from a server.
POST
"Here is my information." Used to send data (like a login or a form) to a server.
// HTTP Request Example
GET /index.html HTTP/1.1
Host: www.example.com
User-Agent: Chrome/120.0
Accept-Language: en-US
// HTTP Response Example
HTTP/1.1 200 OK
Content-Type: text/html
<html>...</html>
Status Language
200
OK
Success! The server found what you wanted and is sending it.
301
Moved
Redirect. The page has moved to a new address permanently.
404
Not Found
The server is fine, but it has no record of that specific URL.
The Handshake
A website is just instructions. HTTP brings the instructions to your browser, and your browser "renders" (builds) the site based on the HTML, CSS, and JS received.
HTML: Structure
CSS: Style
JS: Logic
HTTP Handshake Organizer HTTP Handshake Organizer
Internet Protocol Anatomy // Lesson 04
Name:
1 Deconstructing the Request
The Data Stream
GET /profile/settings.html HTTP/1.1
Host: www.socialmedia.com
Accept-Language: en-US,en;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 10.0)
The Method
What action is the browser asking for?
The Resource
What specific file or "path" is being requested?
2 The Request-Response Timeline
1
Browser generates GET request
What happens if the browser needs to send your password? Which method would it use instead of GET and why?
2
Server processes request
The server checks its database. List two possible status codes it might return and what they mean to the user.
Code A:
Code B:
3
Browser receives and renders
The browser receives text-based code (HTML). Explain the difference between receiving the code and seeing the "Web Page."
Data Journeys Slides Data Journeys
Diagnostic Tools and Global Routing
Lesson 05 // Sequence: Navigating Networks
The Invisible Map
"When you click a link to a server in Japan, your data doesn't just teleport there. It physically travels through wires in your floor, under your street, and through cables on the ocean floor."
Today, we peel back the curtain.
We will use network tools to see every city, every router, and every "hop" your data takes on its journey across the world.
Tool: Traceroute
What it does
It sends packets with an increasing "TTL" (Time to Live) to force every router on the path to reply with its identity.
The output
It shows you the IP address of each "hop" and how many milliseconds (ms) it took to get there.
$ traceroute google.com
1 192.168.1.1 (1.2 ms)
2 10.0.0.1 (4.5 ms)
3 68.86.91.193 (12.1 ms) [Philadelphia]
4 68.86.85.177 (15.2 ms) [New York]
5 * * * (Request Timed Out)
6 142.251.41.46 (22.8 ms) [DONE]
Physical Reality
Undersea Cables
99% of international data is carried by subsea fiber optic cables. Only 1% uses satellites (due to latency).
"Your request to a Japanese server likely travels through a pipe at the bottom of the Pacific Ocean."
Visualizing the Cable Network
550+
Active Submarine Cables
Traceroute Trek
Open your terminal. We are going to trace the path to servers in:
🇬🇧
London
bbc.co.uk
🇯🇵
Tokyo
sony.co.jp
🇧🇷
São Paulo
globo.com
Traceroute Trek Lab Traceroute Trek
Network Diagnostics Lab // Lesson 05
Name:
Lab Objective
Use the traceroute (Mac/Linux) or tracert (Windows) command to visualize the hops between your computer and global servers.
1 Tracing a Local Server
Command: traceroute google.com
Hop # IP Address Time (ms) Inferred Location (City/Org) 1 (Likely your router) 2 (Local ISP) 3 4
Note: If you see "* * *", it means a router is configured to hide its identity for security.
2 Tracing an International Server
Command: traceroute bbc.co.uk (UK) or traceroute sony.co.jp (Japan)
Hop # IP Address / Name Time (ms) Notable Transition ... (Atlantic/Pacific crossing?) Final (Target Server)
Analysis: The Latency Leap
Look at your hop list. Between which two hops did the latency (ms) jump the most? Explain why this jump likely represents a significant physical distance (e.g., crossing an ocean).
Global Route Visualization
Sketch the path of one international trace here
Label major cities and underwater cable transitions
1. The Speed of Light
Information in fiber optic cables travels at roughly 2/3 the speed of light. If a packet takes 200ms to go from your school to Tokyo and back, what does that tell you about the physical reality of our "instant" internet?
2. Geopolitics and Routing
Sometimes, data doesn't take the physically shortest path. For example, data from Canada to Brazil might pass through New York first. Why might a network choose a longer path through a specific country's routers?
3. Final Reflection: The Unit Goal
How does the internet translate human-readable requests into machine-executable routes?
Summarize the journey of a single click, from DNS lookup to physical routing to HTTP rendering.