OSI Packet Teacher Guide Teacher Guide
The OSI Model and Packet Analysis
Unit: Network Security
Lesson 1 of 5
Learning Objectives
Define the 7 layers of the OSI model and their specific functions.
Explain the process of data encapsulation and de-encapsulation.
Trace the movement of a data packet from sender to receiver across network layers.
The Hook (5 mins)
"Imagine you're sending a physical letter. You write the message, put it in an envelope, write the address, put a stamp on it, and drop it in a mailbox. The internet does the same thing, but it does it in 7 distinct stages. Today, we are the postal workers of the digital world. How do we make sure a packet gets to the right house without being lost or opened?"
Materials Needed
Data Flow Slides
OSI Pocket Guide (Ref)
Packet Journey Worksheet
7 Envelopes (Prop)
Instructional Steps
1. Direct Instruction: The 7-Layer Cake (15 mins)
Use the Data Flow Slides to introduce the OSI model. Focus on the mnemonic: Please Do Not Throw Sausage Pizza Away (Physical, Data Link, Network, Transport, Session, Presentation, Application).
Pro Tip:
Emphasize that the Physical layer is the only one where actual bits (1s and 0s) move; every other layer is about logic and headers.
2. Modeling: The Envelope Demo (10 mins)
Simulate encapsulation. Write "Hello" on a paper (Application). Put it in an envelope labeled "L6: JSON" (Presentation), then "L5: Start Session" (Session), etc., all the way to "L2: MAC Address".
3. Guided Practice: Packet Journey (20 mins)
Students complete the Packet Journey Worksheet . They must identify which layer handles specific tasks like IP routing (Network) or error checking (Transport).
4. Exit Ticket: The Layer Swap (5 mins)
Ask: "If a router only operates at Layer 3, does it care about what's inside the Layer 4 header?" (Answer: No, it only looks at IP addresses).
Differentiation Strategies
Scaffolding:
Provide a word bank of layer names and icons for the worksheet. Use the "postal service" analogy consistently throughout.
Extension:
Challenge students to research what happens if a packet is too large for the Physical layer (Fragmentation at Layer 3).
OSI Data Flow Slides Data Detective
Tracing the 7-Layer Journey of a Digital Packet
Lesson 01: The OSI Model
The Postal Problem
Sending an email isn't just "sending a file." It's a complex process of packaging, addressing, and transporting.
"How do we ensure a message gets to the right destination across millions of computers without being corrupted?"
The Internet is a Global Postal System
The 7-Layer Cake
7
Please Physical
6
Do Data Link
5
Not Network
4
Throw Transport
3
Sausage Session
2
Pizza Presentation
1
Away Application
Note: We often read the layers from top (Application) to bottom (Physical).
The Software Layers
Layers 7, 6, and 5
7
Application
Where the user interacts with the network (HTTP, FTP, Email).
The Interface
6
Presentation
Translates data (encryption, compression, file formats like JPEG).
The Translator
5
Session
Opens and closes communication channels between apps.
The Coordinator
Layer 4: Transport
The Reliability Manager
Key Roles:
Segmentation: Breaking big files into smaller "segments."
Error Correction: Requesting a resend if data is lost.
Flow Control: Managing speed so the receiver isn't overwhelmed.
TCP / UDP
TCP is the "Handshake" protocol—it makes sure everything arrives perfectly.
Layer 3: Network
The GPS of the Internet
The "Packet" Layer
This layer takes the Transport segments and adds a Header with the source and destination IP Addresses.
Hardware at this layer:
ROUTERS
[Visual: A packet hopping between routers across the globe]
The Hardware Layers
Layers 2 and 1
2
Data Link
Handles "node-to-node" transfer. This is where MAC Addresses live.
Switching
1
Physical
The actual transmission of bits over wires, fiber optics, or radio waves.
Bits & Cables
Encapsulation: The Russian Doll
L4 Header
Data inside...
L3 Header
Segment inside...
L2 Header
Packet inside...
L2 Trailer
Each layer adds its own Header of control information.
Application → Physical
Quick Check
1. Which device works at Layer 3?
A) Switch
2. Where do MAC addresses live?
A) Layer 1
Answers: 1: B, 2: B
Packet Journey Worksheet Packet Journey
OSI Model Analysis Activity
Name:
Date:
1
The Stack Identification
Label the seven layers of the OSI model from top (7) to bottom (1). Then, briefly describe what Data Unit is used at that layer (e.g., Segments, Packets, Frames, Bits).
7
Data Unit:
6
Data Unit:
5
Data Unit:
4
Data Unit:
3
Data Unit:
2
Data Unit:
1
Data Unit:
2
The Encapsulation Process
A user sends a request to visit www.google.com. Describe what happens to the data as it moves through the following layers on the sender's computer.
Layer 4 (Transport):
Identify the protocol (TCP/UDP) and what header information is added.
Layer 3 (Network):
Explain what type of addressing is added here.
Layer 2 (Data Link):
What physical address is added to the "Frame" at this stage?
3
Network Detective
For each scenario, identify which OSI Layer is responsible or where the issue is occurring.
An Ethernet cable is unplugged from a wall jack.
An encrypted HTTPS connection is negotiated between browser and server.
A router looks at an IP address to determine the best path for a packet.
A large file is broken into segments and given sequence numbers for reassembly.
Secure Protocols Teacher Guide Teacher Guide
Protocols: HTTP vs. HTTPS
Unit: Network Security
Lesson 2 of 5
Learning Objectives
Explain the structural difference between HTTP and HTTPS.
Describe the role of SSL/TLS certificates in securing communications.
Identify the risks of cleartext protocols in a shared network environment.
The Hook (5 mins)
"If I shout your password across the cafeteria, everyone knows it. If I whisper it in your ear after we've shared a secret code, nobody else can understand it. Today, we're going to 'sniff' the air. We'll see how easy it is to steal data from HTTP and how HTTPS keeps it locked in a digital vault."
Materials Needed
Secure Connection Slides
Packet Sniffer Activity Sheet
Paper "Encryption Keys"
Instructional Steps
1. Direct Instruction: Cleartext vs. Ciphertext (15 mins)
Use the Secure Connection Slides to demonstrate HTTP (port 80) and HTTPS (port 443). Explain that "S" stands for Secure (SSL/TLS).
2. Activity: The Sniffer Challenge (20 mins)
Students use the Packet Sniffer Activity Sheet . They act as "sniffers" capturing messages. In Part 1 (HTTP), messages are readable. In Part 2 (HTTPS), they are gibberish unless they have the "Private Key."
3. Discussion: The TLS Handshake (10 mins)
Model the "handshake." 1. Client says Hello. 2. Server sends Certificate. 3. Client checks certificate. 4. They agree on a secret key. Use the "Certificate" props if available.
Common Misconception
Students often think HTTPS means a website is safe or trustworthy . Clarify that HTTPS only means the connection is private . A malicious site can still use HTTPS to steal data privately!
Differentiation Strategies
Support:
For the encryption activity, use a simple Caesar cipher (A=B, B=C) to demonstrate the concept of obfuscation before moving to "complex" looking strings.
Extension:
Ask students to research "Man-in-the-Middle" attacks and how a fake certificate might be used to intercept HTTPS traffic.
Secure Connection Slides Secure the Line
Inside the Battle Between HTTP and HTTPS
Lesson 02: Secure Protocols
HTTP: Plaintext
When you use HTTP, your data is sent in "Cleartext."
"Anyone on the same network can read your traffic like a postcard."
Packet Sniff Capture:
GET /login.php HTTP/1.1
Host: unsecure-site.com
POST DATA:
username=jsmith
password=P@ssw0rd123!
HTTPS: The Secure S
How it works:
Uses Encryption to turn data into gibberish.
Uses Certificates to prove the site is real.
Operates on Port 443 (HTTP is Port 80).
Encrypted Capture:
GET /login.php HTTPS/1.1
Host: secure-site.com
POST DATA:
a7b2#f91!kz*99qLp1zR...
0x9F2E77D1A5B...
[Readable only by the server]
The TLS Handshake
Client
Client Hello
Server Certificate
Secret Key Exchange
Server
The "Handshake" establishes trust and encryption before any data is sent.
The Digital ID
A Certificate acts like a passport for a website.
Verified by a Certificate Authority (CA) .
Contains the site's Public Key .
Has an Expiration Date .
Verified
SSL CERTIFICATE
Issued to: *.wikipedia.org
Issued by: DigiCert Inc
Valid until: 2026-10-15
Digital Signature:
0A:4F:9C:21:88:ED:3B:11...
The Verdict
HTTP
× Port 80
× No Encryption
× Low Security
× Best for static public info
HTTPS
✓ Port 443
✓ Encrypted (TLS)
✓ Verified Identity
✓ Standard for all web traffic
"Encryption doesn't hide the fact you're communicating, just the content of what you're saying."
Packet Sniffer Activity Sheet Packet Sniffer
Protocol Analysis Activity
Name:
Date:
Target: HTTP (Port 80)
Intercepting Plaintext
You are a malicious actor on a public library network. You've set up a sniffer to capture traffic. Below is a raw packet capture from a user logging into http://old-forum.net.
Packet #102 | Source: 192.168.1.15 | Dest: 104.22.3.1
--------------------------------------------------
POST /login.php HTTP/1.1
Host: old-forum.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
user_id=cyber_ninja&user_pass=SuperSecret99&action=login
1. Captured Credentials
List the username and password found in the capture.
Username: ________ Password: ________
2. Vulnerability
Why was this information readable to you?
Target: HTTPS (Port 443)
Intercepting Encrypted Traffic
The user now navigates to https://secure-bank.com. You attempt to sniff the same login process. This is what you see in your sniffer tool.
Packet #205 | Source: 192.168.1.15 | Dest: 216.58.217.46
--------------------------------------------------
TLSv1.3 Record Layer: Application Data Protocol: http-over-tls
Encrypted Application Data: (144 bytes)
f9a1 0e32 88cc d101 4b22 1f88 09ee b3d1 4a22 10cc 99ff 112a 0b88 f9a1 0e32 88cc d101 4b22 1f88 09ee b3d1 4a22 10cc 99ff 112a 0b88 f9a1 0e32 88cc d101 4b22 1f88 09ee b3d1 4a22 10cc 99ff 112a 0b88
3. Captured Content
What information can you determine about the user's password from this capture?
4. The "S" Factor
What specific protocol was used to hide this data?
3
The TLS Handshake Logic
Order the steps of the TLS handshake (1-4) to describe how a secure connection is built.
The Server sends its Digital Certificate containing its public key.
The Client and Server use the keys to generate a Session Key for symmetric encryption.
The Client sends a "Client Hello" message with supported encryption methods.
The Client verifies the certificate with a trusted Certificate Authority .
Firewall Logic Teacher Guide Teacher Guide
Firewalls and Access Control Lists
Unit: Network Security
Lesson 3 of 5
Learning Objectives
Explain the function of a firewall in a network architecture.
Apply rule-based logic to write Access Control Lists (ACLs).
Differentiate between "Permit" and "Deny" rules based on IP, port, and protocol.
The Hook (5 mins)
"You are the head bouncer at the most exclusive club in the city: The Web Server. You have a clipboard with strict instructions. Only people with certain IDs (IP addresses) or wearing certain 'outfits' (Ports) can get in. Everyone else? Blocked. If you make a mistake, a hacker gets in, or your customers get locked out. Ready to write the guest list?"
Materials Needed
Firewall Defense Slides
ACL Rule Writing Activity
ACL Answer Key
Instructional Steps
1. Direct Instruction: The Perimeter Guard (15 mins)
Use the Firewall Defense Slides to introduce firewalls. Explain that they work at OSI Layers 3 (IP) and 4 (Port). Introduce the concept of "Implicit Deny"—if it's not on the list, it's not coming in.
2. Modeling: Writing the First Rule (10 mins)
Demonstrate ACL syntax: [Action] [Protocol] [Source IP] [Destination Port]. Example: PERMIT TCP ANY 10.0.0.5 80 (Allow anyone to visit the web server on port 80).
3. Independent Practice: ACL Challenge (20 mins)
Students complete the ACL Rule Writing Activity . They must configure a firewall for a small office network that needs to block social media but allow email and web browsing.
Differentiation Strategies
Scaffolding:
Provide a "Cheat Sheet" of common ports (80, 443, 22, 25). Use a drag-and-drop or fill-in-the-blank version of the ACL activity for students who struggle with syntax.
Extension:
Challenge students to write a "Stateful" firewall rule vs. a "Stateless" one. Ask: "How does the firewall know if this packet is part of a conversation we already started?"
Firewall Defense Slides The Digital Bouncer
Mastering Firewall Logic and Access Control Lists
Lesson 03: Firewall Defense
The Perimeter Guard
A Firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules.
"Think of it as a barrier between a trusted network and an untrusted network (like the Internet)."
Filters traffic at Layers 3 & 4
Access Control Lists (ACL)
The Rule Formula:
ACTION
Permit / Deny
SOURCE
IP or Network
DEST
IP or Network
PORT
Service (80, 443...)
DENY TCP 192.168.1.50 ANY 443
Implicit Deny
If a packet doesn't match any of the rules in your list, the firewall automatically drops it.
"Whitelist by default, blacklist by exception."
The Security Gateways
80
HTTP
Web Traffic (Unsecure)
443
HTTPS
Web Traffic (Secure)
22
SSH
Secure Remote Access
25
SMTP
Sending Email
The Sequence Problem
Firewalls read top-to-bottom.
1. DENY ANY ANY MATCH!
2. PERMIT 10.0.0.1 ANY 80 Ignored
Once a packet matches a rule, the firewall stops looking at the rest of the list.
Always put your most specific rules at the top and general rules at the bottom.
ACL Rule Writing Activity ACL Bouncer
Access Control List Configuration
Name:
Date:
Network Blueprint: Titan Corp
WEB SERVER
10.0.0.10
Ports: 80, 443
ADMIN PC
10.0.0.50
Full Access Needed
STAFF WI-FI
192.168.1.0/24
Restricted Access
Security Requirements
Write the ACL rules for the Titan Corp perimeter firewall. The firewall uses Implicit Deny logic. All traffic is TCP unless otherwise specified.
Anyone on the Internet must be able to visit the company website (HTTPS).
The Admin PC must have remote access (SSH) to the Web Server.
The Staff Wi-Fi network must be blocked from accessing the Web Server entirely.
Staff must be able to send emails (SMTP) to an external mail server (IP: 8.8.4.4).
Rule #
Action
Protocol
Source
Destination
Port
1
2
3
4
Security Analysis
If you swapped the order of Rule #3 and Rule #1, would the Staff Wi-Fi still be blocked from the Web Server? Explain why or why not.
Wireless Security Teacher Guide Teacher Guide
Wireless Security and VPNs
Unit: Network Security
Lesson 4 of 5
Learning Objectives
Identify common vulnerabilities in public and open Wi-Fi networks.
Compare WPA2 and WPA3 encryption standards.
Explain how Virtual Private Networks (VPNs) create secure tunnels over untrusted networks.
The Hook (5 mins)
"You're at Starbucks. The Wi-Fi is free. You log in to your bank account. What you don't see is the person in the corner with a small antenna and a laptop. In 5 minutes, they have your login cookie. Is 'Free Wi-Fi' ever actually free? Today, we learn how to build a digital tunnel through the coffee shop air."
Materials Needed
Wireless & VPN Slides
VPN Tunnel Activity Sheet
Starbucks Network Map (Case Study)
Instructional Steps
1. Direct Instruction: The Invisible Air (15 mins)
Discuss how radio waves propagate. Explain that wireless traffic is broadcast to everyone in range. Introduce WPA2/WPA3 as the solution (encryption at Layer 2).
2. Concept Exploration: The VPN Tunnel (15 mins)
Use the "Tunnel" analogy. Explain that a VPN encapsulates your entire packet inside another packet, which is encrypted. Even if someone sniffs the Wi-Fi, they only see the outer tunnel, not the data inside.
3. Discussion: Evil Twins and Public Risks (15 mins)
Discuss "Evil Twin" hotspots. How can you tell the difference between "Starbucks_Free" and "Starbucks_Free_Secure"? (Hint: You often can't without looking at the certificate).
Security Best Practice
"Always assume public Wi-Fi is compromised. Use a VPN to create a trusted layer on top of an untrusted physical medium."
Differentiation Strategies
Visual Learners:
Draw the VPN encapsulation on the board using nested boxes. Show how the original IP header is hidden inside the encrypted payload of the new packet.
Advanced Challenge:
Ask students to research the difference between Split-Tunneling and Full-Tunneling in VPN configurations.
Wireless Connection Slides The Invisible Air
Wireless Vulnerabilities and the VPN Tunnel Solution
Lesson 04: Wireless & VPNs
Wi-Fi is a Shout
Unlike a wired connection, wireless signals are broadcast in every direction.
"Anyone with an antenna can 'hear' the conversation if it isn't locked."
WPA: The Digital Lock
WPA2
Standard since 2004
Vulnerable to "KRACK" attacks
Uses AES encryption
WPA3
Modern standard (2018)
Stronger protection against password guessing
Individualized encryption for each user
The "Free" Trap
The Sniffer
Eavesdropping on cleartext traffic (HTTP, FTP) from other users on the same open network.
Evil Twin
A hacker sets up a fake hotspot with the same name as the real one to capture your data.
Sidejacking
Stealing "cookies" to hijack your active session (like being logged into your email without a password).
VPN: The Secure Tunnel
Your Device
Encrypted Data
VPN Server
"Your data is wrapped in a protective layer that the public Wi-Fi can't peel back."
Packet-in-a-Packet
A VPN uses Encapsulation to hide your true destination.
1
Original packet is encrypted.
2
New IP Header is added (pointing to VPN).
3
Public Wi-Fi only sees traffic to the VPN.
The VPN Payload
VPN Header (To: VPN IP)
Encrypted Original Packet
(Hidden: To Bank IP, Data: Login)
The Wireless Defense Kit
Safe Practices:
Always use WPA3 if available.
Enable VPN on all public networks.
Ensure HTTPS is active in browser.
Set devices to not auto-join open Wi-Fi.
Defend Your Data
VPN Tunnel Activity Sheet Tunnel Builder
VPN Encapsulation & Wireless Analysis
Name:
Date:
1
Public Wi-Fi Threat Analysis
Read the scenario below and answer the questions. Assume the network is "Open" (No WPA encryption).
"You are at 'The Daily Grind' coffee shop. You connect to the Wi-Fi. You decide to check your grades on http://myschool.edu. At the next table, an attacker is running a sniffer tool. They see your device ID and every page you visit."
Vulnerability #1: HTTP
Why is using HTTP specifically dangerous on this open network?
Vulnerability #2: The Medium
What physical property of Wi-Fi allows the attacker to 'hear' your traffic?
2
VPN Encapsulation Diagram
A VPN takes your original data packet and wraps it in a "Secure Tunnel." Use the labels below to complete the diagram of a VPN-encapsulated packet .
NEW IP HEADER (TO VPN) ENCRYPTED PAYLOAD ORIGINAL IP HEADER (HIDDEN) VPN AUTH TRAILER
A
Encapsulated Space
B1
B2
C
Identify Box A:
Identify Box B1 & B2 (Payload):
Identify Box C:
3
WPA Standards Check
Select the correct WPA standard for each security feature.
Introduced "Simultaneous Authentication of Equals" to stop password guessing.
WPA2
WPA3
The most common current standard, but vulnerable to KRACK attacks.
WPA2
WPA3
Final Thought
If you use a VPN on a public Wi-Fi network, can the coffee shop owner see that you are visiting netflix.com? Why or why not?
Topology Project Teacher Guide Teacher Guide
Designing a Secure Network Topology
Unit: Network Security
Lesson 5 of 5
Project Summary
In this culminating project, students act as network security consultants for "Lumina Tech," a small startup. They must design a secure network topology that balances usability with defense-in-depth strategies. Students will create a physical diagram and write a security justification for their design choices.
Key Concepts to Assess
Placement of Firewalls
DMZ Implementation
Network Segmentation
Secure Protocol Selection
Estimated Time
Introduction 10m
Diagramming 45m
Security Logic 25m
Peer Review 10m
Facilitation Notes
1. The Scenario Pitch: Present the Lumina Tech brief. Emphasize that they have high-value research data on an internal server and a public-facing web server. How do they protect both without making it impossible for employees to work?
2. Diagramming Requirements: Students must use standard icons (Firewall, Router, Switch, Server, PC, Cloud). Encourage the use of a 3-legged firewall or back-to-back firewall design for the DMZ.
3. The Justification: The diagram alone isn't enough. Students must explain why they placed the firewall where they did. This assesses their understanding of traffic flow and perimeter defense.
Grading Rubric
Criteria Exceeds (4) Meets (3) Approaching (2) Topology DMZ used correctly; clear segmentation between public and private. Logical flow; firewall placed between Internet and LAN. Unclear flow; firewall missing or misplaced. Security Logic Detailed explanation of ACL logic and protocol selection (HTTPS, VPN). Explains basic firewall function and port selection. Vague explanation of security choices. Clarity Professional icons used; clear labeling of IPs and ports. Mostly clear; minor labeling errors. Difficult to follow or missing key labels.
Support:
Provide a pre-printed page with the "Cloud" and "Internal Server" already placed. Give students a "Sticker Sheet" of components to arrange rather than draw from scratch.
Challenge:
Ask students to add a "Guest Wi-Fi" segment that is isolated from the corporate LAN but has internet access.
Network Blueprint Project Architect of Defense
Culminating Network Design Project
Blueprint No: LT-2026-05
Designer:
Project Brief: Lumina Tech
"Lumina Tech is a small startup with 15 employees. They have two major network needs: 1. A public-facing Web Server (10.0.1.10) where customers access their app. 2. An internal Database Server (10.0.2.50) containing secret research data. Employees work from the Corporate LAN (192.168.1.0/24). Your mission: Design a topology that prevents internet users from touching the Database, while allowing the Web Server to talk to the Database securely."
Topology Diagram
• Internet • LAN • DMZ
Internet
[ Create your secure network diagram here ]
1. The DMZ Strategy
Which server did you place in the DMZ and why? How does this protect the internal LAN?
2. Secure Protocols
Identify two protocols you would mandate for this network to ensure data security in transit.
ACL Blueprint (Draft)
Write one critical firewall rule to protect the internal Database Server (10.0.2.50) while allowing the Web Server (10.0.1.10) to access it.
Action:
Source IP:
Dest IP:
Port:
Checklist
Firewall at perimeter
Web Server isolated in DMZ
All components labeled
Traffic flow lines drawn
Network Security
Lumina Tech Solutions
