Router Relay Teacher Guide Router Relay
Teacher Facilitation Guide
Lesson 1
Network Architecture
Learning Objectives
Explain how data is broken into packets for transmission.
Identify the roles of clients, servers, and routers in a network.
Describe the impact of packet loss and latency on communication.
Materials Needed
Post-it notes (3 different colors)
Envelopes (labeled "Packet")
Classroom obstacles (desks, chairs)
Timer/Stopwatch
Prep Checklist
Prepare 3 distinct "Messages" broken into 5 fragments each.
Assign roles: 2 Clients (Senders), 2 Servers (Receivers), 10+ Routers.
Clear a path but include 2 "Congested" zones.
Activity: The Human Router
1
The Setup
Position "Clients" at one side of the room and "Servers" at the other. Scatter "Routers" in between. Routers cannot move; they can only pass packets to an adjacent router.
2
Packet Injection
Give Clients their message fragments (Post-its numbered 1-5). They must put each in an envelope and hand them one by one to a nearby Router.
3
The Rules of the Wire
Packet Loss: Every 30 seconds, the teacher "drops" one packet in transit (removes it from the game).Latency: Routers must count to 3 before passing a packet if they are holding more than one.Out-of-Order: Servers must wait until they have all 5 fragments before they can "read" the message.
Debrief Questions
Guide the transition from the physical game to technical concepts.
"What happened when a router was overwhelmed with packets?"
Key Concept: Network Congestion. When routers receive more data than they can process or send out, packets queue up, leading to high latency (lag).
"Did the message fragments arrive in the right order?"
Key Concept: Packet Reassembly. IP packets often take different paths. The receiving device (Server) must use sequence numbers in the packet headers to reassemble the data correctly.
"How did the 'dropped' packets affect the message?"
Key Concept: Reliability vs. Speed. This introduces TCP (Reliability - asking for a resend) vs. UDP (Speed - moving on without the lost data). Ask students which one they think YouTube uses vs. Email.
Pro-Tips for Facilitation
Monitor the "Routers": Ensure they aren't running! Networking is about logic and connection, not physical speed. Routers should represent static physical nodes.
Visualizing Attacks: After the first round, introduce a "Malicious Node" who copies a packet before passing it on. This previews the Man-in-the-Middle lesson.
Scaling: If you have a large class, create two separate networks (Subnets) and only one "Gateway Router" that connects them.
Packet Journey Slides Lesson 1: Network Basics
Packet
Journey
How data moves across the global web of wires and airwaves.
The Digital Conversation
The Client
The device requesting data (Your phone, laptop, smart fridge).
The Server
The high-powered computer hosting data (Netflix, Google, Minecraft).
Client
RESOURCES?
Server
Breaking it Down: Packets
1. Chop
Files are too big to send at once. Computers chop them into smaller chunks called packets .
2. Label
Each packet gets a header with the destination address and its sequence number.
3. Send
Packets travel independently across the network, often taking different routes.
The Traffic Controllers
Routers are the "sorting machines" of the internet. They look at a packet's IP address and decide the fastest path to the next hop.
Fast Paths
Dynamic Rerouting
Interconnectedness
When things go wrong
Packet Loss
Packets can be dropped due to congestion, interference, or faulty hardware. The system needs a way to handle missing pieces!
Latency
The time it takes for a packet to travel from sender to receiver. High latency results in "lag" in games or buffering in videos.
Network Protocols
A protocol is simply a **set of rules**. Without them, computers wouldn't know how to talk to each other.
TCP
Transmission Control Protocol
The "Reliable" One. Makes sure every packet arrives and is in the right order.
UDP
User Datagram Protocol
The "Fast" One. Sends data as quickly as possible without checking for errors.
Packet Route Map Worksheet Packet Route Map
Observation Sheet: Human Router Simulation
Name: ____________________
Date: ____________________
Part 1: Network Roles
Briefly describe your role in the simulation and what your primary responsibility was.
Part 2: Traffic Observations
1. When the "network" became congested, what did you observe about the speed of delivery?
2. Did the packets always take the same path? Why or why not?
3. What happened at the "Server" end when a packet was removed (Packet Loss)?
The Essential Link
Based on today's activity, why do you think it is more efficient to send data in small packets rather than one giant chunk? Consider what would happen if a 1GB file was lost halfway through a transfer versus a single 1KB packet.
Digital Doors Slides Lesson 2: Protocol Deep Dive
Digital Doors
Understanding Ports, Protocols, and the 3-Way Handshake.
The Handshake
SYN
Synchronize
"Hey! Can we talk?"
SYN-ACK
Acknowledgment
"I hear you! Let's talk."
ACK
Connected
"Awesome. Sending data!"
This process ensures reliability. If a step fails, the connection is never made.
IP Address vs. Port
The Building Address (IP)
Tells you which physical server you are trying to reach.
The Apartment Number (Port)
Tells you which specific application or service you want inside that server.
80 HTTP
443 HTTPS
22 SSH
Closed
Closed
25 SMTP
Closed
3389 RDP
Closed
SERVER: 192.168.1.50
Knocking on Digital Doors
Hackers and Network Admins use tools like Nmap to "scan" a computer. They send messages to every port to see which ones are open.
Open: Ready for a connection.Closed: The door is locked.Filtered: A firewall is blocking the scan.
$ nmap 192.168.1.1
Starting Nmap 7.80...
Nmap scan report for 192.168.1.1
Host is up (0.0021s latency).
PORT STATE SERVICE
80/tcp open http
443/tcp open https
22/tcp open ssh
_
The Danger Zone
Every open port is a potential entry point for an attacker. If a service is poorly secured or has a bug, the open door allows the attacker inside.
Rule of Least Privilege:
If you don't need a port for your business or application, **CLOSE IT**. Only leave open what is absolutely necessary.
Port Scavenger Hunt Worksheet Port Scavenger Hunt
Analyzing Network Scan Data
Name: ____________________
Date: ____________________
Mission Briefing
Below is a raw network scan (Nmap) from a mysterious server on the school subnet. Your job is to identify what services are running and determine if this server follows the Rule of Least Privilege .
# Nmap 7.92 scan report for 10.12.5.42
Port State Service
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp closed smtp
53/tcp open domain
80/tcp open http
110/tcp open pop3
443/tcp open https
3389/tcp open ms-wbt-server
1. How many "open" doors (ports) did you find on this server?
2. This server is meant to be a simple **Public Web Server**. Which TWO ports are absolutely necessary for it to function correctly?
3. **Security Red Flag:** Telnet (Port 23) sends all data in clear text (no encryption). Based on what you know about port security, what should the administrator do with Port 23?
4. Critical Thinking: If an attacker finds that Port 22 (SSH) is open, what kind of attack might they try to "unlock" that door?
Port Scavenger Hunt Answer Key Port Scavenger Hunt
Answer Key & Teacher Reference
Lesson 2 Key
1. How many "open" doors (ports) did you find on this server?
Answer: 8
(Ports 21, 22, 23, 53, 80, 110, 443, 3389 are all listed as open.)
2. This server is meant to be a simple Public Web Server. Which TWO ports are absolutely necessary for it to function correctly?
Answer: Port 80 (HTTP) and Port 443 (HTTPS)
3. **Security Red Flag:** Telnet (Port 23) sends all data in clear text. What should the administrator do with Port 23?
The administrator should CLOSE Port 23. Telnet is an outdated and insecure protocol. For remote management, they should use SSH (Port 22), which is encrypted.
4. Critical Thinking: If an attacker finds that Port 22 (SSH) is open, what kind of attack might they try?
An attacker would likely attempt a Brute Force or Dictionary Attack . Since the "door" is open, they will try thousands of common username and password combinations until they find one that works.
Key Teaching Point: Rule of Least Privilege
Remind students that this server is highly insecure . It has email ports (110), file transfer ports (21), and remote desktop ports (3389) all open on a public web server. This increases the "attack surface." Every open port is another opportunity for a hacker to find a vulnerability.
Invisible Ear Slides Lesson 3: Interception
The Invisible Ear
Man-in-the-Middle Attacks and the Power of Encryption.
What is MITM?
A Man-in-the-Middle (MITM) attack occurs when a malicious actor inserts themselves into a conversation between two parties to secretly listen or alter the data.
Client
Server
The attacker sees everything that passes through.
The Tool: Packet Sniffers
How it Works
In a shared network (like public Wi-Fi), data packets travel through the air. A packet sniffer copies these packets as they fly by, even if they aren't meant for the attacker's computer.
// Intercepted Packet Data
Source: 192.168.1.15
Dest: 93.184.216.34
Protocol: HTTP
POST /login HTTP/1.1
Host: example.com
user=student123&pass=super_secret_42
The Shield: HTTPS
HTTP
Clear Text
"Meet me at the park at midnight."
Easy to read, easy to steal.
HTTPS
Encrypted
a7b29xc!90k_82$vLmPqZ91...
Unreadable without the secret key.
Stay Safe on Public Wi-Fi
Look for the Lock
Only visit HTTPS sites. Avoid sites that trigger "Unsecured" warnings.
Incognito ≠ Invisible
Incognito mode only hides your history locally. The network can still see your traffic!
Use a VPN
Wait for Lesson 5! We'll see how VPNs create a secure tunnel for your data.
Sniffer Log Worksheet The Sniffer's Log
Case Study: Man-in-the-Middle Scenarios
Name: ____________________
Date: ____________________
Scenario: "Free Public Wi-Fi"
"You are sitting in a local coffee shop. You see an open Wi-Fi network named 'Free_Coffee_Web'. You connect and log into your favorite non-HTTPS website to check some scores. Unbeknownst to you, someone in the corner is running a packet sniffer."
1 Why is an "Open" Wi-Fi network (one without a password) particularly dangerous for MITM attacks?
2 Explain the difference between what an attacker sees when you use **HTTP** vs. **HTTPS**.
HTTP (Unencrypted)
HTTPS (Encrypted)
3 Your browser shows a red "Not Secure" warning. What does this usually mean about the connection? Is it safe to enter a password?
Security Rule: Treat all public Wi-Fi as "hostile." If you must use it, ensure you see the padlock icon in your browser address bar.
Interception Demo Teacher Guide Intercepting the Wire
MITM Attack Demonstration Guide
Lesson 3
Interception & Encryption
Safety Warning
This demonstration is intended for educational purposes only. Always perform network testing in a controlled environment. Ensure students understand the ethical and legal implications of unauthorized network interception.
Technical Setup
Network: A dedicated "Sandboxed" Wi-Fi router (not the school network).Sniffer Machine: Teacher laptop running Wireshark or tcpdump .Victim Machine: A student volunteer's laptop or a secondary school device.Target Site: A simple, non-HTTPS login page (e.g., http://info.cern.ch or a locally hosted HTML form).
The Hook
Challenge a student volunteer to log into a "secret site" using a username and password they choose. Announce that you are not looking at their screen, yet you will tell them their password within 10 seconds.
Facilitation Steps
1
Start the Capture
Open Wireshark on the Sniffer machine. Select the Wi-Fi interface and apply the filter http.request.method == "POST". This filters for data sent from the victim to a server.
2
The Interception
Have the student volunteer type their username and password into the unencrypted form and click "Submit". Point out the lack of a "padlock" icon in the browser.
3
The Reveal
In Wireshark, double-click the captured POST packet. Expand the "HTML Form URL Encoded" section. The student's password will be visible in clear text. Project this for the class to see the "Invisible Ear" in action.
Debrief & Transition
Question: "Could I have done this if the site was HTTPS?"
Answer: No. While I could still capture the packets, the contents would be encrypted. I would see random gibberish instead of the actual password. This highlights that HTTPS doesn't stop the "sniffing," but it makes the "listening" useless.
Question: "What if the attacker was the Wi-Fi router itself?"
Answer: This is a common tactic. Attackers set up "Evil Twin" hotspots with familiar names like "Starbucks_Guest". Because all your data passes through their hardware, they have a perfect vantage point for a MITM attack.
Extension Activity: The Packet Race
If time permits, have students attempt to "race" a packet manually using paper slips, while a designated "Attacker" student tries to grab the slip as it passes by. This reinforces the physical vulnerability of shared media.
The Gatekeeper Slides Lesson 4: Perimeter Defense
The Gatekeeper
Controlling the flow of data with Firewalls and ACLs.
The Digital Perimeter
A Firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
The Bouncer Analogy
Just like a bouncer checks IDs at a club door, a firewall checks "headers" at the network's edge.
How it Decides: Inspection
IP Address
Where is this packet coming from? Where is it going?
Port Number
Which "door" is it trying to enter? (e.g., Port 80 for web)
Protocol
Is it using TCP, UDP, or ICMP (Ping)?
The ACL Rulebook
An Access Control List is a sequential list of permit or deny statements that apply to IP addresses or protocols.
Firewall_Config_v1
10 DENY tcp from 123.45.67.89 any port 80
20 PERMIT tcp from any any port 443
30 DENY icmp from any any
Rule order matters! The first match wins.
Implicit Deny
In security, if a packet doesn't match any rule in your list, it is automatically blocked .
"If you're not on the list, you're not coming in."
ACL Designer Worksheet ACL Designer
Writing Network Security Rules
Name: ____________________
Date: ____________________
Mission Objective
You are the security admin for Titan Corp . You must configure an Access Control List (ACL) to protect the internal network (10.0.0.0/24) based on the following security requirements.
Rule 1: Deny all traffic from the known malicious IP: 203.0.113.5
Rule 2: Allow all employees to access the web via HTTPS (Port 443).
Rule 3: Deny all PING requests (ICMP) to prevent discovery scans.
The ACL Rulebook
Sequence Action (Permit/Deny) Protocol / Port Source IP 10 20 30 40 Implicit Deny ANY ANY
Order Matters:
What would happen if you put a "Permit ANY ANY" rule at Sequence 05, before your "Deny Malicious IP" rule?
ACL Designer Answer Key ACL Designer
Answer Key & Scoring Guide
Lesson 4 Key
Completed Rulebook (Exemplar)
Sequence Action Protocol / Port Source IP 10 Deny ANY 203.0.113.5 20 Permit TCP / 443 ANY 30 Deny ICMP (Ping) ANY 40 Implicit Deny ANY ANY
Refining the Logic:
"What would happen if you put a 'Permit ANY ANY' rule at Sequence 05, before your 'Deny Malicious IP' rule?"
The Answer:
The malicious IP would be PERMITTED . Because firewalls process rules sequentially from top to bottom, the "match" at Sequence 05 would happen first, and the security system would stop looking at any further rules (including the Deny rule at Sequence 10).
Scoring Rubric
Accuracy (5 pts): Did they use the correct Protocol/IP for each requirement?Order (5 pts): Is the "Deny" rule for the specific IP above the "Permit" rule?Implicit Deny (5 pts): Did they recognize that anything not explicitly permitted (like HTTP on Port 80) is blocked? Private Pipe Slides Lesson 5: Privacy & Tunneling
The Private Pipe
Creating secure tunnels across public networks using VPNs.
What is a VPN?
A Virtual Private Network (VPN) extends a private network across a public network, enabling users to send and receive data as if their devices were directly connected to the private network.
The Tunnel Analogy
Think of a subway tunnel running through a busy city. People outside (on the public net) can't see who or what is inside the tunnel.
ENCRYPTED TUNNEL
The Secret Sauce: Encapsulation
Original Packet
"Private Data"
VPN Header
New Outer Envelope
01101001 01100111...
Encapsulation hides the original packet inside a new one. The new header only shows the address of the VPN server, hiding where the data is actually going.
The Big Three Use Cases
Public Safety
Protects your traffic from packet sniffers on unsecured public Wi-Fi (Lesson 3 revisited!).
Remote Work
Allows employees to securely access company files from home as if they were in the office.
Privacy
Hides your IP address from websites, preventing them from tracking your physical location.
Unit Recap
1
Packets
Data chopped for travel
2
Ports
Digital entry points
3
HTTPS
Encryption shields
4
Firewalls
The Gatekeepers
5
VPNs
The Private Tunnel
Security is layers, not a single door.
Keep yours layered. Stay safe.
Unit Security Audit Exit Ticket Unit Security Audit
Network Security Final Reflection
Name: ____________________
Date: ____________________
Part 1: Security Match-Up
A. Packet Switching
B. 3-Way Handshake
C. Port Scanning
D. Encapsulation
Hiding data inside a "new" packet (VPN).
Breaking data into chunks for routing.
SYN -> SYN/ACK -> ACK reliability check.
Searching for "open doors" on a server.
Part 2: Multi-Layer Defense
Explain how a **VPN** would have protected the victim in the Man-in-the-Middle scenario from Lesson 3. Be specific about what the attacker would see vs. what they wouldn't.
The Big Picture
Throughout this unit, we've looked at many different security tools. If you could only use **ONE** of these for your personal laptop—a Firewall or a VPN—which would you choose and why?
Unit Security Audit Answer Key Unit Security Audit
Teacher Answer Key
Final Assessment Key
Part 1: Security Match-Up
D Hiding data inside a "new" packet (VPN).
A Breaking data into chunks for routing.
B SYN -> SYN/ACK -> ACK reliability check.
C Searching for "open doors" on a server.
Part 2: Multi-Layer Defense
Exemplar Response:
A VPN creates an encrypted "tunnel" for your data. In Lesson 3, the attacker used a packet sniffer to read unencrypted HTTP data. If the victim had used a VPN, the attacker would still have intercepted the packets, but they would only see the encrypted outer layer . They would not be able to see the destination (the website) or the data (passwords) inside because it would be scrambled gibberish.
Part 3: The Big Picture
Acceptable Arguments:
Firewall: Best if you are worried about hackers trying to connect into your computer directly. It blocks unauthorized entry.VPN: Best if you frequently use public Wi-Fi and want to hide your browsing activity and protect your data in transit from sniffers.Advanced: Students might note that modern OS's already have built-in firewalls, making a VPN a more useful "add-on" for privacy. 
