University Networking Lab · Interactive

Computer Networking
Interactive Lab

Build a mental model of how modern networks actually move, route, secure, observe, and troubleshoot data. Work from Ethernet and IP through DNS, TCP, TLS, VPNs, firewalls, routing, and SIEM correlation.

ProtocolsSwitching & routingTLS & VPNFirewallsSIEMTroubleshooting

All simulations run locally in the browser. They model networking behavior for instruction; they do not scan networks, open sockets, or transmit student data.

Client AClient BSwitchL2RouterFirewallInternet

1. Networking foundations

Start with the layered model: each layer solves a narrower problem and hands a service to the layer above it.

7OSI conceptual layers
4–5Common TCP/IP teaching layers
48-bitEthernet MAC address
32 / 128IPv4 / IPv6 address bits

OSI model: a troubleshooting lens

7ApplicationHTTP, DNS, SMTP, SSH, SNMPUser-facing network services
6PresentationEncoding, serialization, cryptographic representationFormat & transform
5SessionDialog/session management conceptsConversation state
4TransportTCP, UDP, QUIC transport functionsPorts & end-to-end delivery
3NetworkIPv4, IPv6, ICMP, routingLogical addressing
2Data LinkEthernet, Wi-Fi, VLANs, ARP contextFrames & local delivery
1PhysicalCopper, fiber, RF, modulation, opticsBits & signals

What each device principally decides

DevicePrimary decisionKey state
Repeater / hubRegenerate or repeat bitsLittle/no forwarding intelligence
Layer-2 switchWhich local port should receive this Ethernet frame?MAC/CAM table, VLAN membership
RouterWhich next hop best reaches this destination IP network?Routing table / forwarding information base
FirewallDoes policy permit this flow or packet?Rules, state table, application/security context
Load balancerWhich backend should receive this service request?Pool health, policy, session state
SIEMDo multiple events collectively indicate a security-relevant pattern?Normalized events, rules, baselines, threat context
Key distinction: a MAC address answers a local-link delivery question; an IP address supports logical delivery across routed networks; a TCP/UDP port identifies a transport endpoint/service on a host.

2. Major protocol atlas

Filter by name, layer, or security role. Ports shown are conventional defaults, not guarantees.

3. Encapsulation laboratory

Watch application data acquire transport, IP, and Ethernet information before transmission.

Build the protocol data unit

Application
Data
Transport
TCP headerData
Network
IPv4/IPv6 headerTCPData
Data Link
Ethernet headerIPTCPDataFCS
Physical
10110100 01101001 00101110 ...

Headers answer different questions

Header / fieldQuestion answered
Ethernet destination MACWhich interface on this local L2 segment should accept the frame?
IP destinationWhich logical host/network is the packet trying to reach?
TCP/UDP destination portWhich transport endpoint/service should receive the payload?
TCP sequence/ACKWhich bytes have been sent and acknowledged?
Ethernet FCSWas the received frame corrupted at the link layer?
Important: routers normally replace the Layer-2 framing hop by hop while the routed IP packet continues toward its destination. NAT or tunneling can also alter/add network-layer information.

4. Ethernet, switching, VLANs, and local delivery

A switch learns source MAC addresses and forwards based on destination MAC addresses within a VLAN.

MAC-learning switch simulator

L2 SwitchMAC learning Host AAA:AA · Port 1 Host BBB:BB · Port 2 Host CCC:CC · Port 3 Host DDD:DD · Port 4
The table is empty. The first source MAC the switch sees will be learned on its ingress port.

Learned MAC/CAM table

MACPortStatus
No entries learned yet.

VLAN mental model

A VLAN partitions a Layer-2 switching domain. Devices in different VLANs require a Layer-3 function—router or multilayer switch—to communicate, subject to policy.

VLAN 10 · StudentsVLAN 20 · Servers⇄L3 routing + policy
Spanning Tree Protocol (STP): redundant Layer-2 links are useful for resilience, but uncontrolled loops can create broadcast storms and MAC-table instability. STP logically blocks selected paths to maintain a loop-free topology.

5. IP addressing, subnetting, and routing

IP provides logical addressing. Routing uses the most-specific matching route, not the first route that merely “looks close.”

IPv4 subnet calculator

Network—
Subnet mask—
Broadcast—
Usable host range—
Addresses / conventional usable hosts—
/31 and /32 have special uses; this calculator identifies them separately rather than applying the old “network + broadcast” convention blindly.

Longest-prefix routing simulator

DestinationNext hop/interface
10.10.20.0/24G0/2 → Lab subnet
10.10.0.0/16G0/1 → Campus core
10.0.0.0/8G0/0 → Enterprise WAN
0.0.0.0/0WAN → ISP default
Enter a destination and ask the router to perform a longest-prefix match.

Static routing is administrator-defined. OSPF is an interior gateway protocol commonly used within an autonomous system. BGP exchanges reachability and policy between autonomous systems and is foundational to Internet interdomain routing.

6. Core network services and transport behavior

Most real transactions require several supporting protocols before the application request can even begin.

DHCP DORA animation

For conventional IPv4 DHCP, a new client may progress through Discover → Offer → Request → Acknowledge.

ClientNo IPv4 lease yetDHCP ServerAddress poolReady
Discover: the client attempts to locate available DHCP service.

DNS resolution walk-through

ClientRecursive ResolverRootTLDAuthoritative
Step 1: the stub resolver asks its configured recursive resolver. Cache may answer immediately.

TCP connection state

TCP is connection-oriented and reliable. Its three-way handshake establishes bidirectional sequence-number context before application data is exchanged.

ClientServer · SYN
Client · SYN-ACKServer
ClientServer · ACK
ApplicationData begins

TCP, UDP, and QUIC

PropertyTCPUDPQUIC
Connection semanticsConnection-oriented byte streamDatagram-orientedSecure multiplexed transport over UDP
ReliabilityBuilt inApplication decidesBuilt in at QUIC layer
OrderingOrdered byte streamNo inherent orderingPer-stream handling avoids some TCP head-of-line effects
SecurityTLS layered above for common secure useNot inherentTLS 1.3 integrated into QUIC design

7. Secure communications: TLS, PKI, SSH, and VPNs

Different security technologies protect different layers and scopes. “Encrypted” is not a complete architecture description.

TLS 1.3 conceptual handshake

ClientClientHello
ServerHelloServer
Certificate + proofServer
ClientFinished
FinishedServer
EncryptedApplication data
TLS provides: authentication (normally server authentication, optionally mutual), confidentiality, and integrity for the protected connection. Certificates bind identities to public keys through PKI validation.

VPN tunnel visualizer

A VPN creates a protected logical path across an untrusted or less-trusted network. IPsec commonly protects at the IP layer; TLS-based VPNs protect selected application/transport exchanges depending on design.

🔒
DATA
Use caseTypical patternWhat is protected
Site-to-siteGateway ↔ gatewayTraffic between protected networks
Remote accessUser endpoint ↔ VPN gatewaySelected or all client traffic by policy
Host-to-hostEndpoint ↔ endpointTraffic between specific systems

IPsec / IKE

IPsec can provide confidentiality, integrity, authentication, and anti-replay services at the IP layer. IKE negotiates security associations and keying material.

ESPIKEv2Tunnel / transport modes

SSH

Secure Shell protects remote interactive sessions and supports secure channels such as port forwarding and SFTP. Host-key verification is central to resisting impersonation.

TCP 22Host keysPublic-key auth

mTLS

Mutual TLS authenticates both sides with certificates. It is common in service-to-service environments where both client and server identities must be cryptographically established.

Client certificateServer certificatePKI trust

8. Firewalls, NAT, segmentation, and policy

Evaluate traffic as a policy engine would: source context, destination context, protocol, port, direction, connection state, and sometimes application identity.

Firewall rule simulator

Source zone
User LAN
FIREWALL
POLICY
Destination
Server zone
Policy has not been evaluated.

Policy used by simulator

#SourceServiceAction
1AdminTCP/22Allow
2User LANTCP/443Allow
3GuestUDP/53Allow
4AnyICMPAllow for lab
5AnyAnyDeny
Stateful filtering: a stateful firewall tracks connection state so return traffic for an allowed session can be treated differently from an unsolicited new inbound attempt.

NAT/PAT rewrites addressing and/or ports. NAT is not itself a complete security policy, although some deployments combine address translation with stateful filtering.

9. Network monitoring, telemetry, IDS/IPS, and SIEM

Security monitoring depends on useful telemetry, reliable time, normalization, correlation, context, and investigative judgment.

1 · Telemetry

Firewall, DNS, DHCP, VPN, endpoint, authentication, NetFlow/IPFIX, IDS/IPS, cloud, identity.

→

2 · Normalize & enrich

Common fields, timestamps, asset identity, user identity, geolocation, threat intelligence.

→

3 · Correlate & investigate

Rules, baselines, analytics, alerts, timelines, case management, response.

SIEM correlation lab

Generate a small synthetic event stream and let the teaching correlator identify defensive patterns.

[SIEM] Ready. Choose an event set.

Correlation result

No event set analyzed yet.
TelemetryUseful question
DNSWhich hosts requested this domain, and how often?
FirewallWas the flow allowed, denied, reset, or translated?
VPNWhich identity authenticated, from where, and for how long?
NetFlow/IPFIXWho talked to whom, on what ports, for how long, and how much?
IDS/IPSWhich signature/behavior fired, and what packet/flow context supports it?

10. Troubleshooting methodology and tools

Start with symptoms, scope, and recent change. Test from lower layers upward without assuming the first error message identifies the root cause.

Command study bench

QuestionWindowsLinux/macOS
Address/interface state?ipconfig /allip addr / ip link
Reachability / latency?pingping
Path?tracerttraceroute
DNS?nslookupdig / host
Neighbors?arp -aip neigh
Connections/listeners?netstat / Get-NetTCPConnectionss
Routes?route printip route
Packet capture?Wireshark / pktmontcpdump / Wireshark

Troubleshooting scenario generator

Choose a symptom and generate a structured diagnostic path.

11. Guided student laboratories

These labs use the simulators above. Check each lab when complete; progress is stored only in this browser.

01

Encapsulation and the OSI model

  1. Run the encapsulation animation with HTTP-like data.
  2. Identify which layer adds source/destination ports.
  3. Identify which header changes hop-by-hop across routers.
  4. Explain why the OSI model remains useful even when real implementations do not map perfectly to seven discrete modules.
Questions: What is the PDU at L2? Which field identifies the destination logical host?
02

Switch learning and unknown unicast

  1. Clear the MAC table.
  2. Send A→B. Observe what the switch can learn from the source.
  3. Send B→A. Compare behavior after both addresses are known.
  4. Explain flooding versus forwarding and why the switch learns from source MAC, not destination MAC.
03

IPv4 subnetting

  1. Calculate 192.168.10.77/24.
  2. Repeat with /27 and /30.
  3. Determine how the network boundary and available address space change.
  4. Explain why subnetting matters for broadcast domains, routing aggregation, security zoning, and address management.
04

Longest-prefix routing

  1. Look up 10.10.20.45, then 10.10.99.2, then 10.44.8.8, then 8.8.8.8.
  2. Record the matching route for each.
  3. Explain why the default route does not win when a more-specific route exists.
05

DNS and DHCP dependencies

  1. Step through DORA.
  2. Step through recursive DNS resolution.
  3. Describe what changes when DNS answers from cache.
  4. Explain how DHCP can supply DNS-server and default-gateway information to a client.
06

TCP versus UDP

  1. Animate the TCP handshake.
  2. Contrast TCP reliability and ordering with UDP datagrams.
  3. Give two applications where low latency or application-controlled recovery may make UDP appropriate.
  4. Explain why “UDP is faster” is an oversimplification.
07

TLS and VPN scope

  1. Animate TLS 1.3.
  2. Run the VPN visualizer.
  3. Compare TLS connection protection with an IPsec site-to-site tunnel.
  4. Explain server certificate validation and what mTLS changes.
08

Firewall policy reasoning

  1. Test User LAN→TCP/443.
  2. Test Guest→TCP/443.
  3. Test Admin→TCP/22.
  4. Explain first-match/default-deny policy logic and why source zone is security-relevant.
09

SIEM correlation

  1. Generate all four event sets.
  2. For each alert, identify the minimum telemetry needed to support the conclusion.
  3. Explain the difference between a suspicious pattern and proof of compromise.
  4. List two enrichment sources that would help an analyst triage the event.
10

Capstone: design a secure small-campus network

  1. Create at least three VLANs: users, servers, and management.
  2. Place a firewall between trust zones and document four explicit rules.
  3. Choose routing, DNS, DHCP, secure administration, and remote-access approaches.
  4. Identify at least five log/telemetry sources to send to a SIEM.
  5. Explain where TLS, VPN, network segmentation, and least privilege complement rather than replace one another.

Lab progress

0 of 10 labs complete

12. Study guide

Use these as review prompts rather than memorizing isolated numbers without context.

Addressing

  • MAC: local Layer-2 identity
  • IPv4: 32-bit logical address
  • IPv6: 128-bit logical address
  • Prefix length: network boundary
  • Default gateway: next hop for off-subnet traffic

Ports worth recognizing

  • 22 SSH
  • 25 SMTP
  • 53 DNS
  • 67/68 DHCPv4
  • 80 HTTP
  • 123 NTP
  • 161/162 SNMP
  • 389 LDAP
  • 443 HTTPS
  • 445 SMB
  • 636 LDAPS
  • 3389 RDP

Switching

  • Learn source MAC on ingress
  • Forward known unicast to one port
  • Flood unknown unicast/broadcast within VLAN
  • VLAN = separate L2 broadcast domain
  • STP mitigates loops

Routing

  • Choose most-specific route
  • Default = 0.0.0.0/0 or ::/0
  • TTL/Hop Limit prevents endless circulation
  • OSPF: interior routing
  • BGP: interdomain reachability/policy

Security

  • TLS: secure application connection
  • IPsec: IP-layer protection
  • VPN: protected logical path
  • Firewall: policy enforcement
  • IDS: detects; IPS can block inline
  • SIEM: centralizes/correlates events

Troubleshooting order

  • Define symptom and scope
  • Check link/interface state
  • Check address, prefix, gateway
  • Check local/remote reachability
  • Check DNS/service
  • Check policy and logs
  • Capture packets when ambiguity remains
Protocol comparison: ARP versus IPv6 Neighbor Discovery

ARP resolves IPv4 addresses to link-layer addresses on local Ethernet-like networks. IPv6 does not use ARP; Neighbor Discovery uses ICMPv6 messages for functions including address resolution, router discovery, neighbor reachability, and related local-link tasks.

Why NAT is not the same as a firewall

NAT changes addressing and sometimes ports. A firewall makes explicit allow/deny decisions based on security policy and may track connection state, identity, application, or content. Many devices perform both functions, which is why the concepts are often conflated.

Why encryption does not eliminate network monitoring

Encryption protects content, but defenders can still use endpoints, authentication events, DNS telemetry, certificate metadata, flow records, timing, volume, destination identity, and permitted inspection points. Monitoring architecture shifts rather than disappearing.

13. Twenty-question knowledge check

Questions mix recall with reasoning. The grader reports score and topics to review.

Not graded yet.

14. References and further reading

Primary standards and high-value technical references for deeper study.

  1. RFC 8200 — Internet Protocol, Version 6 (IPv6)
  2. RFC 9293 — Transmission Control Protocol (TCP)
  3. RFC 768 — User Datagram Protocol (UDP)
  4. RFC 8446 — TLS 1.3
  5. RFC 9000 — QUIC
  6. RFC 1034 — DNS Concepts and Facilities
  7. RFC 1035 — DNS Implementation and Specification
  8. RFC 2131 — DHCP
  9. RFC 826 — ARP
  10. RFC 4861 — IPv6 Neighbor Discovery
  11. RFC 791 — Original IPv4 specification
  12. RFC 4632 — CIDR
  13. RFC 2328 — OSPF Version 2
  14. RFC 4271 — BGP-4
  15. RFC 4301 — IPsec Security Architecture
  16. RFC 7296 — IKEv2
  17. RFC 4251 — SSH Protocol Architecture
  18. RFC 9110 — HTTP Semantics
  19. RFC 9114 — HTTP/3
  20. NIST SP 800-52 Rev. 2 — TLS Guidelines
  21. NIST SP 800-77 Rev. 1 — Guide to IPsec VPNs
  22. NIST SP 800-41 Rev. 1 — Firewalls and Firewall Policy
  23. NIST SP 800-207 — Zero Trust Architecture
  24. NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
  25. Wireshark Documentation
  26. IANA Service Name and Port Number Registry
  27. IANA Protocol Numbers
  28. IANA addressing / registry resources
  29. MITRE technical publications search
  30. MITRE ATT&CK
  31. CISA Cyber Threats and Advisories
  32. CISA Zero Trust Maturity Model
  33. IETF Datatracker
  34. IEEE 802 LAN/MAN Standards Committee
For protocol behavior, prefer the current RFC or standards document over secondary summaries. For security configuration, also consult current platform/vendor guidance because defaults and supported cryptographic suites change over time.
Computer Networking Interactive Lab · Standalone HTML/CSS/JavaScript educational lab · No network scanning or live packet transmission