# Course Blueprint (60 Minutes)

The bridge between this vault and the interactive course. Ten modules, six minutes each, one running example, and a decision about what to leave out. Every module names the notes it draws from, the terms it introduces, the diagram it needs, the mistake it teaches, and the interaction that makes it stick.

**Running example:** one person, one laptop, one office, one website. Every module revisits the same request at a deeper layer.

**Teaching stance:** instructional, not survey. Define the term, show the dynamic (what moves, in what order), then show the failure (how it breaks, where it happens, what it looks like).

| # | Module | Question it answers | Notes | Minutes |
|---|---|---|---|---|
| 1 | What a network is | Why can't everything be one cable? | Network-Design-And-Topologies, Terminology | 6 |
| 2 | Packets and layers | How does a message survive the trip? | Packet-Flow-Encapsulation, OSI-TCPIP-Models | 7 |
| 3 | Addresses and subnets | How does anything know where to go? | Addressing-Subnetting-CIDR, Network-Terminology | 7 |
| 4 | The local network | How do neighbours talk, and why does it break? | Ethernet-ARP-And-Local-Delivery, VLANs-Trunking | 6 |
| 5 | Crossing the world | How does a packet get to another continent? | Routing-Fundamentals, Route-Selection, OSPF, BGP | 7 |
| 6 | Names and numbers | How do you find a service and join a network? | DNS-DHCP-ICMP, Ports-And-Services | 6 |
| 7 | Conversations and trust | How does it stay reliable and private? | IP-TCP-UDP, TLS-And-HTTPS, HTTP-Versions | 6 |
| 8 | Wireless and the edge | Why is Wi-Fi different? | Wireless-80211 | 5 |
| 9 | Boundaries | What stops one machine taking everything? | Network-Security-Fundamentals, Zero-Trust, NAT-And-PAT | 6 |
| 10 | When it breaks | How do professionals diagnose this? | Troubleshooting-Scenarios, Telemetry, Packet-Analysis | 7 |
| A | Challenges | Five exercises | Labs/* | — |
| B | Glossary | 60 terms | Foundations/Network-Terminology | — |
| C | Sources | Maps and links | README sources | — |

Total: 63 minutes of content, which with interaction overhead is a 60–75 minute sitting.

## Per-module brief

### 1. What a network is (6 min)

- **Terms (≤6):** host, link, switch, router, LAN, WAN.
- **Dynamic:** two devices, one cable; add a third, add a switch; add a fourth network, add a router.
- **Diagram:** two rooms, then three rooms with a switch, then two buildings with a router between.
- **Mistake:** "the internet is one big network" — it is a network of networks that agree to forward each other's traffic.
- **Interaction:** tap-to-build topology — add a host, add a switch, see what needs a router.
- **Quiz angle:** why a switch cannot connect two different subnets.

### 2. Packets and layers (7 min)

- **Terms:** packet, frame, header, encapsulation, decapsulation, MTU, PDU.
- **Dynamic:** application → segment → packet → frame → bits, and the reverse.
- **Diagram:** the envelope-in-envelope figure with byte counts (14 / 20 / 20 / 1,460).
- **Mistake:** "the network delivers my message" — it delivers packets, individually, best-effort. Also: debugging the wrong layer.
- **Interaction:** a packet-builder where the learner adds headers one at a time and watches the size grow; at 1,500 it turns red and must be split.
- **Quiz angle:** which address changes at each hop.

### 3. Addresses and subnets (7 min)

- **Terms:** IP address, prefix/CIDR, mask, network, broadcast, usable host, gateway, private range.
- **Dynamic:** block-size arithmetic; a host deciding local vs remote; the gateway must be inside the subnet.
- **Diagram:** a /24 split into four /26s, with one host highlighted and its "local" boundary drawn.
- **Mistake:** gateway outside the subnet (silent failure), and two subnets with the same address.
- **Interaction:** subnet calculator — enter an address and prefix, see network/broadcast/range; plus a "same subnet?" drag game.
- **Quiz angle:** which of two hosts can reach the other without a router.

### 4. The local network (6 min)

- **Terms:** MAC, ARP, broadcast domain, VLAN, trunk, access port, flooding.
- **Dynamic:** ARP request broadcast → unicast reply → cache; switch learns MAC → port.
- **Diagram:** three hosts on a switch with an ARP broadcast fanning out.
- **Mistake:** duplicate IP causing intermittent failure; VLAN mismatch on a trunk; unmanaged switch causing a loop.
- **Interaction:** ARP simulator — click "ping", watch the broadcast, the reply, and the cache entry appear.
- **Quiz angle:** why a duplicate IP produces "sometimes it works".

### 5. Crossing the world (7 min)

- **Terms:** routing table, next hop, default route, longest prefix match, metric, admin distance, AS, BGP.
- **Dynamic:** each router strips the frame, reads the destination IP, picks the next hop, builds a new frame. Longest prefix wins before any metric.
- **Diagram:** three routers, two paths, one more-specific route that wins.
- **Mistake:** longest-prefix beating metric; leftover static route shadowing OSPF; a BGP misconfiguration taking down someone else's network.
- **Interaction:** route-table puzzle — eight destinations, choose the path; wrong answers show which rule was misapplied.
- **Quiz angle:** given two routes, which is chosen and why.

### 6. Names and numbers (6 min)

- **Terms:** DNS, resolver, cache, TTL, record types (A/AAAA/CNAME/MX), DHCP, lease, DORA, port.
- **Dynamic:** stub → resolver → root → TLD → authoritative; DORA four messages.
- **Diagram:** the DNS hierarchy with the cache hits marked; the DHCP four-step timeline.
- **Mistake:** TTL too high during a migration; DHCP scope exhaustion (looks like a broken network); DNS resolving to a public IP internally (hairpin).
- **Interaction:** DNS lookup timeline with cache toggles — turn off the cache and watch the latency change.
- **Quiz angle:** why one user sees the new site and another sees the old.

### 7. Conversations and trust (6 min)

- **Terms:** TCP, UDP, handshake, port, retransmission, TLS, certificate, SNI, HTTP/2, HTTP/3.
- **Dynamic:** SYN/SYN-ACK/ACK; then ClientHello → certificate → keys; then the first request.
- **Diagram:** two timelines stacked (transport, then TLS) with round-trip counts labelled.
- **Mistake:** expired certificate (the most common real outage); clock skew making a valid certificate fail; UDP 443 blocked so QUIC silently falls back.
- **Interaction:** handshake stepper — click through each packet, with a "what breaks here?" callout per step.
- **Quiz angle:** which step fails when the error says "certificate not yet valid".

### 8. Wireless and the edge (5 min)

- **Terms:** SSID, BSSID, channel, band, airtime, roaming, WPA2/WPA3.
- **Dynamic:** shared medium, one transmitter at a time per channel; more clients = less airtime each.
- **Diagram:** channel overlap graph (1/6/11) plus an airtime pie for 40 clients.
- **Mistake:** designing for coverage instead of capacity; hidden SSID as security; shared PSK for a whole organisation.
- **Interaction:** channel planner — place four APs, see interference and pick channels.
- **Quiz angle:** why a full-signal client can be slow.

### 9. Boundaries (6 min)

- **Terms:** NAT/PAT, ACL, stateful vs stateless, security group, segmentation, zero trust.
- **Dynamic:** packet leaves private network → source translated → return packet matched by state table; policy evaluated at each boundary.
- **Diagram:** three zones (user, server, data) with allowed flows drawn and denied ones marked.
- **Mistake:** NAT is not a firewall; VLANs without inter-VLAN policy are not segmentation; symmetric routing assumed through a stateful device.
- **Interaction:** "allow or deny" flows — drag five flows onto a zone diagram, then reveal which rules would be needed.
- **Quiz angle:** why the server sees the NAT address, not the client.

### 10. When it breaks (7 min)

- **Terms:** baseline, layer isolation, symptom vs cause, blast radius, runbook.
- **Dynamic:** the ordered method — define, isolate layer, isolate path, read evidence, change one thing.
- **Diagram:** a decision tree from "it's down" to the first five commands.
- **Mistake:** changing several variables at once; trusting the ticket's diagnosis; fixing the alert instead of the cause.
- **Interaction:** three incident cards with symptoms only; the learner picks the next command and gets feedback.
- **Quiz angle:** refused vs timeout — what each tells you.

## What is deliberately excluded

BGP attribute order, OSPF LSA types, VXLAN internals, IPsec phase details, cloud provider naming differences. All exist in the vault, all appear in the "where to go next" page with a one-line reason to care. Excluding them is a design decision, not an oversight: a 60-minute course that tries to cover them teaches none of them.

## Assessment design

- One quiz per module, four options, with an explanation that names the error in the wrong answers.
- Three incident cards in module 10, scored on the *next command chosen*, not the final answer.
- Five challenges in the appendix, each with a completion checklist and a "prove it" artifact (a capture, a config, a working ping).
- Glossary with module backlinks, so a stuck learner can jump to the explanation.

## Where this goes wrong

- **Ten modules of equal weight.** Diagnosis and subnets deserve more; wireless less. The table above is deliberately uneven.
- **Teaching a protocol before the problem it solves.** Every module opens with a failure, not a definition.
- **Skipping the hands-on because it is hard to build.** One `tcpdump` and one subnet calculator are enough; they do not need a full lab.
- **Ending on "there is so much more".** End with one thing to do this week.

## Related Notes

- [[Pedagogy/Teaching-Sequence-And-Analogies.md]] — why the order is right
- [[Pedagogy/Where-It-Goes-Wrong.md]] — the mistakes each module teaches
- [[Foundations/Network-Terminology.md]] — the term budget