RobotnixAcademy

Week 18 · lesson

Final Network Dossier: Explain the Whole Trip

This is the final Garden State Cyber I systems task.

You are not being asked to perform penetration testing.

You are being asked to prove that you can explain how normal systems work, identify where security properties matter, and keep every claim tied to the right evidence source.

Two evidence sources, two jobs

Your final dossier uses two different datasets/models.

Evidence Source A: Week 17 packet capture

gsc-week17-baseline.pcapng

This local synthetic capture can support claims about:

  • ARP request/reply
  • MAC and IPv4 fields
  • DNS lookup
  • TCP three-way handshake
  • HTTP request/response
  • packet order/timestamps in the supplied conversation

It cannot prove a remote routed path that is not present in the capture.

Evidence Source B: Week 18 topology/fault model

The Robotnix topology simulator and teacher-provided architecture facts support reasoning about:

  • client/local-network/router/service relationships
  • routed paths
  • failure locations
  • reachability versus service availability
  • corrective-action choices

A model is not a packet capture.

Your dossier must label which source supports each major claim.

Part 1: trace the modeled path

Draw the Week 18 routed scenario:

student workstation -> local network -> router -> other network(s) -> course service

Label only the devices and values provided by the scenario.

For each major path claim, mark it:

MODEL

unless you also have separate packet evidence that directly supports it.

Part 2: prove local resolution from packet evidence

Return to the Week 17 capture.

Use the ARP packets to explain the local mapping actually recorded by the synthetic capture.

Cite packet numbers and fields.

Mark these claims:

PCAP EVIDENCE

Part 3: prove the TCP conversation

From the same capture, identify:

  • SYN
  • SYN/ACK
  • ACK
  • first supplied HTTP/application-data packet

Build the timeline and cite packet numbers.

Again, this proves the supplied local conversation, not every hop in the Week 18 routed model.

Part 4: explain the layers

Choose one packet and annotate:

What local source/destination information is visible?

Network layer

What source/destination IP addresses are visible?

Transport layer

What protocol and ports are visible?

Application layer

What does Wireshark actually identify?

If a layer or claim is not established by the capture, say so.

Part 5: add the defensive security model

Select six controls or concepts from the course.

Possible examples:

  • MFA
  • unique credentials
  • host firewall
  • supported/updated software
  • least privilege
  • network separation
  • safe phishing verification
  • appropriate cryptographic protection
  • backups/recovery
  • evidence logging

For each control, explain:

  • asset protected
  • CIA property
  • failure it reduces
  • limitation
  • evidence source or reasoning used

Part 6: inject one bounded failure

Use one teacher-provided topology failure or Robotnix simulator scenario.

Possible cases include:

  • router unavailable
  • client addressing problem
  • server unavailable
  • application service unavailable
  • authentication failure
  • unsupported software fact from an earlier system record

Explain:

  • expected symptom
  • layer/component involved
  • evidence you would inspect first
  • safe corrective action
  • what the symptom does not prove

Part 7: build the course portfolio

Choose five earlier artifacts that show your growth.

Include at least one from each area:

  • ethics/authentication/human factor
  • systems/hardening/IoT
  • binary/cryptography/steganography
  • command line
  • networking/packet analysis

For each artifact:

What I understood then

What I understand now

Evidence that improved

One misconception I corrected

Final architecture defense

Prepare a five-minute explanation answering:

  1. What does the Week 17 capture actually prove?
  2. What does the Week 18 topology model add?
  3. Why are MAC and IP addresses both present in network reasoning?
  4. What does the TCP handshake establish?
  5. Which security control matters most in your system and why?
  6. What evidence would you need before calling an event malicious?

Evidence for Lesson 3

Submit:

  • modeled path diagram
  • source labels separating model claims from packet claims
  • ARP evidence explanation
  • TCP timeline
  • layered packet annotation
  • six-control security map
  • bounded failure analysis
  • five-artifact learning portfolio
  • architecture-defense outline

Finish with:

At the beginning of this course I thought cybersecurity was mostly ________. Now I understand that defensive cybersecurity starts with ________.

That is the endpoint of GSC I: explain the system, inspect the evidence, stay inside scope, and choose a defense that matches the failure.