NET-201: Intermediate Networking -- Course Outline

Course Code: VCA-NET-201 Track position: Part-II Networking-Track Anchor Prerequisites: VCA-NET-101 (Networks and Packet Analysis) + VCA-CSA-101 (or equivalent computing-systems foundation) Belt: 4/5 Advanced Duration: 14 weeks (~145 hr: ~22 lec / ~45 lab / ~78 indep) Credential: VCA-NET-201 Certificate of Completion

Mission

NET-201 pays the forward promises NET-101 made. Every protocol NET-101 introduced at first-encounter depth arrives here at production-grade inspection depth. A student who finishes NET-201 can stand up a multi-router OSPF/BGP topology in GNS3, dissect a TLS 1.3 handshake byte-by-byte against Rescorla's annotation, author a DNSSEC-signed zone, measure bufferbloat and fix it, and write Suricata signatures and Zeek scripts that detect named threat scenarios. The capstone is the structural precursor to the PEN-101 engagement report: the student attacks a network they first learned to build.

Foundational Anchors

Primary pair (continued from NET-101 at intermediate depth):

Module-specific anchors (NET-201 introduces):

Petzold CODE is the CSA-track anchor; it does not appear in NET-201.

Course-Wide Architecture Comparison Sidebars

Four structured sidebars cross-reference existing handouts; two are new NET-201 originals:

Learning Outcomes (Bloom's Taxonomy)

1. Remember. State the four major IGP routing-protocol families (OSPF, IS-IS, EIGRP, RIP) and BGP's role as the inter-AS protocol; the three TLS generations (1.2, 1.3, QUIC-TLS) and their handshake RTT counts; the IPv6 transition mechanisms (dual-stack, 6to4, NAT64) and when each is used.

2. Understand. Explain why a centralised SDN control plane buys per-flow visibility and per-flow policy at the cost of controller-availability dependency, and why distributed routing protocols persist in environments where that trade-off is unfavorable.

3. Understand. Distinguish DNSSEC (cryptographic origin authentication of DNS records) from DoH/DoT (transport encryption of DNS queries) and explain why a network can have one without the other.

4. Apply. Stand up a multi-router OSPF or BGP topology in GNS3 or Containerlab; observe convergence with packet captures; intentionally break a peering and recover it.

5. Apply. Capture and dissect a TLS 1.3 handshake byte-by-byte; identify ClientHello, ServerHello, EncryptedExtensions, Certificate, Finished records; correlate with Rescorla's annotation.

6. Apply. Author a DNSSEC-signed zone for a lab domain; observe chain-of-trust validation in dig +dnssec; deliberately break the trust chain and observe the validation failure.

7. Analyze. Given a captured trace of a misbehaving network (slow pages, intermittent connectivity, partial DNS), identify the layer at which the fault is occurring and propose targeted instrumentation to confirm the diagnosis.

8. Synthesize. Author a 25-35 page operational playbook for a small enterprise network: routing-protocol choice and rationale; switching topology; DNS architecture; TLS-everywhere policy; NSM signature and Zeek-script roster; IPv6-transition timeline.

14-Week Course Shape

Time Budget

Note: independent practice is largely self-directed Kurose-Ross + Stevens reading + GNS3/Containerlab topology experiments and is counted at a compressed rate relative to the public-page headline figure.

Lab Index

NET-201-Originating Toolchain Diary Entries (~12 new)

First-introduce in NET-201 (added to the toolchain diary initiated in NET-101):

SB6141 and Cross-Track Threads

The SB6141 cable modem lab target runs as a forward thread across three chapters:

• Ch 3 (Switching): SB6141 bridges Ethernet (LAN-side) to DOCSIS (cable-side) -- see handouts/cross-chapter-docsis-quad-cross-cut.md for chip-by-chip mapping (MaxLinear RF demod, Broadcom DOCSIS PHY, TI PDSP coprocessors, ARM1176JZ-S Linux application layer)
• Ch 6 (NAT): SB6141 runs a NAT instance; its default DHCP/NAT behavior is the first thing an SB6141 owner interacts with from the LAN side
• Ch 13 (PT cross-cut): SB6141 as adversarial target; routes into vca-re-101 + vca-arm-201 + vca-emb-201 pipeline

The wireless-AKA progression thread (WPA2-SAE vs WPA3-SAE vs 5G-AKA) runs through:

• Ch 4 (TLS): TLS handshake as structural companion to key-derivation protocols in wireless AKA
• Ch 13 (RE/PT cross-cuts): Full CT-A AKA-progression sidebar as a synthetic protocol-analysis exercise

Decisions + Pedagogy + Supplement Candidates

Decisions made

1. 12 chapters across 14 weeks (not 12+2): Routing (Ch 1-2) gets 2 weeks each; TLS and DNS each get their own full week given the depth of material. Ch 11-12 (cross-cuts) share Week 13 as they are forward-pointer weeks, not new-material weeks.

2. GNS3 + FRRouting as primary routing lab substrate (not Cisco IOSv): Open-source-first per TIR-2. FRRouting runs OSPF/BGP/IS-IS identically to the commercial stack for these exercises. Students on free GNS3 without a Cisco license can complete every routing lab. Cisco Packet Tracer remains an EXTERNAL optional for NetAcad-credential-track students.

3. Containerlab joins GNS3 starting Week 5: Containerlab is the modern successor pattern for Docker-container-based topologies (Arista cEOS, SR Linux, FRR). Week 5 (Switching) introduces it for the first time; Labs 6, 9, 11 use it as the primary substrate.

4. Rescorla as TLS anchor even though it is not in the master library: The Rescorla book is explicitly named in the public page and is available paperback. The TLS module requires page-number citations, so students must acquire the book or use the TLS 1.3 RFC (RFC 8446) as a free substitute. Lab 4 annotations are anchored on the RFC structure (which is freely available) with Rescorla references bracketed as "see Rescorla Ch N for background."

5. NSM corpus: A pre-built academy NSM pcap corpus (20-30 traffic files representing named TTPs) ships as a course artifact with Lab 8. This is the same infrastructure that NET-101 mystery-pcap labs used; extended to include Suricata + Zeek processing.

Pedagogical implications

1. Every lab opens a NET-101 first-encounter: Lab 1 opens Week 3's "routing is about finding a path" with OSPF's actual LSDB convergence. Lab 4 opens Week 12's TLS sketch with a byte-by-byte handshake dissection. Students who kept their NET-101 captures can compare the same protocol at two levels of inspection.

2. Capstone = operational playbook (not attack): The NET-201 capstone is explicitly constructive: build a network, defend it, document it. The PEN-101 capstone follows and attacks a network matching this profile. The two capstones are designed to be experienced in sequence.

3. BGP looking-glass tools anchor real-world context: Reading the global BGP table via RIPEstat or HE.net gives students evidence that the routing protocols they are simulating in a GNS3 sandbox underpin the actual Internet. Lab 2's sandboxed prefix hijack becomes conceptually serious when students can observe real-world BGP hijacking events via Cloudflare Radar.

Supplement candidates

1. eBPF/XDP packet processing: High student-interest topic; forward-pointer into NET-301. NET-201 introduces the concept in Ch 7 (SDN) but does not build an eBPF program. A dedicated eBPF lab supplement would bridge NET-201 → NET-301.

2. HTTP/3 and QUIC deep-dive: NET-201 covers QUIC as a transport-layer protocol in Ch 9 (Performance). A dedicated QUIC lab (capturing HTTP/3 traffic from a QUIC-enabled server) would complement Lab 4 (TLS) and is a candidate for v0.2.

3. RPKI and BGP route origin validation: Lab 2 covers BGP prefix hijacking conceptually but does not implement RPKI validation. RPKI is the production defense; a lab exercising RPKI-enabled FRRouting would be NET-201's contribution to the BGP-security story.