About this course
Secure networks and communication channels against interception, tampering, and intrusion across the protocol stack.
Course format. Thirteen weeks, four contact hours each: a two-hour lecture (concepts and theory) and a two-hour practice session. The course is project-based; teams carry one running project end to end and present it three times, in weeks 5, 8, and 13.
What you will build
Teams build and attack a multi-segment lab network in GNS3 or Eve-NG, then harden it. The red phase executes ARP spoofing, VLAN hopping, TCP session hijacking, and a DNS cache-poisoning attack crafted with Scapy. The blue phase implements firewall rules with iptables/nftables, IDS signatures in Snort and Suricata, a WireGuard VPN between segments, and a Zeek-based detection script for each attack executed in the red phase.
Expected outcomes
- Model network security across protocol layers, identifying attacker capabilities and defender controls at L2 through L7 of the OSI and TCP/IP stacks.
- Analyze TCP/IP protocol vulnerabilities — SYN flooding, RST injection, DNS cache poisoning, ARP spoofing, and VLAN hopping — and evaluate how TLS 1.3 forward secrecy, DNSSEC, and stateful inspection defeat them.
- Design and configure layered network defenses: zone-based firewall rule sets with iptables/nftables, IDS/IPS signatures with Snort and Suricata, and encrypted site-to-site tunnels with WireGuard.
- Execute controlled red-phase attacks (ARP spoofing, VLAN hopping, TCP session hijacking, DNS poisoning) using Scapy inside a GNS3/Eve-NG lab, then implement and validate the corresponding blue-phase countermeasures.
- Perform network forensic investigations using Wireshark, tcpdump, and Zeek to reconstruct attack timelines from full-packet captures and NetFlow/IPFIX records.
- Write and tune detection rules for signature-based and anomaly-based IDS, measuring alert fidelity by false-positive rate and coverage against a defined attack catalog.
Key topics
- TLS & secure protocols
- Firewalls & IDS/IPS
- VPNs & network segmentation
- Attack detection
Theoretical foundations
The concepts and results this course rests on.
- the OSI and TCP/IP protocol stacks as layered attack surfaces, with distinct threat models and defender controls at each layer
- the TCP three-way handshake state machine and how SYN flood and RST injection exploit half-open connection exhaustion
- DNS resolution chain, cache-poisoning vulnerability, and the DNSSEC chain-of-trust model including DNS-over-HTTPS tradeoffs
- the TLS 1.3 handshake protocol: 1-RTT and 0-RTT record, ECDHE forward secrecy, and certificate validation against downgrade attacks
- stateful packet inspection and zone-based firewall policy with implicit-deny defaults and DMZ segmentation
- signature-based rule matching and anomaly detection baselines in IDS/IPS, and the alert fidelity trade-off between false-positive rate and detection coverage
- IPsec Security Associations and IKEv2 negotiation: tunnel vs. transport mode, AH vs. ESP headers, and split-tunneling risks
- network address translation (PAT, STUN/TURN NAT traversal) and its effect on end-to-end security and connectivity
- Spanning Tree Protocol root-bridge attacks and 802.1Q double-tagging VLAN hopping, with VLAN segmentation best practices
- full-packet capture analysis and NetFlow/IPFIX record aggregation for traffic baseline anomaly detection and forensic reconstruction
Prerequisites
This is a Year-3 course. It assumes the mandatory CS core: data structures and algorithms, operating systems, computer networks, databases, software engineering, and the core mathematics (linear algebra, probability and statistics, calculus, discrete mathematics). It additionally requires the specific prior courses listed below.
Course-specific prerequisites:
- Computer networks
- Operating systems
Weekly schedule 13 weeks · lecture + practice
Foundations
Wk 1
OSI and TCP/IP layers as attack surfaces
LectureSurvey the OSI and TCP/IP models as layered security surfaces; enumerate attacker capabilities and defender controls at L2 (ARP), L3 (IP spoofing), L4 (TCP/UDP flooding), and L7 (HTTP injection); introduce the course's red-blue project structure.
PracticeBuild the multi-segment GNS3/Eve-NG lab topology; run nmap and ncat against each segment to enumerate open services; document the attack surface per protocol layer.
ProjectStand up the GNS3/Eve-NG lab and produce a layer-by-layer threat model document for the planned red-blue exercise.
Wk 2
TCP state machine and transport-layer attacks
LectureExamine the TCP three-way handshake and its state machine; analyze SYN flood and half-open connection exhaustion; explain RST injection and TCP session hijacking at the transport layer.
PracticeCraft SYN flood and RST injection packets with Scapy; capture the resulting half-open connection states with tcpdump; measure service degradation and identify countermeasures (SYN cookies).
ProjectExecute a controlled TCP session hijacking against a lab target with Scapy; capture and document the packet-level evidence in a pcap file.
Wk 3
DNS as critical infrastructure and cache poisoning
LectureExplain DNS as critical infrastructure and the resolution chain; analyze DNS spoofing and Kaminsky-style cache poisoning; introduce the DNSSEC chain of trust and DNS-over-HTTPS visibility implications for defenders.
PracticeCraft a DNS cache-poisoning attack with Scapy; verify cache corruption; deploy DNSSEC on the lab resolver and confirm that the signed chain of trust rejects the poisoned response.
ProjectExecute and document the DNS cache-poisoning red-phase attack; capture evidence in a pcap and record the resolver's cache state before and after.
Wk 4
TLS 1.3 handshake internals and downgrade attacks
LectureWalk through the TLS 1.3 handshake: 1-RTT vs 0-RTT record, cipher suite negotiation, ECDHE forward secrecy, ALPN, and certificate validation; explain downgrade and stripping attacks and the defenses that block them.
PracticeTrace a live TLS 1.3 handshake byte by byte in Wireshark; identify the ClientHello, ServerHello, and Finished messages; deliberately configure a downgrade to TLS 1.2 and observe cipher-suite and record-layer differences.
ProjectAdd an instrumented TLS 1.3 endpoint to the lab; capture and annotate its handshake pcap with per-field comments.
Wk 5
Architecture specificationPresentation
LectureReview defense-in-depth principles; discuss how perimeter controls, encrypted channels, and detection layers compose into a coherent security architecture; introduce the criteria for a graded specification.
PracticeTeam presentation: each team presents the GNS3/Eve-NG lab topology, layer-by-layer threat model, planned red-phase attacks, and the intended blue-phase countermeasures.
ProjectFreeze the lab architecture specification and the red/blue exercise plan; obtain instructor sign-off before proceeding.
Perimeter & Detection
Wk 6
Firewall architecture and network segmentation
LectureCover firewall architecture: stateful packet inspection, zone-based policies, DMZ segmentation, and implicit-deny defaults; explain how ingress and egress filtering combine with network segmentation to limit lateral movement.
PracticeConfigure iptables/nftables rule sets in the GNS3/Eve-NG lab to enforce zone boundaries; verify enforcement by running nmap scans from each segment and comparing allowed vs. blocked flows.
ProjectDeploy firewall rules separating red and blue segments; deliver a documented rule set with nmap validation output confirming implicit-deny behaviour.
WatchWhat is a Firewall?
Wk 7
Intrusion detection: signatures, anomalies, and fidelity
LectureCompare signature-based rule matching and anomaly detection baselines; explain inline IPS placement vs. passive IDS tap; analyze alert fidelity trade-offs between false-positive rate and detection coverage.
PracticeWrite Snort rules targeting SYN floods and DNS anomalies; deploy Suricata in IPS mode on the lab segment; tune alert thresholds and measure false-positive rate against benign background traffic.
ProjectAdd Snort/Suricata sensors to the lab; deliver an initial rule set with confirmed detection of the week-2 and week-3 red-phase attacks.
Wk 8
Detection engineering and interim demoPresentation
LectureDiscuss detection-engineering discipline: rule lifecycle, validation against synthetic traffic, coverage mapping to the attack catalog, and the cost of missing a detection vs. alert fatigue.
PracticeTeam presentation: each team live-demonstrates Snort or Suricata detecting a replayed red-phase attack in the GNS3/Eve-NG lab, with alerts visible on screen.
ProjectConfirm detection of at least two distinct red-phase attacks; record and submit the alert logs as evidence.
VPN & Switching
Wk 9
VPN tunneling, IPsec, and WireGuard
LecturePresent VPN tunneling and IPsec: IKEv2 SA negotiation, tunnel vs. transport mode, AH vs. ESP headers, and split-tunneling risks; contrast with WireGuard's cryptographic design, minimal code surface, and key-management model.
PracticeConfigure WireGuard tunnels between isolated lab segments; inspect the Noise Protocol handshake in Wireshark; compare WireGuard and IPsec SA parameter output and key-rotation procedures.
ProjectDeploy a WireGuard VPN linking the lab's red and blue segments; verify that tunnel traffic is encrypted in a Wireshark capture and that only tunnelled flows cross the firewall boundary.
Wk 10
NAT mechanics and VLAN hopping attacks
LectureExplain network address translation: PAT mechanics, STUN/TURN NAT traversal, and NAT's effect on end-to-end security; then cover spanning tree and VLAN hopping — STP root-bridge attack, double-tagging 802.1Q frames, and VLAN segmentation best practices.
PracticeExecute a VLAN hopping attack using 802.1Q double-tagged frames crafted with Scapy inside GNS3/Eve-NG; verify that trunk-port hardening and BPDU guard block the attack; observe STP convergence events.
ProjectExecute the VLAN hopping red-phase attack and document the double-tagging mechanism in a pcap; implement the iptables/nftables and switch-configuration mitigations.
Forensics & Capstone
Wk 11
Network forensics and flow analysis
LectureCover network forensics and flow analysis: full-packet capture analysis and chain-of-custody procedures; flow record aggregation with NetFlow and IPFIX; connection log correlation; and traffic baseline anomaly detection.
PracticeUse tcpdump to collect full-packet captures of simulated lateral movement; write Zeek scripts to detect ARP spoofing, DNS poisoning, and unusual connection patterns; correlate NetFlow records to reconstruct the attacker's path through the lab.
ProjectDeploy Zeek as the lab's flow-logging pipeline; deliver detection scripts for each red-phase attack vector executed so far.
Wk 12
Full red-blue exercise
LectureReview red-versus-blue methodology: attack execution discipline, chain-of-custody evidence collection, and systematic coverage verification across the full attack catalog; discuss gap analysis and remediation.
PracticeRed phase: execute ARP spoofing, VLAN hopping, TCP session hijacking, and DNS cache-poisoning against the hardened lab using Scapy. Blue phase: verify that Snort, Suricata, and Zeek alerts fire; correlate evidence across captures and flow logs.
ProjectComplete and document the full red-blue exercise; compare detection coverage against the planned attack catalog and identify any gaps requiring rule updates.
Capstone
Wk 13
Final red-team defensePresentation
LectureReview the complete defended architecture: coverage across all ten principles, lessons learned from the red-blue exercise, and open problems in network security.
PracticeTeam presentation: live red-team-versus-blue-team demonstration in the GNS3/Eve-NG lab with oral defense of all design decisions — firewall rules, IDS signatures, VPN configuration, and Zeek detection scripts.
ProjectDeliver the fully documented multi-segment lab with red-phase attack evidence (pcaps), blue-phase countermeasures, and the complete Snort/Suricata/Zeek detection rule set.
AI tools in this course.
Students use AI assistants throughout the red-blue lab: drafting Snort and Suricata signatures from an attack description, generating Zeek detection scripts for specific flow patterns, and refactoring iptables/nftables rule sets. They craft red-phase attack packets by describing the target protocol behaviour to the assistant, which produces Scapy snippets they then test and refine against the GNS3/Eve-NG lab. AI helps explain Wireshark dissections — pasting a TLS handshake or a DNS exchange and asking the assistant to annotate each field — and it generates tcpdump filter expressions for targeted capture. Students also use AI to reconstruct attack timelines from Zeek logs and to propose detection rule improvements after a missed alert. Every generated rule is validated against real lab traffic and measured for false-positive rate: a signature that looks correct but never fires, or that floods the alert queue, is a graded failure.
Student project
Teams build and attack a multi-segment lab network in GNS3 or Eve-NG, then harden it. The red phase executes ARP spoofing, VLAN hopping, TCP session hijacking, and a DNS cache-poisoning attack crafted with Scapy. The blue phase designs and implements firewall rules with iptables/nftables, IDS signatures in Snort and Suricata, a WireGuard VPN between segments, and a Zeek-based detection rule for each attack executed in the red phase. Each week introduces a new attack or defense that must be demonstrated live before moving on.
Requirements
- Build a working multi-segment network lab, not a set of disconnected exercises.
- Execute every planned red-phase attack with Scapy and capture packet-level evidence in a pcap.
- Implement a corresponding blue-phase countermeasure for each attack: firewall rule, IDS signature, or Zeek detection script.
- Carry one running GNS3/Eve-NG topology from specification to a fully defended, documented result across the whole term.
- Work in a team of three or four and defend the design at each of the three presentations (weeks 5, 8, and 13).
Example projects
Multi-segment GNS3 red-blue rangeVLAN hopping detection suiteDNS hardening pipeline (DNSSEC + DoH)Snort/Suricata rule libraryWireGuard mesh between Eve-NG segmentsZeek lateral-movement detectorTCP session hijacking forensics labNetFlow anomaly dashboard
Assessment & grading
Grading is project-based, with no written exam. Teams of three or four present one running project three times.
| Component | What it covers | Weight |
|---|---|---|
| Project · Specification | Presentation 1 (week 5): problem, objectives, and architecture | 20% |
| Project · Interim | Presentation 2 (week 8): the working system demonstrated live | 30% |
| Project · Final | Presentation 3 (week 13): end-to-end demo with oral defense | 50% |
Tools & platforms
- Wireshark: full-packet capture and protocol dissection
- Scapy: packet crafting and red-phase attack automation
- Snort: signature-based IDS rule engine
- Suricata: signature and anomaly IDS/IPS with inline blocking
- Zeek: network flow analysis, scripted detection, and security logging
- nmap / ncat: network reconnaissance and service probing
- iptables / nftables: stateful Linux firewall and packet filtering
- WireGuard: modern VPN tunneling with Noise Protocol cryptography
- GNS3 / Eve-NG: virtual network lab for multi-segment topology simulation
- tcpdump: command-line packet capture and filter-based traffic collection
Free online courses
Existing free, video-based courses this course can build on, for self-study or as a teaching basis.
In Hebrew · בעברית
- Campus IL, מערך הסייבר הלאומימרושתים - איך עובד האינטרנט?
- Campus ILWebSec - לזהות חולשות, לבנות הגנות
- Campus ILNetwork.Py - לתכנת במרחב הרשת
Primary literature
Seminal works for advanced study.
- PaperThe Protection of Information in Computer Systems
- PaperUsing Encryption for Authentication in Large Networks of Computers
- PaperSecurity Problems in the TCP/IP Protocol Suite
- PaperRFC 4301: Security Architecture for the Internet Protocol
- PaperRFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3
References
Books and resources link to an online or publisher page.
- DocumentationRFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3
- TextbookBulletproof TLS and PKI, 2nd Edition
- TextbookCryptography and Network Security: Principles and Practice, 8th Edition
- DocumentationSuricata User Guide
- DocumentationWireshark User's Guide
- DocumentationSP 800-77 Rev. 1: Guide to IPsec VPNs
- DocumentationThe Illustrated TLS 1.3 Connection: Every Byte Explained
Role in each concentration
| Concentration | Role |
|---|---|
| Intelligent Software Systems | Elective |
| Networking & Cyber Security | Core · Semester 1 |
| AI & Robotics | Elective |
| AI and Quantum Computing for Finance | Elective |
| Immersive Systems & Game Development | Elective |
| Defense Technologies & Autonomous Systems | Elective |