High School Beginner • Module B4 • Lesson B4.2
IP Addresses and Network Identity
Devices need a way to be found on a network. IP addresses help traffic move to the right place, while network identity gives defenders more context: device name, role, location, expected activity, and permission boundaries.
Professional Hook
An address is a clue, not the whole story.
Security teams often see addresses in logs, dashboards, tickets, and diagrams. They use those addresses to organize evidence, but they still need context before deciding whether something is normal, blocked, risky, or worth escalating.
Lesson Progress
B4.2 IP Addresses and Network Identity
High School Beginner • B4: Networking Basics • Lesson 2 of 7
Readiness Check
Before You Start
0/3 ready
Learning Objectives
By the end of this lesson, you can explain network identity safely.
- • Explain that an IP address helps network information reach the correct destination.
- • Describe why an address alone is not enough to identify a person or prove intent.
- • Compare device name, address, network zone, and expected role as defender context.
- • Read fake address cards and fake logs without touching a real network.
Why This Matters
Defenders use addresses to connect evidence carefully.
When a device joins Wi-Fi, opens a website, prints a document, or triggers a warning, logs may include addresses. A beginner defender should not panic or accuse someone from one address. The safer move is to combine clues and ask whether the activity matches the device's approved role.
Core Concept
IP addresses are network delivery labels.
An IP address is like a delivery label for network communication. It helps information travel toward a device or service. But it is not the same as a student's full identity, a password, a location report, or proof of wrongdoing. In defensive work, addresses are clues that must be reviewed with time, device name, network zone, account context, and normal behavior.
Address
Where traffic is being sent in a network diagram or log.
Context
What device, role, time, network, and expected behavior surround the address.
Decision
Whether to document, ask for help, report, or keep monitoring through approved channels.
Visual Diagram
Fake device identity cards
These fictional cards show why defenders need more than one clue. The address helps organize traffic, but the role and network zone explain what the device should normally do.
Fake Device
Student Laptop
Name: student-laptop-07
Address: 192.0.2.47
Zone: Classroom Wi-Fi
Expected: Learning portal, video class, approved web research
Fake Device
Teacher Laptop
Name: teacher-laptop-01
Address: 192.0.2.15
Zone: Staff Wi-Fi
Expected: Class meeting, gradebook, presentation display
Fake Device
Class Printer
Name: class-printer-02
Address: 198.51.100.22
Zone: Internal resources
Expected: Receives approved print jobs only
Fake Device
Guest Tablet
Name: guest-tablet-03
Address: 203.0.113.88
Zone: Guest Wi-Fi
Expected: Internet access only, no internal printer access
Key Vocabulary
Address and identity words
IP Address
A network address that helps information move to the right device or service.
Network Identity
The way a device is recognized on a network using details such as an address, name, role, and connection context.
Private Address
An address commonly used inside homes, schools, and organizations, not as a direct public internet identity.
Public Address
An address used for internet-facing communication. Students should not collect, post, or investigate real public addresses.
Dynamic Address
An address that may change over time, often assigned automatically by a network service.
Static Address
An address that is intentionally kept the same for a device or service that needs predictable access.
Technical Breakdown
How defenders build safer context
Address
A fake IP address such as 192.0.2.24 helps a training diagram show where traffic is going.
Defender use: Used to group fake events and understand which device or service is involved.
Device name
A readable label such as student-laptop-04 or classroom-printer makes diagrams easier to understand.
Defender use: Used to connect technical evidence with the device's expected purpose.
Network location
A device might be on classroom Wi-Fi, guest Wi-Fi, a home network, or a training lab network.
Defender use: Used to decide what access should be normal for that network zone.
Expected role
A printer, student laptop, teacher laptop, router, or server should behave differently.
Defender use: Used to avoid treating every device event the same way.
Fake Dashboard
Fake Network Identity Snapshot
A fictional dashboard showing how a defender might summarize approved training devices. No real network information is used.
Known fake devices
24
Devices already listed in the training inventory.
Guest zone devices
6
Allowed to reach internet-only training services.
Address changes today
3
Expected because some addresses are assigned dynamically.
Fake Log Panel
Fake Address Assignment Events
09:02 device=student-laptop-07 assigned_address=192.0.2.47 zone=classroom-wifi method=dynamic status=expected 09:04 device=teacher-laptop-01 assigned_address=192.0.2.15 zone=staff-wifi method=dynamic status=expected 09:07 device=guest-tablet-03 assigned_address=203.0.113.88 zone=guest-wifi method=dynamic status=expected 09:10 device=guest-tablet-03 attempted_resource=class-printer-02 result=blocked reason=guest_zone_policy 09:12 device=student-laptop-07 requested_service=learning.example result=allowed reason=approved_service
Training note: this is fake data for defensive analysis practice only.
Common Mistakes
Address mistakes that lead to bad conclusions
Safe Defensive Lab
Match fake addresses to fake network roles
Step 1: Read the card
Use the fake device name, fake address, zone, and expected purpose. Do not use real devices.
Step 2: Compare behavior
Ask whether the fake event matches the device's expected role and approved network zone.
Step 3: Choose a safe response
Document normal events, note blocked events, and involve trusted adults or technology staff for real concerns.
Analyze the Evidence
Which clue matters most with the address?
What is the safest defensive conclusion?
Scenario Decision Lab
A classmate asks for a real address
During a group project, a classmate says, 'Send me the IP address from your home router so I can compare it with mine.' What is the safest response?
Fake SOC Alert
Address Context Needed
Source: Fake classroom gateway • Time: 09:10
Defender Habits
IP Address and Network Identity Checklist
Check Your Understanding
IP Addresses and Network Identity Quiz
Choose your answers first. Explanations appear only after submission.
1. What is the main beginner purpose of an IP address?
2. A fake dashboard shows classroom-laptop-07 using 192.0.2.47. What should a beginner defender do first?
3. Which statement is safest?
4. What does network identity include besides an address?
5. A guest device tries to reach an internal classroom resource and gets blocked. What is the best first conclusion?
Portfolio Prompt
Write a fake network identity note
Create a short fake ticket note for guest-tablet-03. Include the fake address, network zone, attempted resource, policy result, and safest next step. Do not use real addresses or real device names.
Key Takeaways
What You Should Remember
Navigation