Interactive network lab

Subspace

Trace packets, inspect protocols, and tune edge defenses in one hands-on workspace.

09 labs L2-L7 coverage Live scenarios

Interactive TCP Connection Lab

Explore realistic connection outcomes: established sessions, refused ports, silent filtering, and graceful closes.

CLIENT 192.168.1.100
SERVER 93.184.216.34

TCP Handshake Process

  1. SYN (Synchronize): Client sends SYN packet with initial sequence number to initiate connection
  2. SYN-ACK (Synchronize-Acknowledge): Server responds with SYN-ACK, acknowledging client's sequence number and sending its own
  3. ACK (Acknowledge): Client sends final ACK to confirm - connection established!

Why 3-way? This ensures both sides are ready to communicate and have synchronized their sequence numbers for reliable, ordered data transmission.

DNS Query Resolution Process

Domain Name System translates human-readable domains into IP addresses. See the hierarchical lookup process.

Your Device Initiates query
DNS Resolver Recursive lookup
Root Server Points to TLD
TLD Server Points to Auth NS
Authoritative Returns IP

DNS Resolution Result

DNS Record Types

  • A Record: Maps domain to IPv4 address (e.g., 93.184.216.34)
  • AAAA Record: Maps domain to IPv6 address
  • CNAME: Canonical name (alias) pointing to another domain
  • MX Record: Mail exchange servers for email routing
  • TXT Record: Text records for verification and SPF/DKIM
  • NS Record: Name servers authoritative for the domain

TLS and HTTPS Diagnostics Lab

Inspect certificate, hostname, protocol, and cipher failures the way you would when debugging a real HTTPS endpoint.

PASS

Valid modern TLS

Endpoint:

Negotiated Session

Protocol
Cipher
ALPN
SNI

Certificate

Subject
Issuer
SAN
Validity

Validation Checks

    OpenSSL Evidence

    Recommended action:

    HTTP (Insecure)

    PLAINTEXT NO ENCRYPTION
    • Unencrypted - Data sent in plain text
    • Eavesdropping - Anyone can intercept and read
    • MITM Vulnerable - Easy to tamper with data
    • Port 80 - Standard HTTP port
    • No Authentication - Can't verify server identity
    • Browser Warnings - Marked as "Not Secure"

    HTTPS (Secure)

    TLS 1.3 AES-256
    • TLS/SSL Encryption - End-to-end encrypted
    • Data Privacy - Unreadable to attackers
    • MITM Protection - Tampering detected
    • Port 443 - Secure HTTPS port
    • Certificate Auth - Verifies server identity
    • SEO Boost - Google ranks HTTPS higher

    HTTPS Security Features

    TLS/SSL Versions

    • TLS 1.3 (2018): Latest, fastest, most secure. Reduced handshake, removed vulnerable ciphers
    • TLS 1.2 (2008): Still widely supported, secure with proper configuration
    • SSL 3.0, TLS 1.0, 1.1: Deprecated due to vulnerabilities (POODLE, BEAST)

    Perfect Forward Secrecy (PFS)

    • Ephemeral Keys: Unique session keys for each connection
    • Past Security: Compromised private key doesn't decrypt past sessions
    • Cipher Suites: ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)

    Common HTTPS Mistakes

    • Mixed Content: Loading HTTP resources on HTTPS pages (blocked by browsers)
    • Expired Certificates: Must renew before expiration (use Let's Encrypt for free auto-renewal)
    • Self-Signed Certs: Browser warnings, not trusted by default
    • Weak Ciphers: RC4, 3DES, MD5-based ciphers are vulnerable

    Packet Structure Breakdown (OSI Model)

    Network data is encapsulated in layers. Each layer adds headers for routing, error checking, and delivery. Click layers to expand.

    Decoded Fields

    Raw Hex Dump

    Encapsulation Process

    Sending (Top-Down):

    1. Application creates data (e.g., HTTP request)
    2. Transport layer adds TCP/UDP header (ports, sequence numbers)
    3. Network layer adds IP header (source/dest IP addresses)
    4. Data Link layer adds Ethernet frame (MAC addresses)
    5. Physical layer converts to electrical/light signals

    Receiving (Bottom-Up): Reverse process - each layer strips its header and passes data up

    Man-in-the-Middle Attack Demonstration

    Compare how HTTP vs HTTPS handle the same attack scenario. Watch what an attacker can see!

    HTTP (Vulnerable)

    USER
    ATTACKER
    SERVER
    Login: admin
    Password: secret123
    READING: admin / secret123

    HTTPS (Protected)

    USER
    ATTACKER
    SERVER
    Encrypted
    TLS Protected
    BLOCKED: *#@$%&!

    How MITM Attacks Work

    1. ARP Spoofing: Attacker claims to be the router, intercepts local traffic
    2. DNS Spoofing: Redirects domain lookups to malicious servers
    3. SSL Stripping: Downgrades HTTPS to HTTP, steals plaintext data
    4. Rogue WiFi: Fake access points (e.g., "Free Airport WiFi")

    Defense Against MITM Attacks

    • Always Use HTTPS: Check for lock icon in address bar
    • Enable HSTS: Force HTTPS, prevent downgrade attacks
    • Use VPN: Encrypts all traffic on untrusted networks
    • Avoid Public WiFi: For banking, shopping, sensitive data
    • Validate Certificates: Don't ignore browser security warnings!

    Network Protocol Comparison

    Compare characteristics of different network protocols and their use cases.

    Protocol Layer Type Speed Reliability Security Use Case
    TCP Transport (L4) Connection-oriented Moderate High No encryption Web, Email, File Transfer
    UDP Transport (L4) Connectionless Very Fast Best-effort No encryption Streaming, Gaming, DNS
    HTTP Application (L7) Request/Response Fast TCP-based Plaintext Legacy web browsing
    HTTPS Application (L7) HTTP + TLS Fast TCP-based TLS encryption Modern web, APIs
    SSH Application (L7) Encrypted shell Fast TCP-based SSH encryption Secure remote access
    DNS Application (L7) Name resolution Very Fast UDP (fallback TCP) Plaintext (use DoH) Domain to IP translation
    WebSocket Application (L7) Full-duplex Real-time TCP-based Can use TLS (wss://) Chat, live updates
    QUIC Transport (L4) UDP-based Very Fast Built-in recovery Always encrypted HTTP/3, modern web

    TCP vs UDP

    TCP: Like certified mail - guaranteed delivery, ordered, acknowledged. Perfect for web, email, file transfer where accuracy matters.

    UDP: Like postcards - fast, no guarantees, no handshake. Perfect for streaming, gaming, DNS where speed > reliability.

    Security First

    Always prefer encrypted protocols:

    • HTTPS over HTTP
    • SFTP/SSH over FTP/Telnet
    • DoH (DNS over HTTPS)
    • WSS (WebSocket Secure)

    Firewall Rule Simulator

    Create and test firewall rules to control network traffic. Rules are evaluated in order (first match wins).

    Active Firewall Rules (evaluated in order)

    Common Firewall Rules & Best Practices

    • Port 80 (HTTP): Usually allowed outbound, restricted inbound
    • Port 443 (HTTPS): Allow for web traffic
    • Port 22 (SSH): Restrict to specific IPs, disable password auth
    • Port 3389 (RDP): Block from internet, use VPN for remote access
    • Port 3306 (MySQL): Never expose to internet, localhost only
    • Default Deny: Block all, then whitelist specific services

    Firewall Configuration Mistakes

    • Allow Any/Any: Defeats the purpose of a firewall
    • Exposed Database Ports: 3306, 5432, 27017 should never face internet
    • No Logging: Can't detect attacks without logs
    • Stale Rules: Old rules for decommissioned services create attack surface

    CIDR Notation Calculator

    Calculate network ranges, subnet masks, and IP address information from CIDR notation.

    Canonical CIDR
    -
    Network Address
    -
    Subnet Mask
    -
    Wildcard Mask
    -
    First Usable IP
    -
    Last Usable IP
    -
    Broadcast Address
    -
    Total IPs
    -
    Usable Host IPs
    -
    IP Class
    -
    IP Type
    -
    Binary Subnet Mask
    -
    Hexadecimal
    -

    Membership Check

    Overlap Check

    CIDR Notation Explained

    CIDR (Classless Inter-Domain Routing) uses /X notation to specify network prefix length.

    Common CIDR Blocks

    • /32 - Single IP (1 host)
    • /30 - 4 IPs, 2 usable (router links)
    • /24 - 256 IPs, 254 usable (Class C)
    • /16 - 65,536 IPs (Class B)
    • /8 - 16,777,216 IPs (Class A)

    Private IP Ranges (RFC 1918)

    • 10.0.0.0/8 - 10.0.0.0 to 10.255.255.255
    • 172.16.0.0/12 - 172.16.0.0 to 172.31.255.255
    • 192.168.0.0/16 - 192.168.0.0 to 192.168.255.255

    Pro Tips

    • Subnetting: /24 gives you 256 IPs. /25 splits it into 2 subnets of 128 each.
    • Quick Math: /24 = 256, /25 = 128, /26 = 64, /27 = 32, /28 = 16
    • AWS VPC: Typical setup uses /16 for VPC, /24 for subnets

    Network Monitoring Lab

    Investigate realistic monitoring snapshots and learn how metrics, counters, and CLI evidence point to root cause.

    OK

    Healthy edge link

    Sample 1
    0Mbps
    Throughput
    0ms
    Latency
    0%
    Packet Loss
    0/s
    TCP Retransmits
    0
    Active Connections
    0%
    Interface Utilization

    Evidence

      Threshold Checks

        Interface Counters

        CLI Evidence

        Recommended Next Step