netsec-lab¶
Hands-on network security training. Each topic is a self-contained proof
of concept that walks the same three steps - attack → detect → defend -
and ships as an independent netlab-* uv package. Most modules run inside an
isolated network-namespace lab where no traffic ever leaves the host; the
Layer 1 modules are the exception - they need real radio or physical hardware
and are documented for awareness.
How it is organized¶
The curriculum follows the network stack, layer by layer:
- Layer 1 - Physical - media, radio and hardware: Wi-Fi recon/deauth, evil twin, WPA/WPS cracking, tapping, TEMPEST, rogue implants. Hardware-bound, so not replayable in the netns lab.
- Layer 2 - Data Link - the switch edge: DHCP, ARP, MAC/CAM, STP, VLANs, 802.1X, MACsec.
- Layer 3 - Network - routing and reachability: IP spoofing, ICMP, fragmentation, IGP injection, BGP, FHRP.
- Layer 4 - Transport - TCP/UDP: scanning, SYN flood, hijacking, amplification, IDS evasion, covert channels.
- Network services - DNS, TLS, SNMP, NTP, QUIC and LAN name resolution, viewed on the wire.
- Defensive tooling - IDS rules, firewalling, NetFlow, PCAP forensics, TLS inspection.
Before you start¶
- Read Lab setup to build the isolated netns/veth segment.
- Read the Methodology - the attack/detect/defend model every module follows.
- Pick a layer and work through its modules in order.
Every offensive PoC refuses to run without
--i-own-this-network. Use these tools only on networks you own. This material is for defenders and for authorized testing.