● Network Security
Working through a structured network security lab series — four labs deep so far, using packet capture analysis to surface what a network's actual topology looks like versus what it's supposed to look like.
● Exercise
Analyzed a week-long packet capture (iot-vlan-week.pcap) covering the 10.40.0.0/24 subnet. The exercise surfaced two findings worth documenting: a rogue device sitting at 10.40.0.53 that shouldn't have been on that segment, and an entirely undocumented subnet (10.30.0.0/24) visible in the traffic that wasn't part of the expected network map.
● Why It Matters
This is exactly the kind of gap between assumed and actual network state that causes real incidents — a device or subnet nobody accounted for is invisible to monitoring built around the documented topology. Finding it in a lab is the same skill as finding it in a live environment, just with lower stakes.
● Also Working
Alongside the structured labs, working a CTF flag (format CSL{...}) via Nmap-driven reconnaissance and follow-on attack paths — same reconnaissance discipline, applied to a different kind of target.
● More Coming
More lab writeups get added here as the series progresses.
Back to Labs