Appendix A20–90 min each

Challenges

Five exercises that turn an hour of reading into something you have done. Each one is small enough to finish and specific enough to prove.

01Map one request from your own machine

Time: 20 minutes · You produce: an annotated transcript

Pick a site you use daily. Run the five commands from module 10 against it, in order, and paste each output into a document with one sentence saying what it proved.

dig output, and the address it returned
ip route get output, and the interface it chose
nc -vz result, and whether it was open or refused
curl -v output, with the TLS version and HTTP status noted

02Break your own subnet

Time: 45 minutes · You produce: a script that builds a broken network and fixes it

Create two Linux namespaces joined by a veth pair, address them in the same /24, and confirm they ping. Then break it two ways: a wrong prefix on one side, and a duplicate address. Note the exact symptom for each — the difference between them is the lesson.

Two namespaces ping each other
I changed one prefix and recorded what happened
I created a duplicate address and watched it fail intermittently
The whole lab rebuilds from one script

03Capture a page load

Time: 45 minutes · You produce: a capture with three bookmarks

Start tcpdump -ni any -w load.pcap 'port 53 or port 443', load a page, stop the capture, and open it in Wireshark. Find the DNS query, the TCP handshake, and the TLS ClientHello. Bookmark each one.

I found the DNS query and its answer
I found SYN, SYN-ACK and ACK, and can point at them
I found the ClientHello and the server name inside it
I can state how long the whole setup took

04Rewrite a real outage

Time: 30 minutes · You produce: a one-page incident write-up

Take a published post-mortem from a provider you use. Rewrite it using the six steps from module 10, and mark which of the five commands would have found it earliest. Then write the check they added — or should have.

The six steps are filled in, in order
I named which layer failed, and which layer looked broken
I named the earliest command that would have found it
I wrote the detection that was missing

05Two rooms, one router

Time: 90 minutes · You produce: a working two-subnet lab with NAT

Three namespaces: two hosts in different subnets and one router with an address in each. Enable forwarding, add a default route on each host, and confirm they reach each other. Then add NAT on the router and confirm one subnet can reach an outside address.

Host A reaches host B through the router
Forwarding is enabled and I can explain why it was needed
NAT works, and I can show the translation
I broke it once and found it with tcpdump

How to know you're done

Not when the checklist is green — when you can explain the failure out loud to someone who was not there, in under two minutes, without notes. That is the test an interview will apply, and the one an incident will apply later.