Defensive › Module 4 › Lesson 1
Device Surface
Routers and switches expose services — inventory YOUR lab device only.
Visual · device_surface
Network device surface literacy. YOUR lab router only. Original Cyberlium.
Opening
Every open port on a gateway is a story — read YOUR lab router's chapter, not the café's.
Network devices (routers, switches, APs) run firmware with web UI, SSH, SNMP, and sometimes Telnet exposed. Defenders inventory services, disable unused ones, and segment management networks. Cyberlium teaches surface literacy on a lab router YOU purchased or a VM sim — not the dorm building gateway, ISP CPE you do not own, or café admin page. Next: Management Plane.
1. What listens on a gateway
Common surfaces: HTTPS admin, SSH, SNMP, WAN ping response, UPnP, remote admin from internet. Document what is enabled on YOUR lab device from the LAN side only.
Port scanning the neighborhood gateway is recon on stranger infrastructure — out of scope.
Command guide
Try these commands — What listens on a gateway
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CIS Controls v8 — https://www.cisecurity.org/controls CISA SOHO guidance — https://www.cisa.gov/news-events/news/harden-your-network-home-and-small-business-networks
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install curl
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
nmap -sn 192.168.1.1 2>/dev/null | head -8 || echo 'Ping YOUR lab router IP only' curl -sS -m 3 -I http://192.168.1.1/ 2>/dev/null | head -5 || echo 'Document YOUR lab router admin — not neighbor gear'
Primary tools to practice this lesson: nmap, curl. Reference sites: CIS Controls v8 (https://www.cisecurity.org/controls); CISA SOHO guidance (https://www.cisa.gov/news-events/news/harden-your-network-home-and-small-business-networks). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Blast radius of an edge device
Compromise of a router often means compromise of every client behind it. Defenders treat edge devices as crown jewels — you practice naming services before disabling Telnet on lab.
Never 'secure' the library router without written authorization from the owner.
3. Lab device boundary
Use a disposable lab router or isolated management VLAN you control. Record model, firmware, and management IP in notes — not stranger BSSIDs or ISP gear.
Ship: service inventory table for YOUR lab device. Next: Management Plane.
4. What you ship: lab device surface inventory
List enabled services on YOUR lab router (LAN access only). No neighbor gateway scans. chmod 600.
5. What you record before the next lesson
Date. Lab device model and enabled services. NEVER café/dorm ISP CPE. File t16-m04-l01-device-surface.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
nmap the dorm default gateway and 'fix' findings. Enable remote admin on ISP router you rent.
Right
Inventory surface on YOUR lab device. Next: Management Plane.
Mission: device surface inventory
1) Document YOUR lab router model and firmware. 2) List management services enabled (read-only from LAN). 3) No scans of stranger gateways. Never touch café or dorm edge devices.
Stuck? Ask Cyberlium AI Mentor
WAN-side remote admin should default off — note it even if you only read settings.
Knowledge Check
APPLY: Device surface literacy in Cyberlium applies to:
Multiple choice
Knowledge Check
APPLY: True or False: nmap on the dorm building gateway is defensive homework.
True or False
Knowledge Check
APPLY: Edge router compromise often:
Multiple choice