Lab — Network Recon with Linux

A host footprint for this lab is four facts: (1) which interfaces exist and which are UP, (2) which IPv4/IPv6 addresses they hold, including 127.0.0.1 on lo, (3) whether ICMP echo to yourself works, and (4) which sockets are listening locally. Together they explain why SSH might bind on one address and fail on another, or why a service is "up" but unreachable from outside the VM.

Write the results into $HOME/cyberlium-lab/network-footprint.txt. Notes are evidence practice: timestamp, whoami, command, and a short interpretation. If you only scroll terminal history, you will lose the story when the scrollback dies. Analysts keep artifacts; this lab keeps a tiny artifact under your home directory.

Legal line stays loud: mapping YOUR interfaces is administration. Mapping a neighbor's Wi-Fi clients, sweeping a /24 you do not own, or port-scanning a company "for the portfolio" without written permission is unauthorized access. Skill does not create consent. This lab never needs nmap against anyone else.

ip -br addr (or ip addr) lists interfaces in a scannable form. Look for lo with 127.0.0.1/8, and your primary NIC (eth0, ens33, eth0 in WSL sometimes looks different). Note MAC vs IP: MAC is link-layer identity on the segment; IP is the routable (or private) address. Confusing them produces wrong firewall tickets forever.

ping -c 4 127.0.0.1 proves your own IP stack answers ICMP. If that fails, fix local networking before blaming the internet. ping -c 4 of your primary address (from ip addr) checks that address is alive on the box. Do not flood ping. Do not ping strangers. Continuous ping without -c is a habit to break in labs — always bound it.

ss -tuln lists TCP/UDP sockets that are listening, numeric, without resolving names (faster, clearer). 127.0.0.1 means local-only; 0.0.0.0 means all IPv4 interfaces; [::] is the IPv6 all-interfaces story. A listener on 127.0.0.1:8080 is not the same exposure as 0.0.0.0:8080. Write that distinction into your notes — it is the whole point of reading ss carefully.

WSL may show different interface names and sometimes limited ICMP behavior depending on version and Windows firewall. A VM NAT NIC often gets 10.x or 192.168.x addresses that are not reachable from the public internet — that is expected. Missing ifconfig is not an outage; prefer ip. Empty ss output can mean nothing is listening, or you need privileges for some sockets — try without sudo first on your own box.

If traceroute or external pings are blocked in your environment, skip them for this lab. The required success criteria are local inventory commands that do not require contacting other people's hosts. Defenders document what they can prove; they do not invent reachability by attacking a firewall they do not own.

Save outputs with redirection: ip -br addr >> network-footprint.txt. Add echo separators and date so the file is readable later. chmod 600 the notes file if you ever paste anything sensitive (you should not need to). Never chmod 777 the lab folder "for convenience."

Create the lab directory, append command outputs with labels, and read the file back with less or cat. If a command is missing, install it only on a machine you administer (apt install iproute2 is usually already present). Do not chase ifconfig if ip works.

mkdir -p "$HOME/cyberlium-lab"
OUT="$HOME/cyberlium-lab/network-footprint.txt"

{
  echo "=== network footprint ==="
  echo "date: $(date)"
  echo "whoami: $(whoami)"
  echo
  echo "--- ip -br addr ---"
  ip -br addr 2>/dev/null || ip addr
  echo
  echo "--- ping self ---"
  ping -c 4 127.0.0.1
  echo
  echo "--- listeners ---"
  ss -tuln
} > "$OUT"

less "$OUT"

ping floods, mass traceroute across campus

You now have a repeatable local inventory: interfaces, self-ping, listeners, and a note under cyberlium-lab. That is networking literacy without crossing into unauthorized scanning. Next up — Quiz — Networking Commands — checks whether you can read these outputs under pressure.