Network › Module 2 › Lesson 4
Lab — Local Alert from Your Loopback App
Start a logger YOU own, hit it, count the file — first.
Visual · ids_loopback_alert_lab
Lab: local alerts from YOUR loopback hits. http://192.168.0.1/ YOUR lab. Bind never 0.0.0.0.
Opening
The only sensor in this lab is a log file that grows when YOU curl loopback.
You now have verbs, patterns, and a false-positive vocabulary. The lab makes that physical: a tiny HTTP toy bound to that appends one line per GET. You curl paths you choose. You wc -l the log. You python-count unique paths. That is an IDS-shaped feedback loop without pretending you operate a city SOC. Original Cyberlium.
1. Write and bind the toy on loopback before you generate noise
The lab server is not “an IDS product.” It is a witness with a file handle. It must bind If a snippet uses 0.0.0.0, refuse it — that publishes on every interface, including networks this course does not authorize.
. If the saved body or live curl is a router admin page, STOP and still run the toy only on loopback. A home gateway is not your sensor platform.
Command guide
Write and bind the toy on loopback before you generate noise
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t11-m02-ids-toy.py" << 'PY'
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
import datetime, os
LOG = os.path.expanduser("~/cyberlium-lab/t11-m02-hits.log")
HOST, PORT = "127.0.0.1", 8781
class H(BaseHTTPRequestHandler):
def do_GET(self):
with open(LOG, "a", encoding="utf-8") as f:
f.write("%s %s
" % (datetime.datetime.utcnow().isoformat() + "Z", self.path))
self.send_response(200)
self.end_headers()
self.wfile.write(b"detect-only loopback toy
")
def log_message(self, fmt, *args):
pass
if __name__ == "__main__":
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
ThreadingHTTPServer((HOST, PORT), H).serve_forever()
PYCommand — copy this
if [ -f "$HOME/cyberlium-lab/t11-m02-ids-toy.pid" ]; then kill "$(cat "$HOME/cyberlium-lab/t11-m02-ids-toy.pid")" || true; fi python3 "$HOME/cyberlium-lab/t11-m02-ids-toy.py" & sleep 1
2. Hit YOUR dest, then count — that is the whole detector loop
Send several GETs: /, /hit, /lab. Each should add a line. wc -l is your SIEM for this hour. If the count does not move, the toy is down, you curled the wrong host, or you are looking at a different file. Do not “debug” by scanning the LAN.
curl stays on No DEMO repeat. No 0.0.0.0 bind “so the phone can join.” Classmates run their own loopback.
Command guide
Hit YOUR dest, then count — that is the whole detector loop
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 2 "http://127.0.0.1:8781/" >/dev/null curl -sS -m 2 "http://127.0.0.1:8781/hit" >/dev/null curl -sS -m 2 "http://127.0.0.1:8781/lab" >/dev/null grep -c " /hit" "$HOME/cyberlium-lab/t11-m02-hits.log" tail -n 5 "$HOME/cyberlium-lab/t11-m02-hits.log"
3. Summarize unique paths, then stop the toy you started
Unique paths tell you whether you actually varied the experiment or hammered one URL. Python counting on a file you own is analysis. Unique IPs on a /24 would be a scan report — forbidden here.
Kill the pid you wrote. Leaving a loopback toy running is mostly harmless; leaving a 0.0.0.0 toy running is how class labs become café services. Confirm the bind was 127.0.0.1 in the script you saved.
Command guide
Summarize unique paths, then stop the toy you started
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
from pathlib import Path
from collections import Counter
p = Path.home() / "cyberlium-lab" / "t11-m02-hits.log"
c = Counter()
if p.exists():
for ln in p.read_text(encoding="utf-8", errors="replace").splitlines():
parts = ln.split()
if parts:
c[parts[-1]] += 1
print("unique_paths", len(c))
for path, n in c.most_common(12):
print(n, path)
PYCommand — copy this
grep -n "127.0.0.1" "$HOME/cyberlium-lab/t11-m02-ids-toy.py" kill "$(cat "$HOME/cyberlium-lab/t11-m02-ids-toy.pid")"
4. What you ship: a loopback witness, a hit log, a unique-path count
Toy script chmod 600, bind hits.log has YOUR curls. Unique paths counted. DEMO identified or STOPPED. Process cleaned up. No 0.0.0.0. No LAN sensor fantasies.
5. What you record before the next lesson
Date. Bind wc -l hits.log. Unique path count. DEMO GATE. NEVER nmap/hydra/ettercap/0.0.0.0. File t11-m02-l04-ids-lab.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
python -m http.server --bind 0.0.0.0 8781 on café Wi-Fi. nmap the LAN to “compare sensors.” Leave hydra running against 192.168.0.1 because the toy was boring.
Right
Bind loopback. Curl three paths. wc -l and unique-path python. Stop YOUR pid. Next: Quiz — IDS vs IPS.
Mission: grow a local alert file from YOUR curls only
1) / STOP if router. 2) Start the toy (never 0.0.0.0). 3) Curl ≥3 paths, wc -l the log, count unique paths. 4) Stop the pid you started.
Stuck? Ask Cyberlium AI Mentor
If the port is busy, ask Mentor how to find YOUR pid on this OS — not how to steal port 80 on a router.
Knowledge Check
APPLY: The lab snippet says ThreadingHTTPServer(("0.0.0.0", 8781)). What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: wc -l on YOUR t11-m02-hits.log after YOU curled loopback is a valid beginner detector loop.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is TP-Link Router Admin in the middle of the IDS lab. Next?
Multiple choice