East-West vs North-South

North-south controls are familiar: home NAT, office edge, cloud load balancer. They do nothing to a process that already sits beside its victim. If 8782 and 8792 were two VMs on one VLAN, a curl from one to the other would never hit the internet firewall.

first. A router admin page is an edge device; it is not your east-west lab. STOP and keep arrows on 127.0.0.1. List THIS host’s addresses so you remember which talks never leave the machine.

ip -4 -o addr show | head -n 20
powershell.exe -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,InterfaceAlias | Format-Table -AutoSize"

When you curl from a client that also uses 8782, no packet hits 192.168.0.1. That is the pedagogical gift: you can talk about east-west without a second physical NIC. The metaphor’s limit is also honest — real east-west crosses real NICs you must be authorized to instrument.

Do not “make it more real” with ettercap on the LAN. Do not bind 0.0.0.0 so a second laptop can be the east. Classmates run their own two ports.

sudo apt install curl
sudo apt install python3
sudo apt install dnsutils

brew install python3

python3 - << 'PY'
import socket
for port in (8782, 8792):
  s = socket.socket(); s.settimeout(0.4)
  r = s.connect_ex(("127.0.0.1", port))
  s.close()
  print("east-west cartoon dest 127.0.0.1:%s" % port, "listen" if r == 0 else "down")
PY

curl -sS -m 2 -o /dev/null -w "8782:%{http_code}
" "http://127.0.0.1:8782/"
curl -sS -m 2 -o /dev/null -w "8792:%{http_code}
" "http://127.0.0.1:8792/"

Once you can say “app may speak to db on this port, workstations may not,” you are doing east-west allowlisting. Identity can sit in that sentence. A giant “inside” VLAN cannot. Tomorrow’s lab starts two listeners so the dests exist; today’s job is the arrow labels.

Refuse lateral-movement cookbooks: no nmap -sS inside, no hydra between peers, no hping3. Literacy is the map, then YOUR two ports.

sudo apt install nmap
sudo apt install python3

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

grep "east_west" "$HOME/cyberlium-lab/t11-m03-arrows.txt"
python3 - << 'PY'
dests = [("127.0.0.1", 8782), ("127.0.0.1", 8792)]
for ip, port in dests:
  if ip != "127.0.0.1":
      raise SystemExit("refusing non-loopback dest")
print("ew dests ok", dests)
print("never nmap peers, never 0.0.0.0")
PY

north_south vs east_west written. THIS host addresses listed. 8782/8792 named as unseen-by-edge cartoons. No ARP spoof, no peer nmap, no 0.0.0.0.

Date. Arrow definitions. DEMO GATE. ip/Get-NetIPAddress. Loopback EW cartoon. File t11-m03-l03-east-west.txt chmod 600. NEVER nmap/ettercap/arpspoof.