Network › Module 3 › Lesson 4
Lab — Two Loopback Zones
Start and , list THIS host, curl both — never 0.0.0.0.
Visual · two_loopback_zones_lab
Two python listeners, both 127.0.0.1. ip/Get-NetIPAddress on THIS host.
Opening
Two rooms, one computer: if you cannot name which port you hit, you are still living flat.
The lab is deliberately small. You start two HTTP toys: zone A on and zone B on Both binds are loopback. You list THIS host’s addresses so you remember the experiment never needed a /24. You curl each dest and write which promise it kept. That is segmentation literacy without a production switch. Original Cyberlium.
1. Start both rooms on 127.0.0.1 or do not start them
One script, two ports, explicit HOST = 127.0.0.1. If you copy a blog that binds 0.0.0.0 “for Docker,” stop — that is how a zone cartoon becomes a café service. ; router admin still means STOP on the gateway, not on your loopback toys.
You may already have 8782 from a teaching server. Reusing a pid you own is fine. Scanning the LAN for “who else runs 8782” is not.
Command guide
Start both rooms on 127.0.0.1 or do not start them
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t11-m03-two-zones.py" << 'PY'
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
import sys, threading
HOST = "127.0.0.1"
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
def make(port, name):
class H(BaseHTTPRequestHandler):
def do_GET(self):
body = ("zone=%s port=%s bind=127.0.0.1
" % (name, port)).encode()
self.send_response(200); self.end_headers(); self.wfile.write(body)
def log_message(self, fmt, *args):
pass
return ThreadingHTTPServer((HOST, port), H)
a, b = make(8782, "A"), make(8792, "B")
threading.Thread(target=a.serve_forever, daemon=True).start()
print("listening", HOST, 8782, 8792, flush=True)
b.serve_forever()
PYCommand — copy this
if [ -f "$HOME/cyberlium-lab/t11-m03-two-zones.pid" ]; then kill "$(cat "$HOME/cyberlium-lab/t11-m03-two-zones.pid")" || true; fi python3 "$HOME/cyberlium-lab/t11-m03-two-zones.py" & sleep 1
2. Inventory THIS host, then curl each zone dest
ip / Get-NetIPAddress proves you know your own doors. curl 8782 and 8792 proves the two promises answer. If one port fails, debug YOUR pid — do not nmap neighbors for a spare listener.
Bodies should mention bind=127.0.0.1. If you ever see 0.0.0.0 in YOUR script, you failed the lab even if curl worked from the same PC.
Command guide
Inventory THIS host, then curl each zone dest
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
ip -4 -o addr show | head -n 20 powershell.exe -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,InterfaceAlias | Format-Table -AutoSize" curl -sS -m 2 "http://127.0.0.1:8782/" | tee "$HOME/cyberlium-lab/t11-m03-zone-a.body" curl -sS -m 2 "http://127.0.0.1:8792/" | tee "$HOME/cyberlium-lab/t11-m03-zone-b.body" grep -E "zone=|bind=" "$HOME/cyberlium-lab/t11-m03-zone-a.body" "$HOME/cyberlium-lab/t11-m03-zone-b.body"
3. Write which talks you did not allow, then stop YOUR pid
Segmentation is also the missing third dest: you did not publish these rooms on Wi-Fi, you did not curl a neighbor, you did not open the router VLAN page. Negative space is the control.
Kill the pid you started. Confirm the script still says 127.0.0.1. Notes chmod 600.
Command guide
Write which talks you did not allow, then stop YOUR pid
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install nmap sudo apt install python3 sudo apt install dnsutils
macOS:
Command — copy this
brew install nmap brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/ Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
grep -n "127.0.0.1" "$HOME/cyberlium-lab/t11-m03-two-zones.py"
grep -n "0.0.0.0" "$HOME/cyberlium-lab/t11-m03-two-zones.py" && echo "FAIL: non-loopback bind"
python3 - << 'PY'
import socket
for port in (8782, 8792):
s = socket.socket(); s.settimeout(0.5)
print("127.0.0.1:%s" % port, s.connect_ex(("127.0.0.1", port)))
s.close()
PYCommand — copy this
kill "$(cat "$HOME/cyberlium-lab/t11-m03-two-zones.pid")"
4. What you ship: two loopback answers, a local address list, a bind audit
8782 and 8792 answered on 127.0.0.1. ip/Get-NetIPAddress captured. No 0.0.0.0 in the toy. DEMO GATE. Pid stopped. Zone bodies saved chmod 600.
5. What you record before the next lesson
Date. Two-zone lab. THIS host inventory. bind audit. DEMO identified/STOP. NEVER nmap/hydra/0.0.0.0. File t11-m03-l04-zones-lab.txt.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Bind 0.0.0.0 so a second laptop can be zone B. nmap the house for free ports. Click Netgear VLAN while the toy runs.
Right
Two loopback listeners, two curls, local inventory, bind audit. Next: Quiz — Segmentation.
Mission: run two rooms on loopback and prove the bind
1) / STOP if router. 2) Start and 3) ip or Get-NetIPAddress on THIS host. 4) Curl both, grep bind=127.0.0.1, stop YOUR pid.
Stuck? Ask Cyberlium AI Mentor
If 8782 is busy, ask Mentor how to use YOUR pid file — not how to steal a port on the default gateway.
Knowledge Check
APPLY: Zone B blog uses --bind 0.0.0.0 --port 8792. Cyberlium lab says:
Multiple choice
Knowledge Check
APPLY: True or False: You should nmap 192.168.0.0/24 to confirm nobody else is using 8782.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is Router Admin during the two-zone lab. Next?
Multiple choice