Network › Module 3 › Lesson 1
Why Flat Networks Fail
One LAN for everything is a blast radius — then list THIS host’s addresses and stay on
Visual · flat_network_fail
Flat means every neighbor can talk. Original Cyberlium.
Opening
A flat network is not “simple.” It is a single room where the printer can file a ticket as the payroll server.
Segmentation starts with a failure mode you can picture: every socket on the same layer-2 or wide-open layer-3 neighborhood can start a conversation with every other socket, limited only by whatever host firewall someone remembered. Malware loves that room. So do curious guests, IoT cameras, and the laptop that still has SMB on. “We are all on Wi-Fi” is not an architecture; it is a hope. This is ORIGINAL Cyberlium Topic 11 teaching — not a CCNA VLAN dump, not a warrant to re-cable an office, not a café client isolation bypass. Practical commands start at http://192.168.0.1/ as a lab app YOU own.
1. Blast radius is a seating chart, not a slogan
If the guest tablet can reach the backup share, your seating chart failed. Flat networks fail because reachability defaults to yes: ARP works, IPv4 local subnet works, IPv6 neighbor discovery works, and nobody named a deny. Host firewalls can patch this per device; they do not patch the idea that the camera and the domain controller share a broadcast domain.
You will not prove failure by scanning the dorm. You will list how many IPv4 addresses THIS computer already has — each one is a possible door. Router Admin means STOP: do not “fix” a home LAN by nmap, and do not treat the gateway as a switch you may rezone.
Command guide
Blast radius is a seating chart, not a slogan
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ COMMANDS ═══
Command — copy this
ip -4 addr show || ipconfig powershell.exe -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,InterfaceAlias,PrefixLength | Format-Table -AutoSize"
2. Loopback ports are a safe cartoon of two rooms
and are not VLANs. They are two doors on the same computer, which is enough to practice “this process is not that process.” A flat mind says one listener is as good as any other dest. A segmented mind names which dest is allowed to speak to which.
Later labs start both listeners bound to 127.0.0.1. Today you only probe whether they exist and write the cartoon. You do not bridge them onto Wi-Fi. You do not scan other hosts to see who else has 8782 open.
Command guide
Loopback ports are a safe cartoon of two rooms
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
import socket
for port in (8782, 8792):
s = socket.socket(); s.settimeout(0.5)
r = s.connect_ex(("127.0.0.1", port))
s.close()
print("127.0.0.1:%s -> %s" % (port, "open_or_listen" if r == 0 else "closed_or_filtered(%s)" % r))
print("do not probe other hosts")
PYCommand — copy this
curl -sS -m 2 -I "$SAFE/" | head -n 8
3. What you will not do to “make flatness visible”
Ping sweeps, ARP scans, and “just nmap the /24 to see how flat we are” are how students become the incident. Flatness is already visible in the missing deny: if you did not name a boundary, assume a path exists until a control you own proves otherwise.
Home mesh nodes, hotel VLANs, and campus NAC are other people’s seating charts. ; if it is the router, STOP. Your inventory remains ip/Get-NetIPAddress on THIS PC plus loopback cartoons.
Command guide
What you will not do to “make flatness visible”
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install python3 sudo apt install dnsutils
macOS:
Command — copy this
brew install nmap brew install python3
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/ Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
{ ip -4 -o addr show
powershell.exe -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | ForEach-Object { $_.IPAddress }"
grep -c . "$HOME/cyberlium-lab/t11-m03-this-host-ipv4.txt"4. What you ship: THIS host’s address list and a two-port cartoon, not a neighborhood map
ip or Get-NetIPAddress captured. 8782/8792 named as loopback zones-to-be. DEMO identified or STOPPED. No /24 scan. No gateway rezoning. Notes chmod 600.
5. What you record before the next lesson
Date. Flat = default yes among neighbors. THIS host IPv4 inventory. Cartoon and :8792. DEMO GATE. NEVER nmap/hydra/0.0.0.0. File t11-m03-l01-flat-fail.txt.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
nmap 192.168.0.0/24 to “show how flat the house is.” Log into Netgear admin and create VLANs you do not understand. Bind a scanner to 0.0.0.0 on café Wi-Fi.
Right
List THIS host. Write the two-room cartoon on loopback. Leave the router alone if GATE fires. Next: VLANs and Trust Zones as Ideas.
Mission: inventory THIS host, not the street
1) / STOP if router. 2) Run ip or Get-NetIPAddress on THIS computer. 3) Write vs :8792 as a future zone cartoon. Never nmap the LAN. Never reconfigure someone else's switch.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how to print IPv4 on Windows vs Linux for THIS PC — not how to enable client isolation on a hotel AP.
Knowledge Check
APPLY: curl http://192.168.0.1/ is TP-Link “Router Admin” while you study flat networks. You:
Multiple choice
Knowledge Check
APPLY: True or False: A ping sweep of the /24 is the required way to see that a network is flat.
True or False
Knowledge Check
APPLY: Why do and :8792 appear in this module?
Multiple choice