Lab — Explore Your Local Network

ip link: iface names, UP/DOWN, link/ether MAC — Layer 2 labels on this box. ip addr: inet CIDR, lo vs real NIC — the DHCP (or static) result. ip neigh: ARP/ND cache this kernel already has — including the gateway MAC if it was resolved. Empty-ish on a quiet VM is possible; do not fill it by scanning. ip route: default via and iface — the DHCP router option in practice. ss -tuln: TCP/UDP LISTEN on THIS host — 127.0.0.1 vs 0.0.0.0, the same honesty check as Topic 2. Together they answer: what doors exist, what addresses they hold, whom we think the gateway is at Layer 2, how we leave, and what we offer if a packet arrives. They do not answer "who else is on the Wi-Fi." That question is how unauthorized recon starts.

Defenders inventory themselves first because bind address and default route explain more real incidents than a pretty neighbor table. A service on 0.0.0.0:3000 on a laptop that later joins café Wi-Fi is an exposure story. Home NAT does not travel with you. Recording that bind now — on your machine — is the defensive win. Sweeping strangers' phones on the same SSID is not a learning goal and is out of scope forever in Cyberlium.

ip neigh shows what this kernel already resolved. If the table is sparse, write NONE for gateway MAC and move on — or, if your policy allows, ping YOUR default via once so ARP populates that single entry. One ping to the router you already use is not a /24 sweep. Mass ping, arp-scan, and nmap -sn are different animals: they actively discover other hosts. This lab forbids them. Sparse output is still a valid lab result. Pretty screenshots are not a reason to leave scope.

Home-lab honesty check: a VirtualBox/VMware guest you created, a WSL instance on your PC, or a Raspberry Pi you administer in your house is in scope. A stranger's laptop on the same coffee-shop SSID is not. If you cannot name the owner and the permission, you do not inventory that host. Cyberlium never asks you to map café tables, dorm floors, or "everyone on my Wi-Fi." Defensive LAN literacy starts and ends with machines you control.

Stay in your home directory for the notes file. These commands read kernel state; they should not reconfigure interfaces. If ip neigh is sparse, write that down — do not hunt other hosts to make the table prettier. Windows: ipconfig /all, arp -a, route print, netstat -ano — same mission, same scope, same private notes folder. Fill MAC, CIDR, default via, gateway MAC or NONE, and two LISTEN binds. That is the whole deliverable — not a network map of strangers.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/lan-inventory.txt"

{
  echo '=== Cyberlium LAN inventory (THIS host only) ==='
  echo "date: $(date -Is 2>/dev/null || date)"
  echo "scope: own machine / home lab / documented lab VMs — NEVER café sweep"
  echo

echo '--- ip link ---'
  ip link
  echo

echo '--- ip addr ---'
  ip addr
  echo

echo '--- ip neigh ---'
  ip neigh
  echo

echo '--- ip route ---'
  ip route
  echo

echo '--- ss -tuln ---'
  ss -tuln
  echo

echo '--- fill in ---'
  echo 'non-lo MAC (link/ether):'
  echo 'non-lo inet CIDR:'
  echo 'default via (gateway IP):'
  echo 'gateway MAC from ip neigh (or NONE):'
  echo 'two LISTEN ports and bind (127.0.0.1 vs 0.0.0.0):'
} > "$NOTES"

chmod 600 "$NOTES"

GW=$(ip route | awk '/^default/ {print $3; exit}'); [ -n "$GW" ] && ping -c 1 "$GW"

You mapped the only LAN that is always authorized: this host's MACs, addresses, cached neighbors, routes, and listeners — written down, mode 600, no sweep. Sparse neigh tables are acceptable. Unauthorized discovery is not. Keep the notes private. Next — Quiz — Networking Basics Final — APPLY the whole of Topic 3 (OSI through DHCP), then Topic 4: Privacy & Digital Safety.