A live multi-site network, in Docker
Four sites — Perth, London, Los Angeles and a remote mine site on satellite — joined by WAN links with real distance in them. Real OSPF routers, per-office DNS, and staff who work their own hours, so traffic follows the sun. Then six labs: measure it, attack it, detect the attack, firewall it, break it seven ways, and rebuild the whole thing from a packet capture.
First time? About 10 minutes — most of it Docker downloading images. Done once.
Free, one-time, and the only software you need besides make. Download for your system ↗, install it, and start it — wait until it shows “running”.
⭳ Download the ZIP, then unzip it. You'll get a folder named enterprise-network-lab-main — put it somewhere easy, like your Desktop. (Or git clone it if that's your style.)
If make isn't installed, macOS will offer the Command Line Tools — accept, wait, and re-run.
This lab is driven by make from a Linux shell — WSL is the supported path on Windows.
Native Docker Engine works directly; Docker Desktop is also fine — the Makefile detects it and handles the difference automatically.
Six labs, all on the same running network. Work them in order — each builds on the last.
Feel the 250ms to London, watch DNS cross the WAN and get cached, sniff out the routing protocol with tcpdump, then cut a WAN link — twice, two different ways — and watch OSPF heal it.
Attack the network and watch a real Suricata sensor catch it against 52,000 Emerging Threats rules. Record the incident, replay it, then write and tune a rule of your own.
Write real nftables policy: contain the branch offices, stop lateral movement, and discover the hard way that a firewall rule is not a statement of intent — it is a position in a list.
Seven faults get injected — loss, jitter, one-way loss, an MTU black hole, DNS, a bandwidth cap, asymmetric routing. Diagnose each one, and learn why "I can ping it" proves nothing.
From a capture alone, infer the hosts, subnets, services and routers of a network you have never seen — stand it back up in Docker, then find everything your reconstruction gets confidently wrong.
Every office works its own hours, so traffic follows the sun. Profile a full simulated day, then hide an attack made entirely of ordinary packets sent at the wrong hour — and watch the signature sensor say nothing at all.
Four sites, OSPF everywhere. Cut any link between the three offices and traffic reroutes; the mine site has only one way home.
The distance is tc netem on the WAN interfaces — but your tools can't tell. Everything here is the real thing: real FRR routing daemons, real dnsmasq, real tcpdump. No wrappers, no mockups.
Hands-on security labs across the lifecycle — plus two companion books and a game that tie it together. Found one? Here's the rest — or browse the whole series on the series home.