Enterprise Network Lab

A live multi-site network, in Docker

Run a global enterprise on your laptop.

Four sites — Perth, London, Los Angeles and a remote mine site on satellite — joined by WAN links with real distance in them. Real OSPF routers, per-office DNS, and staff who work their own hours, so traffic follows the sun. Then six labs: measure it, attack it, detect the attack, firewall it, break it seven ways, and rebuild the whole thing from a packet capture.

Get started

First time? About 10 minutes — most of it Docker downloading images. Done once.

1

Install Docker Desktop

Free, one-time, and the only software you need besides make. Download for your system ↗, install it, and start it — wait until it shows “running”.

2

Download the lab — no git needed

⭳ Download the ZIP, then unzip it. You'll get a folder named enterprise-network-lab-main — put it somewhere easy, like your Desktop. (Or git clone it if that's your style.)

3

Bring the enterprise up

  1. Open Terminal, type cd (with a trailing space), drag the folder onto the window, press Enter.
  2. Run make up — the first run builds everything (a few minutes).
  3. Run make test to feel the geography, then make perth for a workstation shell, and open Lab 00.

If make isn't installed, macOS will offer the Command Line Tools — accept, wait, and re-run.

  1. One-time: install WSL 2 with Ubuntu ↗ and enable WSL integration in Docker Desktop settings. In the Ubuntu terminal: sudo apt install make
  2. cd into the unzipped folder and run make up (first run builds everything — a few minutes).
  3. Run make test, then make perth, and open Lab 00.

This lab is driven by make from a Linux shell — WSL is the supported path on Windows.

  1. Open a terminal in the folder and run make up.
  2. Then make test, make perth, and open Lab 00.

Native Docker Engine works directly; Docker Desktop is also fine — the Makefile detects it and handles the difference automatically.

The labs

Six labs, all on the same running network. Work them in order — each builds on the last.

00 Available

Tour of the enterprise

Feel the 250ms to London, watch DNS cross the WAN and get cached, sniff out the routing protocol with tcpdump, then cut a WAN link — twice, two different ways — and watch OSPF heal it.

Open the lab →
01 Available

Intrusion detection

Attack the network and watch a real Suricata sensor catch it against 52,000 Emerging Threats rules. Record the incident, replay it, then write and tune a rule of your own.

Open the lab →
02 Available

Firewall the edge

Write real nftables policy: contain the branch offices, stop lateral movement, and discover the hard way that a firewall rule is not a statement of intent — it is a position in a list.

Open the lab →
03 Available

WAN troubleshooting

Seven faults get injected — loss, jitter, one-way loss, an MTU black hole, DNS, a bandwidth cap, asymmetric routing. Diagnose each one, and learn why "I can ping it" proves nothing.

Open the lab →
04 Capstone

Rebuild a network from its traffic

From a capture alone, infer the hosts, subnets, services and routers of a network you have never seen — stand it back up in Docker, then find everything your reconstruction gets confidently wrong.

Open the lab →
05 Available

Baselining & the anomaly signatures miss

Every office works its own hours, so traffic follows the sun. Profile a full simulated day, then hide an attack made entirely of ordinary packets sent at the wrong hour — and watch the signature sensor say nothing at all.

Open the lab →

The network

Four sites, OSPF everywhere. Cut any link between the three offices and traffic reroutes; the mine site has only one way home.

~250 ms RTT ~150 ms ~140 ms satellite ~600 ms + jitter, loss Perth — HQ users .10 · servers .20 · dmz .30 10.10.0.0/16 dns · intranet · IDS sensor · firewall London users 10.20.10.0/24 local dns cache · office hours UTC Los Angeles users 10.30.10.0/24 local dns cache · office hours UTC-8 Pilbara — mine site users 10.40.10.0/24 no local resolver — every lookup crosses the satellite

The distance is tc netem on the WAN interfaces — but your tools can't tell. Everything here is the real thing: real FRR routing daemons, real dnsmasq, real tcpdump. No wrappers, no mockups.

Part of the Assume-Breach series

Hands-on security labs across the lifecycle — plus two companion books and a game that tie it together. Found one? Here's the rest — or browse the whole series on the series home.