Hack the Route Start free Open app

Labs

99 labs, 11 roads

Each lab is a small network of real Linux machines with steps to run. They come in 33 short groups on 11 roads, easy to hard. Free opens the beginner labs of First Contact, plus each other road's beginner first lab: 14 labs.

01

First Contact

Learn networking from zero: IP addresses and subnets, ARP and DHCP, routing and ICMP, and how a packet leaves its network.

4 groups · 12 labs · medal: Crossroads

IP addressing & subnets

Addresses, subnet masks and cutting blocks to size.

  1. 01 A home network, from the laptop's point of view A home network lab: follow one laptop's traffic through it, end to end. Free
  2. 02 A bare machine: networking by hand Linux networking by hand: bring a bare machine online, then make it survive a reboot. Free
  3. 03 Addresses and subnets: on my network, or through the router? Subnetting practice: read what a prefix means, then watch a wrong one break the network. Free
  4. 04 VLSM: one block, subnets cut to size Cut one /24 into subnets of different sizes, so nothing is wasted. Pro

ARP & DHCP

Finding neighbours and getting an address to join.

  1. 01 ARP and MAC addresses: who is behind this IP address? See how ARP works: an IP address turns into a MAC address, hop by hop. Free
  2. 02 DHCP: how a device gets its address See how DHCP works: a device asks for an address and gets a lease. Free
  3. 03 DHCP relay Serve addresses to networks the DHCP server is not on, through a relay. Pro

IP routing

How packets cross routers from one network to the next.

  1. 01 Routing across hops: how a packet finds a server three routers away Follow routing tables and TTL across three routers, and find a broken hop. Free
  2. 02 Static routes, by hand Type routes by hand, then add a backup route that takes over on failure. Pro
  3. 03 Route summarisation: one route for many subnets Cover a branch's subnets with one route, then stop the loop it makes. Pro

ICMP & gateway redundancy

Error messages, and a gateway that survives a router.

  1. 01 ICMP: what the network tells you about your packets Read the error messages routers send back when a packet cannot be delivered. Pro
  2. 02 First-hop redundancy: one gateway address, two routers Share one gateway address between two routers with VRRP, then power one off. Pro
02

Speaking Protocols

TCP, UDP and DNS, then the protocols programs speak on top: the web and its certificates, mail, files, time and the office.

3 groups · 11 labs · medal: Protocol speaker

TCP, UDP & DNS

Ports, connections and names turned into addresses.

  1. 01 TCP and UDP: ports, connections and datagrams TCP vs UDP: see ports, the TCP handshake and teardown, and no-promises datagrams. Free
  2. 02 The DNS tree: how a name is found Follow a resolver down the DNS hierarchy, from the root to an answer. Pro
  3. 03 DNS zones, zone transfers and encrypted DNS Serve a zone, copy it by DNS zone transfer, then query over DoT and DoH. Pro

HTTP, TLS & mail

The web, its security and versions, and mail, up close.

  1. 01 HTTP up close: requests, answers and connections Type HTTP requests by hand and read every line of the answers. Pro
  2. 02 TLS certificates: chains, trust and what breaks them Read a certificate chain, see what breaks it, and trust a self-signed one. Pro
  3. 03 HTTP/1.1, HTTP/2 and HTTP/3 Compare HTTP versions: ALPN picks one, HTTP/2 shares a connection, HTTP/3 rides QUIC. Pro
  4. 04 The path of an email How email works: send one by hand over SMTP and follow it between servers. Pro

Time & office: NTP, files, FTP & PTP

Keeping time, and the office's files, desktops and calls.

  1. 01 NTP: keeping clocks right, and what a wrong one breaks Set clocks with NTP, outvote a wrong one, and watch a bad clock break TLS. Pro
  2. 02 The office LAN's own protocols: files, desktops and calls Watch file sharing, remote desktop and a VoIP call on an office LAN's wire. Pro
  3. 03 FTP: two channels, active and passive Move files over FTP: active, passive, and why only passive mode crosses NAT. Pro
  4. 04 PTP and NTS: time that is precise, and time that is proven Sync a clock to microseconds with PTP, then authenticate time with NTS. Pro
03

The Switchyard

Switches, loops, VLANs and multicast inside one network, IPv6, the next version of IP, and Wi-Fi.

4 groups · 13 labs · medal: Bridge builder

Switching, STP & link aggregation

How switches learn, avoid loops and bundle links.

  1. 01 Switching: how a switch learns where everyone is A switching lab: watch a switch learn MACs, then overfill its table until it floods. Free
  2. 02 Spanning tree: a loop on purpose, and the protocol that breaks it Build a loop of three switches and watch spanning tree block one port. Pro
  3. 03 Rapid Spanning Tree: the blocked port takes over in about a second Cut a cable in a looped network; the spare port takes over in a second. Pro
  4. 04 Link aggregation: two cables, one link Bond two cables into one link with LACP, then cut one mid-transfer. Pro

VLANs, trunks & multicast

Many networks on one switch, carried over trunks.

  1. 01 VLANs: many networks on one switch Split one switch into separate networks and route between them on a stick. Pro
  2. 02 VLANs across switches: trunks Carry several VLANs between two switches on one trunk, voice VLAN included. Pro
  3. 03 Multicast: one stream, only to those who asked Send one stream to a group and see only the members that joined receive it. Pro

IPv6

The next IP: self-built addresses and running beside IPv4.

  1. 01 IPv6 basics: addresses that build themselves IPv6 explained: a card builds its own addresses and finds neighbours without ARP. Pro
  2. 02 IPv6 dual stack: IPv6 beside IPv4 Run IPv6 beside IPv4, and see why blocking ICMPv6 breaks it. Pro
  3. 03 IPv6 addressing: address kinds, anycast and DHCPv6 Meet every kind of IPv6 address and where each one comes from. Pro
  4. 04 Beyond IPv6 basics: NAT64, DNS64 and anycast Reach an IPv4-only server from an IPv6-only laptop, then share one address by anycast. Pro

Wi-Fi

How Wi-Fi joins a network, and how it is secured.

  1. 01 Wi-Fi: joining a wireless network Find an access point, join it with a passphrase, and get an address. Pro
  2. 02 Wi-Fi security: WPA2, WPA3 and the evil twin Set up WPA2 and WPA3 over real radios, and spot an evil twin. Pro
04

Internetwork

Joining networks into one: NAT, routing protocols, and BGP and its policy between providers.

3 groups · 8 labs · medal: Network engineer

NAT: port forwards, static, pools & traversal

Many devices behind one address, and getting back in.

  1. 01 A home router: NAT, one port forward, and the firewall Hide a house behind NAT, then open exactly one service with port forwarding. Free
  2. 02 Static NAT, address pools and overload NAT explained on a Linux router: static for a server, then a pool, then overload. Pro
  3. 03 NAT traversal: two devices behind NAT, talking directly Punch a UDP hole between two NATed peers, and see where it fails. Pro

RIP & OSPF

Routers that find their own routes.

  1. 01 RIP: routing by rumour Route by hop count with RIP and watch a loop count to infinity. Pro
  2. 02 OSPF: routers that find their own routes Let routers map the network themselves and reroute when one fails. Pro
  3. 03 OSPF network types, DR election and LSAs Elect a DR on a shared segment, split areas and read the LSA types. Pro

BGP: the internet's routing

Routes between networks run by different organisations.

  1. 01 BGP: how the networks of the internet find each other Join autonomous systems with BGP, steer traffic by prepending and survive a cut. Pro
  2. 02 BGP policy: local preference, MED, communities and RPKI Steer BGP with local-pref, MED and communities, then stop a leak and a hijack. Pro
05

Under Load

Keeping a network fast and watched: TCP tuning, QoS, MTU and load balancing, what is plugged in where, management and counters, flows, logs and config backups.

3 groups · 11 labs · medal: On call

TCP performance, QoS, MTU & load balancing

Making connections fast and sharing a busy line.

  1. 01 TCP performance: bandwidth, delay, the window and loss Measure bandwidth and delay with iperf3, and watch the TCP window size react to loss. Free
  2. 02 Quality of service: a call and a backup on one slow line Keep a call clear beside a backup on one slow line with marking and shaping. Pro
  3. 03 MTU and fragmentation: when a packet is too big for the next link Send packets too big for the path and fix the downloads that hang. Pro
  4. 04 Load balancing: one address, many servers Put three servers behind one address, then crash one and drain another. Pro

Management & monitoring: LLDP, out of band, errors & SNMP

What each cable leads to, broken devices and counters.

  1. 01 LLDP and CDP: what is plugged in where Read what each device announces about itself on every cable. Pro
  2. 02 Out-of-band management: a way in that does not depend on the network Lock yourself out with one wrong command, then get back in another way. Pro
  3. 03 Interface errors: reading the counters Read an interface's counters to find drops, giants, bad frames and flaps. Pro
  4. 04 SNMP: asking devices how they are Poll devices with SNMP, turn counters into rates and secure it with SNMPv3. Pro

Syslog, config backups & NetFlow

Logs, config backups and traffic flows in one place.

  1. 01 Central syslog: every device's log in one place Send every device's log to one syslog server, then take that server down. Pro
  2. 02 Router config backups: TFTP, SCP and a restore Save a router's config, back it up over TFTP and SCP, and restore it. Pro
  3. 03 NetFlow: who talks to whom Export flows from a router and find the top talkers and a scan. Pro
07

The Fabric

How data centres and clouds build networks out of software: containers, VPCs, VRFs, labels and overlays.

2 groups · 5 labs · medal: Fabric weaver

Containers & cloud

Containers on one host, then a cloud provider's network in miniature.

  1. 01 Container networking: namespaces, veth and a bridge Wire two containers with namespaces, veth and a bridge, then NAT them out. Free
  2. 02 A cloud VPC in miniature A cloud VPC explained in miniature: public and private subnets, gateways, security groups. Pro

VRF, MPLS & VXLAN

Labels, virtual routers and networks over a fabric.

  1. 01 VRF-lite: one router, two customers who must never meet Give two customers with the same addresses their own routing table on one router. Pro
  2. 02 MPLS: forwarding by label Forward packets by label instead of address, from push to pop. Pro
  3. 03 VXLAN: one tenant network across a routed fabric Stretch one tenant subnet across racks of a routed fabric with VXLAN. Pro
08

Night Watch

Detecting an attack, hardening a host, and reading and responding to what happened.

3 groups · 7 labs · medal: Blue team

IDS/IPS, honeypots & sinkholes

Spotting attacks with decoys, sinkholes and signatures.

  1. 01 A honeypot: the host nobody should touch Set out a decoy nobody should touch, and catch a scan that does. Free
  2. 02 DNS sinkhole: blocking bad domains for every client at once Block a bad domain for every client at once and find the infected host. Pro
  3. 03 IDS and IPS: Suricata watching, then blocking Detect an attack with Suricata on a copy of traffic, then block it inline. Pro

Harden & audit: vulnerability scanning, baselines & file integrity

Scan a host, fix what is found and catch tampering.

  1. 01 Vulnerability management: scan, assess, remediate, rescan Scan a host against a baseline, fix the findings and catch a tampered file. Pro

Forensics, incident response & log correlation

Reading what happened and responding by the runbook.

  1. 01 Packet forensics: reading an incident from a capture file Pcap analysis of an incident: work out what happened from one saved capture. Pro
  2. 02 Log correlation: one event, many logs, a rule that joins them Join logs from several devices into alerts with rules, like a small SIEM. Pro
  3. 03 Incident response: working a live compromise by the runbook Find and clean up a live compromise step by step, following the runbook. Pro
09

Red Team

Network attacks, run to learn how a network falls: mapping it, getting in, standing in the middle, abusing DHCP, and flooding it off the air.

4 groups · 11 labs · medal: Intruder

Recon, brute force & exfiltration

How attackers map a network and find a way in.

  1. 01 Reconnaissance: mapping a network before you touch it Do network reconnaissance: find which hosts are up and which services they run. Free
  2. 02 A weak password, guessed See how fast a guessable password falls, and how loud it is in the log. Pro
  3. 03 DNS exfiltration: smuggling data out through the one port left open See how data leaks out through DNS queries, and how to stop it. Pro

MITM: ARP, DNS & public Wi-Fi

Standing between a device and the network, and the defence.

  1. 01 ARP spoofing: the machine in the middle Poison ARP caches to sit in the middle; read HTTP; watch HTTPS shut it out. Pro
  2. 02 How DNS works, and how a lie in DNS hijacks you See how a lie in DNS redirects you, and how HTTPS catches it. Pro
  3. 03 Hotel Wi-Fi: who is on your path Someone is on your path on a hotel network: HTTP read and rewritten, HTTPS warns. Pro

DHCP attacks: rogue servers & starvation

Abusing DHCP, and the switch features that stop it.

  1. 01 Rogue DHCP: the server nobody checked Watch a rogue DHCP server hand out a false gateway, then shut it out. Pro
  2. 02 DHCP starvation: every address taken Watch a pool of addresses get drained, then stop it at the switch. Pro
  3. 03 Layer 2 security: the switch says no Turn on DHCP snooping, ARP inspection and port security on an access switch. Pro

Denial of service: floods, reflection & spoofing

Floods that knock servers over, and what stops them.

  1. 01 SYN flood: half-open connections and how a server resists Watch half-open connections pile up and see how SYN cookies keep a server alive. Pro
  2. 02 DNS amplification: a small lie, a large flood See how open resolvers become a flood, and how closing them stops it. Pro
10

The Architect

Running the network from programs, then designing whole networks from a brief: segmentation, NAT and DMZ, redundancy and failover.

3 groups · 3 labs · 4 designs · medal: Toolsmith

Automation: REST APIs, Ansible & SDN

Running the network from code and controllers.

  1. 01 A REST API that changes the network Change the network through a controller's REST API with curl and JSON. Pro
  2. 02 Network automation: Ansible pushes the config Push router config from code with Ansible, then catch and undo drift. Pro
  3. 03 SDN: one controller programs every switch Let one OpenFlow controller program every switch, then take it away. Pro

Design: segmentation, NAT & DMZ

Design an office's networks, NAT and DMZ from a brief.

  1. 01 Small office Design
  2. 02 Web hosting Design

Design: redundancy & failover

Design networks that keep working through a failure.

  1. 01 Busy site Design
  2. 02 Two lines Design
11

Who Goes There

Proving who someone is: AAA, port login, central accounts, tickets, single sign-on, second factors and zero trust.

2 groups · 7 labs · medal: Gatekeeper

AAA, 802.1X & LDAP

Logging in to routers, ports and servers centrally.

  1. 01 AAA with RADIUS: who logs in to the router, what they may do, and a log of it Router AAA: RADIUS decides who logs in, what they may run, and records it. Pro
  2. 02 802.1X and RADIUS: logging in to a switch port Unlock a switch port by logging in with 802.1X against RADIUS. Pro
  3. 03 LDAP: one directory for every login Use one LDAP login on every server, and remove it in one place. Pro

Kerberos, SSO, MFA & zero trust

Tickets, single sign-on, second factors and zero trust.

  1. 01 Kerberos: one login, tickets for everything Get a Kerberos ticket once, then log in to services with no password. Pro
  2. 02 Two-factor SSH with a one-time code Add SSH 2FA: a one-time code as well as the password for every login. Pro
  3. 03 Single sign-on: one login, many services Sign in once with OpenID Connect and SAML, and see how the portal trusts it. Pro
  4. 04 Zero trust with mutual TLS Let only devices with a valid client certificate reach each service. Pro

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Start free