Containerlab Packet Capture: Save show Output and a pcap
Built in my home lab: one script pulls show output from an IOL console, captures a ping in the client's network namespace, redacts management IPs, then cleans up.
GUIDES MEET PRACTICE
Learn networking. Put it into practice.
Clear networking guides and 68 CCNA browser labs. Learn the concepts, practice IOS-style commands, and check your work as you go.
One lab free. No account, installation, or hardware needed.
A browser simulation of selected IOS behavior. It does not run an IOS image.
EXPLORE THE LIBRARY
Go deeper by topic
01Fundamentals
Models, addresses, and the basics that connect everything.
↗ 02Switching & VLANsBuild and troubleshoot Layer 2 networks.
↗ 03RoutingUnderstand forwarding decisions and paths.
↗ 04Security & accessExplore controls, authentication, and firewalls.
↗ 05WirelessFrom WLAN fundamentals to controller operations.
↗ 06Linux & toolsDiagnose and verify from the command line.
↗FREE FIELD REFERENCES
Four field references. Free to keep.
A free PingLabz account unlocks the Linux, ASA, BGP, and OSPF PDFs. Choose the guide you need and keep it close while you practice.
Linux commandsCisco ASABGPOSPF
GO FURTHER WITH PRO
A whole network to practice in.
Pro unlocks 60 build labs, six troubleshooting labs, and the campus Mega Lab. Follow guided exercises, try IOS-style commands, and check your configuration as you go.
SELECTED READING
Useful places to begin
Keep learning
Latest guides
FMC Home Lab RAM: What Ran Beside a 32 GB FMCv on One Host
Built in my home lab: FMCv held 32 GiB of a 63 GiB host. IOL, IOSv-L2, ASAv and one-FTDv labs ran beside it; a dual-FTDv boot left FMC unhealthy for 183 s.
IOL vs IOSv in Containerlab: Which Image Passed Each Lab Test
Built in my home lab: twelve Containerlab tests decide IOL, IOL-L2 or IOSv-L2. IOSv-L2 won dynamic DHCP snooping and 802.1X; IOL-L2 won IPSG, RA Guard and SPAN.
Syslog Timestamps Out of Order: ASA Timezone vs IOS XE Logs
Built in my home lab: one ICMP packet, an IOS XE permit and an ASA deny. A legacy ASA timestamp with no timezone flipped the order; UTC and rfc5424 fixed it.
Zeek Rogue DHCP and ARP Spoofing Detection: Why SPAN Matters
Built in my home lab: a 51-line Zeek script flags rogue DHCP and gateway ARP spoofing, but only after SPAN sends it the unicast attack frames.
Suricata Inline IPS with NFQUEUE Between Cisco IOL Routers
Built in my home lab: Suricata on NFQUEUE between two Cisco IOL routers drops one test datagram, and pcaps, EVE and the NFQ verdict count prove it.
Zeek Across ASA PAT: Match Inside and Outside conn.log Flows
Built in my home lab: two Zeek sensors either side of an ASA, six HTTP flows matched through show xlate, and an ASA clock skew that broke a time-window join.
FreeRADIUS Filter-Id Lab: Per-User ACLs on a Cisco Switch
Built in my home lab: FreeRADIUS returns Filter-Id, IOSv-L2 binds a local ACL to one 802.1X session, and a missing attribute quietly gives full access.
BPDU Guard Lab: Catch a Rogue Bridge on an Access Port
Built in my home lab: a Linux bridge sends BPDUs, BPDU Guard err-disables the Cisco access port, and shutdown/no shutdown restores it. Storm control stays untested.
FlexVPN Spoke Has No Routes? 6 IKEv2 Authorization Faults
Six FlexVPN authorization faults, built in my home lab on Cisco IOL 17.18.2. Missing hub references stopped establishment; other faults kept READY SAs while losing routes. Real outputs separate received prefixes, installed routes and host forwarding.
GRE over IPsec MTU Black Hole: MSS 1360 vs a 1400-Byte Path
Small pings and HTTP passed, but three 2 MiB downloads stalled in a deliberate GRE/IPsec PMTUD fault. A DF sweep found a 1302-byte inner limit. Measured captures explain why MSS 1360 failed and what MTU 1302 plus MSS 1262 repaired.
Adding a Subnet to IPsec: Crypto Map ACL vs SVTI Route
Adding a subnet to an IPsec VPN on the same IOL routers took mirrored crypto ACL edits and a second ESP pair with a crypto map, but one OSPF line with SVTI. Follow both changes, the failed transform-fault attempt, the destination typo, and verified GCM recovery.