Lab · Cyber Security: from zero to SOC analyst
Lab: reading a clinic's network
The brief
A small clinic in Indore has one office network. You write Python helpers that every security analyst uses: how many devices fit in a network, whether an address is inside it, what kind of address a log line shows, and which open ports leak data in clear text. Then you find your own computer's address.
Why it matters
Alerts and logs are full of IP addresses and port numbers. An analyst must decide in seconds whether an address is the office, a home router, or the internet, and whether a service sends passwords unencrypted. Firewall rules, VPN checks and SIEM filters all use the same CIDR maths.
Skills you practise
- IPv4 and CIDR
- the ipaddress module
- private, public and loopback addresses
- cleartext and encrypted protocols
- ipconfig and ip addr
You need
- Your own Windows, Linux or macOS computer for the last step
What you will have at the end
network.py with four tested helpers, plus your own computer's address and network written in CIDR form.
How it is marked (rubric, 100 points)
| Correct helpersAll four functions pass, including the /26 edge case and loopback before private. | 50 |
|---|---|
| Security judgementYou can say why FTP, Telnet and HTTP are risky and what replaces each. | 25 |
| Own network understoodYour pasted output shows a private address and you wrote its network in CIDR form. | 15 |
| Readable codeHelpers reuse each other (label_ip uses in_network) and names are clear. | 10 |
0/5 steps done
Step 1 of 5
How many devices fit
usable_hosts(cidr) returns the number of addresses a device can use in that network.
A network written as 192.168.10.0/24 has 256 addresses. The first is the network address and the last is the broadcast address, so devices can use 254. ipaddress.ip_network(cidr).num_addresses gives the total; take away 2.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.