GUIDES MEET PRACTICE
Clear networking guides and 68 CCNA browser labs. Learn the concepts, practice IOS-style commands, and check your work as you go.
One lab free. No account, installation, or hardware needed.
A browser simulation of selected IOS behavior. It does not run an IOS image.
EXPLORE THE LIBRARY
Models, addresses, and the basics that connect everything.
↗ 02Switching & VLANsBuild and troubleshoot Layer 2 networks.
↗ 03RoutingUnderstand forwarding decisions and paths.
↗ 04Security & accessExplore controls, authentication, and firewalls.
↗ 05WirelessFrom WLAN fundamentals to controller operations.
↗ 06Linux & toolsDiagnose and verify from the command line.
↗FREE FIELD REFERENCES
A free PingLabz account unlocks the Linux, ASA, BGP, and OSPF PDFs. Choose the guide you need and keep it close while you practice.
GO FURTHER WITH PRO
Pro unlocks 60 build labs, six troubleshooting labs, and the campus Mega Lab, with ad-free browsing on PingLabz. Follow guided exercises, try IOS-style commands, and check your configuration as you go.
SELECTED READING
Keep learning
After an SNMPv3 migration, one leftover community still gave snmp-check the IOS version and every interface over v2c and v1. Removing it produced a timeout; SNMPv3 kept answering.
A matching AES-256/SHA-256/DH14 proposal got a Main Mode handshake. A wrong DH group, a wrong hash and the right suite from an address with no PSK all got NO-PROPOSAL-CHOSEN, and only debug crypto isakmp told them apart.
sslscan found an IOS XE WebUI accepting only TLS 1.0 with AES-CBC-SHA. Two ip http commands left TLS 1.2/1.3 with five ECDHE suites, compared with sslyze and nmap.
2,000 HTTP requests replayed into Suricata: 2,000 of 2,000 alerts up to 40,000 pps. At --topspeed, tcpreplay said 24,308 successful and Suricata said 0.00% drops, yet only 22,650 packets arrived and 1,605 alerts fired. Commands, output and the fix.
Two hosts on 192.0.2.20. On an access port arpwatch logged nothing while the requester cached the impostor 5 of 6 times. On a SPAN port the same 6 lookups produced 9 flip flop reports. Install, service setup, every report message, and exact errors.
fping -g sweeps a /24 in seconds. Through a 64 kbps ICMP policer, its 10 ms default interval reported 20% to 40% loss on 13 of 21 healthy hosts while the router counted 203 drops. At -i 20: 0% loss, 0 drops. Commands, output and the math.
Through a 200 kbps policer, masscan at --rate 300 found all 64 open ports and at --rate 1000 only 21, because masscan never resends a dropped SYN. nmap -T4 found all 64 in 16 seconds. Commands, output and how to size the rate to the path.
One SYN, four answers: SYN-ACK, RST, ICMP 3/13 from the router, or nothing. I ran hping3 against an IOS XE ACL, found the deny with the router's own unreachables and counters, and hit IOS's 500 ms rate limit: 20 probes, 4 answers.
1% loss dropped 145 segments of a 20 MB download. Wireshark at the client flagged 144 gaps, a capture upstream of the drop counted exactly 145 retransmissions, and the download went from 0.53 s to 26.04 s. Capture, filter and read it step by step.
A least-privilege automation user created 24 hosts through the Checkmk Community 2.5.0p18 REST API; official MCP is not in this edition. Interface 3, the provider A link, went CRITICAL 38 seconds after a shutdown once SNMP helper timeouts were fixed.
With parents set, cutting branch 2 off both providers made the branch edge DOWN and its user UNREACHABLE. A provider A shutdown left every host UP and went HARD CRITICAL on a data-plane check 3 min 51 s later. Real object config and logs.
Cacti 1.2.31 graphed 15 Cisco IOS-XE devices over SNMPv3. A 13-minute provider A shutdown showed as status 2 on one interface graph while the loopback-polled router kept polling. Config, rrdtool checks, and how 5-minute polls blur the edges.