dnsrecon rolls zone transfers, SRV enumeration, subdomain brute forcing, and reverse lookups into one Python tool. Every command here was run from Kali against a real BIND9 server, with XML, CSV, and JSON export covered.
A worked example of every IPv6 address type you will actually meet, broken down field by field. Learn to read the first hextet and instantly know if you are looking at link-local, global unicast, multicast, or unique-local.
A working HSRP config is two lines per router, but priority, preemption, tracking, and timers decide how it behaves in production. Walk the full setup on Cisco IOS XE, from the virtual IP to the four settings people skip.
Dual-stack, tunneling, and translation each solve a different IPv6 migration problem. This decision guide shows you which mechanism fits which situation and how the three fit together on real networks.
How NAT64 lets an IPv6-only client reach an IPv4-only server: the full stateful configuration on Cisco IOS XE 17.18, the address synthesis math done by hand, the DNS64 half that makes it usable, and an honest platform finding from the lab.
Configure a manual IPv6-over-IPv4 tunnel on Cisco IOS XE 17.18, prove it with a real ping across an IPv4-only core, and compare the three tunnel types you need to know: manual, GRE, and 6to4.
IS-IS runs a single topology by default, forcing IPv6 down the IPv4 shortest path even where IPv6 is broken. See how multi-topology IS-IS fixes the black hole, with real adjacency output on Cisco IOS XE 17.18.
EIGRP for IPv6 is a separate protocol instance with no network statement and link-local next hops. You walk the classic interface-based config on IOS XE 17.18, see real adjacencies and routes, and clear up the shutdown gotcha.
The default Layer 2 posture is wide open. This checklist ties every switch-hardening control to the specific attack it stops, with live CML proof where possible: 8 spoofed ARPs dropped, an intra-VLAN ping killed, and more.
Private VLANs isolate hosts that share a subnet, at Layer 2, without a subnet per host. Primary, isolated, and community secondary VLANs on Cisco IOS XE, with the classic DMZ use case and real show output.
A router ACL only sees routed traffic, so it can never filter two hosts in the same VLAN. A VACL can. Real CML before/after: intra-VLAN ping goes 0% to 100% loss while the gateway ping still works.
DAI needs DHCP snooping bindings to validate ARP. On a static-IP segment there are none, so you supply the legitimate IP-to-MAC pairs with a static ARP ACL. Proven in CML: 8 spoofed ARPs dropped.