J

3x CCIE (R&S, Wireless, Security). Went from running networks to leading the people who do. Still learning daily. Dad of two, gravel rider, always mid-book.

[J @CCIE4K]

Step one of a scan isn't ports. It's "who's even here."

nmap -sn 10.10.10.0/24

On a local subnet that's an ARP sweep, no TCP at all. 6 live hosts in under 2 seconds.

And the MAC OUI already gives them away: AA:BB:CC is Cisco gear, 52:54:00 is a Linux VM. You're profiling the network before you touch a single port.

[J @CCIE4K]

I built an attacker-vs-network lab in Cisco Modeling Labs to learn nmap the right way.

A scanner. A server farm. Real Cisco routers and a switch. An ASA firewall with a DMZ behind it. 13 nodes.

Over this series I scan all of it and post every result. Real output from real gear, nothing faked.

Here's the topology.

[J @CCIE4K]

B, 62. think of /26 as a street with 64 houses on it. two of them aren't livable, one's the street sign (network address) and one's the mailbox everyone shares (broadcast). so 64 minus 2 leaves 62 you can actually put a device on. the .130 is just telling you which street, doesn't change the house count

[J @CCIE4K]

@jpschroeder if it's running 24/7 unlimited, yes.

[J @CCIE4K]

@PrashantByte09 Ext4 - just works and simple

[J @CCIE4K]

@techyoutbe What is the first prompt you’re running?

[J @CCIE4K]

@AnthropicAI Midnight?

[J @CCIE4K]

@AnthropicAI @claudeai been watching this one closely since half my work touches the cyber side. good to see it landing somewhere

[J @CCIE4K]

@Hamzaonchain wireshark tcpdump kismet for me. how's zeek treating you if you've run it? i keep hearing zeek for monitoring but haven't sat down with

[J @CCIE4K]

@CyberRacheal B, ipsec. network layer is the giveaway. ssh and s/mime both encrypt but they sit up at the application layer, and pop3 is just pulling mail down. ipsec is the one operating on the packet itself

[J @CCIE4K]

@BowTiedCyber B. ssh. https would encrypt a session too but the cli requirement rules it out, that's a web protocol. telnet and tftp are both cleartext so they're gone

[J @CCIE4K]

@TutaPrivacy good list. the one people miss is a layer down. you can run all of this and still leak every site you visit in plaintext dns to your isp. encrypted dns or doh is the unglamorous piece that makes the rest of it actually hold

[J @CCIE4K]

@dkare1009 nice diagram. worth naming what the nat table is actually showing here, three hosts sharing one public ip and staying separate by port. that's PAT, or nat overload on cisco gear. it's why a whole house runs off a single isp address

[J @CCIE4K]

@Computerlearn_ clean breakdown. drop a third-party sfp in a cisco switch though and it'll reject it until you allow unsupported transceivers. fits fine, switch just won't light it

[J @CCIE4K]

@ip_cisco @AnjeloAnzo solid sheet. the one thing i'd tell anyone labbing port-security: add switchport port-security mac-address sticky or it learns nothing persistent, and know your violation mode. shutdown err-disables the port and people panic thinking they broke it

[J @CCIE4K]

"Networking is dying, it's all cloud now."

Cool. Who do you think builds the VPC peering, the transit gateways, and the BGP between your DC and three cloud regions?

The network didn't die. It moved and got harder.

[J @CCIE4K]

Two commands that explain 90% of "the trunk isn't passing VLANs":

show interfaces trunk

Check "Vlans allowed and active" + "in spanning tree forwarding." A VLAN allowed on the trunk but pruned or STP-blocked won't pass traffic, and this output tells you which.

[J @CCIE4K]

Prompt-to-config is coming and honestly it's fine.

The skill that just went UP in value: reading a config you didn't write and spotting what's about to break.

AI writes. You verify. The verifier is the one who gets paid, because they're the one who understands what the words actually do.

[J @CCIE4K]

GRE vs IPsec, and why you usually want both:

GRE: tunnels anything (multicast, routing protocols), zero encryption.

IPsec: encrypts, but won't carry multicast/routing on its own.

So the classic combo is GRE-over-IPsec: GRE carries OSPF/EIGRP, IPsec wraps it in crypto. Two tools, one secure tunnel.

[J @CCIE4K]

"Default gateway" demystified:

It's the address your device sends a packet to when the destination ISN'T on its own network.

Same subnet? Talk directly. Different subnet? "I don't know the way, gateway, you handle it." The router then figures out the next hop.

No gateway = you can talk to your neighbors and no one else.