Practice Network Segmentation with VLANs by producing and reviewing portable evidence without requiring unavailable host, cloud, hardware, or multi-node access.
Briefing
### Scenario
You are a vlan practitioner handling a realistic client engagement. For Network Segmentation with VLANs, the client has provided a staging environment that mirrors production but is isolated to this lab. Your task is to demonstrate the core technique on the local target without touching external systems. The scenario is intentionally scoped to what you can verify inside the container.
### Environment and scope
Use the Ubuntu 22.04 practice container. Working directory is `/home/student/lab-work` (create it with `mkdir -p`). Target is `127.0.0.1` and `127.0.0.1:8080` where a `python3 -m http.server` or service-specific daemon runs. Install only needed tools via `sudo apt-get update && sudo apt-get install -y vlan, iproute2, bridge-utils` then verify with `ip link add link eth0 name eth0.10 type vlan id 10 2>&1 | head`. Credentials: `student:lab123` with `sudo` (created via `useradd` + `chpasswd` + `sudoers.d` as in `labs.service.ts:554`). Do not scan or query outside 127.0.0.0/8 or lab-work. Scope is strictly container-only; no external cloud, hardware, or nested container engines.
### Mission objective
For Network Segmentation with VLANs: install and verify tooling, prepare the local target (`vlan interfaces on lo/eth0`), execute the technique step-by-step, and collect evidence. Each walkthrough step produces a verifiable artifact (file, command output, or service state) that you will cite in your submission.
### Success criteria
You have completed the lab when:
- Tooling verification passes (`ip link add link eth0 name eth0.10 type vlan id 10 2>&1 | head` returns expected version without error)
- Local target is running and responds (`curl -s http://127.0.0.1:8080/` or `dig @127.0.0.1` or `tshark -r` shows expected output)
- `solution.md` in `lab-work` documents each step's exact command, raw output excerpt, and your interpretation (what the output proves)
- All flag answers are direct values from your local output (e.g., version string, status code, IP, header name) and no external hosts were targeted (`history | grep -E "nmap|dig|tshark|openssl|nikto|curl"` shows only 127.0.0.1)
Runtime mode: portable artifact validation
