Run a Real Network with AI

1Ground rules and the lay of the land 10m

Your facilitator walks the room, names each piece of equipment, and reads the ground rules. Follow along on the tables above. When you can point at the switch and say what it does, you're ready.

2Meet the gear 5m

Get up. Look at the actual hardware. Find the gateway, the switch, and both access points. Notice which device connects to which. You'll be configuring this in forty minutes; it helps to have seen it.

3Build your Network Lab Tutor Bot 15m

This is the assistant you'll use for the rest of the day. It knows this network — the real addresses, the real device names — which is what makes it useful when you're standing at the switch trying to remember which VLAN the cameras are on.

1Why segment a network at all? 15m

A flat network is one where every device can talk to every other device. Convenient and dangerous: when the guest wifi can reach the accounting computer, one compromised visitor laptop is a company-wide problem. Segmentation — VLANs — is how you build walls inside one physical network. Marrowfield needs four segments: staff, guest, cameras, phones. Why those four? Discuss before you design.

2Design the scheme with AI 20m

Ask your tutor bot to help you design it:

Now critique what it gives you. Beginners accept AI output because it sounds correct. Don't. Run its answer against this checklist:

• A distinct VLAN number for each of the four groups?
• A non-overlapping subnet for each? (Two networks with the same subnet is a broken network.)
• Did it explain why cameras and guests especially need walling off?
• Did it keep the management network separate from all of them?
• Is anything it said contradicted by the real lab table above? The real table wins.

Write down anything the AI got wrong or vague. That list is useful all day.

3Rotation stations 40m · ~20m each

Station A — Read it in the UniFi console

The station laptop is already signed into LC-Gateway's console — you don't need to log in, just drive it. Work through these in order; it's fine to do this as a group with one person clicking:

1. Click Settings (the gear icon), then Networks. You'll see the four VLANs. Click Guest. Write down: what VLAN ID? what subnet? Does it match what you designed?
2. Go to Settings → Security → Firewall Rules. Find the rule named Block Guest to Staff and click it.
3. In plain English, what does that rule do? Ask your tutor bot if you're unsure: "On LC-Gateway, what does a firewall rule blocking the Guest network from the Staff network actually protect against?"

Look, don't change. This is the live lab — read the settings, don't edit them. If something looks wrong, that's a great thing to raise, not to fix.

Station B — Build it on the command line

LC-EdgeRouter is a different world: no pretty console, just a command line. First, get to one — two ways, pick whichever works:

Once you have a command line either way, ask your tutor bot to translate the same guest-isolation rule into EdgeOS:

Station C — Compare

The UniFi rule and the EdgeOS commands do the same thing. Why is one so much easier? What does the easy one hide from you that the hard one makes you see?

1Turn on the lights and make some traffic 15m

Intrusion detection is already running on LC-Gateway: Settings → CyberSecure → Threat Management. It watches every packet crossing the network and flags anything matching a known attack signature — 26,656 of them, updated daily. Now feed it: connect your phone to NonprofitGuest and browse a few sites. Watch yourself appear in the client list — on the guest VLAN, exactly where the Phase 1 firewall rule keeps you walled off from staff.

2Read the real alerts 20m

Open the Threats view. Events are grouped into categories:

• Botnets and Threat Intelligence
• Viruses, Malware and Spyware
• Hacking and Exploits
• Peer to Peer and Dark Web
• Attacks and Reconnaissance ← the one to watch today
• Protocol Vulnerabilities

Your facilitator generates a port scan from a lab machine. Watch Attacks and Reconnaissance light up in near real-time — that's an attacker "looking around." But notice the noise too: some alerts are just ICMP (someone's device pinging something). That's not an attack; that's normal traffic matching a broad signature. Telling them apart is the job.

3Analyze the traffic yourself 20m

The gateway tells you that something happened. A packet capture shows exactly what. Here's how to open one:

1. In your browser, go to apackets.com (your facilitator confirms the exact tool on the board — no account, no install).
2. Download the two capture files your facilitator shares, then drag them onto the page — or click Upload and pick them:
   • staff-normal.pcap — a few minutes of ordinary staff-VLAN activity
   • portscan.pcap — the scan that fired the alert
3. The page shows every packet as a row. Don't panic at the volume — you're looking for two specific things below.

In the normal capture, find a DNS query — a device asking "what's the address for this website?" — in plain readable text. That legibility is the point: unencrypted traffic hides nothing. In the scan capture, notice the pattern: one machine hammering many ports on another in seconds. That shape is the attack signature.

4Build a triage flow 20m

Real teams don't read every alert by hand — they build automation that sorts them. You'll build that sorter in Zapier or Make (from Workshop 3). Don't start from a blank page — build this exact flow first, then improve it.

Step 1 — make a fake alert feed. Create a Google Sheet called Alerts with columns time, source, category. Paste these rows so you have something to sort:

Step 2 — build the sorter. In Zapier (Make is the same idea):

1. Trigger: Google Sheets → New Spreadsheet Row → your Alerts sheet.
2. Add Paths (Zapier) or a Router (Make) — this is the fork in the road.
3. Path A — Urgent. Condition: category contains Scan, Recon, or Exploit. Action: send yourself an email — "URGENT: [category] from [source] at [time]".
4. Path B — Just log it. Everything else (the ICMP rows). Action: add a row to a second sheet called Reviewed. No email.

Step 3 — test and improve. Run it. Two rows should email you (the Recon and the Exploit); two should just get logged (the ICMPs). If that works, you've built the core of what a security operations analyst does all day. Now make it smarter — ask your tutor bot:

1Authorization: the line you do not cross 15m

Everything in this phase is legal because of where you do it and whose permission you have. Remove either and the same keystrokes become a federal crime.

What makes security testing legal:

1. Written permission from the owner, in advance. Not implied — written, specific, signed.
2. A defined scope. The permission names exactly which systems, addresses, and techniques are allowed. Anything outside it is off-limits.
3. A sandbox for practice. When you don't have a real authorized target — most of the time while learning — you practice in an environment built to be attacked, like picoCTF.

The same command, two contexts: a port scan against a network you've been hired and scoped to test is a Tuesday. The identical scan against your neighbor's wifi, or a company you're "just curious" about, is a crime under the Computer Fraud and Abuse Act — whether or not you break anything. Intent doesn't save you. Ownership and written scope do.

2OSINT: what a network leaks about itself 25m

Before an attacker touches a network, they read everything the organization has published about itself. This is open-source intelligence — OSINT — and it's legal, because it's all public. It's also where most real attacks begin.

Your facilitator hands out the public footprint of Marrowfield Community Trust — the same nonprofit whose network you built this morning. A team page, a job posting, a conference talk, a press release, a Facebook post. All public. Nothing "hacked." Your job: figure out what an attacker learns. What technology are they running? Who's the easiest person to target? Where's the way in?

Then use your browser agent on the real technologies the packet names — not on the organization:

Hold the line: researching a product is normal professional work. Researching a specific organization you intend to attack is the part we don't do. Then turn it around — the point of the exercise: go back through the five items and ask, did Marrowfield actually need this public? Most of it was reasonable. The failure wasn't publishing; it was the operational details that rode along. Security literacy is knowing which sentence to cut.

3picoCTF + the Kali box — practice on targets built to be attacked 25m · rotation

picoCTF is the browser track. picoCTF is Carnegie Mellon's free security-training platform; every challenge is designed to be broken. It runs in your browser. Log in (you made your account before today), then click Practice in the top menu to reach picoGym. Use the search box to find each challenge by name, click it, and read the instructions — most give you a file to download or a "launch" button. Work these beginner challenges:

• "Packet Primer" (Forensics) — reading a packet capture, exactly what you did in Phase 2
• "Wireshark doo dooo do doo…" (Forensics) — finding a hidden detail inside network traffic
• "Obedient Cat" (General Skills) — a gentle warm-up if those feel steep

Use your tutor bot as a hint engine — ask it to guide, not hand you the flag:

4The rogue AP demo 15m

Watch — this is a demonstration, not hands-on. Your facilitator broadcasts a wireless network using the same name as the lab's staff SSID — a classic "evil twin." Then you watch LC-Gateway detect it and flag it as a rogue access point. An evil twin tricks devices into connecting to the attacker instead of the real network; the defense is exactly what you're watching. Note what this is not: nobody is knocked offline, no device is jammed, no traffic intercepted. Detection, not disruption.

1Brief 10m

The room divides into Blue (defenders) and Red (probers). Your facilitator sets scope — which addresses are in play — before anyone starts.

2Live round 40m · concurrent

3Incident report 20m

Both teams together draft an incident report with AI's help. Feed your logs to your tutor bot:

Then check what the AI wrote against your actual logs. Did it invent a detail? Overstate severity? Miss something you noted? Correcting the draft is the skill — a report with a fabricated fact is worse than no report.

1Build the handoff document 25m

In your teams, produce one page for Marrowfield Community Trust. Use the Handoff template as your structure: what we set up (the segmentation, in plain language), what we found (the OSINT exposure, the detectable activity), what we recommend (concrete, prioritized, jargon-free). Draft it with your tutor bot, then edit hard. The director reading this doesn't know what a VLAN is — make the recommendation land anyway.

2Share-out and close 20m

Each team reads its top recommendation to the room. Your facilitator closes the loop: what you did today, and what the rung above help desk actually looks like from here.