MMission Tech
Lecture tool Download scriptChecksum
Networking Zero to Hero | Lab 02

Switching,
Boom!

Build three open-source Linux switches inside one WSL2 Ubuntu environment. Prove Spanning Tree, VLAN trunks, MAC learning, failover and the exact moment Layer 2 stops being enough.

Start workshop Download lab script
EnvironmentWindows 11 + WSL2 Ubuntu
Time45 to 60 minutes
StackLinux bridge + kernel STP
CostFree and local
00

What you are building

One Ubuntu environment becomes a small campus fabric with three switches, two VLANs and three isolated hosts.

Three-switch triangle topologyCore, East and West Linux bridges connected in a triangle. Host A and Host B use VLAN 110. The application uses VLAN 120. mls1-corelowest priority | root mls1-eastEast rack mls1-westWest rack Host A | VLAN 110 Host B | VLAN 110 App | VLAN 120 protected path
Forwarding trunkSpanning Tree protected pathAccess port
PhysicalAre the links up?
STPWhich path may forward?
FDBWhere does the MAC live?
VLANIs the frame in the right LAN?
Important change from the first versionThis lab uses the Linux kernel Spanning Tree implementation. It removes the fragile mstpd and systemd dependency that made the earlier build difficult to diagnose. The lecture can still compare STP and RSTP, but the WSL lab first proves the core topology protection model reliably.
01

Prepare WSL2 Ubuntu

Download the script into your Linux home folder. Do not run it from /mnt/c.

Open Ubuntu

Open Windows Terminal and choose your Ubuntu profile. One terminal is enough. A second terminal is useful later for live observation.

Download the lab script

Use the download button at the top of this page, then copy the file into your WSL home directory.

Ubuntu terminal
cp /mnt/c/Users/YOUR-WINDOWS-USER/Downloads/mission-switching-lab-v2.sh ~/
cd ~
chmod +x mission-switching-lab-v2.sh
Replace the Windows usernameChange YOUR-WINDOWS-USER to the folder name shown under C:\Users. You can also drag the downloaded script into your Ubuntu home folder using File Explorer at \\wsl$\Ubuntu\home\YOUR-LINUX-USER.
I already have the script in Ubuntu
Run pwd. A path beginning with /home/ is correct. A path beginning with /mnt/c/ should be moved first.
02

Run preflight checks

Install the small open-source toolset, then prove WSL can create a Linux bridge before building anything.

Install tools

Ubuntu terminal
sudo ./mission-switching-lab-v2.sh install
What it does
Updates Ubuntu package metadata and installs iproute2, bridge tools, tcpdump, Python, curl, ping and process tools.
Success
The command ends with Packages installed.
If apt fails
Check that WSL has internet access, read the first apt error, then retry the same install command. Do not continue to doctor while packages are missing.

Run the doctor

Ubuntu terminal
sudo ./mission-switching-lab-v2.sh doctor
Expected
Every tool shows PASS, the script path begins with /home/, and Linux bridge creation passes.
Stop here when
The doctor reports a missing tool, a /mnt/ script path, or inability to create a bridge.
✓Checkpoint 1

Your environment is ready only when the final line says Environment ready.

Troubleshooting: script still runs from /mnt/c
Move and retry
cp ./mission-switching-lab-v2.sh ~/
cd ~
chmod +x mission-switching-lab-v2.sh
sudo ./mission-switching-lab-v2.sh doctor
Troubleshooting: permission denied
Fix execute permission
chmod +x mission-switching-lab-v2.sh
03

Build the switching fabric

The script creates three bridges, three trunks, three namespaces, VLAN access ports and a small HTTP application.

Build
sudo ./mission-switching-lab-v2.sh build

The build pauses briefly while Spanning Tree settles. It does not open a menu or take over your terminal.

Verify the baseline

Verify
sudo ./mission-switching-lab-v2.sh verify
PASS 1
Spanning Tree has a protected path.
PASS 2
Host A reaches Host B in VLAN 110.
PASS 3
Host A cannot reach the application in VLAN 120 without routing.
✓Checkpoint 2

Do not continue until all three baseline checks pass.

The build failed. Show me the clean recovery
Clean rebuild
sudo ./mission-switching-lab-v2.sh destroy
sudo ./mission-switching-lab-v2.sh doctor
sudo ./mission-switching-lab-v2.sh build
sudo ./mission-switching-lab-v2.sh verify
04

The Four Checks

Troubleshoot in order. Each check answers a different question, and no single check proves the whole network.

1. PhysicalAre links up and carrying frames?
2. STPWhich paths may forward?
3. FDBWhere was each source MAC learned?
4. VLANDoes the port carry the right VLAN?

Physical

Question: Are the lab links up?

Ubuntu | Physical
sudo ./mission-switching-lab-v2.sh physical
Good
The mls1 links are UP and counters can increase.
Failure
A required interface is DOWN or missing.

Spanning Tree

Question: Which healthy path is protected?

Ubuntu | STP
sudo ./mission-switching-lab-v2.sh stp
Good
mls1-core is root and one triangle port is blocking.
Failure
No protected path exists or an unexpected port is disabled.

Forwarding database

Question: Where did each switch learn the endpoint MAC?

Ubuntu | FDB
sudo ./mission-switching-lab-v2.sh fdb
Good
Dynamic MAC entries appear after traffic.
Failure
An expected source MAC is absent or learned on the wrong port.

VLAN

Question: Is VLAN 110 or 120 present with the right port behavior?

Ubuntu | VLAN
sudo ./mission-switching-lab-v2.sh vlan
Good
Access ports show PVID and untagged. Trunks carry VLAN 110 and 120 tagged.
Failure
A VLAN is missing or an access port has the wrong PVID.
✓Checkpoint

Continue only when you can explain what each check proves and what it cannot prove.

05

Find the root and the protected path

All three links are physically up. Spanning Tree allows two paths to forward and keeps one path ready but blocked.

Scenario 1Healthy link, blocked on purpose
Show STP
sudo ./mission-switching-lab-v2.sh stp
Look for
mls1-core has the lowest bridge priority and becomes root.
Look for
At least one East-West port shows blocking.
Meaning
The cable works. The control plane is intentionally refusing ordinary forwarding on that path.
Say this out loudUp is a physical fact. Forwarding is a network decision.

Watch port state only

Compact state
sudo bridge link show | grep -E 'master mls1-(core|east|west)'
06

Prove access ports and trunks

VLAN 110 carries the two users. VLAN 120 carries the application. Every inter-switch link carries both VLANs as tagged traffic.

Show VLAN membership
sudo ./mission-switching-lab-v2.sh vlan
Access portsmls1-a-port and mls1-b-port

VLAN 110, PVID, untagged.

Application portmls1-app-port

VLAN 120, PVID, untagged.

Trunksmls1-ce-*, mls1-cw-* and mls1-ew-*

VLAN 110 and VLAN 120 are present without PVID or untagged flags.

Reading the outputPVID Egress Untagged means the port behaves like an access port. A VLAN number without those flags is carried as tagged trunk traffic.
07

Make the switches learn

Generate traffic, then inspect where each Linux bridge believes the endpoint MAC addresses live.

Generate A to B traffic

Ping inside namespace
sudo ip netns exec mls1-host-a ping -c 3 10.110.0.12

Inspect learned MAC addresses

Show FDB
sudo ./mission-switching-lab-v2.sh fdb
Host A MAC
02:00:00:00:11:0a
Host B MAC
02:00:00:00:11:0b
Learning rule
A switch learns from the source MAC of frames arriving on a port.
Optional: watch MAC changes live
Second Ubuntu tab
sudo bridge monitor fdb
08

Cut an active trunk

The protected East-West path should become usable after the active Core-West path disappears.

Scenario 2Stored redundancy becomes the live path
Trigger failure
sudo ./mission-switching-lab-v2.sh scenario failover

Open a second Ubuntu tab and watch the port states.

Observe
watch -n 1 "bridge link show | grep -E 'master mls1-(core|east|west)'"
First
mls1-cw-c goes down.
Then
The protected East-West port moves through Spanning Tree states.
Finally
Host A to Host B traffic recovers.
Repair
sudo ./mission-switching-lab-v2.sh fix
Classroom timersThe bridges use shortened timers so the transition is visible without waiting for production defaults. The guide labels this clearly because these values are for learning, not deployment.
09

Diagnose a quiet VLAN outage

Every link remains up and Spanning Tree remains healthy, but VLAN 110 disappears from one active trunk.

Scenario 3Green links, broken service
Trigger outage
sudo ./mission-switching-lab-v2.sh scenario vlan-outage
PhysicalPASS
STPPASS
FDBMay look normal
VLANFAIL

Prove the exact failure

Inspect one port
sudo bridge vlan show dev mls1-cw-w

VLAN 110 is missing while VLAN 120 remains.

Repair
sudo ./mission-switching-lab-v2.sh fix
sudo ./mission-switching-lab-v2.sh verify
Operational lessonA correct MAC table does not prove correct segmentation.
10

Move a MAC without changing the host

Move Host B to another access port while keeping the same MAC and IP. Normal movement is one clean update. Repeated movement between ports is flapping.

Trigger

Ubuntu | Move Host B
sudo ./mission-switching-lab-v2.sh scenario mac-move

Observe

Ubuntu | Show FDB
sudo ./mission-switching-lab-v2.sh fdb
Good
Host B keeps MAC 02:00:00:00:11:0b and IP 10.110.0.12, but the learned port changes.
Diagnose
One movement after a planned change is normal. Rapid repeated movement between ports suggests a loop, duplicate attachment or unstable topology.

Repair

Ubuntu | Restore port
sudo ./mission-switching-lab-v2.sh fix

Verify

Ubuntu | Baseline
sudo ./mission-switching-lab-v2.sh verify
11

Reach the Layer 2 boundary

Prove every switching check passes, then try to reach the application in another IP network.

Act I finaleThe LAN works. The application does not.
Run the handoff
sudo ./mission-switching-lab-v2.sh scenario routing
Source
10.110.0.11/24 in VLAN 110
Destination
10.120.0.50/24 in VLAN 120
Layer 2
Physical, STP, FDB and VLAN checks pass.
Missing
No router, no default gateway, no matching route.
End the lecture hereThe switches are working. The application is running. The packet still has nowhere to go next.
Act IIFrom Your LAN to an Application

Routing Tables: Choosing the Next Hop
Routing table, default route, next hop and longest-prefix match.

12

Clean up completely

Remove every namespace, virtual cable and Linux bridge created by the workshop.

Destroy lab
sudo ./mission-switching-lab-v2.sh destroy

Confirm nothing remains

Verify cleanup
ip netns list
ip -br link show | grep '^mls1-' || echo "Lab removed"
✓Workshop complete

You built a Layer 2 fabric, found its protected path, proved VLAN trunks, watched MAC learning, triggered failover, diagnosed a quiet outage and discovered why routing comes next.