03Layer 2 Grand Finale
Lab 01Lab 02Download packageChecksum
Networking Zero to Hero | Lab 03

The Layer 2
Grand Finale

Build one four-switch campus fabric, then prove eleven switching behaviors with kernel state, bounded captures and repeatable failures.

Start workshopDownload Lab 03 packageScript only
EnvironmentWindows 11 + WSL2 Ubuntu
Time90 to 120 minutes
Fabric4 switches + 4 endpoints
Scope11 Layer 2 investigations
00

One fabric, eleven proofs

The browser is your control room. Linux bridge state and namespace traffic are the evidence.

Lab 03 four-switch campus topologyCore, East, West and Edge bridges joined by VLAN trunks. Hosts A, B and C use VLAN 110. The application uses VLAN 120.mls1-g-corebaseline STP rootmls1-g-eastHost A | VLAN 110mls1-g-westHost B 110 | App 120mls1-g-edgeHost C witness | VLAN 110Traffic stays inside mls1 namespaces
STPRoot, roles, cost and failover
VLANAccess, trunk, pruning and PVID
EthernetFDB, flooding, broadcast and movement
Protocol truthThis lab uses Linux kernel STP. It does not claim RSTP or use vendor images.
Safety boundaryNo physical interface, WSL external link, host route or firewall is modified. Captures and generated traffic are bounded.
01

Prepare WSL2 Ubuntu

Move the script into your Linux home directory, install the open-source tools and pass doctor.

Run
cp /mnt/c/Users/YOUR-WINDOWS-USER/Downloads/mission-layer2-grand-finale.sh ~/
cd ~
chmod +x mission-layer2-grand-finale.sh
Confirm
sudo ./mission-layer2-grand-finale.sh install
Confirm
sudo ./mission-layer2-grand-finale.sh doctor
Expected result
Every tool, Scapy, WSL2 and Linux bridge creation pass.
Evidence
The script writes or prints the kernel state used to support the conclusion.
02

Build and verify the campus fabric

Create four bridges, four trunks, four namespaces, two VLANs and one protected STP path.

Run
sudo ./mission-layer2-grand-finale.sh build
Verify
sudo ./mission-layer2-grand-finale.sh verify
Expected result
Hosts A, B and C communicate in VLAN 110. VLAN 120 stays isolated. STP protects a redundant path.
Evidence
The script writes or prints the kernel state used to support the conclusion.
✓Baseline checkpoint

Continue only when every verification line passes.

03

Elect a different STP root

Lower West priority and watch every bridge agree on the new root.

Run
sudo ./mission-layer2-grand-finale.sh demo root-election
Repair
sudo ./mission-layer2-grand-finale.sh fix
Verify
sudo ./mission-layer2-grand-finale.sh verify
Expected result
West becomes root because its bridge priority is lowest. Fix restores Core.
Evidence
The script writes or prints the kernel state used to support the conclusion.
04

Read STP port roles and states

Prove that a physically healthy redundant link can remain blocked by design.

Run
sudo ./mission-layer2-grand-finale.sh demo port-roles
Expected result
Forwarding links carry frames. A blocking port prevents a Layer 2 loop.
Evidence
The script writes or prints the kernel state used to support the conclusion.
05

Prove the VLAN boundaries

Combine membership output with same-VLAN success and cross-VLAN failure.

Run
sudo ./mission-layer2-grand-finale.sh demo vlan-boundaries
Expected result
A reaches B in VLAN 110. A cannot reach the application in VLAN 120 without routing.
Evidence
The script writes or prints the kernel state used to support the conclusion.
06

Watch the FDB learn again

Flush dynamic entries, generate traffic and inspect learned source MAC addresses.

Run
sudo ./mission-layer2-grand-finale.sh demo fdb-learning
Expected result
Host MAC addresses reappear on the ports where their source frames arrived.
Evidence
The script writes or prints the kernel state used to support the conclusion.
07

Capture unknown-unicast flooding

Send one frame to an unknown destination and let Host C prove the flood.

Run
sudo ./mission-layer2-grand-finale.sh demo unknown-unicast
Expected result
Host C captures 02:00:00:de:ad:03. The capture stops after one frame or five seconds.
Evidence
The script writes or prints the kernel state used to support the conclusion.
08

Measure the broadcast domain

Capture one broadcast simultaneously inside VLAN 110 and VLAN 120.

Run
sudo ./mission-layer2-grand-finale.sh demo broadcast-domain
Expected result
Host C sees MISSION-BROADCAST. The VLAN 120 application does not.
Evidence
The script writes or prints the kernel state used to support the conclusion.
09

Prune a VLAN from an active trunk

Keep the link and STP healthy while VLAN 110 disappears from one trunk endpoint.

Run
sudo ./mission-layer2-grand-finale.sh demo trunk-pruning
Repair
sudo ./mission-layer2-grand-finale.sh fix
Verify
sudo ./mission-layer2-grand-finale.sh verify
Expected result
Physical and STP pass, but VLAN 110 membership is missing until repaired.
Evidence
The script writes or prints the kernel state used to support the conclusion.
10

Break an access-port PVID

Move Host B untagged ingress into VLAN 130 without taking the link down.

Run
sudo ./mission-layer2-grand-finale.sh demo pvid-mismatch
Repair
sudo ./mission-layer2-grand-finale.sh fix
Verify
sudo ./mission-layer2-grand-finale.sh verify
Expected result
Host B remains up, its PVID becomes 130 and VLAN 110 service fails until repaired.
Evidence
The script writes or prints the kernel state used to support the conclusion.
11

Move a MAC without changing the host

Attach Host B to East while keeping the same namespace, IP and MAC.

Run
sudo ./mission-layer2-grand-finale.sh demo mac-move
Repair
sudo ./mission-layer2-grand-finale.sh fix
Expected result
Host B keeps its identity while the learned switch port changes.
Evidence
The script writes or prints the kernel state used to support the conclusion.
12

Engineer the STP path cost

Make the East-West trunk expensive and watch STP recompute its preferred tree.

Run
sudo ./mission-layer2-grand-finale.sh demo path-cost
Repair
sudo ./mission-layer2-grand-finale.sh fix
Expected result
East-West cost changes from 100 to 500. Fix restores the baseline.
Evidence
The script writes or prints the kernel state used to support the conclusion.
13

Finish with active-link failover

Cut Core-West during a bounded ping and observe the protected path become useful.

Run
sudo ./mission-layer2-grand-finale.sh demo link-failover
Repair
sudo ./mission-layer2-grand-finale.sh fix
Verify
sudo ./mission-layer2-grand-finale.sh verify
Expected result
Core-West goes down, an alternate path transitions and A-to-B traffic resumes.
Evidence
The script writes or prints the kernel state used to support the conclusion.
✓Grand finale complete

You proved eleven distinct Layer 2 behaviors with real kernel state and bounded namespace traffic.

14

Clean the fabric, keep the evidence

Remove every Lab 03 namespace, veth and bridge. Timestamped results remain.

Run
sudo ./mission-layer2-grand-finale.sh destroy
Confirm
ip netns list | grep '^mls1-g-' || echo "Lab 03 namespaces removed"
ip -br link show | grep '^mls1-g-' || echo "Lab 03 links removed"
Expected result
No mls1-g namespace, link or bridge remains. Evidence stays under results/.
Evidence
The script writes or prints the kernel state used to support the conclusion.