06Layer 2 Capstone
0102030405PackageChecksum
How Networks Work | Lab 06

The Layer 2
Grand Finale

Build one four-switch campus fabric, then prove eleven switching behaviors with kernel state, bounded captures and repeatable failures.

Start workshopDownload Act 1 packageScript onlyPublic lab docs
EnvironmentClean Ubuntu VM or WSL2
Time90 to 120 minutes
Fabric4 switches + 4 endpoints
Scope11 Layer 2 investigations
00

One fabric, eleven proofs

The browser is your control room. Linux bridge state and namespace traffic are the evidence.

Lab 06 four-switch campus topologyCore, East, West and Edge bridges joined by VLAN trunks. Hosts A, B and C use VLAN 110. The application uses VLAN 120.mls1-g-corebaseline STP rootmls1-g-eastHost A | VLAN 110mls1-g-westHost B 110 | App 120mls1-g-edgeHost C witness | VLAN 110Traffic stays inside mls1 namespaces
Forwarding portBlocked by STPDashed link: redundant path
STPRoot, roles, cost and failover
VLANAccess, trunk, pruning and PVID
EthernetFDB, flooding, broadcast and movement
Capstone readiness gateBefore you build, explain source-MAC learning, unknown-unicast flooding, access ports, trunks, PVIDs, STP root election and path cost. Read the free readiness primer if any prediction is unclear.
Protocol truthThis lab uses Linux kernel STP. It does not claim RSTP or use vendor images.
Safety boundaryNo physical interface, WSL external link, host route or firewall is modified. Captures and generated traffic are bounded.
Clean host requirementUse a clean Ubuntu VM with Docker not installed. The learner scripts will not change the host firewall, packet-filter policy or loaded kernel modules.
Nerd note: why same-prefix mattersThe VLAN 120 application also owns 10.110.3.50/24. Host A therefore builds an Ethernet frame instead of failing at its routing table. A timeout now proves the VLAN boundary at Layer 2.
Keep studying for freeUse the Wireshark guide, Mininet walkthrough and FRRouting docs after this lab.
01

Prepare Ubuntu

Move the script into your Linux home directory, install the open-source tools and pass doctor.

Run
cp /mnt/c/Users/YOUR-WINDOWS-USER/Downloads/mission-layer2-capstone.sh ~/
cd ~
chmod +x mission-layer2-capstone.sh
Confirm
sudo ./mission-layer2-capstone.sh install
Confirm
sudo ./mission-layer2-capstone.sh doctor
Expected result
Every required tool, Scapy and VLAN-filtering STP bridge check passes on native Ubuntu or WSL2.
Evidence
The script writes or prints the kernel state used to support the conclusion.
02

Build and verify the campus fabric

Create four bridges, four trunks, four namespaces, two VLANs and one protected STP path.

Run
sudo ./mission-layer2-capstone.sh build
Verify
sudo ./mission-layer2-capstone.sh verify
Expected result
Hosts A, B and C communicate in VLAN 110. VLAN 120 stays isolated. STP protects a redundant path.
Evidence
The script writes or prints the kernel state used to support the conclusion.
✓Baseline checkpoint

Continue only when every verification line passes.

03

Elect a different STP root

Lower West priority and watch every bridge agree on the new root.

Run
sudo ./mission-layer2-capstone.sh demo root-election
Repair
sudo ./mission-layer2-capstone.sh fix
Verify
sudo ./mission-layer2-capstone.sh verify
Expected result
West becomes root because its bridge priority is lowest. Fix restores Core.
Evidence
The script writes or prints the kernel state used to support the conclusion.
04

Read STP port roles and states

Prove that a physically healthy redundant link can remain blocked by design.

Run
sudo ./mission-layer2-capstone.sh demo port-roles
Expected result
Forwarding links carry frames. A blocking port prevents a Layer 2 loop.
Evidence
The script writes or prints the kernel state used to support the conclusion.
05

Prove the VLAN boundaries

Combine membership output with same-VLAN success and cross-VLAN failure.

Run
sudo ./mission-layer2-capstone.sh demo vlan-boundaries
Expected result
A reaches B in VLAN 110. A cannot reach the same-prefix probe on the VLAN 120 application host, so the failure proves Layer 2 isolation rather than a missing route.
Evidence
The script writes or prints the kernel state used to support the conclusion.
06

Watch the FDB learn again

Flush dynamic entries, generate traffic and inspect learned source MAC addresses.

Run
sudo ./mission-layer2-capstone.sh demo fdb-learning
Expected result
Host MAC addresses reappear on the ports where their source frames arrived.
Evidence
The script writes or prints the kernel state used to support the conclusion.
07

Capture unknown-unicast flooding

Send one frame to an unknown destination and let Host C prove the flood.

Run
sudo ./mission-layer2-capstone.sh demo unknown-unicast
Expected result
Host C captures 02:00:00:de:ad:03. The capture starts deterministically and stops after one marked frame or the bounded timeout.
Evidence
The script writes or prints the kernel state used to support the conclusion.
08

Measure the broadcast domain

Capture one broadcast simultaneously inside VLAN 110 and VLAN 120.

Run
sudo ./mission-layer2-capstone.sh demo broadcast-domain
Expected result
Host C sees MISSION-BROADCAST. The VLAN 120 application does not. An empty VLAN 120 capture is valid isolation evidence.
Evidence
The script writes or prints the kernel state used to support the conclusion.
09

Prune a VLAN from an active trunk

Keep the link and STP healthy while VLAN 110 disappears from one trunk endpoint.

Run
sudo ./mission-layer2-capstone.sh demo trunk-pruning
Repair
sudo ./mission-layer2-capstone.sh fix
Verify
sudo ./mission-layer2-capstone.sh verify
Expected result
Physical and STP pass, but VLAN 110 membership is missing until repaired.
Evidence
The script writes or prints the kernel state used to support the conclusion.
10

Break an access-port PVID

Move Host B untagged ingress into VLAN 130 without taking the link down.

Run
sudo ./mission-layer2-capstone.sh demo pvid-mismatch
Repair
sudo ./mission-layer2-capstone.sh fix
Verify
sudo ./mission-layer2-capstone.sh verify
Expected result
Host B remains up, its PVID becomes 130 and VLAN 110 service fails until repaired.
Evidence
The script writes or prints the kernel state used to support the conclusion.
11

Move a MAC without changing the host

Attach Host B to East while keeping the same namespace, IP and MAC.

Run
sudo ./mission-layer2-capstone.sh demo mac-move
Repair
sudo ./mission-layer2-capstone.sh fix
Expected result
Host B keeps its identity while the learned switch port changes.
Evidence
The script writes or prints the kernel state used to support the conclusion.
12

Engineer the STP path cost

Make the direct Core-West trunk expensive and watch STP recompute its preferred tree.

Run
sudo ./mission-layer2-capstone.sh demo path-cost
Repair
sudo ./mission-layer2-capstone.sh fix
Expected result
Core-West cost changes from 100 to 500 and the blocked port moves. Fix restores the baseline.
Evidence
The script writes or prints the kernel state used to support the conclusion.
13

Finish with active-link failover

Cut Core-West during a bounded ping and observe the protected path become useful.

Run
sudo ./mission-layer2-capstone.sh demo link-failover
Repair
sudo ./mission-layer2-capstone.sh fix
Verify
sudo ./mission-layer2-capstone.sh verify
Expected result
Core-West goes down, an alternate path transitions and A-to-B traffic resumes.
Evidence
The script writes or prints the kernel state used to support the conclusion.
✓Grand finale complete

You exercised eleven Layer 2 behaviors with kernel state and bounded namespace traffic. The release gate still requires the complete smoke run to finish with failed 0, skipped 0 on the target Ubuntu VM.

14

Clean the fabric, keep the evidence

Remove every Lab 06 namespace, veth and bridge. Timestamped results remain.

Run
sudo ./mission-layer2-capstone.sh destroy
Confirm
ip netns list | grep '^mls1-g-' || echo "Lab 06 namespaces removed"
ip -br link show | grep '^mls1-g-' || echo "Lab 06 links removed"
Expected result
No mls1-g namespace, link or bridge remains. Evidence stays under results/.
Evidence
The script writes or prints the kernel state used to support the conclusion.