Knowledge base
Notes library
Clear, practical notes for learners and step-by-step playbooks for people already working in the field. Written from real-world experience and updated regularly.
What is a computer network? A plain-English start
What a network is, the kinds you use every day (LAN, WAN, the internet) and the devices that make them work.
5 min read · Basics
IP addresses explained simply
What an IP address is, public vs private addresses, and why IPv6 exists, explained with everyday comparisons.
6 min read · Basics
How DNS works: the internet's phonebook
How your device turns a name like example.com into an IP address, step by step, and what happens when DNS fails.
5 min read · Basics
DHCP: how devices get an IP address automatically
How a device joining a network is given its IP address, gateway and DNS automatically, and what to check when it fails.
4 min read · Basics
Modem, router, switch, access point: what each one does
The everyday network devices explained in simple terms, so you know which box does what and where problems come from.
5 min read · Basics
TCP, UDP and port numbers in simple terms
How data is delivered reliably or quickly, and how port numbers make sure it reaches the right app on a device.
5 min read · Basics
NAT: how many devices share one internet address
How your router lets every device at home or work use a single public IP address, and what that means for security.
4 min read · Basics
Wi-Fi basics and how to secure your wireless network
How Wi-Fi works, 2.4 GHz vs 5 GHz, and a simple checklist to secure any home or small office wireless network.
5 min read · Basics
Cybersecurity basics: the CIA triad
The three goals behind every security decision (confidentiality, integrity and availability) with everyday examples.
4 min read · Basics
Strong passwords and multi-factor authentication
How to create passwords that are easy to remember and hard to crack, why password managers help, and why MFA matters most.
5 min read · Basics
Phishing: how to spot fake emails and messages
The warning signs of phishing emails, texts and calls, and exactly what to do if you clicked something.
5 min read · Basics
What is cloud computing? IaaS, PaaS and SaaS explained
What "the cloud" really is, the three service models with everyday examples, and the main deployment types.
5 min read · Basics
Virtualisation and virtual machines for beginners
How one physical computer can run many virtual computers, why it matters, and how to use it for your own practice lab.
4 min read · Basics
Essential network commands every beginner should know
The handful of commands that solve most network problems (ping, ipconfig, tracert, nslookup, netstat and more), with Windows and Linux versions.
6 min read · Basics
MAC addresses: the name tag on every network card
What a MAC address is, how it differs from an IP address, how switches use it, and how to find yours.
5 min read · Basics
Network cables and Ethernet: what you plug in and why it matters
Copper Ethernet cables, categories (Cat5e to Cat6A), fibre, connectors and speeds explained simply, with tips for choosing the right cable.
5 min read · Basics
Firewalls for beginners: what they block and why
What a firewall does, how rules allow or block traffic, the difference between network and device firewalls, and why "deny by default" matters.
5 min read · Basics
Malware basics: viruses, ransomware and how to stay safe
The main types of malicious software (viruses, worms, trojans, ransomware, spyware), how they get onto devices and the habits that keep you safe.
5 min read · Basics
What is a server? Clients, servers and the services they run
What servers and clients are, the common services servers run (web, email, file, DNS, DHCP), and where servers live today: on-site, data centres and the cloud.
5 min read · Basics
Backups made simple: the 3-2-1 rule
Why backups matter, the 3-2-1 rule, full and incremental backups, sync versus backup, and why you must test a restore.
5 min read · Basics
The OSI model, used the way engineers really use it
The seven OSI layers explained with real examples, and how to use them to troubleshoot from the bottom up.
7 min read · Beginner
Subnetting in your head: the block-size method
A fast, reliable way to find network, broadcast and host ranges without a calculator.
8 min read · Beginner
VLANs and trunks: concepts, configuration and common mistakes
Why VLANs exist, how access and trunk ports differ, an example configuration and the mistakes that cause outages.
9 min read · Beginner
Firewalls explained: stateless, stateful and next-generation
How each firewall type decides what to allow, where you meet them in real networks, and rule-writing principles that apply to all of them.
8 min read · Intermediate
Zero Trust in plain words
What Zero Trust really means, how it differs from the old perimeter model, and practical first steps for any organisation.
7 min read · Intermediate
Playbook: hardening a new access switch
A practical security checklist for any new managed switch, with an example Cisco IOS configuration.
10 min read · Intermediate
IPsec explained: how site-to-site VPNs keep traffic safe
How IPsec protects traffic between sites: IKE, ESP and AH, tunnel vs transport mode, how a tunnel comes up, a Cisco example and how to troubleshoot it.
11 min read · Intermediate
The cloud shared responsibility model
Who secures what in IaaS, PaaS and SaaS, and the customer-side mistakes behind most cloud breaches.
6 min read · Beginner
Playbook: "Users can't reach the internet"
A step-by-step troubleshooting checklist for one of the most common support tickets, with Windows and Linux commands.
10 min read · All levels
Breaking into networking and security: a practical roadmap
A realistic path from beginner to your first role and beyond, wherever you are in the world.
7 min read · Beginner
Introduction to computer networks: purpose, benefits and risks
What a computer network is, the words engineers use (node, host, data rate), why organisations build networks, the risks they bring and how networks are judged.
6 min read · Beginner
Data communication: components, data flow and connection types
The five parts of every data communication system, simplex vs half-duplex vs full-duplex, and point-to-point vs multipoint links, with diagrams.
6 min read · Beginner
Network system types: peer-to-peer, client-server, cloud, cluster and more
How networks are organised: peer-to-peer vs client-server (with a comparison table), cloud computing and IaaS/PaaS/SaaS, clusters, centralised and virtualised systems.
9 min read · Beginner
Network types: LAN, WAN, MAN, VPN, SAN, CAN, intranet and extranet
The main kinds of network by size and purpose: PAN, LAN, MAN, WAN, VPN, SAN and CAN, plus intranets, extranets and internetworks, with diagrams.
8 min read · Beginner
Networking standards: who makes them and the IEEE 802 family
Why standards matter, the main standards organisations (ANSI, IEEE, ISO, IETF, W3C), the IEEE 802 family, Ethernet (802.3) and the Wi-Fi generations (802.11).
7 min read · Beginner
The OSI and TCP/IP models: layers, functions and encapsulation
Why network models exist, the seven OSI layers and what each does, how data is encapsulated, the four-layer TCP/IP model and how the two map together.
10 min read · Beginner
Application layer protocols and their ports: FTP, SSH, Telnet, SMTP, POP3, DNS, HTTP(S), DHCP, SNMP
What a protocol is and how the main application protocols work: file transfer, remote access, email, DNS, web, DHCP and SNMP, with port numbers and security notes.
10 min read · Beginner
TCP, UDP, IP, ICMP and ARP: the transport and internet layer protocols
How TCP and UDP deliver data (and when to use each), what IP does, how ICMP reports errors and powers ping and traceroute, and how ARP finds MAC addresses.
8 min read · Intermediate
IPv4 addressing: classes, subnet masks, private ranges and subnetting
How a 32-bit IPv4 address is built, address classes A to E, default subnet masks and the AND operation, public vs private addresses and an introduction to subnetting, with practice questions.
11 min read · Intermediate
IPv6 explained: why we need it, address structure, shortening rules and address types
Why IPv6 replaced IPv4's limited address space, its main features, how to read and shorten a 128-bit address, EUI-64 interface IDs and the global, unique local and link-local address types.
10 min read · Intermediate
Network topologies: bus, star, ring, mesh, tree, hybrid and the hierarchical model
Physical and logical topologies explained with diagrams: bus, star, ring, mesh (full and partial), tree and hybrid, plus the core, distribution and access model used in real networks.
8 min read · Beginner
Ethernet, VLANs and Token Ring: logical topologies explained
How Ethernet works (CSMA/CD, 10BASE-T, Fast and Gigabit Ethernet), why VLANs split broadcast domains and how they are configured, and what Token Ring was.
9 min read · Intermediate
Network devices: NIC, hub, switch, bridge, router, access point, modem, firewall and more
What each network device does and which OSI layer it works at: NIC, hub, switch, bridge, repeater, router, access point, modem, content filter, firewall, load balancer, packet shaper and VPN concentrator.
9 min read · Beginner
Transmission media and network software: twisted pair, coax, fibre, wireless, client and server software
The physical and wireless media that carry network signals (UTP vs STP, coaxial, single-mode and multimode fibre, microwave, satellite, cellular, infrared) and the software that runs networks.
8 min read · Beginner
Designing network systems: bandwidth, requirements, design goals and methodology
How to plan a network: what bandwidth really means, what users and businesses need, the four design goals (scalability, availability, security, manageability) and a step-by-step design method.
8 min read · Intermediate
Network services: DHCP, static vs dynamic IP, DNS, NAT and routing
The services that make networks work: how DHCP leases addresses (DORA, scopes, relay), when to use static or dynamic IPs, how DNS and NAT work, and static vs dynamic routing.
9 min read · Intermediate
Configuring and verifying network connections: Windows settings, ping, traceroute, Telnet and SSH
How to set up a network adapter and IP settings in Windows 10 and 11, choose automatic or manual addressing, and verify connectivity with ping, traceroute, Telnet and SSH.
8 min read · Beginner
Network monitoring, maintenance and IT policies: SNMP, schedules, AUP, DR/BCP and change management
How networks are monitored (SNMP, alerts, resource monitoring), how to plan regular maintenance, and the key policies every organisation needs: acceptable use, security awareness, information security, disaster recovery and change management.
9 min read · Intermediate
Why network security matters: attackers, malware and security policy
Why every organisation must protect its network, who attacks networks and why, the main types of malware and how to prevent them, and the role of security policies and CERTs.
7 min read · Beginner
Denial of service, DDoS and social engineering attacks
How DoS and DDoS attacks take services offline (flooding, SYN floods, ICMP attacks, crash attacks), how botnets work, what social engineering is and how to defend against all of them.
7 min read · Intermediate
CIA, data confidentiality and AAA (authentication, authorisation, accounting)
How the CIA triad maps to security controls, practical guidelines for keeping data confidential, and how AAA controls who can log in to network devices, what they can do and what is logged, including RADIUS vs TACACS+.
8 min read · Intermediate
Encryption and hashing: ciphers, symmetric and asymmetric keys, MD5, SHA and HMAC
How encryption turns plaintext into ciphertext, classic transposition and substitution ciphers, symmetric vs asymmetric algorithms, cryptographic hash functions (MD5 vs SHA) and HMAC.
9 min read · Intermediate
Securing switches and routers: VLANs, port security, DHCP snooping and ACLs
How switches and routers connect a network and how to secure them: VLAN types and benefits, port security, DHCP snooping, standard vs extended access control lists and NAT types.
9 min read · Intermediate
Firewalls, next-generation firewalls, IDS and IPS
What a firewall does, the main firewall types (packet filtering, stateful, application gateway, NAT firewall), what next-generation firewalls add, and how IDS and IPS detect and stop attacks.
8 min read · Intermediate
VPNs and site-to-site IPsec: types, framework and configuration
Why organisations use VPNs, remote-access vs site-to-site, the IPsec framework (confidentiality, integrity, authentication, key exchange), the five steps of an IPsec tunnel and a configuration example.
9 min read · Intermediate
Designing a secure corporate network: scalability, redundancy, hierarchy and device selection
How to plan a secure corporate network: what a design must document, designing for scalability and redundancy (STP, EtherChannel), the role of each hierarchical layer, choosing switches, routers and security appliances, and segmenting with subnets.
9 min read · Intermediate
Syslog, SNMP, NTP, network monitoring tools and penetration testing
How syslog messages and severity levels work, SNMP versions and why SNMPv3 matters, why accurate time from NTP is essential, what to look for in monitoring software, and the basics and benefits of penetration testing.
8 min read · Intermediate
Testing network security: test plans and best practices
How to create a network test plan (objectives, acceptance criteria, schedule, responsibilities, resources, procedures), what a test record looks like, and a checklist of network security best practices.
8 min read · Intermediate
What is information security? Attacks, CIA and how security is achieved
The meaning of information security, the difference between active and passive attacks, the three key security concepts (CIA), and the main tools for achieving security: encryption, digital signatures and access control.
7 min read · Beginner
Threats, vulnerabilities, risk and risk management
The core vocabulary of security (vulnerability, threat, risk, countermeasure), the common threats from viruses and worms to zero-day attacks and identity theft, and how organisations manage and analyse risk.
8 min read · Beginner
Network security infrastructure: NAT, firewalls, bastion hosts and DMZ
How NAT hides internal addressing, the principles behind firewalls (least privilege, separation of duties), host-based vs network-based firewalls, firewall limits and types, bastion hosts, and why public servers belong in a DMZ.
8 min read · Intermediate
Network performance, RAID, load balancing and backups
How network performance is measured, the RAID levels (0, 1, 5, 6, 10), NIC teaming, load-balancing methods, asset management, full vs differential vs incremental backups, and what a SAN is.
9 min read · Intermediate
Data centre risks, replication and secure transport (TLS, SSH, Tor, MPLS)
The risks a data centre faces, how replica data centres keep services running, and the protocols that protect data in transit: SSL/TLS, SSH and Tor, plus how MPLS carries traffic across provider networks.
8 min read · Intermediate
Change and configuration management, IT audit, business continuity and disaster recovery
How network change and configuration management (NCCM) keeps devices consistent, what an IT audit checks, the difference between business continuity and disaster recovery, business impact analysis, and the main causes of data loss and how to prevent it.
9 min read · Intermediate
IT risks, UK computer law and ISO 31000 risk management
Risks from hardware, software, mobile and IoT devices; intellectual property; the UK data protection and Computer Misuse Act rules every IT professional should know; and the ISO 31000 risk management standard.
9 min read · Intermediate
Physical security of IT centres and biometric authentication
How server rooms and IT centres are physically protected, the three authentication factors, the main biometric methods and their accuracy, and practical steps to prevent theft of equipment and data.
7 min read · Beginner
Security policies, standards, procedures and ISO/IEC 27002
What a security policy is, how policies differ from standards, procedures and guidelines, the common types of security policy, and how ISO/IEC 27002 (formerly ISO 17799) guides physical, people and access controls.
8 min read · Intermediate
Windows networking and security commands
The important Windows commands for checking IP settings, testing connectivity, resolving names, viewing connections, managing the firewall and checking users and updates, from Command Prompt and PowerShell.
6 min read · Beginner
Linux networking and security commands
The important Linux commands for interfaces and addresses, connectivity tests, DNS, open ports and sockets, firewalls (ufw, firewalld, nftables), SSH and logs.
6 min read · Beginner
Cisco switch commands: VLANs, trunks and port security
The important Cisco IOS switch commands for basic setup, secure management with SSH, VLANs and trunks, port security, DHCP snooping and dynamic ARP inspection, and verification.
8 min read · Intermediate
Cisco router commands: interfaces, routing, ACLs and NAT
The important Cisco IOS router commands for interfaces, static and OSPF routing, inter-VLAN routing, standard and extended ACLs, NAT/PAT, DHCP, and management services such as NTP and syslog.
8 min read · Intermediate
Cisco ASA firewall commands: interfaces, NAT, ACLs and VPN
The important Cisco ASA commands for interfaces and security levels, management access, object NAT, access rules, site-to-site IPsec VPN and verification.
8 min read · Advanced
Network design fundamentals: building blocks, network types and the design plan
What a network needs (end devices, intermediary devices, protocols and media), how networks are classified by size, topology and where resources live, physical versus logical topology, and why every network starts with a design plan.
7 min read · Beginner
Choosing switches and routers, and configuring them for the first time
The kinds of switch and router you can buy and how to choose between them, how to reach a device (console, SSH, AUX), the Cisco IOS command modes, and a secure first-time configuration.
8 min read · Beginner
Network design overview: goals, the hierarchical model and design methodology
Why modern networks must be designed, the four fundamental design goals, the five steps to building a good network, the three-layer and two-layer hierarchical models, modular enterprise architecture and the design methodology.
9 min read · Intermediate
VLANs, trunking, VTP and inter-VLAN routing
Collision and broadcast domains, how VLANs split a switched network into separate logical networks, 802.1Q trunking, VTP modes and its risks, access and trunk ports, and the three ways to route between VLANs.
9 min read · Intermediate
Layer 2 redundancy: spanning tree and EtherChannel
Why redundant switch links create Layer 2 loops, how spanning tree elects a root bridge and assigns port roles, how STP, RSTP, MST, PVST+ and Rapid PVST+ compare, and how LACP, PAgP and static EtherChannel bundle links.
10 min read · Intermediate
Routing operations: static routing and dynamic routing protocols compared
How routers choose paths, static versus dynamic routing, the families of routing protocols (distance vector, link state, advanced distance vector, path vector), RIP, OSPF, IS-IS, EIGRP and BGP, and administrative distance.
10 min read · Intermediate
Layer 3 redundancy: HSRP, VRRP and GLBP
Why the default gateway is a single point of failure, and how first hop redundancy protocols (HSRP, VRRP and GLBP) share a virtual gateway between routers: roles, elections, preemption, states and configuration.
9 min read · Intermediate
Access control lists: purpose, types, placement and best practice
What access control lists do and why they are used, standard, extended and named ACLs, how routers process them, inbound versus outbound, where to place each type, and practical guidelines.
9 min read · Intermediate
Network monitoring and management: syslog, NTP, SNMP and controllers
What network monitoring is and why it matters, a step-by-step approach, syslog message fields, facilities and severity levels, NTP and stratum, SNMP managers, agents and MIBs, and centralised network controllers.
9 min read · Intermediate
WAN technologies: leased lines, PPP, MPLS, Metro Ethernet, broadband and VPNs
How organisations connect sites over long distances: private and public WANs, leased lines and PPP with PAP and CHAP, legacy Frame Relay, MPLS, Metro Ethernet, broadband and mobile, internet VPNs, and how to choose.
9 min read · Intermediate
Quality of service (QoS) for voice, video and business applications
Why converged networks need QoS, what voice and video require, classification and DSCP marking, trust boundaries, queuing with LLQ, policing versus shaping, congestion avoidance, and a sample policy.
9 min read · Advanced
Troubleshooting LAN and WAN networks: methods, tools and common faults
A structured troubleshooting process, the top-down, bottom-up, divide-and-conquer and follow-the-path methods, the main tools and commands, and the common LAN and WAN faults with their likely causes.
9 min read · Intermediate
Campus and data centre architectures: three-tier, collapsed core and spine-leaf
How enterprise networks are laid out today: three-tier and collapsed-core campus designs, why data centres moved to spine-leaf fabrics, oversubscription, overlays such as VXLAN, and how to choose an architecture.
8 min read · Intermediate
Network planes and software-defined networking (SDN)
The data, control and management planes inside every network device, how SDN separates and centralises control, controllers and their northbound and southbound APIs, underlay and overlay, and intent-based networking.
8 min read · Intermediate
Zero trust architecture and network segmentation
Why the old castle-and-moat model fails, the principles of zero trust, macro- and micro-segmentation, network access control with 802.1X, zero trust network access (ZTNA) replacing VPNs, and a practical roadmap.
8 min read · Intermediate
What is SD-WAN? Architecture, components and benefits
Why traditional WANs struggle with cloud applications, what SD-WAN is, its components (edge devices, controller, orchestrator, management), how the overlay uses several transports, and the benefits and limits.
8 min read · Intermediate
SD-WAN path selection, SLAs and application performance
How SD-WAN identifies applications, measures links with probes, applies SLA policies for latency, jitter and loss, steers or fails over traffic, and uses QoS, forward error correction and packet duplication to protect real-time traffic.
8 min read · Advanced
SD-WAN security, segmentation and SASE
How SD-WAN secures traffic with IPsec tunnels and segmentation, the security needed for local internet breakout, how SASE combines SD-WAN with cloud security services (SWG, CASB, ZTNA, FWaaS), and a migration plan from MPLS.
8 min read · Advanced
Network automation: why automate, the toolchain and model-driven APIs
Why manual configuration doesn’t scale, the benefits of automation, the automation stack, how tools talk to devices (SSH, NETCONF, RESTCONF, gNMI, REST), YANG, YAML and JSON, sources of truth and idempotency.
8 min read · Intermediate
Python for network engineers: libraries and a first automation script
Why Python is the language of network automation, the key libraries (Netmiko, NAPALM, ncclient, requests, Nornir, TextFSM), a complete configuration backup script with a YAML inventory, safe changes and a learning path.
9 min read · Intermediate
Ansible and NetDevOps: playbooks, inventories and CI/CD for networks
Why Ansible suits network teams, inventories and variables, an idempotent VLAN playbook using Cisco IOS modules, check mode, protecting secrets, and how Git, reviews and CI/CD pipelines make network changes safer.
9 min read · Advanced
Ethernet frames and MAC addresses: structure, types and how to read them
What is inside an Ethernet frame, how a 48-bit MAC address is built, the difference between unicast, multicast and broadcast frames, and why frame size and the FCS matter when you troubleshoot.
7 min read · Beginner
ARP explained: how IPv4 finds MAC addresses, gratuitous ARP, proxy ARP and ARP spoofing
How the Address Resolution Protocol maps IPv4 addresses to MAC addresses, what the ARP cache does, when hosts ARP for the gateway, gratuitous and proxy ARP, and how ARP spoofing works and is stopped.
7 min read · Beginner
The IPv4 packet header: TTL, fragmentation, DSCP and the protocol field explained
A field-by-field tour of the IPv4 header, with the practical side: how TTL stops loops, how fragmentation and the Don't Fragment bit cause MTU problems, and how DSCP and the protocol field are used by firewalls and QoS.
8 min read · Intermediate
VLSM, CIDR and route summarisation with worked examples
How classless addressing (CIDR) replaced classes, how to carve one block into different-sized subnets with VLSM, and how to summarise contiguous networks into a single route, with step-by-step worked examples.
9 min read · Intermediate
IPv6 Neighbour Discovery, SLAAC and DHCPv6: how IPv6 hosts get addresses
How IPv6 replaces ARP and much of DHCP with the Neighbour Discovery Protocol: router and neighbour messages, SLAAC, duplicate address detection, solicited-node multicast, DHCPv6 options and RA Guard.
8 min read · Intermediate
TCP in depth: header, handshake, windowing, congestion control and resets
How TCP delivers data reliably: the header fields and flags, sequence and acknowledgement numbers, the handshake and teardown, flow control with windows, congestion control, and what resets and retransmissions tell you when troubleshooting.
9 min read · Intermediate
ICMP, ping and traceroute: message types and how to read the results
What ICMP is for, the message types every engineer should recognise, exactly how ping and traceroute use them, how to read stars and timeouts, and which ICMP messages a firewall must allow.
8 min read · Beginner
CDP and LLDP: discovering neighbours, mapping networks and locking them down
How the Cisco Discovery Protocol and the Link Layer Discovery Protocol let devices advertise themselves to direct neighbours, how to use them to map a network and find where a device is plugged in, LLDP-MED for IP phones, and when to turn them off.
7 min read · Beginner
How switches work: MAC address learning, flooding, forwarding and aging
How a Layer 2 switch builds its MAC address table from source addresses, when it forwards, floods or filters a frame, how aging works across several switches, and how MAC flooding attacks are stopped with port security.
8 min read · Beginner
How routers forward packets: the routing table, longest prefix match, AD and metrics
A walk through what a router does with every packet, how to read a Cisco routing table, how longest prefix match picks the route, and how administrative distance, metrics and equal-cost paths decide what goes into the table.
9 min read · Intermediate
Static, default and floating static routes: configuration, tracking and pitfalls
How to configure static routes, default routes and floating static backup routes on Cisco IOS for IPv4 and IPv6, the difference between next-hop and exit-interface forms, tracking a route with IP SLA, and the mistakes that cause outages.
8 min read · Beginner
OSPF fundamentals: link-state routing, areas, cost and basic configuration
How OSPF works as a link-state protocol: LSAs, the link-state database and SPF, router IDs, cost and reference bandwidth, single and multi-area design, and a clean, secure basic configuration with verification commands.
10 min read · Intermediate
OSPF neighbours and DR/BDR: adjacency states, network types and troubleshooting
How OSPF routers become neighbours, the adjacency states from Down to Full, what must match for an adjacency to form, how the designated router is elected, OSPF network types, authentication, and a step-by-step troubleshooting method.
10 min read · Advanced
EIGRP fundamentals: DUAL, successors, feasible successors and the composite metric
How EIGRP works: neighbours and its three tables, the bandwidth-and-delay metric, feasible distance and reported distance, the feasibility condition that guarantees loop-free backup routes, unequal-cost load balancing and basic configuration.
9 min read · Intermediate
Inter-VLAN routing in practice: router-on-a-stick, SVIs and troubleshooting
A practical guide to routing between VLANs: how a packet travels from one VLAN to another, configuring router-on-a-stick and Layer 3 switch SVIs on Cisco IOS, DHCP relay, controlling traffic between VLANs, and a checklist for when it does not work.
9 min read · Intermediate
Spanning tree in practice: port states, path cost, PortFast and BPDU Guard
The practical side of spanning tree: classic and rapid port states and roles, how path cost decides the root port, choosing the root bridge, and the protection features (PortFast, BPDU Guard, Root Guard, Loop Guard) every access and distribution switch should use.
9 min read · Intermediate
Switch interfaces: speed, duplex, error counters and err-disabled ports
How to set up and read switch interfaces: speed and duplex auto-negotiation, duplex mismatches, what CRC errors, runts, giants and output drops mean, why ports become err-disabled and how to recover them safely.
8 min read · Beginner
Securing routing: protocol authentication, route filtering, uRPF and control plane protection
How to protect routers and routing protocols: authenticating OSPF, EIGRP and BGP neighbours, passive interfaces, filtering routes with prefix lists, anti-spoofing with uRPF and ingress filtering, control plane policing, and RPKI for internet routing.
10 min read · Advanced
Layer 2 attacks and defences: MAC flooding, VLAN hopping, spoofing and storm control
Why the switched LAN is an easy target, how MAC flooding, VLAN hopping, rogue DHCP, ARP spoofing and spanning tree attacks work in principle, and the switch features that stop each one.
9 min read · Intermediate
Web, email and DNS security: secure web gateways, email filtering, protective DNS and browser isolation
How organisations protect the three channels most attacks arrive through: the web, email and DNS. Covers secure web gateways, email filtering with SPF, DKIM and DMARC, protective DNS, encrypted DNS and remote browser isolation.
8 min read · Intermediate
Data loss prevention (DLP): finding, watching and protecting sensitive data
What data loss prevention is, where DLP tools watch data (in motion, at rest and in use), how they recognise sensitive information, the actions a policy can take, and how to roll DLP out without disrupting work.
8 min read · Intermediate
Secure remote access: SSL/TLS VPNs, split tunnelling, MFA and ZTNA
How staff connect securely from home or on the road: IPsec and SSL/TLS remote-access VPNs, clientless portals, full versus split tunnelling, hardening the VPN gateway, device posture checks and the move to zero trust network access.
8 min read · Intermediate
Zone-based policy firewall on Cisco IOS: zones, zone pairs and inspection policies
How a router becomes a stateful firewall using the Cisco IOS zone-based policy firewall: security zones, the self zone, default rules, class maps, policy maps with inspect, pass and drop actions, zone pairs and verification commands.
9 min read · Advanced
Enterprise network domains: campus, WAN, data centre, cloud and edge as one architecture
How a modern organisation's network splits into domains (campus access, branch and WAN, data centre, cloud, edge and remote users), what each domain is designed for, and how identity and policy tie them together end to end.
8 min read · Intermediate
Capacity planning and dependency mapping: bandwidth, growth and critical paths
How to plan network capacity from measured baselines and growth forecasts, size links and oversubscription sensibly, and map the dependencies and critical paths that an application relies on so you know what a single failure would break.
9 min read · Intermediate
Service provider network architecture: access, aggregation, core, peering and transit
How internet service providers and carriers build their networks: customer premises, access, aggregation and core layers, points of presence, peering and transit, internet exchange points, content caches, and how an enterprise connection fits in.
9 min read · Intermediate
SD-WAN vs MPLS vs IPsec VPN: differences, costs and how to choose
A side-by-side comparison of MPLS, traditional router-based IPsec VPNs and SD-WAN: how each works, what they cost, how they handle cloud traffic and outages, and how to decide which mix suits an organisation.
8 min read · Intermediate
SD-WAN deployment models, zero-touch provisioning and choosing a vendor
How SD-WAN is bought and run (do it yourself, co-managed, fully managed and cloud-delivered), how zero-touch provisioning brings a new site online, typical use cases by sector, and what to check when you compare vendors.
9 min read · Intermediate
Monitoring and operating SD-WAN: link health, application SLAs and troubleshooting
How to monitor an SD-WAN day to day: watching underlay links, overlay tunnels, application SLAs and user experience, which metrics and alerts matter, how traditional monitoring tools fit in, and a simple troubleshooting order.
8 min read · Intermediate
Automating the network lifecycle: discovery, zero-touch provisioning, upgrades and decommissioning
How automation applies across a device's whole life: discovering what is on the network, zero-touch provisioning of new switches and routers with DHCP, templates and standard profiles, safe automated software upgrades, and clean decommissioning.
9 min read · Intermediate
Planning network automation: benefits, risks, skills and a staged roadmap
How to introduce network automation in a real team: the benefits you can expect, the drawbacks and barriers (skills, cost, culture), the difference between automation, orchestration and programmability, a staged roadmap and how to measure success.
8 min read · Beginner
Collision domains and broadcast domains: what they are and how to count them
What a LAN segment is, how early Ethernet shared one cable with CSMA/CD, why switches split collision domains and routers split broadcast domains, how VLANs fit in, and a worked example of counting both in a small network.
7 min read · Beginner
Binary and hexadecimal for network engineers: conversions you will use every day
A practical guide to the two number systems behind networking: binary place values, converting decimal to binary and back, subnet mask octet values, hexadecimal digits and nibbles, and where hex appears in MAC addresses, IPv6 and packet captures.
8 min read · Beginner
Subnetting step by step: the binary method, the fast decimal method and planning from requirements
What subnetting is and why we do it, how to find the network, first host, last host and broadcast address of any IPv4 address in binary, the faster block-size method in decimal, and how to choose a mask from a number of subnets or hosts.
10 min read · Intermediate
How to take networking notes that you will actually use
A practical method for studying networking and preparing for certifications such as CCNA: a simple note template per topic, lab journals, command cheat sheets, drawing your own diagrams, self-testing with questions and reviewing on a schedule.
7 min read · Beginner
IPv4 versus IPv6: the real differences and how networks run both
A clear comparison of IPv4 and IPv6: address size and notation, header changes, broadcast versus multicast, ARP versus Neighbour Discovery, fragmentation and MTU, NAT and security, plus the main ways networks run both protocols during the transition.
8 min read · Beginner
IPv6 by hand: address types, finding the prefix, EUI-64 and solicited-node multicast
Worked IPv6 calculations: a quick map of unicast, multicast and anycast address types, finding the prefix of an address for /48, /56, /64 and awkward lengths, building an EUI-64 interface ID step by step, and working out solicited-node multicast and multicast MAC addresses.
9 min read · Intermediate
TCP window size and window scaling: why fast links can still feel slow
How the TCP receive window controls how much data can be in flight, why the original 64 KB limit throttles long-distance links, how to calculate the bandwidth-delay product, how the window scale option works and how to check and troubleshoot it.
8 min read · Intermediate
Cisco IOS CLI and basic device configuration: modes, help, switch management IP and router as a host
How to move around the Cisco IOS command line, use help and shortcuts, save your work, give a Layer 2 switch a management IP address, apply a basic router configuration and use a router as a simple host or server.
9 min read · Beginner
Inside the switch: static MAC entries, CEF, SDM templates and unicast flooding
What happens inside a Cisco switch after it learns MAC addresses: static MAC entries, Cisco Express Forwarding (CEF) with its FIB and adjacency table, SDM templates that share out hardware memory, and why asymmetric routing causes unicast flooding.
9 min read · Intermediate
802.1Q trunking in depth: tags, native VLAN, DTP, troubleshooting and Q-in-Q
How 802.1Q tags frames on a trunk, how to configure and restrict trunks, why the native VLAN matters, how Dynamic Trunking Protocol negotiates (and why to turn it off), how to troubleshoot VLANs and trunks, and how 802.1Q tunnelling (Q-in-Q) stacks two tags.
10 min read · Intermediate
Voice VLANs and Power over Ethernet: configuring ports for IP phones
How a single switch port carries both a PC and an IP phone using a voice VLAN, how the phone learns its VLAN through CDP or LLDP-MED, how Power over Ethernet standards and classes work, and how to configure and check PoE on Cisco switches.
8 min read · Beginner
VTP in depth: modes, revision numbers, pruning and VTP version 3
How the Cisco VLAN Trunking Protocol copies VLANs between switches, what the configuration revision number does, why an old switch can wipe out every VLAN, how VTP pruning works, and how VTP version 3 makes the protocol safer.
8 min read · Intermediate
Private VLANs, protected ports and VLAN ACLs: isolating hosts inside one subnet
How to stop devices in the same VLAN from talking to each other: private VLANs with promiscuous, isolated and community ports, the simpler protected port feature, and VLAN access maps (VACLs) that filter traffic inside a VLAN.
9 min read · Advanced
802.1X and MAC Authentication Bypass: controlling who can use a switch port
How IEEE 802.1X port-based access control works with a supplicant, an authenticator switch and a RADIUS server, how MAC Authentication Bypass handles printers and cameras, a basic Cisco configuration, and how to roll it out without locking everyone out.
9 min read · Intermediate
SPAN, RSPAN and RMON: capturing and measuring switch traffic
How to copy traffic from switch ports to a packet analyser with local SPAN, carry it to another switch with RSPAN or across a routed network with ERSPAN, and collect built-in traffic statistics and threshold alarms with RMON.
8 min read · Intermediate
EtherChannel in practice: Layer 3 bundles, load balancing and troubleshooting
Building on the basics of LACP and PAgP: how to configure Layer 2 and Layer 3 EtherChannels on Catalyst switches, how traffic is shared out with hashing, and how to read show etherchannel summary to fix bundles that will not form.
9 min read · Intermediate
Switch virtualisation: StackWise, VSS, StackWise Virtual and multichassis EtherChannel
How several physical Cisco switches can act as one: stacking with StackWise at the access layer, VSS and StackWise Virtual for pairs of distribution or core switches, multichassis EtherChannel, and the split-brain problem of dual-active detection.
8 min read · Intermediate
Spanning tree under the hood: BPDUs, timers, topology changes and reconvergence
What is inside a BPDU, how the hello, max age and forward delay timers work, how classic 802.1D spanning tree announces topology changes with TCN BPDUs, how long reconvergence takes after direct and indirect failures, and what UplinkFast and BackboneFast did about it.
9 min read · Advanced
PVST+, root bridge placement and Rapid Spanning Tree (RSTP) configuration
How Per-VLAN Spanning Tree runs a separate tree per VLAN, how to place root bridges to share load across uplinks, and how Rapid Spanning Tree converges in about a second with port roles, edge ports, link types and the proposal and agreement handshake.
10 min read · Intermediate
Multiple Spanning Tree (MST): regions, instances and interoperating with PVST+
How IEEE 802.1s Multiple Spanning Tree maps many VLANs onto a few spanning tree instances, what makes switches part of the same region, how to configure MST on Cisco switches, and what to watch when an MST region meets switches running PVST+.
9 min read · Advanced
The spanning tree toolkit: BPDU Filter, Loop Guard, UDLD, Bridge Assurance and PortFast behaviour
The less-known spanning tree protection features and where to use them: how PortFast really behaves, BPDU Filter in its global and interface forms, Loop Guard and UDLD against unidirectional links, the RSTP dispute mechanism and Bridge Assurance.
9 min read · Advanced
Troubleshooting spanning tree, its limitations and the alternatives (including FlexLinks)
A practical method for spanning tree faults such as broadcast storms, the wrong root and flapping MAC addresses, the commands that reveal them, the built-in limitations of spanning tree, and the designs that replace it: EtherChannel, virtual switch pairs, routed access, fabrics and the legacy FlexLinks feature.
9 min read · Advanced
Classful vs classless routing, ip classless, ICMP redirects, directed broadcasts and IP unnumbered
Why classful routing protocols failed with modern subnetting, what auto-summary and discontiguous networks are, what the ip classless command changes in forwarding, and three router features you will meet in configurations: ICMP redirects, IP directed broadcasts and IP unnumbered interfaces.
9 min read · Intermediate
MTU, TCP MSS and PPPoE: fixing "some websites do not load" problems
What the maximum transmission unit and the TCP maximum segment size are, how path MTU discovery works and why it breaks, why PPPoE and tunnels reduce the MTU, and how to configure a PPPoE client and a simple PPPoE server on Cisco routers.
8 min read · Intermediate
Routing policy tools: wildcard bits, prefix lists, distribute lists, offset lists and route-maps
The tools Cisco routers use to select and change routes: wildcard bits in ACLs, prefix lists with ge and le, distribute lists to filter routing updates, offset lists to adjust metrics, and route-maps that combine matching with set actions.
10 min read · Advanced
Policy-based routing (PBR) and reliable PBR with IP SLA tracking
How policy-based routing sends selected traffic by a different path than the routing table would choose, how to configure it with an ACL and a route-map, how to make it fail over with IP SLA and object tracking, and when to use something else.
8 min read · Intermediate
Route redistribution: seed metrics, route tagging and avoiding loops between protocols
How routes move between routing protocols such as EIGRP, OSPF and RIP, why every protocol needs a seed metric, how to configure redistribution in both directions, and how route tags, filtering and administrative distance prevent loops and suboptimal paths.
10 min read · Advanced
GRE tunnels on Cisco IOS: configuration, recursive routing, tunnel keys and MTU
How Generic Routing Encapsulation builds a virtual point-to-point link across another network, how to configure a GRE tunnel and run a routing protocol over it, why recursive routing shuts tunnels down, what the tunnel key is for, and how to handle MTU and security.
9 min read · Intermediate
Network virtualisation on routers: VRF-lite, Cisco EVN and LISP
How virtual routing and forwarding (VRF) gives one router several separate routing tables, how to configure VRF-lite with static and dynamic routes, how Cisco Easy Virtual Network simplified carrying VRFs between devices, and how LISP separates a device's identity from its location.
9 min read · Advanced
Fast convergence: BFD, loop-free alternate fast reroute and CEF polarization
How routers detect failures in milliseconds with Bidirectional Forwarding Detection, how OSPF and EIGRP loop-free alternates and remote LFA pre-install backup paths, and why equal-cost load sharing can become polarized and how to avoid it.
9 min read · Advanced
Optimized Edge Routing and Performance Routing (OER/PfR): legacy performance-based WAN routing
What Cisco Optimized Edge Routing and its successor Performance Routing did: master controllers and border routers, the profile, measure, policy, control and verify phases, policy priorities and variance, timers, and why SD-WAN has replaced them.
8 min read · Advanced
Binary and hexadecimal for network engineers, and building your own subnetting cheat sheet
How binary and hexadecimal numbers work, how to convert between them and decimal quickly, why subnet masks and IPv6 and MAC addresses depend on them, and how to write a one-page subnetting cheat sheet from memory before an exam or a design task.
9 min read · Beginner
IPv6 prefixes and summarisation: finding the prefix and combining routes
How to find the IPv6 prefix of any address for a given prefix length, why nibble boundaries make it easier, how to handle lengths such as /61 that split a hex digit, and how to summarise several IPv6 prefixes into one route.
8 min read · Intermediate
OSPF packets, neighbour discovery and LSDB flooding
The five OSPF packet types, how two routers move from Down to Full, and how link-state advertisements are flooded, acknowledged, aged and refreshed so every router keeps the same database.
8 min read · Intermediate
OSPF LSA types and how to read the OSPF database
What each OSPFv2 LSA type describes, which router creates it and how far it is flooded, plus a practical guide to reading show ip ospf database output to find where a route came from.
9 min read · Intermediate
OSPF network types: broadcast, point-to-point, NBMA, point-to-multipoint and loopback
How each OSPF network type behaves: DR election, neighbour discovery, default timers and next-hop handling, with guidance on choosing the right type for Ethernet, WAN links, DMVPN and loopbacks.
9 min read · Intermediate
OSPF router ID, hello and dead timers, passive interfaces and cost tuning
How to configure and verify the OSPF router ID, change hello and dead intervals safely, use passive interfaces to protect LANs, and set reference bandwidth and interface cost so OSPF picks the paths you expect.
8 min read · Intermediate
Multi-area OSPF: configuration, ABRs, path selection and virtual links
How to configure OSPF across several areas, what an ABR does, how OSPF chooses between intra-area, inter-area and external routes, and when (and when not) to use a virtual link.
9 min read · Intermediate
OSPF authentication: plain text, MD5, HMAC-SHA and TTL security
Why OSPF neighbours should authenticate each other, how plain text, MD5 and HMAC-SHA authentication work and are configured on Cisco IOS, how to rotate keys, and how TTL security adds protection.
8 min read · Intermediate
OSPF default routes, summarisation and route filtering
How to advertise a default route into OSPF, summarise inter-area and external routes on ABRs and ASBRs, and filter routes with filter-lists, distribute-lists and summary options, including the traps to avoid.
9 min read · Advanced
OSPF stub, totally stubby and NSSA areas explained with configuration
What OSPF stub, totally stubby, not-so-stubby (NSSA) and totally NSSA areas block and allow, how to configure each on Cisco IOS, how type 7 LSAs are translated and what the P-bit does.
9 min read · Advanced
Advanced OSPF: throttling, stub router, graceful restart, fast reroute and OSPFv3
An overview of the OSPF features used in larger networks: SPF and LSA throttling, incremental SPF, prefix suppression, stub router, graceful shutdown and restart, loop-free alternate fast reroute, OSPFv3 address families, and how to troubleshoot missing routes.
10 min read · Advanced
EIGRP packets, neighbour adjacency, timers and the neighbour and topology tables
The EIGRP packet types and reliable transport, what must match for two routers to become neighbours, hello and hold timers, static neighbours, passive interfaces, the router ID, and how to read the neighbour and topology tables when troubleshooting.
9 min read · Intermediate
EIGRP metric in depth: K values, the formula, wide metrics and unequal-cost load balancing
How the EIGRP composite metric is calculated from K values, a worked example, why load and reliability are left off, how wide metrics fix fast links, and how variance enables unequal-cost load balancing safely.
9 min read · Advanced
EIGRP named mode and authentication: MD5, HMAC-SHA-256 and per-interface keys
How EIGRP named mode is structured and why it is preferred, and how to secure EIGRP neighbours with MD5 or HMAC-SHA-256 authentication, using key chains and different keys per interface.
8 min read · Intermediate
EIGRP summarisation, stub routing, stuck in active and default routes
How EIGRP manual and automatic summarisation work, how leak maps let specific routes through, how stub routing and summaries limit the query scope that causes stuck-in-active, and the ways to advertise a default route.
9 min read · Advanced
EIGRP route filtering and advanced features: distribute-lists, route-maps, add-path, OTP and troubleshooting
How to filter EIGRP routes with distribute-lists using ACLs, prefix-lists and route-maps, plus a tour of advanced features: add-path, LFA, Over the Top, graceful shutdown, external route handling, legacy Frame Relay behaviour and a route troubleshooting checklist.
10 min read · Advanced
RIP explained: RIPv2 configuration, timers, loop prevention and troubleshooting
How the Routing Information Protocol works, the difference between RIPv1, RIPv2 and RIPng, its timers and loop-prevention rules, and how to configure passive interfaces, default routes, summaries, offset-lists and load sharing on Cisco IOS.
9 min read · Beginner
IS-IS fundamentals: NET addresses, levels, DIS and pseudonode, metrics and configuration
How IS-IS works as a link-state protocol: NET addressing, level 1 and level 2 routing, packet types, the designated intermediate system and pseudonode on LANs, narrow and wide metrics, and a basic Cisco IOS configuration.
10 min read · Advanced
IS-IS authentication, redistribution, summarisation, filtering and route leaking
How to secure IS-IS adjacencies and LSPs with authentication, redistribute routes into IS-IS, summarise at level boundaries, filter routes and leak level 2 routes into level 1 for better exit selection, with Cisco IOS examples.
9 min read · Advanced
HSRP and VRRP configuration, tracking and troubleshooting on Cisco IOS
Step-by-step HSRP and VRRP configuration with priorities, pre-emption, interface tracking and authentication, the differences between HSRP versions 1 and 2 and VRRPv3, and a checklist for fixing common first hop redundancy faults.
9 min read · Intermediate
Configuring NAT on Cisco IOS: static NAT, dynamic NAT, PAT and port forwarding
How to configure and verify static NAT, dynamic NAT with a pool, PAT (overload) and port forwarding on a Cisco router, what inside local and inside global mean, and how to troubleshoot translations that do not work.
9 min read · Intermediate
Cisco IOS ACLs in practice: wildcard bits, standard and extended ACL examples
How Cisco IOS access lists are written, numbered, named, edited and applied, how wildcard bits work (including non-contiguous masks), and worked standard and extended ACL examples with verification commands.
9 min read · Intermediate
Extended ACL options: the established keyword and time-based ACLs
How the established keyword lets return TCP traffic back in, why it is not the same as a stateful firewall, and how to build time-based ACLs with time ranges that permit or block traffic during set hours.
8 min read · Intermediate
Infrastructure ACLs: protecting routers and network devices at the edge
What an infrastructure ACL (iACL) is, why it protects routers and switches better than per-device rules alone, the four-part structure, an example for an internet edge, and how it works alongside uRPF and control plane policing.
8 min read · Advanced
IPv6 access lists on Cisco IOS: syntax, implicit rules and Neighbour Discovery
How IPv6 ACLs differ from IPv4 ACLs on Cisco IOS: named-only syntax, prefix lengths, applying them with ipv6 traffic-filter, the implicit Neighbour Discovery permits, and which ICMPv6 messages you must not block.
8 min read · Intermediate
QoS fundamentals: delay, jitter, loss, the bandwidth-delay product and the three QoS models
What quality of service really controls, the four kinds of delay, jitter and packet loss, how to calculate the bandwidth-delay product, and how best effort, IntServ with RSVP and DiffServ compare.
8 min read · Intermediate
IP Precedence and DSCP values: CS, AF and EF classes and how to decode them
How the ToS byte evolved from IP Precedence to DSCP and ECN, how class selector, assured forwarding and expedited forwarding values are built, how to convert between decimal, binary and ToS values, and common marking choices.
8 min read · Intermediate
QoS classification and marking on Cisco IOS: class maps, NBAR and set commands
How to classify traffic with class maps using ACLs, DSCP, CoS and NBAR application recognition, how to mark it with set commands in a policy map, where to apply the policy, how QoS pre-classify works on tunnels, and how to verify the result.
9 min read · Intermediate
QoS on LAN switches: trust boundaries, CoS-DSCP mapping and egress queues
Why switches need QoS even on fast links, where to place the trust boundary, how conditional trust works with IP phones, how switches map CoS and DSCP, and how egress queues are configured on legacy Catalyst MLS QoS and modern Catalyst 9000 switches.
8 min read · Intermediate
Congestion management: CBWFQ, LLQ, bandwidth remaining and hierarchical policies
How class-based weighted fair queuing guarantees bandwidth, how low latency queuing adds a policed priority queue, why priority queues used to starve other traffic, the difference between bandwidth and bandwidth remaining, and why sub-interfaces need a parent shaper.
9 min read · Advanced
Traffic shaping and policing: CIR, Bc, Be, token buckets and Cisco IOS configuration
How shapers and policers use token buckets, what CIR, Bc, Be and Tc mean, average versus peak shaping, single-rate and two-rate policers with conform, exceed and violate actions, and the legacy Frame Relay traffic shaping you may still read about.
9 min read · Advanced
Congestion avoidance and other QoS tools: WRED, ECN, link fragmentation, RSVP and IP SLA testing
How tail drop causes TCP global synchronisation, how RED and WRED avoid it, where ECN fits, and other QoS tools: legacy multilink PPP fragmentation and interleaving, RSVP admission control, and IP SLA operations to measure delay and jitter.
9 min read · Advanced
BGP fundamentals: autonomous systems, path vector routing, eBGP, iBGP and multihoming
What the Border Gateway Protocol does, autonomous system numbers including private and 4-byte ASNs, how path vector routing prevents loops, the difference between eBGP and iBGP, and when single-homed, dual-homed and multihomed sites need BGP.
9 min read · Intermediate
Configuring BGP on Cisco IOS: neighbours, network statements, next hop and reading the BGP table
A practical guide to configuring eBGP and iBGP on Cisco IOS, advertising networks with network statements and aggregates, eBGP multihop to loopbacks, the iBGP next-hop problem and next-hop-self, auto-summary, and how to read show ip bgp output.
10 min read · Intermediate
BGP neighbour states, messages and troubleshooting sessions and missing routes
The BGP finite state machine from Idle to Established, the five BGP message types, active and passive session roles, a checklist for sessions that will not come up, why advertised routes go missing, and soft reconfiguration versus route refresh.
9 min read · Intermediate
BGP path attributes and best path selection: weight, local preference, AS path, MED and more
The BGP path attributes and the order Cisco routers use to choose the best path: weight, local preference, locally originated, AIGP, AS path length and prepending, origin, MED, eBGP over iBGP, IGP metric and tie-breakers, plus BGP multipath.
10 min read · Advanced
BGP communities and route filtering: prefix lists, AS path regex, route maps and avoiding transit
How BGP communities tag routes, the well-known NO_EXPORT, NO_ADVERTISE and LOCAL_AS communities, filtering with prefix lists, AS path regular expressions and route maps, IPv6 route filtering, legacy extended ACL filtering, and how to stop your network becoming a transit AS.
10 min read · Advanced
Scaling iBGP: full mesh, route reflectors, confederations, peer groups and synchronisation
Why iBGP needs a full mesh, how route reflectors and their client rules work, how confederations split an AS into member ASes, how peer groups and templates simplify configuration, and what the old BGP synchronisation rule did.
9 min read · Advanced
Advanced BGP features: MP-BGP, private AS removal, allowas-in, AS override, aggregation, dampening and backdoors
A tour of the BGP features you meet in CCNP and provider networks: multiprotocol BGP address families, removing private ASNs, allowas-in and as-override for sites sharing an ASN, 4-byte ASN compatibility, aggregation with AS_SET, route dampening and backdoor routes.
10 min read · Advanced
BGP security and convergence: route leaks, RPKI, next-hop tracking, Add-Path and PIC
How route leaks and hijacks happen, how RPKI route origin validation works and how to deploy it, session protections such as TTL security and maximum-prefix, and the features that make BGP converge faster: next-hop tracking, BFD, Add-Path and Prefix Independent Convergence.
10 min read · Advanced
MPLS fundamentals: labels, LSRs, label operations and LDP
Why service providers use Multiprotocol Label Switching, the MPLS label format, the roles of CE, PE and P routers, push, swap and pop operations, penultimate hop popping, how LDP discovers neighbours and distributes labels, and how to filter LDP labels.
9 min read · Advanced
VRFs and MPLS Layer 3 VPNs: route distinguishers, route targets and MP-BGP
How VRFs create separate routing tables on one router, VRF-lite without MPLS, and how an MPLS L3VPN uses route distinguishers, route targets, VPNv4 routes in MP-BGP and a two-label stack to give many customers private any-to-any networks.
10 min read · Advanced
MPLS L3VPN PE-CE routing and route leaking: BGP, OSPF sham links, EIGRP, RIP and extranets
How customer routers exchange routes with an MPLS VPN using static routes, eBGP, OSPF, EIGRP or RIP, why OSPF sites need sham links when a backdoor exists, how default routes reach VRFs, and how extranets, import and export maps and VRF-lite route leaking share routes between VRFs. Also MPLS over FlexVPN.
10 min read · Advanced
MPLS Layer 2 VPNs and IPv6 over MPLS: AToM pseudowires, VPLS, EVPN, 6PE and 6VPE
How Any Transport over MPLS builds point-to-point pseudowires, how VPLS and EVPN extend that to multipoint Ethernet, and how 6PE and 6VPE carry IPv6 and IPv6 VPNs across an IPv4-only MPLS core without upgrading the P routers.
8 min read · Advanced
DHCP on Cisco IOS: server pools, exclusions, static bindings and DHCP clients
How to run a DHCP server on a Cisco router or Layer 3 switch: pools, excluded ranges, options and leases, how to reserve an address with a static binding, and how to make a router interface a DHCP client.
9 min read · Intermediate
DHCP relay, APIPA and troubleshooting DHCP step by step
Why DHCP needs a relay agent when the server is on another subnet, how ip helper-address and the giaddr field work, what an APIPA 169.254 address tells you, and a structured way to troubleshoot clients that do not get an address.
9 min read · Intermediate
The Cisco IOS file system: flash, NVRAM, copying files and the running configuration
A practical guide to the Cisco IOS file system: what flash, NVRAM and the system file system hold, how to list and copy files, how to back up and restore configurations, and why copying into the running configuration merges rather than replaces.
8 min read · Beginner
Syslog on Cisco IOS: message format, severity levels and logging destinations
How to read a Cisco IOS syslog message (facility, severity and mnemonic), what the eight severity levels from 0 to 7 mean, and how to send logs to the console, buffer, terminal sessions and a central syslog server with accurate timestamps.
8 min read · Beginner
NTP on Cisco IOS: stratum, configuration, NTPv4, authentication and troubleshooting
Why accurate time matters on a network, how NTP strata and associations work, how to configure Cisco IOS as an NTP client and server with authentication, what NTPv4 added (including IPv6), and how to fix devices that will not synchronise.
9 min read · Intermediate
SNMP in depth: managers, agents, MIBs, OIDs, traps and SNMPv3
How the Simple Network Management Protocol works: managers and agents, the MIB and object identifiers, get, set, trap and inform messages, the differences between SNMPv1, v2c and v3, and a secure SNMPv3 configuration on Cisco IOS.
9 min read · Intermediate
Cloud computing for network engineers: characteristics, service and deployment models, and connectivity
The five essential characteristics of cloud computing, the IaaS, PaaS and SaaS service models and the public, private, community and hybrid deployment models, explained from a network engineer's point of view, with how sites connect to the cloud.
9 min read · Beginner
Overlay networks explained: underlay, tunnels, VXLAN, LISP and when to use them
What underlay and overlay networks are, the main overlay technologies (GRE, IPsec VPNs, DMVPN, VXLAN, LISP and SD-WAN), how a VXLAN tunnel works, and the benefits and costs of overlays, including MTU and troubleshooting.
9 min read · Intermediate
Data formats, YANG models and device programmability: NETCONF, RESTCONF and gNMI
Why the CLI and SNMP are awkward for automation, the data formats you will meet (XML, JSON and YAML), what a YANG data model is, and how NETCONF, RESTCONF and gNMI/gRPC let software read and change device configuration and stream telemetry.
10 min read · Intermediate
REST APIs for network engineers: resources, CRUD, status codes and authentication
What a REST API is and why network controllers and cloud platforms use them, how CRUD maps to HTTP methods, how to read status codes and JSON responses, and the common ways APIs authenticate you: basic authentication, API keys, tokens and OAuth 2.0.
9 min read · Beginner
Configuration management tools, version control and Terraform for networks
How configuration management tools such as Ansible, Puppet, Chef and Salt differ (agent or agentless, push or pull, procedural or declarative), why Git version control matters for network changes, and how Terraform builds cloud and network infrastructure as code.
10 min read · Intermediate
SDN controllers in practice: OpenDaylight, ONOS and Cisco SD-Access
How open-source SDN controllers OpenDaylight and ONOS are built and used, and how Cisco SD-Access turns the campus into a controller-driven fabric with Catalyst Center, a VXLAN overlay, a LISP control plane and group-based policy using SGTs and ISE.
10 min read · Advanced
Controller path trace and ACL analysis: from APIC-EM to Catalyst Center
What a controller-based path trace does, how the legacy Cisco APIC-EM path trace and ACL analysis tool worked, what replaced it in Catalyst Center Assurance, and how to check the same things by hand on the command line.
8 min read · Intermediate
AI and machine learning in networking: concepts, real uses and safe adoption
What artificial intelligence, machine learning and generative AI are, the main kinds of machine learning, and how they are used in network operations: baselining, anomaly detection, root-cause analysis, Wi-Fi optimisation and AI assistants, with their limits and risks.
9 min read · Beginner
Python for network engineers: strings, f-strings, input, split and slicing
The Python text skills network scripts use most: creating and changing strings, useful string methods, formatting reports with f-strings, asking the user for input, splitting device output into fields, and slicing out the part you need.
9 min read · Beginner
Python operators for network engineers: arithmetic, comparison, logic, membership and bitwise
The Python operators network scripts rely on, with network examples: arithmetic for bandwidth and capacity, comparison and logical operators for decisions, membership and identity tests, and bitwise operators that show how subnet masks really work.
9 min read · Beginner
Metro Ethernet and Carrier Ethernet services: E-Line, E-LAN and E-Tree
What Metro Ethernet is, how providers deliver Ethernet across a city or country, the MEF service types (E-Line, E-LAN, E-Tree), port-based versus VLAN-based services, bandwidth profiles and how to connect a router to the service.
8 min read · Intermediate
HDLC and PPP on Cisco serial links: configuration and troubleshooting
How point-to-point serial WAN links work on Cisco routers: DCE and DTE and the clock rate, Cisco HDLC, PPP with LCP and NCPs, PAP and CHAP authentication, and the show and debug commands that find faults.
8 min read · Beginner
GRE tunnels on Cisco IOS: configuration, MTU and common problems
How Generic Routing Encapsulation (GRE) builds virtual point-to-point links over another network, how to configure a GRE tunnel on Cisco IOS, why MTU and MSS matter, how to avoid recursive routing, and why GRE is combined with IPsec.
9 min read · Intermediate
Frame Relay (legacy WAN): DLCIs, LMI, point-to-point and multipoint
A concise guide to Frame Relay, the legacy packet-switched WAN: virtual circuits, DLCIs, LMI and Inverse ARP, the provider switch, point-to-point and multipoint sub-interfaces, split horizon problems, and what replaced it.
9 min read · Intermediate
Advanced PPP: multilink, fragmentation and interleaving, PPPoA and PPPoE
How PPP grew beyond single serial links: Multilink PPP to bundle links, link fragmentation and interleaving for voice, PPP over ATM for older DSL, and PPPoE, still used by many broadband providers, with Cisco IOS client and server examples.
10 min read · Intermediate
Performance Routing (PfR) and OER: legacy intelligent path control
A concise guide to Cisco Optimized Edge Routing (OER) and Performance Routing (PfR): master controllers and border routers, the five phases, policies and variance, timers for labs, and how SD-WAN application-aware routing replaced them.
8 min read · Advanced
Cellular WAN: from legacy 3G to 4G and 5G backup links
How routers use mobile networks as a WAN link: what 3G wireless WAN was and why it is legacy, how a modern 4G or 5G interface is set up with an APN, and how to make it a reliable backup with floating static routes and IP SLA tracking.
8 min read · Intermediate
Cisco Catalyst SD-WAN architecture: Manager, Controller, Validator, OMP and TLOCs
How Cisco Catalyst SD-WAN (formerly Viptela) is built: the Manager, Controller and Validator roles and their old names, WAN edge routers, control connections, OMP, TLOCs and colours, system IP and site ID, and how the data plane tunnels form.
10 min read · Advanced
Cisco SD-WAN lab, onboarding and templates: from controllers to configured edges
How to build a Cisco Catalyst SD-WAN lab, install the controllers, register devices through Plug and Play Connect, onboard vEdge and cEdge routers, and configure them with device templates, feature templates, CLI templates and configuration groups.
10 min read · Advanced
Cisco SD-WAN service VPNs, OSPF and BGP at the site
How Cisco SD-WAN separates traffic with VPN 0, VPN 512 and service VPNs, how service VPNs map to VRFs on IOS XE edges, and how OSPF and BGP connect site LANs and data centres to the overlay through redistribution with OMP.
9 min read · Advanced
Cisco SD-WAN policies: localised, centralised, hub-and-spoke and application-aware routing
How Cisco SD-WAN policies work: localised policies on the edge (QoS, ACLs, policers, route policies for BGP and OSPF) and centralised policies on the Controller (control policies that build topologies such as hub-and-spoke, data policies and application-aware routing with SLA classes).
10 min read · Advanced
The areas of cyber security: network, endpoint, cloud, identity and more
A tour of the main areas of cyber security, from network and endpoint security to identity, application, data, cloud, OT and physical security, and how they fit together in one programme.
7 min read · Beginner
Common types of cyber attack and how to defend against each
An overview of the attack types you meet most often, including malware, phishing, credential attacks, denial of service, interception, injection, supply chain attacks and insider misuse, with the main defence for each.
8 min read · Beginner
Cyber hygiene: the essential controls for people and small organisations
The everyday security habits and basic technical controls that stop most common attacks, using the UK Cyber Essentials scheme as a checklist, with advice for individuals and small organisations.
7 min read · Beginner
Cyber resilience: planning to keep running when attacks succeed
What cyber resilience means, how it differs from cyber security, and the practical building blocks: critical service mapping, recovery objectives, immutable backups, business continuity plans and exercises.
8 min read · Intermediate
Types of hackers: white hat, black hat, grey hat and more
What the white hat, black hat and grey hat labels mean, how other groups such as hacktivists, script kiddies and bug bounty hunters fit in, and why permission is the dividing line.
6 min read · Beginner
The five phases of ethical hacking and how defenders respond
The classic five-phase hacking model of reconnaissance, scanning, gaining access, maintaining access and covering tracks, explained from a defender's point of view with the controls that break each phase.
8 min read · Beginner
Becoming an ethical hacker: skills, certifications and legal practice
The technical and professional skills ethical hackers need, how ethical hacking relates to penetration testing, the main certifications such as CEH, PenTest+ and OSCP, and safe, legal ways to practise.
8 min read · Beginner
Wireless security testing: what assessors check and how to harden Wi-Fi
What an authorised wireless security assessment looks at, including WPA2 and WPA3, Personal and Enterprise modes, rogue and evil twin access points, guest isolation and signal leakage, with practical hardening steps.
8 min read · Intermediate
Types of vulnerability: software, configuration, network, hardware, cloud and human
The main kinds of security vulnerability, from software bugs and zero-days to misconfigurations, weak network services, hardware and firmware flaws, cloud mistakes and human or process gaps.
7 min read · Beginner
Types of vulnerability assessment and how they differ from penetration tests
The main kinds of vulnerability assessment, including network, host, wireless, application and database assessments, a simple step-by-step process, and how assessments compare with penetration testing and vulnerability management.
8 min read · Beginner
Configuration assessment: misconfigurations, CIS Benchmarks and hardening
How to find and fix security misconfigurations using secure baselines such as the CIS Benchmarks, including default credentials, unneeded services, weak TLS, risky software, open ports and configuration drift.
8 min read · Intermediate
From vulnerability management to exposure management: CTEM, CSPM and metrics
How vulnerability management is widening into exposure management, including the five CTEM stages, external attack surface management, cloud posture tools, attack path analysis and metrics that show real risk reduction.
9 min read · Advanced
The digital forensic investigation process: from identification to report
The stages of a digital forensic investigation, identification, preservation, collection, examination and analysis, and reporting, with how they differ between incident response and HR or legal cases.
8 min read · Beginner
Branches of digital forensics: computer, mobile, email, cloud, database and more
An overview of the main branches of digital forensics, including computer, memory, network, mobile, email, cloud, database and malware forensics, with typical evidence for each and the skills and roles involved.
7 min read · Beginner
Mobile device forensics: isolation, acquisition and the challenge of encryption
How investigators handle smartphones as evidence: isolating them from networks, the levels of acquisition from manual to physical, the impact of encryption and locked devices, cloud backups and the key artefacts phones hold.
8 min read · Intermediate
Forensic tools and modern challenges: encryption, cloud, volume and anti-forensics
The main categories of digital forensic tool, with well-known free and commercial examples, and the big challenges facing examiners today: encryption, cloud data, huge volumes, anti-forensic techniques and validating tools.
8 min read · Intermediate
SecOps explained: how security and IT operations work together
What SecOps (security operations) means, how it differs from a SOC and from DevOps, the daily work it involves, the common challenges teams face and a practical order for building a programme.
8 min read · Beginner
Network security monitoring: packet captures, NetFlow and session data
The kinds of data a SOC uses to watch a network, from full packet capture to NetFlow and IPFIX flow records, what each reveals, where to collect it, and how encryption changes what you can see.
9 min read · Intermediate
Threat hunting: hypothesis-driven searching for hidden attackers
What threat hunting is, how it differs from alert-driven detection, the three main hunting approaches, a step-by-step hunting loop and how to turn every hunt into better detections.
9 min read · Intermediate
Log sources and log analysis: Windows, Linux, firewall and web logs
Which logs matter most for security monitoring, useful Windows event IDs and Linux log files, how to read firewall and web server logs, and a simple method for analysing logs during an investigation.
10 min read · Intermediate
Threat intelligence platforms and practical use cases
What a threat intelligence platform (TIP) does, how it connects to the SIEM, EDR and firewall, and the practical ways intelligence helps with alert triage, incident response, patching, fraud and brand protection.
9 min read · Intermediate
Malware analysis basics for defenders: static, dynamic and sandboxes
An introduction to malware analysis for SOC and threat intelligence work: the main types of malware, static and dynamic analysis, sandboxes, building a safe lab and turning findings into indicators and YARA rules.
9 min read · Intermediate
Incident response frameworks compared: NIST, SANS PICERL and ISO/IEC 27035
How the main incident response models compare: the four NIST SP 800-61 Rev. 2 phases, the six SANS PICERL steps, the 2025 NIST Rev. 3 approach built on CSF 2.0, and ISO/IEC 27035, with advice on choosing one.
8 min read · Intermediate
Responding to denial-of-service attacks: detection, mitigation and preparation
How to recognise and respond to denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks: the main attack types, the first steps, mitigation through your provider, communication and how to prepare in advance.
8 min read · Intermediate
Handling insider threat incidents: malicious, negligent and compromised insiders
How to respond fairly and effectively when the threat comes from inside: the three types of insider, warning signs, working with HR and legal, protecting evidence and privacy, and the controls that reduce insider risk.
9 min read · Intermediate
Cloud deployment models: public, private, hybrid, community and multi-cloud
The five cloud deployment models, how they differ in ownership, cost and control, and a practical way to choose the right model for a workload.
7 min read · Beginner
Cloud regions, availability zones and edge locations
How cloud providers organise their infrastructure into regions, availability zones and edge locations, and how to use them for resilience, low latency and data residency.
7 min read · Beginner
Cloud networking basics: VPCs, VNets, subnets, route tables and gateways
The building blocks of a cloud virtual network: address space, public and private subnets, route tables, internet and NAT gateways, and how they compare with a traditional network.
8 min read · Beginner
Cloud storage types: object, block and file storage
Object, block and file storage in the cloud: how each works, when to use it, storage tiers, durability versus availability, and the main security settings.
7 min read · Beginner
Compute options: virtual machines, containers and serverless compared
A side-by-side look at virtual machines, containers and serverless functions in the cloud: what you manage, cost, scaling, security responsibilities and when to choose each.
8 min read · Beginner
Cloud costs and FinOps: pricing models, tagging, budgets and rightsizing
How cloud pricing works, the FinOps cycle, tagging and budgets for cost visibility, rightsizing and commitment discounts, and the surprises that inflate bills.
8 min read · Beginner
AWS IAM basics: root account, users, groups, roles and least privilege
The core of AWS Identity and Access Management: protecting the root user, users versus roles, writing policies, how AWS evaluates permissions, and applying least privilege.
9 min read · Beginner
AWS VPC security: security groups, network ACLs, subnets and NAT
How to secure an Amazon VPC: security groups versus network ACLs, public and private subnet design, NAT gateways, VPC endpoints and flow logs.
9 min read · Intermediate
Securing Amazon S3: public access, bucket policies, encryption and logging
A practical guide to protecting Amazon S3 buckets with Block Public Access, bucket policies, encryption, versioning, Object Lock, logging and data discovery.
9 min read · Intermediate
AWS logging and detection: CloudTrail, CloudWatch, GuardDuty and Security Hub
What each AWS logging and detection service does, how they fit together, which events to alert on, and how to build a sensible baseline for a new account.
9 min read · Intermediate
Encryption on AWS: KMS keys, envelope encryption and key policies
How AWS Key Management Service works, the types of KMS key, envelope encryption, key policies and grants, rotation, and encrypting data in transit.
9 min read · Intermediate
The AWS Well-Architected security pillar in practice
The design principles and best-practice areas of the AWS Well-Architected Framework security pillar, with practical examples of applying each one to a real workload.
8 min read · Intermediate
Microsoft Entra ID: identities, Conditional Access, MFA and identity protection
An introduction to Microsoft Entra ID (formerly Azure AD): tenants and identity types, MFA methods, Conditional Access policies, risk-based identity protection and privileged access.
9 min read · Intermediate
Azure RBAC and governance: management groups, subscriptions and Azure Policy
How Azure organises resources into management groups, subscriptions and resource groups, how role-based access control works, and how Azure Policy enforces standards.
9 min read · Intermediate
Azure network security: VNets, NSGs, Azure Firewall, private endpoints and Bastion
How to secure Azure virtual networks with network security groups, Azure Firewall, user-defined routes, private endpoints, Azure Bastion and DDoS protection in a hub-and-spoke design.
9 min read · Intermediate
Microsoft Defender for Cloud: secure score, recommendations and workload protection
What Microsoft Defender for Cloud does: cloud security posture management, secure score and recommendations, Defender workload protection plans, alerts and multicloud coverage.
8 min read · Intermediate
Azure Key Vault: secrets, keys, certificates, access control and rotation
How Azure Key Vault stores secrets, keys and certificates, how to control access with Azure RBAC and managed identities, and how to protect and rotate what it holds.
8 min read · Intermediate
Azure Monitor, Log Analytics and Microsoft Sentinel concepts
How Azure Monitor collects metrics and logs, what a Log Analytics workspace is, how KQL queries work, and how Microsoft Sentinel turns those logs into detections, incidents and automated responses.
9 min read · Intermediate
Well-architected frameworks: common pillars across AWS, Azure and Google Cloud
What well-architected frameworks are, the pillars that AWS, Microsoft Azure and Google Cloud share, the trade-offs between pillars, and how to run a workload review.
8 min read · Intermediate
Landing zones: account structure, guardrails, network hub and identity
What a cloud landing zone is, how to structure accounts or subscriptions, which guardrails to apply, how the network hub and identity fit in, and the provider tools that help.
9 min read · Advanced
High availability and disaster recovery in the cloud
How to design cloud workloads for high availability and disaster recovery: RTO and RPO, multi-AZ and multi-region patterns, DR strategies, backup good practice and testing.
9 min read · Intermediate
Hybrid connectivity: site-to-site VPN versus Direct Connect and ExpressRoute
How to connect on-premises networks to the cloud using site-to-site IPsec VPNs or dedicated links such as AWS Direct Connect, Azure ExpressRoute and Google Cloud Interconnect, including resilience and security.
9 min read · Intermediate
Multi-cloud: reasons, challenges, portability and consistent security
Why organisations use more than one public cloud, the real challenges it brings, how portable designs work, and how to keep security consistent across AWS, Azure and Google Cloud.
8 min read · Advanced
Cloud migration strategies: the 7 Rs and planning migration waves
The seven common cloud migration strategies (retire, retain, rehost, relocate, repurchase, replatform, refactor), how to choose between them, how to plan waves, and how to keep security intact during the move.
9 min read · Intermediate
Identity and access management: identities, authentication, authorisation and lifecycle
The core ideas of identity and access management (IAM): what an identity is, how authentication differs from authorisation, and how the joiner, mover, leaver lifecycle keeps access correct over time.
7 min read · Beginner
Single sign-on and federation: SAML, OAuth 2.0 and OpenID Connect
How single sign-on and federation let one identity provider vouch for users across many applications, and what SAML, OAuth 2.0 and OpenID Connect each actually do.
9 min read · Intermediate
MFA and passwordless sign-in: factors, FIDO2 and passkeys
The types of authentication factor, how common MFA methods compare in strength, and why FIDO2 security keys and passkeys are called phishing-resistant.
8 min read · Beginner
Access control models: RBAC, ABAC, least privilege and access reviews
How role-based and attribute-based access control work, how they compare, and how least privilege and regular access reviews keep permissions under control in cloud environments.
8 min read · Intermediate
Privileged access management: admin accounts, just-in-time access and break-glass
Why privileged accounts need extra protection, and how vaulting, just-in-time elevation, session recording and break-glass accounts keep administrative power under control.
8 min read · Intermediate
Service accounts, workload identities and secrets: avoiding long-lived keys
How applications, scripts and pipelines should authenticate to cloud services, why long-lived access keys are risky, and how managed identities and workload identity federation remove them.
8 min read · Intermediate
Containers versus virtual machines: images, layers and isolation
What containers are, how images and layers work, how isolation differs from virtual machines, and why those differences matter for security.
7 min read · Beginner
Container image security: minimal bases, scanning, secrets and pinning
Practical ways to build safer container images: choose minimal base images, use multi-stage builds, scan for vulnerabilities and secrets, run as non-root and pin images by digest.
8 min read · Intermediate
Software supply chain for containers: registries, signing, SBOMs and provenance
How attackers target the path from source code to running container, and how private registries, image signing, software bills of materials (SBOMs) and build provenance help you trust what you deploy.
9 min read · Advanced
Container runtime security: least privilege, read-only filesystems, capabilities and monitoring
How to restrict what a running container can do using non-root users, dropped Linux capabilities, read-only filesystems, seccomp and resource limits, and how to detect suspicious behaviour at runtime.
8 min read · Intermediate
Hardening Docker hosts and daemons: CIS ideas, rootless mode and user namespaces
How to secure the machine and daemon that run your containers, drawing on CIS Docker Benchmark ideas, rootless mode, user namespace remapping, socket protection and auditing.
8 min read · Intermediate
Handling secrets for containers: environment variables, secret stores and rotation
How to supply passwords, API keys and certificates to containers safely, comparing environment variables, mounted files and external secret stores, and how to rotate secrets without downtime.
8 min read · Intermediate
Kubernetes architecture: control plane, nodes, pods and services
A plain-language tour of Kubernetes components, from the API server and etcd to nodes, pods, deployments and services, showing where each security control fits.
8 min read · Beginner
Kubernetes RBAC: roles, cluster roles, bindings and service accounts
How Kubernetes role-based access control works, the difference between Roles and ClusterRoles and their bindings, how service accounts fit in, and how to apply least privilege.
9 min read · Intermediate
Kubernetes network policies: default deny and allowing only needed traffic
How Kubernetes NetworkPolicy objects segment pod traffic, why you start with default deny for ingress and egress, and how to allow only the flows each application needs, including DNS.
8 min read · Intermediate
Pod Security Standards and admission control: privileged, baseline and restricted
How Kubernetes Pod Security Standards define privileged, baseline and restricted profiles, how Pod Security admission enforces them per namespace, and where policy engines add further checks.
8 min read · Intermediate
Kubernetes Secrets and etcd encryption: risks and better options
Why Kubernetes Secrets are only base64-encoded by default, how to turn on encryption at rest with a KMS provider, how to lock down etcd and its backups, and when to use an external secret store instead.
8 min read · Advanced
Hardening a Kubernetes cluster: API access, upgrades, auditing and CIS ideas
A practical plan for hardening a Kubernetes cluster: restricting API server access, securing nodes and the kubelet, staying on supported versions, enabling audit logging and checking against the CIS Kubernetes Benchmark.
9 min read · Advanced
Observability in the cloud: logs, metrics and traces
What observability means, how logs, metrics and traces differ and fit together, why cloud and microservice systems need them, and how OpenTelemetry standardises collection.
7 min read · Beginner
A cloud logging strategy: what to log, central storage, retention and protection
How to plan logging in the cloud: which sources matter most, how to centralise logs in a protected account, how long to keep them, and how to stop attackers and mistakes from deleting or altering them.
8 min read · Intermediate
Cloud security posture management: finding misconfigurations continuously
What cloud security posture management (CSPM) tools do, the misconfigurations they find, how they relate to CNAPP, and how to turn findings into lasting fixes with prioritisation and guardrails.
8 min read · Intermediate
Cloud alerting and on-call: thresholds, noise reduction and runbooks
How to design cloud alerts that people trust: choosing thresholds, alerting on symptoms and SLOs, cutting noise, routing by severity, writing runbooks and running a sustainable on-call rota.
8 min read · Intermediate
Monitoring cost and performance together: dashboards, anomalies and budgets
Why cloud cost and performance should be watched side by side, which metrics to combine on dashboards, how budgets and cost anomaly detection work, and how unexpected spend can reveal security problems.
7 min read · Beginner
Incident response and forensics in the cloud: snapshots, isolation, logs and provider support
How incident response changes in the cloud: preparing accounts and logs in advance, containing compromised identities and workloads, preserving evidence with snapshots, investigating with audit logs and working with your provider.
9 min read · Advanced
Types of security control and defence in depth
How security controls are classified by purpose (preventive, detective, corrective) and by type (administrative, technical, physical), and how layering them builds defence in depth.
7 min read · Beginner
What is cyber security? Assets, threats, impact and careers
A plain introduction to cyber security today: what it protects, the threats it faces, what incidents really cost an organisation, and the main roles and career paths in the field.
7 min read · Beginner
Threat actors and their motives
Who attacks organisations and why: cyber criminals, nation states, hacktivists, insiders and low-skill attackers, with their typical methods and how knowing them shapes your defences.
7 min read · Beginner
Attack surface and attack vectors: how breaches start
What an attack surface is, the common attack vectors used to breach organisations, and practical ways to find and shrink your exposure.
7 min read · Beginner
Security frameworks: NIST CSF 2.0, ISO/IEC 27001 and CIS Controls
What security frameworks are for, the six functions of NIST CSF 2.0, how ISO/IEC 27001:2022 and the CIS Controls differ, and how to choose and combine them.
8 min read · Intermediate
PKI and digital certificates: CAs, chains of trust and TLS
How public key infrastructure works: certificate authorities, chains of trust, what is inside a TLS certificate, validation types, revocation, short lifetimes and automated renewal.
9 min read · Intermediate
Ethical hacking: permission, scope, law and disclosure
The principles that separate ethical hacking from crime: written authorisation, scope, rules of engagement, relevant laws such as the UK Computer Misuse Act, and responsible disclosure.
7 min read · Beginner
Reconnaissance and OSINT: what you leak and how to reduce it
How attackers and testers gather information before an attack, the difference between passive and active reconnaissance, what organisations commonly expose publicly, and how defenders reduce it.
7 min read · Beginner
Scanning and enumeration: discovery, port states and defences
The concepts behind network scanning and enumeration: host discovery, TCP and UDP port states, service and version detection, what enumeration reveals, and how defenders detect and limit scans.
8 min read · Intermediate
The OWASP Top 10 web application risks and their defences
A defender-focused walk through the OWASP Top 10:2025 categories of web application risk, with a plain example and the main fix for each, plus how to use the list at work.
9 min read · Intermediate
Password attacks and defences: spraying, stuffing and cracking
How password guessing, spraying, credential stuffing and offline cracking work at a concept level, and the defences that stop them: MFA, sensible policies, lockout, monitoring and proper hashing.
8 min read · Intermediate
Social engineering assessments and building awareness
How social engineering works, how authorised assessments such as phishing simulations, pretext calls and physical tests are run ethically, and how to turn the results into lasting awareness.
7 min read · Beginner
The vulnerability management lifecycle
The continuous process for handling security weaknesses: discovering assets and vulnerabilities, assessing and prioritising them, remediating, verifying fixes and reporting progress.
7 min read · Beginner
CVE, CVSS and EPSS: naming and scoring vulnerabilities
How publicly known vulnerabilities are identified with CVE IDs, how CVSS v4.0 scores severity, how EPSS estimates the chance of exploitation, and why the CISA KEV catalogue matters.
8 min read · Intermediate
Vulnerability scanning: authenticated, agent, internal and external
The main types of vulnerability scanning, including authenticated and unauthenticated, agent-based and network-based, internal and external, and how to handle false positives and false negatives.
8 min read · Intermediate
Prioritising vulnerabilities by real risk
How to decide which vulnerabilities to fix first by combining exploitation evidence, likelihood, severity, exposure, asset value and compensating controls, with a worked example.
8 min read · Intermediate
Patch management: testing, rollout rings and emergency patches
How to run patching as a reliable process: inventory, monitoring releases, testing, staged rollout rings, emergency patching, handling systems that cannot be patched, and measuring compliance.
8 min read · Intermediate
Vulnerability reporting and remediation tracking
How to turn vulnerability findings into fixed systems: assigning owners, setting remediation SLAs, handling exceptions properly, and reporting metrics that different audiences understand.
7 min read · Intermediate
Types of penetration test, from black box to red teaming
The different kinds of penetration test: black, grey and white box knowledge levels, target types such as external, internal, web, wireless and social engineering, and how red teaming differs.
7 min read · Beginner
Penetration testing methodologies: PTES, OWASP WSTG and NIST SP 800-115
Why penetration testers follow a methodology, the main published ones (PTES, OWASP WSTG, NIST SP 800-115, OSSTMM) and how their phases fit together into a consistent engagement.
8 min read · Intermediate
Planning and scoping a penetration test
How to plan a penetration test properly: setting objectives, defining scope and exclusions, rules of engagement, contacts and stop procedures, third-party permissions and the legal paperwork.
8 min read · Intermediate
Web application testing: what testers check and how to fix it
An overview of how authorised web application tests are carried out, the main areas examined, typical findings in each, and how development teams should fix and prevent them.
9 min read · Intermediate
Internal and external network testing: findings and fixes
What internal and external network penetration tests examine, the most common findings in each, and the practical fixes defenders apply to close them.
9 min read · Intermediate
Writing a penetration test report
How to write a penetration test report that gets results: the executive summary, scope and method, well-structured findings with risk ratings and evidence, practical remediation and retesting.
8 min read · Intermediate
What a security operations centre does
What a security operations centre (SOC) is, the people, processes and technology inside it, how analyst tiers work, and how in-house, outsourced and hybrid SOC models compare.
7 min read · Beginner
SIEM and log management: collection, correlation and retention
How a Security Information and Event Management (SIEM) platform collects, parses, normalises and correlates logs, how to plan retention, and how to build use cases that produce useful alerts.
8 min read · Intermediate
EDR and XDR: endpoint detection, response and host isolation
What Endpoint Detection and Response (EDR) records on laptops and servers, how analysts use it to investigate and isolate hosts, and how Extended Detection and Response (XDR) widens the view.
7 min read · Intermediate
Alert triage: true and false positives, enrichment and escalation
How SOC analysts triage alerts: telling true from false positives, enriching with context, deciding when to escalate and writing notes that others can trust.
7 min read · Beginner
Detection engineering: writing, testing and mapping detections
How to design, write, test and maintain detection rules as code, map them to the MITRE framework of attacker techniques, and use the vendor-neutral Sigma format.
9 min read · Advanced
SOAR automation and SOC metrics: playbooks, MTTD, MTTR and wellbeing
How Security Orchestration, Automation and Response (SOAR) tools run playbooks, which SOC metrics such as MTTD and MTTR are worth tracking, and why analyst wellbeing is a security issue.
8 min read · Intermediate
What cyber threat intelligence is: strategic, operational, tactical and technical
An introduction to cyber threat intelligence (CTI): how it differs from raw data, the four common levels of intelligence and who uses each one in an organisation.
7 min read · Beginner
The intelligence lifecycle: from requirements to feedback
The six stages of the threat intelligence lifecycle, direction, collection, processing, analysis, dissemination and feedback, with practical examples and common pitfalls at each stage.
8 min read · Intermediate
IOCs versus TTPs and the Pyramid of Pain
The difference between indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs), and how the Pyramid of Pain helps you choose detections that hurt attackers most.
7 min read · Intermediate
MITRE ATT&CK: tactics, techniques and procedures for defenders
How the MITRE knowledge base of adversary tactics and techniques is structured, how to read a technique entry, and how defenders use it for detection, threat-informed planning and gap analysis.
9 min read · Intermediate
Analysis models: the Cyber Kill Chain and the Diamond Model
How the Lockheed Martin Cyber Kill Chain and the Diamond Model of Intrusion Analysis help analysts structure attacks, plan defences and pivot between related evidence.
8 min read · Intermediate
Sharing threat intelligence: STIX, TAXII, ISACs and TLP
How organisations share threat intelligence safely: the STIX data format, the TAXII transport protocol, sector ISACs, the Traffic Light Protocol, and how to judge the quality of feeds.
8 min read · Intermediate
The incident response lifecycle (NIST SP 800-61)
The phases of incident response based on NIST SP 800-61: preparation, detection and analysis, containment, eradication, recovery and lessons learned, with what happens at each step.
8 min read · Beginner
Building an incident response plan and team
What goes into a practical incident response plan: team roles, contact lists, severity levels, decision authority, communication channels and playbooks, sized for small and large organisations.
8 min read · Intermediate
Responding to ransomware: the first hours, recovery and prevention
A defender's guide to ransomware incidents: what to do in the first hours, how to isolate safely, protect and use backups, approach the payment decision, report the incident and prevent repeat attacks.
9 min read · Intermediate
Responding to phishing and compromised email accounts
How to triage reported phishing, find and remove every copy, and respond when an email account is compromised: session revocation, password and MFA resets, malicious rules, scoping and supporting users.
8 min read · Intermediate
Incident communication and legal duties: regulators, customers and evidence
How to communicate during a security incident with staff, leaders, customers and the media, and the main legal duties such as the UK GDPR 72-hour breach notification, NIS rules and evidence preservation.
8 min read · Intermediate
Tabletop exercises: planning, running and learning from them
How to plan a discussion-based incident response exercise, write a realistic scenario with injects, facilitate the session and turn what you learn into tracked improvements.
8 min read · Intermediate
Digital forensics principles: integrity, chain of custody and admissibility
The core rules of digital forensics: protecting evidence integrity with hashing, recording chain of custody, keeping good notes and making sure findings can stand up in a disciplinary hearing or court.
8 min read · Beginner
Order of volatility and live response: what to collect first
Why some evidence disappears in seconds while other evidence lasts for years, the order of volatility from RFC 3227, and how to carry out a careful live response on a running system.
7 min read · Intermediate
Disk forensics: imaging, write blockers, hashing and deleted files
How to make a forensically sound copy of a drive using write blockers and hashing, which image formats to choose, how file systems store data, and why deleted files can often be recovered.
9 min read · Intermediate
Memory forensics: why RAM matters and what you can find
Why random access memory (RAM) is so valuable to investigators, what evidence a memory image can reveal, how memory is captured, and how tools such as Volatility are used at a concept level.
8 min read · Advanced
Network forensics: packet captures, flow data and logs
How investigators use full packet captures, NetFlow and IPFIX records, and firewall, proxy and DNS logs to reconstruct what happened on a network, with examples of tools and filters.
8 min read · Intermediate
Windows forensic artefacts and building a timeline
The Windows artefacts investigators rely on, including event logs, registry hives, prefetch, Amcache, browser history and file system journals, and how to combine them into a timeline of activity.
10 min read · Advanced
AI and machine learning basics for security people
A plain-language introduction to artificial intelligence and machine learning for network and security staff: the main learning types, how models are trained and judged, and the terms you will meet in security products.
8 min read · Beginner
AI for threat detection and security operations
How machine learning and generative AI are used in security operations: behaviour analytics, anomaly detection, alert triage and analyst assistants, with their strengths, limits and how to evaluate them.
8 min read · Intermediate
AI-powered attacks: deepfakes, AI phishing and automation
How criminals use AI to improve phishing, impersonate people with voice and video deepfakes, and automate reconnaissance, and the practical process and technical controls that defend against these attacks.
7 min read · Beginner
Securing LLM apps: prompt injection and the OWASP Top 10 for LLMs
The main security risks in applications built on large language models, including direct and indirect prompt injection, data leakage and excessive agency, mapped to the OWASP Top 10 for LLM Applications with practical controls.
9 min read · Intermediate
Adversarial machine learning: evasion, poisoning and model theft
How attackers target machine learning systems themselves through evasion, data poisoning, backdoors, model extraction and privacy attacks, and how to defend models across their lifecycle using frameworks such as MITRE ATLAS.
9 min read · Advanced
AI governance: NIST AI RMF, EU AI Act and ISO/IEC 42001
An overview of the main AI governance frameworks and laws that security and IT staff meet: the NIST AI Risk Management Framework, the EU AI Act risk tiers and the ISO/IEC 42001 AI management system standard.
9 min read · Intermediate
Using AI tools safely at work: data, accuracy and policies
Practical guidance for using chat assistants and AI features at work without leaking data, trusting wrong answers or breaking policy, with a checklist for engineers and a simple outline for an acceptable use policy.
7 min read · Beginner
From 1G to 5G: how mobile networks evolved
A tour of mobile network generations from analogue 1G to 5G, covering the main technologies, what each generation added, how security improved, and why older generations still matter to security teams.
8 min read · Beginner
5G architecture: RAN, core and the service-based architecture
How a 5G network is built: the user equipment, the radio access network with its RU, DU and CU split, the transport network, and the cloud-native 5G Core with its service-based architecture and key network functions.
9 min read · Intermediate
5G network slicing: logical networks on shared infrastructure
What 5G network slicing is, how slices are identified and selected, how they are created and managed, typical slice types, and the isolation and security questions that slicing raises.
8 min read · Intermediate
5G security features and risks
The security features designed into 5G, such as mutual authentication, concealed subscriber identities, service-based architecture protection and roaming security, and the main risks from virtualisation, supply chain, APIs and legacy networks.
9 min read · Advanced
Private 5G networks for enterprises
What private 5G networks are, the main deployment models, spectrum options, how they compare with Wi-Fi, typical industrial uses and the security and operational points an enterprise must plan for.
8 min read · Intermediate
5G service types: eMBB, URLLC and mMTC
The three 5G usage scenarios defined for IMT-2020, enhanced mobile broadband, ultra-reliable low-latency communication and massive machine-type communication, with realistic examples, their requirements and their security points.
7 min read · Beginner
What 6G may bring and when
A careful look at 6G: how the next mobile generation is being defined through the ITU IMT-2030 framework and 3GPP, the technologies being researched, the likely security themes and how to separate plans from hype.
7 min read · Beginner
What edge computing is
A clear introduction to edge computing: what it means to process data near where it is created, the different edge locations, why organisations use it, and the trade-offs compared with central cloud.
7 min read · Beginner
Edge versus fog versus cloud
How edge, fog and cloud computing differ and work together, what the term fog computing means, how to decide where a workload should run, and a worked example of a three-tier design.
7 min read · Beginner
Multi-access edge computing (MEC): compute inside the operator network
What multi-access edge computing is, how it places applications inside or beside the mobile network, how traffic is steered to it with 5G, what the ETSI MEC framework defines and the security points to check.
8 min read · Intermediate
AI at the edge: running models on local devices
Why organisations run machine learning inference on cameras, gateways and edge servers, how models are shrunk for small hardware, what federated learning is, and how to secure edge models and their data.
8 min read · Intermediate
Securing edge computing sites and devices
The particular risks of edge computing, from physical tampering and weak update processes to remote management exposure, and a layered set of controls from hardware root of trust to data protection.
9 min read · Intermediate
Edge computing use cases and how to choose them
Real-world uses of edge computing across retail, manufacturing, healthcare, transport, energy and media, with a simple method to decide whether a workload belongs at the edge or in the cloud.
7 min read · Beginner
Managing and orchestrating edge sites at scale
How organisations deploy, configure, update and monitor hundreds of edge sites: zero-touch provisioning, fleet management, lightweight Kubernetes, GitOps, staged rollouts and observability over unreliable links.
9 min read · Advanced
OpenFlow and flow tables explained
How OpenFlow lets an SDN controller program a switch: the controller channel, flow entries, priorities, multi-table pipelines, table-miss behaviour, group and meter tables, and hands-on commands with Open vSwitch.
8 min read · Intermediate
SDN controllers: ONOS, OpenDaylight and commercial options
What an SDN controller does, its northbound and southbound interfaces, how open-source controllers such as ONOS and OpenDaylight compare with commercial controllers, and how to keep a controller resilient and secure.
8 min read · Intermediate
Network functions virtualisation (NFV)
What network functions virtualisation is, how virtual and cloud-native network functions replace hardware appliances, the ETSI NFV architecture and MANO, how NFV relates to SDN, and its security points.
8 min read · Intermediate
Intent-based networking in practice
What intent-based networking (IBN) means beyond the marketing: translating business intent into policy, automated activation, continuous assurance and remediation, plus how to adopt it safely and where it fits with automation.
8 min read · Advanced
SDN campus and data centre fabrics: underlay, overlay and policy
A vendor-neutral look at how modern campus and data centre fabrics work: a routed underlay, a VXLAN overlay, an EVPN or LISP control plane, and a controller that turns intent into policy.
8 min read · Intermediate
SDN security: risks to the controller and how to protect it
The main security risks in software-defined networking, from controller compromise and API abuse to flow table exhaustion, and the layered controls that protect an SDN deployment.
8 min read · Intermediate
Programmable data planes and the P4 language
What a programmable data plane is, how the P4 language describes parsers and match-action tables, how it differs from OpenFlow, and where P4 is used for telemetry and security.
9 min read · Advanced
How blockchain works: blocks, hashes and chains
A plain explanation of the building blocks of a blockchain: hash functions, blocks, the chain of hashes, digital signatures, peer-to-peer copies and why tampering is hard to hide.
7 min read · Beginner
Blockchain consensus: proof of work versus proof of stake
How nodes in a blockchain agree on one history, how proof of work and proof of stake each make cheating expensive, their trade-offs, and the voting-based methods used in permissioned chains.
8 min read · Intermediate
Smart contracts: how they work and how they fail
What smart contracts are, how they run on a blockchain virtual machine, what they are used for, the most common security flaws, and the practices that reduce risk before and after deployment.
8 min read · Intermediate
Public, private and permissioned blockchains
The differences between public, private, consortium and hybrid blockchains, what permissionless and permissioned mean, and how to decide which type, if any, fits a business problem.
7 min read · Beginner
Blockchain security: attacks and weaknesses
The main ways blockchain systems are attacked, from 51% and eclipse attacks on the network to smart contract bugs, bridge flaws, key theft and scams, with detection and defence for each.
9 min read · Intermediate
Blockchain use cases beyond cryptocurrency
Realistic, non-financial uses of blockchain such as supply chain traceability, verifiable credentials and document timestamping, the problems they solve, their limits, and a simple test for deciding if a blockchain fits.
7 min read · Beginner
Wallets, keys and protecting digital assets
What a blockchain wallet really stores, how recovery phrases and hierarchical deterministic keys work, the difference between hot, cold, custodial and non-custodial wallets, and practical ways to protect keys.
8 min read · Beginner
Quantum computing basics: qubits, superposition and entanglement
A plain-language introduction to quantum computing: what qubits are, what superposition, entanglement and interference mean, why quantum computers are hard to build, and what they can and cannot do.
8 min read · Beginner
The quantum threat to cryptography: Shor's and Grover's algorithms
How a large quantum computer would affect today's cryptography: why Shor's algorithm breaks RSA and elliptic curve cryptography, why Grover's algorithm only weakens symmetric ciphers, and which systems are most exposed.
8 min read · Intermediate
Post-quantum cryptography: NIST FIPS 203, 204 and 205
What post-quantum cryptography is, the NIST standards FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), how they differ from RSA and ECC in practice, and how hybrid key exchange is being deployed.
9 min read · Intermediate
Harvest now, decrypt later: the quantum risk that exists today
What the harvest now, decrypt later threat is, why it makes quantum risk a present-day issue, how to judge which data is exposed using Mosca's inequality, and the steps that reduce the risk now.
7 min read · Intermediate
Preparing for post-quantum migration and crypto agility
A practical guide to planning a move to post-quantum cryptography: governance, building a cryptographic inventory, prioritising systems, testing hybrid modes, working with vendors and designing for crypto agility.
9 min read · Advanced
Quantum key distribution: how it works and where it fits
How quantum key distribution uses the physics of photons to detect eavesdropping, the BB84 idea in outline, its practical limits such as distance, trusted nodes and authentication, and how it compares with post-quantum cryptography.
8 min read · Advanced
Where quantum computing may help, and where it will not
A balanced look at the problems quantum computers might solve better than classical ones, such as simulating molecules and breaking public-key cryptography, the areas that remain uncertain, and why error correction matters.
8 min read · Beginner
Digital twins of networks and cities
What a digital twin is, how network digital twins let you test changes before touching production, how city and infrastructure twins work, and the security and privacy risks of keeping a live copy of real systems.
8 min read · Intermediate
AR, VR and extended reality: uses and security
What augmented, virtual and mixed reality are, how organisations use them for training, maintenance and design, the network needs they create, and the security and privacy risks of headsets full of sensors.
7 min read · Beginner
Low Earth orbit (LEO) satellite internet
How low Earth orbit satellite internet works compared with traditional geostationary services, where it is useful for homes, business backup and remote sites, and the network and security points engineers should know.
7 min read · Beginner
Wi-Fi 7 (802.11be) and the future of wireless LANs
What Wi-Fi 7 (IEEE 802.11be) adds over Wi-Fi 6 and 6E, including 320 MHz channels, 4096-QAM and multi-link operation, what it means for network design and security, and what is being developed next.
8 min read · Intermediate
AIOps and autonomous networks
How AIOps applies machine learning and automation to network operations, what autonomous or self-driving networks mean, the levels of autonomy used by industry bodies, and how to adopt them safely.
8 min read · Intermediate
Green IT and sustainable networks
How IT and networks affect energy use and carbon emissions, the key measures such as PUE and greenhouse gas scopes, and practical ways engineers can make networks, data centres and hardware lifecycles more sustainable and secure.
7 min read · Beginner
Skills for the future network and security engineer
A practical guide to the skills network and security engineers need as networks become automated, cloud-based and AI-assisted, with a learning plan, lab ideas, and how to show your skills to employers.
7 min read · Beginner
What is the Internet of Things (IoT)?
A plain introduction to the Internet of Things: what counts as an IoT device, how the idea grew, why the number of devices matters, and everyday examples you already use.
7 min read · Beginner
The building blocks of an IoT system
The five parts every IoT solution is built from: device, connectivity, platform, application and user, with what each part does and where security fits in.
7 min read · Beginner
IoT use cases: homes, healthcare, farming, cities, logistics and retail
Practical IoT use cases across six sectors, what problem each solves, what data it collects, and the security and privacy issues that come with it.
8 min read · Beginner
Microcontrollers vs single-board computers: Arduino, ESP32 and Raspberry Pi
How microcontrollers and single-board computers differ in power, memory, operating system and security, and how to choose between an Arduino, an ESP32 and a Raspberry Pi for a project.
8 min read · Beginner
Sensors and actuators: how IoT devices sense and act
What sensors and actuators are, the common types, the difference between analogue and digital signals, and how a raw reading becomes trustworthy data.
8 min read · Beginner
The IoT data lifecycle: collect, transmit, store, analyse, act, delete
Follow IoT data through its six lifecycle stages, from the moment a sensor takes a reading to secure deletion, with the security and privacy controls needed at each step.
8 min read · Beginner
Powering IoT devices: batteries, sleep modes and energy harvesting
How IoT devices are powered, how to estimate battery life, the low-power design techniques that make years on a battery possible, and how power limits affect security choices.
8 min read · Intermediate
Device, edge, fog and cloud: where IoT data is processed
Explains the four places IoT data can be processed, from the device itself to the cloud, and how to decide where each job should run based on latency, bandwidth, privacy and cost.
8 min read · Intermediate
IoT challenges: security, privacy, interoperability, scale and lifetime
The main challenges that make IoT hard to build and run safely, including weak security, privacy concerns, incompatible standards, sheer scale and devices that outlive their support.
8 min read · Beginner
IoT architecture layers: three-, four- and five-layer models
Compares the three-layer, four-layer and five-layer IoT architecture models, what each layer does, how they map to each other and how to use them for threat analysis.
8 min read · Beginner
The device-gateway-cloud pattern and why gateways exist
Explains the most common IoT architecture pattern, where devices connect through a local gateway to a cloud platform, what gateways do and how to secure them.
8 min read · Beginner
Edge computing for IoT: latency, bandwidth, privacy and offline operation
Why and when IoT systems process data at the edge, the main benefits, typical edge hardware and software, and the extra security work that edge nodes need.
8 min read · Intermediate
IoT platforms: registry, messaging, rules, storage and dashboards
A vendor-neutral look at what an IoT platform does: device registry, message ingestion, rules engines, storage, dashboards and device management, plus how to choose and secure one.
8 min read · Intermediate
Digital twins for IoT: what they are and how they are used
What a digital twin is, how it differs from a simple dashboard or simulation, where twins are used and the security issues they raise.
7 min read · Intermediate
IoT data pipelines and time-series databases
How IoT data flows from devices into storage: ingestion, queues, stream and batch processing, time-series databases, retention and downsampling, and the security controls each step needs.
9 min read · Intermediate
IoT device management and over-the-air (OTA) updates at scale
How organisations manage thousands of IoT devices across their lifecycle: provisioning, onboarding, monitoring, over-the-air firmware updates done safely, and secure decommissioning.
9 min read · Intermediate
IoT reference architectures and standards: an ISO/IEC 30141 overview
What a reference architecture is, an overview of ISO/IEC 30141 and its domains and viewpoints, other IoT frameworks such as IIRA and RAMI 4.0, and how to use them in real design and coursework.
9 min read · Advanced
Designing IoT for scale and reliability: queues, retries and offline buffering
Design patterns that keep IoT systems working at large scale and through failures: message queues, retries with exponential backoff and jitter, idempotent processing, offline buffering and redundancy.
9 min read · Advanced
The IoT connectivity landscape: range, power and data rate trade-offs
A map of IoT connectivity options, from Bluetooth and Zigbee to LoRaWAN and 5G, explaining the range, power and data rate trade-offs and how to choose the right one for a project.
8 min read · Beginner
Wi-Fi and Bluetooth Low Energy for IoT
How Wi-Fi and Bluetooth Low Energy (BLE) are used in IoT, the features that matter for constrained devices, BLE roles, GATT and pairing modes, and how to secure both.
9 min read · Beginner
Zigbee, Thread and Matter: mesh networking for smart homes
How the Zigbee and Thread mesh networks work, how they differ, and how the Matter standard sits on top to make smart-home devices from different brands work together securely.
9 min read · Intermediate
LPWAN compared: LoRaWAN, Sigfox, NB-IoT and LTE-M
How low-power wide-area networks (LPWAN) send small amounts of data over kilometres on a battery, with a comparison of LoRaWAN, Sigfox, NB-IoT and LTE-M and their security models.
9 min read · Intermediate
MQTT explained: brokers, topics, QoS and retained messages
How MQTT works: the broker, publish/subscribe, topic design and wildcards, the three QoS levels, retained messages, last will, sessions and the main MQTT 5 additions, with commands to try.
9 min read · Intermediate
CoAP and other constrained protocols compared with HTTP
What the Constrained Application Protocol (CoAP) is, how it maps REST onto UDP, its message types, Observe and block transfers, how it is secured, and how it compares with HTTP, MQTT and LwM2M.
8 min read · Intermediate
IPv6 for IoT: 6LoWPAN and why IPv6 suits billions of devices
Why IPv6 is the natural addressing system for IoT, and how 6LoWPAN squeezes IPv6 into IEEE 802.15.4 radio frames using header compression, fragmentation, RPL routing and border routers.
9 min read · Advanced
Cellular IoT and 5G: NB-IoT, LTE-M, eSIM and private networks
How cellular networks connect IoT devices: NB-IoT, LTE-M, 5G RedCap and massive IoT, how eSIM and iSIM change provisioning, and how private networks and private APNs improve security.
8 min read · Intermediate
The IoT threat landscape: Mirai, default passwords and real incidents
Who attacks IoT devices and why, how the Mirai botnet worked, why default passwords and exposed services remain the biggest problem, and what real incidents teach defenders.
8 min read · Beginner
The OWASP IoT Top 10 explained with fixes
A walk through all ten risks in the OWASP Internet of Things Top 10, what each looks like in a real product, and the practical fix for each one.
9 min read · Intermediate
Secure boot, firmware signing and secure updates
How secure boot builds a chain of trust from immutable code, how firmware is signed and verified, and how to design over-the-air updates with rollback protection and safe recovery.
9 min read · Advanced
Device identity: certificates, secure elements, TPMs and provisioning
How IoT devices prove who they are using X.509 certificates and mutual TLS, how secure elements and TPMs protect private keys, and how devices are provisioned at the factory and in the field.
9 min read · Advanced
Segmenting IoT on enterprise and home networks
How to isolate IoT devices with VLANs, separate SSIDs and firewall rules on both enterprise and home networks, including rule design, access control and the practical problems of discovery protocols.
9 min read · Intermediate
Securing MQTT and IoT messaging: TLS, authentication and topic access control
How to protect an MQTT broker and its clients with TLS, certificates or passwords, per-topic access control lists and sensible broker settings, with Mosquitto and Python examples.
9 min read · Intermediate
IoT security standards and laws: ETSI EN 303 645, NIST IR 8259 and the UK PSTI Act
The main IoT security standards and regulations: ETSI EN 303 645, the NIST IR 8259 series, the UK Product Security and Telecommunications Infrastructure Act, the EU Cyber Resilience Act and how they fit together.
9 min read · Intermediate
Secure IoT lifecycle: vulnerability disclosure, support periods and end of life
How to manage IoT security across the whole product life: secure development, coordinated vulnerability disclosure, stated support periods, and safe end of life and decommissioning.
8 min read · Intermediate
Operational technology versus IT: priorities, lifetimes and safety
What operational technology (OT) is, how its priorities, lifetimes and constraints differ from IT, and why security controls must be adapted rather than copied when protecting industrial systems.
7 min read · Beginner
The Purdue model and industrial network zones
The levels of the Purdue reference model, the role of the IT/OT DMZ, how traffic should flow between levels, and how the model is adapted for modern Industrial IoT and cloud connections.
8 min read · Intermediate
SCADA, PLCs, DCS, HMIs and RTUs explained
What each main industrial control component does: PLCs, RTUs, DCS, SCADA, HMIs, historians and engineering workstations, how they work together, and where their security weaknesses lie.
8 min read · Beginner
Industrial protocols: Modbus, DNP3, OPC UA, PROFINET and their security
How the main industrial communication protocols work, which ports they use, why many lack authentication and encryption, and how secure variants and network controls protect them.
9 min read · Intermediate
IEC 62443: zones, conduits and security levels
How the IEC 62443 series structures industrial cyber security: its four document groups, the roles it defines, zones and conduits, security levels 1 to 4 and the seven foundational requirements.
10 min read · Advanced
Lessons from industrial cyber attacks: Stuxnet, Ukraine power grid and TRITON
What happened in the best-known attacks on industrial systems, including Stuxnet, the Ukraine power grid attacks and TRITON, and the defensive lessons each one teaches.
9 min read · Intermediate
Monitoring OT networks safely: passive monitoring and asset discovery
How to monitor industrial networks without disrupting them: SPAN ports and network TAPs, passive asset discovery, baselining, what to alert on, and how OT monitoring connects to the SOC.
9 min read · Advanced
Predictive maintenance and Industry 4.0 use cases
How predictive maintenance uses sensor data to spot failing machines early, which signals and models are used, other Industry 4.0 use cases, and how to connect it all without weakening plant security.
8 min read · Intermediate
Project: a Wi-Fi temperature and humidity monitor
Build an ESP32 temperature and humidity monitor in MicroPython that publishes readings over MQTT with TLS, with a parts list, wiring, build steps, code and a security checklist.
9 min read · Beginner
Project: a home security door/window sensor with alerts
Build a battery-powered door or window sensor with a reed switch and an ESP32 that wakes from deep sleep, reports over MQTT and sends heartbeat messages, plus a threat review and security checklist.
9 min read · Intermediate
Project: a smart plant watering system
Build an automatic plant watering system with a capacitive soil moisture sensor, an ESP32 and a small pump, including calibration, fail-safe limits, MicroPython code and a security and safety checklist.
9 min read · Intermediate
Project: an MQTT sensor dashboard
Build a self-hosted dashboard on a Raspberry Pi: Mosquitto as a secured broker, Telegraf to collect MQTT messages, InfluxDB to store them and Grafana to graph and alert, with configs and a security checklist.
10 min read · Intermediate
Project: a Raspberry Pi network monitor for your home or lab
Turn a Raspberry Pi into a network monitor that checks key hosts are up, spots unknown devices joining, measures traffic and logs DNS, with a Python script, build steps and a security checklist.
9 min read · Intermediate
Project: building a safe, segmented IoT test lab
Design and build an isolated IoT test lab with VLANs, a firewall, packet capture and DNS logging, so you can study and test devices safely, with a rule table, build steps and a lab safety checklist.
10 min read · Advanced
Project: a Bluetooth Low Energy asset tracker
Build a room-level asset tracker in which ESP32 scanners listen for Bluetooth Low Energy tags and report signal strength over MQTT, covering RSSI limits, MicroPython code, privacy and a security checklist.
9 min read · Advanced
Project: a smart energy monitor
Build a whole-home energy monitor that reads your electricity meter's pulse LED with a light sensor and an ESP32, calculates live power and daily energy, and publishes it over MQTT, with safety and security guidance.
9 min read · Intermediate
Lab: getting started with Cisco Packet Tracer and a first topology
Install Cisco Packet Tracer for free, learn the workspace, and build and test a first small LAN with PCs, a switch and a router.
8 min read · Beginner
Lab: basic switch configuration and SSH access
Configure a new Cisco switch from scratch: hostname, passwords, banner, a management IP address and secure remote access with SSH version 2.
8 min read · Beginner
Lab: VLANs and 802.1Q trunks between two switches
Create VLANs on two switches, assign access ports, and join the switches with an 802.1Q trunk using a dedicated native VLAN and an allowed VLAN list.
8 min read · Beginner
Lab: inter-VLAN routing with router-on-a-stick and SVIs
Route traffic between VLANs in two ways: a router with 802.1Q subinterfaces on one trunk, and switched virtual interfaces on a multilayer switch.
9 min read · Intermediate
Lab: static and default routes across three routers
Build a three-router chain and make it work with static routes, default routes on stub routers, and a floating static backup route.
9 min read · Beginner
Lab: single-area OSPF on three routers
Replace static routes with OSPFv2 in area 0: router IDs, network statements or interface commands, passive interfaces, a default route and full verification.
9 min read · Intermediate
Lab: DHCP server, pools and relay on Cisco routers
Configure a Cisco router as a DHCP server with excluded addresses and two pools, then serve a remote subnet through a DHCP relay using ip helper-address.
8 min read · Intermediate
Lab: NAT and PAT to a simulated internet
Configure static NAT for an internal server and PAT (NAT overload) for a whole LAN on a Cisco router, using documentation address ranges for the simulated internet.
9 min read · Intermediate
Lab: standard and extended access control lists
Write and apply named standard and extended ACLs on a Cisco router: restrict SSH management to staff, and allow students only web access to a server VLAN.
9 min read · Intermediate
Lab: spanning tree root control and EtherChannel
Control which switch becomes the spanning tree root per VLAN, protect edge ports with PortFast and BPDU Guard, and bundle two links into an LACP EtherChannel.
9 min read · Intermediate
Lab: building a safe, isolated virtual security lab
Build an isolated virtual lab for security practice with VirtualBox: an internal-only network, attacker and target VMs, snapshots, and checks that nothing can reach your real network.
9 min read · Beginner
Lab: capturing and reading traffic with Wireshark
Capture your own traffic with Wireshark and tshark, use capture and display filters, and follow ARP, DNS, the TCP handshake and a TLS Client Hello in a real capture.
9 min read · Beginner
Lab: inventory your own lab network with Nmap
Use Nmap to discover hosts, list open ports and identify services on your own isolated lab, save the results and compare scans over time to spot changes.
8 min read · Beginner
Lab: hardening a Windows workstation
Harden a Windows 11 virtual machine step by step: updates, accounts, Microsoft Defender, firewall, BitLocker, removing SMBv1, password and lockout policy, and auditing.
9 min read · Intermediate
Lab: hardening a Linux server (SSH, firewall, updates)
Harden an Ubuntu Server virtual machine: automatic security updates, a sudo user, key-only SSH with root login disabled, a UFW firewall and removal of unused services.
9 min read · Intermediate
Lab: testing password policies and MFA in your lab
Set and test a modern password policy on Linux and Windows lab machines, then add time-based one-time password MFA to SSH and confirm that each control really works.
9 min read · Intermediate
Lab: analysing a suspicious email safely (headers and links)
Analyse a suspicious email without risk: export the raw message, read the headers and SPF, DKIM and DMARC results, extract and defang links, hash attachments and write a short verdict.
9 min read · Intermediate
Lab: Linux log analysis for failed logins
Generate failed SSH logins against your own Linux VM, then find, count and summarise them with journalctl, grep, awk, lastb and simple pipelines.
8 min read · Beginner
Lab: a home SIEM with Wazuh
Install the open-source Wazuh platform in a VM, enrol Linux and Windows agents, and produce real alerts from failed logins and file changes in your own lab.
9 min read · Intermediate
Lab: vulnerability scanning your lab with OpenVAS/Greenbone
Install the Greenbone Community Edition (OpenVAS) scanner on Kali Linux, scan a deliberately vulnerable VM on an isolated network, and turn the findings into a short prioritised report.
9 min read · Intermediate
Lab: using cloud free tiers safely (budgets, MFA, clean-up)
Set up a new AWS, Azure or Google Cloud account for learning so that it stays secure and cheap: MFA on the owner login, budget alerts, tagging, and a reliable clean-up routine.
8 min read · Beginner
Lab: securing an AWS account with IAM users and MFA
Lock down a new AWS account: MFA on the root user, an admin group, an IAM user with MFA for daily work, a password policy and a credential report to prove it.
9 min read · Beginner
Lab: AWS VPC with public and private subnets and an EC2 instance
Build a small AWS VPC from the command line with a public and a private subnet, an internet gateway, route tables, security groups and two EC2 instances, then delete it all.
10 min read · Intermediate
Lab: a private, encrypted S3 bucket
Create an Amazon S3 bucket that is private, encrypted, versioned and only reachable over HTTPS, test access with a pre-signed URL, and delete it cleanly.
8 min read · Beginner
Lab: Azure VNet, VM and network security group
Use the Azure CLI to build a resource group, virtual network, subnet, network security group and a small Linux VM, restrict SSH to your own IP, verify the rules and delete everything.
9 min read · Intermediate
Lab: Microsoft Entra ID MFA and conditional access basics
A hands-on lab in a test tenant: create a test user, protect an emergency admin account, register MFA and build a conditional access policy that you trial in report-only mode before enforcing it.
9 min read · Intermediate
Lab: cloud budgets and cost alerts on AWS, Azure and Google Cloud
Set up a monthly budget with email alerts on AWS, Azure or Google Cloud before you build anything else, and learn why budgets warn you but do not stop charges.
8 min read · Beginner
Lab: your first Docker container and image
Install Docker, run a web server container, publish a port, then write a small Dockerfile, build your own image and clean everything up afterwards.
8 min read · Beginner
Lab: Kubernetes basics with minikube
Run a local Kubernetes cluster with minikube, deploy nginx, scale it, expose it with a Service, watch Kubernetes heal a deleted pod and then delete the cluster.
9 min read · Intermediate
Lab: infrastructure as code with Terraform basics
Learn the Terraform workflow at zero cost by managing a local Docker container as code: write a configuration, run init, plan and apply, change it, and destroy it.
9 min read · Intermediate
Lab: setting up a Raspberry Pi securely
Install Raspberry Pi OS with a unique user and SSH key, update it, disable password logins, add a host firewall and turn on automatic security updates.
9 min read · Beginner
Lab: ESP32 Wi-Fi sensor with MicroPython
Flash MicroPython onto an ESP32, wire a DHT22 temperature sensor, connect to Wi-Fi and print readings, keeping Wi-Fi credentials out of your code repository.
9 min read · Beginner
Lab: running a Mosquitto MQTT broker
Install the Eclipse Mosquitto MQTT broker on a Raspberry Pi or Linux machine, publish and subscribe with the command-line clients, and learn topics, wildcards, retained messages and QoS.
8 min read · Beginner
Lab: securing MQTT with passwords and TLS
Lock down a Mosquitto broker: create a lab certificate authority and server certificate, enable a TLS listener on 8883, require usernames and passwords and restrict topics with an access control list.
10 min read · Intermediate
Lab: Node-RED dashboard for sensor data
Run Node-RED in Docker, subscribe to your MQTT sensor topics, build a live dashboard with a gauge and chart, and protect the editor with a login.
9 min read · Intermediate
Lab: putting IoT devices on their own VLAN or guest network
Separate smart devices from your laptops and phones using either a router guest network or an IoT VLAN with DHCP and firewall rules that allow trusted devices in but stop IoT devices reaching out.
10 min read · Intermediate
Lab: capturing and analysing IoT traffic
Capture network traffic from a smart device you own using a router, a switch mirror port or a Raspberry Pi access point, then analyse its DNS lookups, destinations and encryption in Wireshark.
10 min read · Intermediate
Lab: Home Assistant with security best practice
Install Home Assistant on a Raspberry Pi, virtual machine or container, then secure it with a strong owner account, multi-factor authentication, VPN-only remote access, backups and careful updates.
9 min read · Intermediate
Lab: scanning Bluetooth Low Energy devices you own
Use bluetoothctl and a short Python script with the bleak library to discover your own Bluetooth Low Energy devices, read what their adverts reveal and judge their privacy settings.
8 min read · Beginner
Lab: safe firmware updates for IoT devices
Back up and update ESP32 firmware with checksum verification, then build a small over-the-air update for MicroPython code that checks a SHA-256 hash before replacing anything and keeps the old version for rollback.
9 min read · Intermediate
Project: design a small office network end to end
Plan, build and document a network for a 20-person office: requirements, VLAN and IP design, wireless, security, backup and a test plan, all built first in Packet Tracer or a home lab.
10 min read · Intermediate
Project: build a home lab network
Plan and build a home lab for networking, security and cloud practice: choosing hardware on a budget, isolating it with a firewall and VLANs, running a hypervisor and documenting it as a portfolio project.
9 min read · Beginner
Project: secure branch office with site-to-site VPN
Design and build a head office and branch network joined by an IKEv2 IPsec site-to-site VPN in a simulator, with addressing, firewall rules, testing evidence and a write-up for your portfolio.
10 min read · Intermediate
Project: a home SOC lab
Build a small security operations centre at home: endpoints and a firewall sending logs to a SIEM, safe attack simulations mapped to MITRE ATT&CK, detection rules and triage write-ups.
10 min read · Intermediate
Project: a network automation portfolio
Build three to five small network automation projects with Python and Ansible against a virtual lab, and publish them as clean, tested Git repositories that show real engineering skills.
9 min read · Intermediate
Project: deploy a secure web app in the cloud
Deploy a small web application to AWS or Azure with infrastructure as code, private networking, TLS, a web application firewall, managed secrets and logging, then tear it down and document the design.
10 min read · Advanced
Project: an IoT monitoring system end to end
Build a complete environmental monitoring system: ESP32 sensors publishing over MQTT with TLS, a broker, a time-series database and a Grafana dashboard with alerts, all secured layer by layer.
10 min read · Intermediate
Project: documenting a network (diagrams, IP plan, runbooks)
Produce a professional documentation set for a lab or small network: physical and logical diagrams, an IP and VLAN plan, a device inventory, runbooks and a change log.
9 min read · Beginner
Project: building a GitHub portfolio that gets interviews
Turn your labs and projects into a professional GitHub portfolio: a profile README, well-structured repositories, clear documentation, secret scanning and good commit habits.
8 min read · Beginner
Project ideas for final-year networking and security students
A set of realistic final-year project ideas in networking and cyber security, with how to scope each one, evaluate it, handle ethics, and avoid the mistakes that cost marks.
9 min read · Beginner
Python basics for network engineers: install, run, variables, loops and if
A practical first step into Python for network and security engineers: installing Python 3, running scripts, and using variables, data types, if statements and loops with network examples.
8 min read · Beginner
Python data structures: lists, dictionaries, sets and tuples for networks
How Python lists, dictionaries, sets and tuples work, when to use each one, and how to model devices, interfaces and VLANs with them.
8 min read · Beginner
Reading and writing files in Python: text, CSV, JSON and YAML
How to read and write plain text, CSV, JSON and YAML files safely in Python, with network inventory and report examples.
8 min read · Beginner
Python functions, modules, packages and virtual environments
How to write reusable functions, split code into modules and packages, install libraries with pip, and isolate each project in a virtual environment.
8 min read · Beginner
The Python ipaddress module: subnets, hosts and validation
Using Python’s built-in ipaddress module to validate IPv4 and IPv6 addresses, split networks into subnets, list hosts and check membership.
7 min read · Beginner
Parsing device output and logs with Python regular expressions
How to use Python’s re module to pull interface names, addresses, counters and log fields out of device output and syslog, plus when to use a ready-made parser instead.
9 min read · Intermediate
Network programming with Python sockets: TCP client and server basics
How Python sockets work, the difference between TCP and UDP sockets, a minimal echo server and client, and a safe port check for your own network.
8 min read · Intermediate
Error handling and logging in Python automation scripts
How to handle exceptions with try and except, keep going when one device fails, and replace print statements with proper logging that is safe for credentials.
8 min read · Intermediate
Netmiko in depth: connecting to many vendors, sending commands and config
How Netmiko handles SSH sessions to Cisco, Juniper, Arista and other devices, how to send show and configuration commands, parse output, and handle credentials and errors safely.
9 min read · Intermediate
NAPALM: vendor-neutral getters, config merge, replace and compare
How NAPALM gives a common Python interface to different network operating systems, using getters for structured data and a load, compare, commit workflow for safe configuration changes.
9 min read · Intermediate
Nornir: running Python tasks across many network devices in parallel
How the Nornir framework uses an inventory, filters, tasks and a threaded runner to run Netmiko or NAPALM jobs against many devices at once, with results you can process in Python.
9 min read · Intermediate
Jinja2 templates for network configuration
How to separate data from configuration using Jinja2 templates: variables, loops, conditionals, filters and whitespace control, rendered from Python for consistent device configs.
8 min read · Intermediate
NETCONF and YANG with Python: model-driven network configuration
What YANG data models and the NETCONF protocol are, how datastores and operations work, and how to read and change configuration from Python with ncclient.
9 min read · Advanced
RESTCONF: managing network devices over HTTPS with YANG
How RESTCONF exposes YANG-modelled device data as HTTPS resources, how to build URLs, which HTTP methods to use, and how to call it from curl and Python securely.
8 min read · Intermediate
Source of truth: IPAM and DCIM tools such as NetBox and why they matter
Why network automation needs a single source of truth, what IPAM and DCIM tools record, how NetBox fits in, and how to query it from Python with pynetbox.
8 min read · Intermediate
Network configuration compliance and drift detection with Python
How to define golden configuration rules, collect running configurations, detect drift with rule checks and diffs in Python, and report and fix findings safely.
8 min read · Intermediate
What an API is and how REST APIs work
A plain introduction to APIs (Application Programming Interfaces) and the REST style: resources, URLs, methods, statelessness and JSON, with network and cloud examples.
8 min read · Beginner
HTTP methods, URLs, headers and status codes for APIs
How an API request is built: the parts of a URL, the HTTP methods GET, POST, PUT, PATCH and DELETE, the headers that matter, and how to read status codes.
9 min read · Beginner
JSON and XML for APIs: structure, parsing and pitfalls
How JSON and XML represent data, how they map to Python structures, how to parse and create them safely, and when each format appears in network and security work.
8 min read · Beginner
API authentication: API keys, basic auth, OAuth 2.0 and JWTs
How APIs identify callers using API keys, basic authentication, session tokens, OAuth 2.0 flows and JSON Web Tokens, with secure ways to store and use secrets in scripts.
10 min read · Intermediate
Testing APIs with Postman and curl
A hands-on guide to exploring and testing REST APIs with curl on the command line and with Postman collections, environments and simple response tests.
8 min read · Beginner
Calling REST APIs from Python with requests
How to call REST APIs from Python with the requests library: sessions, headers, JSON bodies, timeouts, error handling, retries with back-off and pagination, without hard-coded secrets.
10 min read · Intermediate
Webhooks and event-driven integrations
How webhooks push events from one system to another, how they differ from polling, and how to build a receiver that verifies signatures, handles retries and stays secure.
9 min read · Intermediate
API security: the OWASP API Security Top 10 and defences
A defender’s guide to the OWASP API Security Top 10 (2023 edition): what each risk means in practice, how it is detected and the controls that prevent it.
10 min read · Intermediate
Bash scripting basics: variables, conditions, loops and exit codes
The building blocks of Bash scripts for engineers: the shebang, variables and quoting, if and case, loops, functions, exit codes and the safety options that stop scripts failing silently.
8 min read · Beginner
Useful Bash scripts for network checks
Practical Bash scripts for everyday network checks: reachability sweeps from a host list, TCP port tests, DNS lookups and HTTP health checks, with results written to a CSV file.
8 min read · Beginner
PowerShell basics: cmdlets, objects and the pipeline
An introduction to PowerShell 7 and Windows PowerShell for engineers: verb-noun cmdlets, finding help, the object pipeline, variables, loops and running your first script safely.
8 min read · Beginner
PowerShell for Windows and network administration
Using PowerShell for real admin work: network diagnostics, IP configuration, event logs, services, remoting with Invoke-Command, Active Directory and Microsoft Graph, with safe habits such as -WhatIf.
9 min read · Intermediate
Scheduling scripts: cron, systemd timers and Windows Task Scheduler
How to run scripts automatically on a schedule using cron and systemd timers on Linux and Task Scheduler on Windows, including cron syntax, service accounts, logging and common pitfalls.
7 min read · Beginner
Text processing on the command line: grep, awk, sed, cut and sort
How to slice logs and device output with grep, cut, awk, sed, sort and uniq, with worked examples for syslog, firewall logs and show command output.
8 min read · Beginner
Git basics for engineers: commits, branches and remotes
The Git commands and ideas an infrastructure engineer needs: repositories, staging, commits, branches, merging, remotes, pull requests and .gitignore, applied to scripts and device configs.
9 min read · Beginner
Writing safe scripts: testing, dry runs, logging and secrets
Habits that stop automation causing outages or leaks: defensive coding, linting, lab testing, dry-run modes, confirmation prompts, logging and keeping credentials out of scripts.
9 min read · Intermediate
Ansible architecture and concepts: control node, inventory, modules and idempotency
What Ansible is and how it works: the agentless control node, inventories, modules, playbooks, plugins and collections, idempotency, and how network devices differ from servers.
8 min read · Beginner
Ansible inventories, groups and variables
How to describe your network to Ansible: YAML and INI inventories, groups and nested groups, host_vars and group_vars folders, connection variables, variable precedence and dynamic inventories.
8 min read · Beginner
Ansible playbooks, tasks, handlers and conditionals
How to write Ansible playbooks: plays and tasks, gathering and using facts, registering results, conditionals with when, loops, handlers, tags, check mode and error handling, with network and server examples.
9 min read · Intermediate
Ansible network modules and collections for Cisco, Arista and Juniper
How Ansible manages network devices: the cisco.ios, arista.eos and junipernetworks.junos collections, connection settings, facts, resource modules and their states, config and command modules, and saving changes.
9 min read · Intermediate
Templates with Jinja2 in Ansible
How to generate device and server configurations from Jinja2 templates in Ansible: variables, loops, conditionals, filters, whitespace control, the template module and rendering configs for review before deployment.
8 min read · Intermediate
Ansible roles and collections: organising automation
How to structure growing Ansible projects with roles and collections: role directory layout, defaults versus vars, using roles in playbooks, dependencies, requirements.yml, Ansible Galaxy and a sensible project layout.
8 min read · Intermediate
Ansible Vault and handling secrets
How to keep passwords, keys and tokens out of plain text in Ansible: ansible-vault commands, encrypted files versus strings, vault IDs, supplying the vault password safely, no_log and external secret managers.
8 min read · Intermediate
Testing and running Ansible at scale: ansible-lint, Molecule and AWX
How teams make Ansible reliable and controlled: linting, syntax checks, Molecule role testing, check mode, CI pipelines, execution environments, and running jobs through AWX or Red Hat Ansible Automation Platform.
10 min read · Advanced
Project: automated network config backups to Git
A complete portfolio project: back up switch, router and firewall configurations over SSH with Python and Netmiko, store them in Git to track every change, and schedule it to run every night.
10 min read · Intermediate
Project: VLAN provisioning from a spreadsheet or YAML
Build a Python tool that reads VLANs from YAML or CSV, validates them, renders configuration with Jinja2, shows a dry-run diff and then applies and verifies the change on lab switches.
10 min read · Intermediate
Project: a network inventory report (models, serials, versions)
Build a Python script that collects hostname, vendor, model, serial number, software version and uptime from lab devices with NAPALM, flags outdated versions and exports a CSV and simple HTML report.
9 min read · Beginner
Project: interface error and utilisation monitor
Build a Python monitor that samples interface counters twice, calculates error and utilisation rates, compares them with thresholds and raises clear alerts, using NAPALM on lab devices.
10 min read · Intermediate
Project: TLS certificate expiry checker
Build a Python tool that connects to your web servers, VPN gateways and device management pages, reads each TLS certificate’s expiry date and warns before anything expires.
9 min read · Beginner
Project: subnet and IP usage report
Build a Python report that combines your subnet plan with ARP tables and DHCP data, calculates how full each subnet is with the ipaddress module and flags subnets close to running out.
9 min read · Intermediate
Project: firewall and ACL rule audit
Build a Python tool that parses router ACLs and firewall rules, then flags over-permissive, risky, shadowed, unused and undocumented rules so you can clean up rule sets safely.
10 min read · Advanced
Project: a ChatOps bot for network checks
Build a chat bot that lets authorised engineers run safe, read-only network checks such as ping, DNS lookup and interface status from a team channel, with strict input validation and audit logging.
10 min read · Advanced
Server types and roles: file, web, database, directory and application
What the common server roles do (file, web, database, directory, application and infrastructure), how they work together in a three-tier design, and how to decide which roles to combine or separate.
7 min read · Beginner
Server hardware: CPU, ECC memory, storage, NICs and redundant power
The components inside a server and why they differ from desktop parts: multi-core CPUs, ECC memory, RAID and drive types, high-speed NICs, redundant power and out-of-band management.
8 min read · Beginner
Server form factors: tower, rack, blade and hyperconverged
Compares tower, rack, blade and hyperconverged servers by space, power, cooling, cost and scaling, with guidance on which suits a small office, a data centre or a branch.
7 min read · Beginner
Windows Server core roles: AD DS, DNS, DHCP and Group Policy
How Active Directory Domain Services, DNS, DHCP and Group Policy fit together on Windows Server, with the forest, domain and OU structure, PowerShell to install roles, and common design mistakes.
9 min read · Intermediate
Linux server essentials: distributions, services, users and packages
A practical introduction to running Linux servers: choosing a distribution, installing packages, managing services with systemd, handling users, groups and sudo, and reading logs.
9 min read · Beginner
Server storage: DAS, NAS and SAN compared
Explains direct-attached storage, network-attached storage and storage area networks, the difference between block and file access, protocols such as SMB, NFS, iSCSI and Fibre Channel, and when to choose each.
8 min read · Intermediate
Server hardening: baselines, patching, least services and logging
How to harden Windows and Linux servers using security baselines such as the CIS Benchmarks, minimal services, least privilege, patch management, host firewalls and central logging.
9 min read · Intermediate
What enterprise architecture is: business, data, application and technology
An introduction to enterprise architecture: the four architecture domains, baseline and target states, gap analysis and roadmaps, and why EA matters to network and security engineers.
7 min read · Beginner
TOGAF overview: the Architecture Development Method cycle
A clear overview of TOGAF and its Architecture Development Method (ADM): the Preliminary phase, phases A to H, requirements management, deliverables and how to apply it without excessive paperwork.
8 min read · Intermediate
The Zachman framework overview
Explains the Zachman framework as a classification grid of six questions and six perspectives, how it differs from a method like TOGAF, and how to use it to check that architecture documentation is complete.
7 min read · Intermediate
Business capabilities and aligning IT with the business
What business capabilities are, how to build and use a capability map, heat mapping for investment decisions, and practical ways to align IT and security work with business goals.
8 min read · Intermediate
Documenting architecture: the C4 model and architecture decision records
How to document software and system architecture with the C4 model (context, containers, components, code) and how to record important choices in short architecture decision records (ADRs).
8 min read · Intermediate
Monoliths, SOA and microservices
Compares monolithic, service-oriented and microservice architectures: how each is structured, their strengths and costs, networking and security implications, and how to choose or migrate.
9 min read · Intermediate
Architecture governance, standards and technology roadmaps
How organisations govern architecture: principles, architecture boards, design reviews, technology standards and lifecycle status, exception handling, and building technology roadmaps that teams actually use.
8 min read · Advanced
Hypervisors: type 1 versus type 2
What a hypervisor does, the difference between type 1 (bare-metal) and type 2 (hosted) hypervisors, common products, hardware support for virtualisation, and how to choose for a lab or a data centre.
7 min read · Beginner
Virtual machine lifecycle: templates, snapshots and cloning
How to manage virtual machines from creation to retirement using templates, full and linked clones, guest customisation and snapshots, with the common snapshot mistakes that cause outages and sprawl.
8 min read · Beginner
Virtual networking: virtual switches, port groups and VLANs
How virtual machines connect to the network: virtual NICs, virtual switches, port groups, VLAN tagging, uplink teaming and network modes, with design tips and security settings.
9 min read · Intermediate
Storage virtualisation and datastores
How hypervisors present storage to VMs: virtual disk formats, datastores on block, file and software-defined storage, thin and thick provisioning, and features such as storage migration and policies.
8 min read · Intermediate
Virtual desktop infrastructure (VDI)
How virtual desktop infrastructure works: brokers, gateways and display protocols, pooled versus persistent desktops, cloud desktop services, sizing, user experience and security benefits.
8 min read · Intermediate
High availability and live migration for virtual machines
How virtualisation clusters keep VMs running: HA restart after host failure, live and storage migration, automatic load balancing, fault tolerance, admission control and the networking needed to support them.
9 min read · Intermediate
Securing virtualisation platforms
How to secure hypervisors, management servers, virtual networks and VMs: key threats such as VM escape and hypervisor ransomware, hardening the management plane, segmentation, encryption, backup protection and monitoring.
9 min read · Advanced
What distributed systems are and why they are hard
An introduction to distributed systems: what they are, why organisations build them, and the core problems of unreliable networks, partial failure and unsynchronised clocks.
8 min read · Beginner
The CAP theorem and PACELC
What the CAP theorem really says about consistency, availability and partition tolerance, common misreadings of it, and how PACELC adds the latency trade-off.
8 min read · Intermediate
Consistency models: strong, eventual and causal
A plain guide to consistency models in distributed systems, from linearisability through causal and session guarantees to eventual consistency, with examples of when each fits.
8 min read · Intermediate
Replication and sharding
How distributed databases copy data with replication and split it with sharding, the main topologies and partitioning strategies, and the pitfalls of each.
9 min read · Intermediate
Consensus: Raft and Paxos simply explained
How distributed nodes agree on one value or one ordered log despite failures, explained through Raft leader election and log replication, with a short look at Paxos and quorum sizing.
9 min read · Advanced
Message queues and event streaming
How message queues and event streams decouple services, the difference between them, delivery guarantees, ordering, idempotency and dead-letter queues.
8 min read · Intermediate
Microservice communication: REST, gRPC and service mesh
How microservices talk to each other: REST, gRPC and asynchronous events compared, resilience patterns such as timeouts and circuit breakers, and what an API gateway and service mesh add.
9 min read · Intermediate
Availability, the nines and SLAs/SLOs
How availability is measured as a percentage, what the "nines" mean in downtime, how to calculate the availability of chained and redundant components, and how SLIs, SLOs, SLAs and error budgets fit together.
8 min read · Beginner
Redundancy patterns: active-active and active-passive
How to remove single points of failure using active-active and active-passive designs, N+1 and 2N redundancy, and hot, warm and cold standbys, with the trade-offs of each.
8 min read · Intermediate
Load balancers: layer 4 versus layer 7
How load balancers spread traffic and remove failed servers, the difference between layer 4 and layer 7 balancing, common algorithms, health checks, session persistence and TLS termination.
8 min read · Intermediate
Clustering and failover, quorum and split brain
How high availability clusters detect failure and move services, why quorum and witnesses are needed, what split brain is, and how fencing protects shared data.
9 min read · Advanced
Database high availability
How to keep relational databases available: replication and standby servers, shared-storage clusters, availability groups and managed services, measured against RPO and RTO, plus how clients follow a failover.
9 min read · Advanced
Geo-redundancy and DNS-based failover
How services survive the loss of a whole site or region using geographically separate deployments, DNS-based failover and global traffic policies, and the limits of DNS TTLs and data replication.
8 min read · Intermediate
Testing resilience: failover tests and chaos engineering
How to prove that high availability designs actually work, through planned failover tests, disaster recovery drills, game days and controlled chaos engineering experiments with a limited blast radius.
8 min read · Intermediate
Secure by design principles
The core principles of secure system design, such as least privilege, defence in depth, fail securely and secure defaults, and how to apply them across the development lifecycle.
8 min read · Beginner
Threat modelling with STRIDE
A practical method for threat modelling a system: drawing a data flow diagram with trust boundaries, finding threats with STRIDE, rating them and choosing mitigations.
9 min read · Intermediate
Security zones and trust boundaries in system design
How to group systems into security zones by trust level, define trust boundaries, control the traffic between them, and apply the same ideas in on-premises, cloud and microservice designs.
8 min read · Intermediate
Identity-centric architecture
Why identity has replaced the network perimeter as the main security control, and how to design around a central identity provider, strong authentication, conditional access, workload identities and least-privilege authorisation.
8 min read · Intermediate
Encryption architecture and key management
How to design encryption for data at rest, in transit and in use, using envelope encryption, key management services and HSMs, with sound key lifecycle, separation of duties and post-quantum planning.
9 min read · Advanced
Security logging architecture
How to design a security logging architecture: which sources to collect, how to transport, normalise, store and protect logs, retention and cost trade-offs, and how logging supports detection and investigation.
9 min read · Intermediate
Security reference architectures and SABSA overview
What security reference architectures are, how to use them without copying blindly, an overview of the SABSA business-driven method and its layers, and how it relates to TOGAF and zero trust models.
9 min read · Advanced
No notes match yet. Try another word, or request a topic.
Coming next
New notes are added regularly. Want a topic sooner? Send a request.
- Routing basics: how routers choose a path
- IPv6 in depth
- OSPF basics
- Linux for network engineers
- Packet capture with Wireshark
- Malware types explained
- Backups and the 3-2-1 rule
- Incident response: the first hour
- Identity and access in the cloud
- Network automation with Python