#containerlab

You can read show ip bgp. You can read show ip ospf neighbor. But when a lab has five routers and...

Hit a public address:port and get nothing, add one DNAT rule, and the same request lands on a hidden internal server — then read the conntrack table to see how the reply gets un-NATed.

Give one name three A records, let BIND rotate the order on every response, and watch clients spread across backends — the simplest load distribution there is, and the coarsest.

Serve the same zone through two BIND views, ask from an internal and an external client, and watch one name resolve to a private address for insiders and a public one for everyone else.

When a narrow link hides deep in the path and ICMP is filtered, PMTUD black-holes your TCP connections. Watch a router rewrite the SYN's MSS from 1460 to 1360 so every segment fits — no PMTUD required.

Build a three-router OSPF triangle, watch every router flood the same link-state map, see SPF pick the cheapest path by cost, then kill the best link and watch it reconverge automatically.

When a link stays up but forwarding silently dies, OSPF alone waits 40 seconds to notice. Add BFD and the same failure is detected in ~900 ms — here's a hands-on lab that proves it.

Install a two-next-hop BGP route with maximum-paths, blast 16 TCP flows across two parallel links, then flip Linux's hash policy and watch one link do all the work — the classic ECMP gotcha.

Attach a tbf token-bucket qdisc to a container's egress and watch iperf3 drop from tens of Gbit/s to exactly the rate you configured — plus why a too-small burst throttles you almost to zero.

Clear the ARP cache, ping a neighbor, and capture the broadcast 'who has 10.0.0.2?' request and unicast 'is-at' reply that make IPv4 delivery on a link actually work.

Build a path with a 1400-byte bottleneck link, send a 1500-byte Don't-Fragment packet into it, and watch ICMP fragmentation-needed teach the sender the Path MTU — the mechanism that silently breaks when firewalls drop ICMP.

Boot a client with no IP address at all, run a DHCP client against a tiny server, and capture the full Discover-Offer-Request-Ack (DORA) exchange on the wire.