grceng.academy
YAML lab 40 bonus XP

Reconstruct a routed and translated flow

Start labRead the room

Objectives

A change record claims that the backup destination follows the default path because it has the smallest metric. Complete the forwarding and translation worksheet from the fixture, not from that claim. Treat every listed route as installed and every next hop as reachable.

The same record calls address sharing a security boundary. Record the separate enforcement control and the evidence needed to attribute a shared-address session. Use a boolean for the firewall claim and a numeric value for the packet lifetime after one router forwards it.

Active routes, packet capture, and control requirement

Route prefix       Next hop     Metric
0.0.0.0/0          192.0.2.1   1
10.24.6.0/24       192.0.2.3   1
10.24.6.64/26      192.0.2.2   50
Lookup destination: 10.24.6.70
Separate outbound TCP capture:
 inside 10.24.6.10:51514 -> 203.0.113.80:443, TTL 64 before router
 outside 198.51.100.10:40001 -> 203.0.113.80:443
 A second client shares the outside IP using source port 40002.
Requirement: explicit traffic-policy enforcement; attribution records must
 include time, protocol, and both original and translated address-port pairs.

Checks the server runs (6)

  • Select the longest matching prefix
  • Use the selected row's next hop
  • Decrement the packet lifetime
  • Identify the mechanism and external port
  • Separate translation from filtering
  • Preserve fields needed to correlate sessions

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Match the destination

    Find the ranges containing the lookup address, then choose the row fixing the greatest number of destination bits.

    Select the longest matching prefix

  2. Step 2

    Follow the winning row

    Read the next-hop column on the chosen row; do not borrow the gateway from a less-specific entry.

    Use the selected row's next hop

  3. Step 3

    Account for forwarding

    Compare the capture point with the requested point and apply the per-router lifetime change once.

    Decrement the packet lifetime

  4. Step 4

    Inspect tuple changes

    Compare the source fields before and after translation and consider how simultaneous clients share an address.

    Identify the mechanism and external port

  5. Step 5

    Identify the policy consumer

    Decide whether rewriting headers itself evaluates permission, then name the independent traffic-control component.

    Separate translation from filtering

  6. Step 6

    Make attribution reproducible

    List the temporal context, transport discriminator, and the endpoint pair on each side of the rewrite. Use the fixture's evidence requirement as your completeness test.

    Preserve fields needed to correlate sessions

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.