Network and security work on real hardware — production systems I run, and lab exercises where an attack is executed, observed, mitigated, and the mitigation verified.
Systems in production, and the architecture decisions behind them.
A segmented home network built on used enterprise gear: a Cisco Catalyst 2960-X, OPNsense on a decommissioned OptiPlex, a Proxmox hypervisor, five VLANs with firewall rules between them, and remote access over a WireGuard mesh. Around $450 in hardware, most of it acquired during a DRAM shortage that made the usual advice wrong.
A generative art kiosk that runs unattended in a public gallery. A visitor walks up, a sensor notices, and the machine prints them an original image on thermal paper. Every piece is archived and retrievable later by unit number. Anyone on the internet can trigger the same pipeline from a browser and land in the same archive.
Attack, observe, mitigate, verify. Cisco layer-2 controls against live attacks.
Ran an ARP cache poisoning attack between two hosts on an isolated VLAN, confirmed a man-in-the-middle position by capturing the victim's traffic, then defended against it with Cisco Dynamic ARP Inspection on a Catalyst 2960-X.
Stood up an unauthorized DHCP server on an isolated VLAN, beat the legitimate server in the lease race, and took a full man-in-the-middle position over a victim host — without touching ARP at all. Then defended it with Cisco DHCP snooping and mapped the control's two distinct behaviors.