2026-11-04 –, Room 1 Language: English
Setting up a realistic network used to mean racks of hardware, an expensive license or a heavy VM appliance. Today a laptop is enough. This talk shows how to build complete, reproducible networks from a single YAML file with containerlab, and how to watch every packet in them live in Wireshark via Edgeshark, without installing anything beyond Docker and VS Code. Starting from an empty laptop, we deploy a small network with a client, DNS and a TLS web server, capture its traffic from any container interface, then turn it into a DHCP-driven setup and see what the protocol really does on the wire. The second half shows how the same setup becomes a training tool: faults are built into the lab on purpose, and trainees have to find them with Wireshark, the way they would in production.
A network lab no longer needs a rack or heavy VM appliances. With containerlab, a topology is a YAML file: nodes, links, addresses and startup commands, versioned in Git and deployed in seconds. Every node is a Linux container wired with veth pairs, so the traffic is real kernel networking – nothing simulated, everything open to packet analysis.
Build it: starting from a clean laptop with VS Code and Docker, we deploy a client, a DNS server and a TLS web server, look at what containerlab creates underneath, and hit the typical day-one traps: subnet clashes, devcontainer path issues, missing return routes.
See it: we compare four ways to capture inside containers, ending with Edgeshark, which lists every container interface in the browser and opens a live capture in your local Wireshark with one click. Live: DNS lookup, TCP handshake, a TLS Client Hello leaking the server name, and the same session decrypted with SSLKEYLOGFILE.
Evolve it: the lab moves from static addresses to DHCP. We follow DISCOVER, OFFER, REQUEST and ACK and inspect the options up to Option 121 – and see that DHCP options are offers the client may ignore.
Train with it: each training scenario is a topology file with a deliberate fault – a missing route, an overridden resolver, an ignored DHCP option. Trainees get a symptom ("the website doesn't load") and work down to the cause with Wireshark. Every trainee gets an identical lab, resets take seconds, and the fix is a one-line change.
Takeaways: a running multi-node network in minutes, a capture workflow for containers that feels local, a method for building troubleshooting trainings from version-controlled labs, and an honest look at where container networks differ from real hardware.
For network engineers, analysts and trainers who know Wireshark. No containerlab experience needed.
