System Hub | Secure By Design

Follow the trafficOptional walkthroughs: how requests cross the network, what-ifs, and the attack drill.

01 / SIGN IN

From a workstation to the directory.

Speed

Paused

Check your understanding

Your answers stay in this browser.

Opening the buildingServer room · offices · media room

AIR-GAPPED DATA CENTER

Every request has a journey.

Select a flow. Follow it through the network.

TRAFFIC FLOWResolving a serviceDNS · TCP / UDP 53

Selected systemsInternal uplinksOffline root

Drag to orbit · scroll to zoom · select equipment

TECHNICAL REFERENCE

Protocols & technical sources

Explore the network’s service protocols, connection requirements, and supporting documentation.

Protocol reference

Service	Transport	Interpretation

Network architecture

The network has eight VLANs, 50 Windows workstations, three administration seats on two machines (Tier 0; member servers; and endpoints, a virtual machine on the member-server seat), an internal time source, and 802.1X port admission through the NPS role on SBD-DHCP01. Splunk and Tenable/Nessus run on domain-joined Linux. Splunk, Tenable/Nessus, and Trellix ePO/DLP each use one server instance, sized for a small network.

The architecture is air-gapped. Boundary transfers use approved media under human control, and the root CA remains offline and non-domain-joined.

Technical sources

Three.js 0.186.1 · MIT license. Assets load locally.