Chapter 64 — Project ideas by level

Each project lists what it builds on. The Go projects reuse the labs from this guide. The Go plan references point to step-by-step versions.

Beginner

1. Map your home network: every device, its IP, MAC, and what it does (Chapters 5, 6, 9).
2. Extend netcheck (Chapter 34) to report link, address, gateway, DNS, and internet reachability, with JSON output, and run it from cron.
3. Capture and fully annotate one web page load, packet by packet (Chapters 4, 31–32). Then decode the same capture with pcapread.
4. Set up a Raspberry Pi as a DNS server (Pi-hole) and watch your own queries (Chapter 18). Use dnsdiff to compare it with public resolvers.
5. Measure and fix bufferbloat on your home connection (Chapters 27, 59).

Intermediate 6. Build a two-subnet lab with a Linux router between them, and route between them by hand (Chapters 13, 52). 7. Set up a WireGuard VPN and investigate its MTU behaviour (Chapter 54). 8. Write a TCP client and server in Go with a length-prefixed binary protocol, and watch it in Wireshark (Chapter 22's stream lab; Go plan Day 53: binary KV protocol). 9. Put a load balancer (nginx, HAProxy, or your own lbdrain) in front of two web servers with health checks. Kill one and watch the failover in a capture (Chapter 57). 10. Compare HTTP/1.1, HTTP/2, and HTTP/3 performance on the same content under simulated loss (tc netem) (Chapters 30, 59). 11. Write a UDP-based reliable transfer in Go: sequence numbers, ACKs, retransmission timer, sliding window. Then compare its throughput with TCP's under 2% loss (Chapters 20, 22, 24).

Advanced 12. Build a container network from scratch with ip netns and veth, with no Docker (Chapter 52). 13. Set up BGP between two routers (FRRouting or BIRD) in a lab (Chapter 50). 14. Extend pcapread into a mini-Wireshark: TCP option decoding, conversations, retransmission and RTT analysis, TLS SNI extraction (Chapter 32). 15. Instrument a Go service with per-connection TCP_INFO metrics (rtt, retransmits, cwnd) exported to Prometheus, and build a dashboard (Chapters 33, 46). 16. Run a full IPv6-only lab with NAT64/DNS64 and see what breaks (Chapter 16). 17. Build an L4 load balancer in Go with PROXY protocol, health checks, and connection draining (Chapter 57; Go plan Day 48). 18. Build an SNI router: accept TLS connections, read the ClientHello without decrypting, and forward to a backend chosen by hostname (Chapters 29, 32; Go plan Day 55). 19. Build a DDoS-aware edge: SYN-flood and Slowloris detection, per-CIDR rate limiting (Go plan Week 13), tested with traffic you generate in your own lab.

Capstone (multi-week): the Go plan's cloud-edge security proxy combines TLS termination, L7 routing, a WAF, rate limiting, observability, and graceful operations. It covers almost everything in Parts 5–13 of this guide in one program.