Chapter 4 — Programming I | Engineering Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX010.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Why program"]
  N2["4.2 The ipaddress module"]
  N3["4.3 Structuring a script"]
  N4["4.4 Testing"]
  N5["Reading data files"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX010"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Why program"]
  N2["4.2 The ipaddress module"]
  N3["4.3 Structuring a script"]
  N4["4.4 Testing"]
  N5["Reading data files"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX010"]

[Learning outcomes]
    |
    v
[4.1 Why program]
    |
    v
[4.2 The ipaddress module]
    |
    v
[4.3 Structuring a script]
    |
    v
[4.4 Testing]
    |
    v
[Reading data files]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX010]

Learning outcomes

You will (1) write small Python programs to parse network data; (2) use the ipaddress module; (3) test with synthetic inputs.

4.1 Why program

Network engineers handle lists of addresses, rules and flows that are too long to check by hand. Kofi writes small Python programs using only the standard library, which runs on any council machine without installing packages. Each program reads synthetic data, computes a result and prints a clear summary.

Manual checks do not scale: comparing a few hundred rules or addresses by eye is slow and error-prone, and the same check must be repeated after every change. A short program performs the comparison identically each time, produces output that can be saved as evidence, and lets another engineer rerun it to confirm the result. That repeatability is the real reason engineers program.

4.2 The ipaddress module

Python's ipaddress module understands networks and addresses. It can check whether an address belongs to a subnet, split a block into smaller subnets and test whether two networks overlap. These operations are exactly what subnet planning and rule analysis need, and using a tested library avoids errors in hand-written bit manipulation.

Python's standard ipaddress module parses addresses and networks, tests membership, and detects overlapping subnets correctly, including edge cases such as host bits set in a network definition. Using it avoids fragile string handling. For example, checking whether a proposed subnet overlaps any existing one becomes a loop over network objects calling overlaps, which is clear to read and easy to test.

4.3 Structuring a script

Kofi's scripts follow one pattern: a docstring explaining purpose, input data near the top, small functions for each step and a final summary line. This makes them easy for council engineers to read and adapt.

A useful script separates three parts: reading input, computing results, and printing a report. Keeping the computation in small functions with clear names lets each be tested on its own and reused later. Constants such as file names belong at the top, and the main block simply calls the functions in order. This structure makes a script readable months later, when the original author has forgotten the details.

4.4 Testing

Each script is tested with inputs where the answer is known, including edge cases such as a /32 single address or an empty rule list. Tests are kept with the scripts.

A test feeds a function a small, known input and checks the output against an answer worked out by hand. For network scripts, good test cases include an exact overlap, adjacent subnets that do not overlap, and invalid input. Writing tests before trusting a script on real data catches mistakes cheaply, and rerunning them after every change shows nothing that worked before has broken.

Reading data files

Most of Kofi's inputs arrive as CSV exports from the council's tools. Python's csv module reads them into dictionaries keyed by column name, which makes scripts robust to column order changes. He checks that the expected columns exist before processing and prints a clear error if one is missing, rather than failing later with a confusing message. Dates are parsed with the datetime module and stored in UTC, because logs from different devices may use different local time settings and comparisons only make sense on a common clock.

Worked example

A ten-line script checks whether 10.40.12.5 is in 10.40.12.0/25 using ip_address(...) in ip_network(...), printing True.

Synthetic case. Data are synthetic.

Errors and limits

Strings like "10.40.12.0/25" with host bits set raise errors unless strict=False is used; understand why before suppressing it.

Exercises

EX010 — Membership check. Write the expression testing whether 192.168.5.9 is in 192.168.5.0/24.
Show marking criteria
Rubric: 3 = correct code;; 2 = near;; 1 = vague;; 0 = none.
EX011 — Edge cases. Name two edge cases for a subnet-splitting script.
Show marking criteria
Rubric: 3 = /32 and overlapping input;; 2 = one;; 1 = vague;; 0 = none.
EX012 — Library choice. Why prefer ipaddress over manual bit operations?
Show marking criteria
Rubric: 3 = tested, fewer errors;; 2 = easier;; 1 = vague;; 0 = none.

Synthesis

Small, tested standard-library scripts are the engineer's tools for checking designs.

Continue studying — chapter 04 of 50

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →