diff --git a/.gitignore b/.gitignore
index f1c4ea203..9d6cc2acc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,14 @@ testing/unit/services/output/
 make/DEBIAN/postinst
 
 testrun.log
+
+# Ignore vagrant files
+test_vm/.vagrant/
+
+# Ingnore  TLS test certificates
+test_vm/certs/
+test_vm/*.cnf
+test_vm/*.csr
+test_vm/*.pem
+test_vm/*.key
+test_vm/*.crt
\ No newline at end of file
diff --git a/test_vm/README.MD b/test_vm/README.MD
index 9a69f91e1..4ab0b130e 100644
--- a/test_vm/README.MD
+++ b/test_vm/README.MD
@@ -8,10 +8,14 @@ This guide will help you set up a Vagrant VM with two network interfaces:
 
 ## 1. Install Required Packages and Dependencies
 
+
+
 ```bash
+sudo wget -O- https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
+sudo add-apt-repository -y "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
 sudo apt-get update
-sudo apt-get install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virt-manager \
-                        ruby ruby-dev libvirt-dev zlib1g-dev ebtables dnsmasq-base vagrant
+sudo apt-get install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils \
+                        ruby ruby-dev libvirt-dev zlib1g-dev ebtables dnsmasq-base vagrant ansible
 
 ```
 
@@ -47,7 +51,13 @@ sudo ip link delete enbr99 type bridge
 
 ## 6. Create an Isolated libvirt Network Without IP and DHCP
 
-### Create the file /tmp/hostonly-noip.xml:
+### Create the file /tmp/hostonly-noip.xml
+
+```bash 
+nano /tmp/hostonly-noip.xml
+```
+
+file content
 
 ```xml
 <network>
@@ -60,6 +70,8 @@ sudo ip link delete enbr99 type bridge
 ### Create and start the network:
 
 ```bash
+sudo virsh net-destroy hostonly-noip || true
+sudo virsh net-undefine hostonly-noip || true
 sudo virsh net-define /tmp/hostonly-noip.xml
 sudo virsh net-start hostonly-noip
 sudo virsh net-autostart hostonly-noip
@@ -76,8 +88,46 @@ You should see hostonly-noip with status active.
 
 ## 8. Start the Virtual Machine
 
+COMPLIANT DEVICE
+
+```bash
+./mock_ethtool.sh
+hash -r
+DEVICE=COMPLIANT vagrant up --provider=libvirt
+DEVICE=COMPLIANT vagrant provision
+./create_certificate.sh <VM IP>
+```
+
+
+NON-COMPLIANT DEVICE (WITHOUT TLS)
+
+```bash
+./restore_ethtool.sh
+hash -r
+DEVICE=NON-COMPLIANT vagrant up --provider=libvirt
+DEVICE=NON-COMPLIANT vagrant provision
+```
+
+NON-COMPLIANT DEVICE (TLS ONLY)
 
 ```bash
-vagrant up --provider=libvirt
+./restore_ethtool.sh
+hash -r
+DEVICE=NON-COMPLIANT-TLS vagrant up --provider=libvirt
+DEVICE=NON-COMPLIANT-TLS vagrant provision
 ```
-If you see "Permission denied to /var/run/libvirt/libvirt-sock", check your libvirt group membership and restart your session.
\ No newline at end of file
+
+NOT-DETECTED DEVICE 
+
+```bash
+./mock_ethtool.sh
+hash -r
+DEVICE=NOT-DETECTED vagrant up --provider=libvirt
+DEVICE=NOT-DETECTED vagrant provision
+```
+
+If you see "Permission denied to /var/run/libvirt/libvirt-sock", check your libvirt group membership and restart your session.
+
+
+## 9. Start Testrun
+
diff --git a/test_vm/Vagrantfile b/test_vm/Vagrantfile
index da820d783..8d01960f4 100644
--- a/test_vm/Vagrantfile
+++ b/test_vm/Vagrantfile
@@ -1,18 +1,55 @@
 Vagrant.configure("2") do |config|
-  config.vm.box = "bento/ubuntu-24.04"
+  config.vm.box = "cloud-image/ubuntu-24.04"
+  config.vm.box_version = "20251126.0.0"
   config.vm.hostname = "ubuntu-vm"
-  config.vm.network "private_network",
+  if ENV['DEVICE'] == 'COMPLIANT'
+    config.vm.network "private_network",
     libvirt__network_name: "hostonly-noip",
     auto_config: false,
-    mac: "52:54:00:12:34:56"
+    mac: "f0:d4:e2:f2:f5:41"
+  end
+  if ENV['DEVICE'] == 'NON-COMPLIANT-TLS'
+    config.vm.network "private_network",
+    libvirt__network_name: "hostonly-noip",
+    auto_config: false,
+    mac: "f0:d4:e2:f2:f5:42"
+  end
+  if ENV['DEVICE'] == 'NON-COMPLIANT'
+    config.vm.network "private_network",
+    libvirt__network_name: "hostonly-noip",
+    auto_config: false,
+    mac: "54:53:52:51:50:49"
+  end
+  if ENV['DEVICE'] == 'NOT-DETECTED'
+    config.vm.network "private_network",
+    libvirt__network_name: "hostonly-noip",
+    auto_config: false,
+    mac: "f0:d4:e2:f2:f5:43"
+  end
+  
   config.vm.provider :libvirt do |libvirt|
     libvirt.memory = 2048
     libvirt.cpus = 2
     libvirt.graphics_type = "none"
   end
-  if ENV['USE_ANSIBLE'] == '1'
+  if ENV['DEVICE'] == 'COMPLIANT'
+    config.vm.provision "ansible" do |ansible|
+      ansible.playbook = "provision-compliant.yml"
+    end
+  end
+  if ENV['DEVICE'] == 'NON-COMPLIANT'
+    config.vm.provision "ansible" do |ansible|
+      ansible.playbook = "provision-non-compliant.yml"
+    end
+  end
+  if ENV['DEVICE'] == 'NON-COMPLIANT-TLS'
+    config.vm.provision "ansible" do |ansible|
+      ansible.playbook = "provision-non-compliant-tls.yml"
+    end
+  end
+  if ENV['DEVICE'] == 'NOT-DETECTED'
     config.vm.provision "ansible" do |ansible|
-      ansible.playbook = "provision.yml"
+      ansible.playbook = "provision-not-detected.yml"
     end
   end
 end
diff --git a/test_vm/create_cert_chain.sh b/test_vm/create_cert_chain.sh
new file mode 100755
index 000000000..a9107ee7d
--- /dev/null
+++ b/test_vm/create_cert_chain.sh
@@ -0,0 +1,135 @@
+#!/bin/bash
+set -e
+
+if [ -z "$1" ]; then
+  echo "Usage: $0 <VM_IP>"
+  exit 1
+fi
+
+VM_USER=vagrant
+VM_PASS=vagrant
+VM_IP="$1"
+SSHPASS="sshpass -p $VM_PASS"
+
+BASE_DIR="$(pwd)"
+WORKDIR="$BASE_DIR/multi_ca_demo"
+CERTS_DIR="$BASE_DIR/certs"
+NGINX_CN="$VM_IP"
+
+mkdir -p "$WORKDIR"
+mkdir -p "$CERTS_DIR"
+cd "$WORKDIR"
+
+# Create CA extension config for intermediates
+cat > ca_ext.cnf <<EOF
+[ v3_ca ]
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+basicConstraints = critical,CA:true,pathlen:0
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+EOF
+
+# 1. Root CA
+openssl genrsa -out rootCA.key 4096
+openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem -subj "/C=RU/O=MyOrgRoot/CN=MyRootCA"
+
+# 2. Intermediate CA 1
+openssl genrsa -out int1CA.key 4096
+openssl req -new -key int1CA.key -out int1CA.csr -subj "/C=RU/O=MyOrgInt1/CN=MyInt1CA"
+openssl x509 -req -in int1CA.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial \
+  -out int1CA.pem -days 1825 -sha256 -extfile ca_ext.cnf -extensions v3_ca
+
+# 3. Intermediate CA 2
+openssl genrsa -out int2CA.key 4096
+openssl req -new -key int2CA.key -out int2CA.csr -subj "/C=RU/O=MyOrgInt2/CN=MyInt2CA"
+openssl x509 -req -in int2CA.csr -CA int1CA.pem -CAkey int1CA.key -CAcreateserial \
+  -out int2CA.pem -days 1825 -sha256 -extfile ca_ext.cnf -extensions v3_ca
+
+# 4. nginx server key and CSR
+cat > openssl_nginx.cnf <<EOF
+[ req ]
+default_bits       = 2048
+prompt             = no
+default_md         = sha256
+req_extensions     = req_ext
+distinguished_name = dn
+
+[ dn ]
+C  = RU
+O  = MyOrganization
+CN = $NGINX_CN
+
+[ req_ext ]
+subjectAltName = @alt_names
+
+[ alt_names ]
+IP.1 = $NGINX_CN
+EOF
+
+openssl req -new -nodes -out nginx.csr -newkey rsa:2048 -keyout nginx.key -config openssl_nginx.cnf
+
+# 5. nginx server cert signed by Intermediate CA 2
+openssl x509 -req -in nginx.csr -CA int2CA.pem -CAkey int2CA.key -CAcreateserial \
+  -out nginx.crt -days 365 -sha256 -extfile openssl_nginx.cnf -extensions req_ext
+
+# 6. Build full chain for nginx
+cat nginx.crt int2CA.pem int1CA.pem rootCA.pem > nginx_fullchain.pem
+
+echo "All certificates generated."
+
+# 7. Copy certs and key to VM
+$SSHPASS scp -o StrictHostKeyChecking=no nginx.key ${VM_USER}@${VM_IP}:/home/vagrant/nginx.key
+$SSHPASS scp -o StrictHostKeyChecking=no nginx_fullchain.pem ${VM_USER}@${VM_IP}:/home/vagrant/nginx_fullchain.pem
+$SSHPASS scp -o StrictHostKeyChecking=no int2CA.pem ${VM_USER}@${VM_IP}:/home/vagrant/int2CA.pem
+$SSHPASS scp -o StrictHostKeyChecking=no int1CA.pem ${VM_USER}@${VM_IP}:/home/vagrant/int1CA.pem
+$SSHPASS scp -o StrictHostKeyChecking=no rootCA.pem ${VM_USER}@${VM_IP}:/home/vagrant/rootCA.pem
+
+# 8. Move certs to correct locations and configure nginx on VM
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/nginx.key /etc/ssl/private/nginx.key"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/nginx_fullchain.pem /etc/ssl/certs/nginx_fullchain.pem"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/int2CA.pem /etc/ssl/certs/int2CA.pem"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/int1CA.pem /etc/ssl/certs/int1CA.pem"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/rootCA.pem /etc/ssl/certs/rootCA.pem"
+
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo bash -c 'cat > /etc/nginx/sites-available/default <<EOF
+server {
+    listen 443 ssl;
+    server_name $NGINX_CN;
+
+    ssl_certificate /etc/ssl/certs/nginx_fullchain.pem;
+    ssl_certificate_key /etc/ssl/private/nginx.key;
+
+    location / {
+        root /var/www/html;
+        index index.html index.htm;
+    }
+}
+EOF
+'"
+
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo nginx -t"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo systemctl restart nginx"
+
+echo "nginx configured with multi-level CA chain on $VM_IP"
+
+# 9. Copy nginx_fullchain.pem, int2CA.pem, int1CA.pem, rootCA.pem from VM to certs subdirectory in working directory
+$SSHPASS scp -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP}:/etc/ssl/certs/nginx_fullchain.pem "$CERTS_DIR/nginx_fullchain.pem"
+$SSHPASS scp -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP}:/etc/ssl/certs/int2CA.pem "$CERTS_DIR/int2CA.pem"
+$SSHPASS scp -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP}:/etc/ssl/certs/int1CA.pem "$CERTS_DIR/int1CA.pem"
+$SSHPASS scp -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP}:/etc/ssl/certs/rootCA.pem "$CERTS_DIR/rootCA.pem"
+echo "Certificates copied from VM to $CERTS_DIR/"
+
+# 10. Add rootCA.pem to trusted store on the client (Ubuntu/Debian)
+if [ -f "$CERTS_DIR/rootCA.pem" ]; then
+  echo "Adding rootCA.pem to trusted store..."
+  sudo cp "$CERTS_DIR/rootCA.pem" /usr/local/share/ca-certificates/myorg-root-ca.crt
+  sudo update-ca-certificates
+  echo "rootCA.pem added to trusted store."
+else
+  echo "rootCA.pem not found in $CERTS_DIR, skipping trusted store update."
+fi
+
+# 11. Remove temporary working directory
+cd "$BASE_DIR"
+rm -rf "$WORKDIR"
+echo "Temporary directory $WORKDIR removed."
\ No newline at end of file
diff --git a/test_vm/create_certificate.sh b/test_vm/create_certificate.sh
new file mode 100755
index 000000000..229c10a7b
--- /dev/null
+++ b/test_vm/create_certificate.sh
@@ -0,0 +1,134 @@
+#!/bin/bash
+set -e
+
+if [ -z "$1" ]; then
+  echo "Usage: $0 <VM_IP>"
+  exit 1
+fi
+
+# Save the initial working directory
+WORKDIR="$(pwd)"
+
+# Check and install sshpass if not present
+if ! command -v sshpass &> /dev/null; then
+  echo "sshpass not found. Installing..."
+  if [ -x "$(command -v apt)" ]; then
+    sudo apt update
+    sudo apt install -y sshpass
+  elif [ -x "$(command -v yum)" ]; then
+    sudo yum install -y epel-release
+    sudo yum install -y sshpass
+  elif [ -x "$(command -v brew)" ]; then
+    brew install hudochenkov/sshpass/sshpass
+  else
+    echo "Please install sshpass manually."
+    exit 1
+  fi
+fi
+
+VM_USER=vagrant
+VM_PASS=vagrant
+VM_IP="$1"
+CA_DIR=~/myCA
+
+SSHPASS="sshpass -p $VM_PASS"
+
+# 1. Generate key and CSR on VM via ssh
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "cat > /home/vagrant/openssl_ip.cnf" <<EOF
+[ req ]
+default_bits       = 2048
+prompt             = no
+default_md         = sha256
+req_extensions     = req_ext
+distinguished_name = dn
+
+[ dn ]
+C  = RU
+O  = MyOrganization
+CN = ${VM_IP}
+
+[ req_ext ]
+subjectAltName = @alt_names
+
+[ alt_names ]
+IP.1 = ${VM_IP}
+EOF
+
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "openssl req -new -nodes -out /home/vagrant/nginx_ip.csr -newkey rsa:2048 -keyout /home/vagrant/nginx_ip.key -config /home/vagrant/openssl_ip.cnf"
+
+# 2. Copy CSR and config from VM to host (current directory)
+$SSHPASS scp -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP}:/home/vagrant/nginx_ip.csr "$WORKDIR/"
+$SSHPASS scp -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP}:/home/vagrant/openssl_ip.cnf "$WORKDIR/"
+
+CSR_PATH="$WORKDIR/nginx_ip.csr"
+CONF_PATH="$WORKDIR/openssl_ip.cnf"
+
+# 3. Create CA (once)
+mkdir -p "$CA_DIR"
+cd "$CA_DIR"
+if [ ! -f myorgca.key ]; then
+  openssl genrsa -out myorgca.key 4096
+fi
+if [ ! -f myorgca.pem ]; then
+  openssl req -x509 -new -nodes -key myorgca.key -sha256 -days 1825 -out myorgca.pem -subj "/C=RU/O=MyOrganization/CN=MyOrgCA"
+fi
+
+# 4. Sign the certificate using absolute paths
+openssl x509 -req -in "$CSR_PATH" -CA myorgca.pem -CAkey myorgca.key -CAcreateserial -out nginx_ip.crt -days 365 -sha256 -extfile "$CONF_PATH" -extensions req_ext
+
+# 5. Copy certificate and CA back to VM
+$SSHPASS scp -o StrictHostKeyChecking=no nginx_ip.crt ${VM_USER}@${VM_IP}:/home/vagrant/
+$SSHPASS scp -o StrictHostKeyChecking=no myorgca.pem ${VM_USER}@${VM_IP}:/home/vagrant/
+
+# 6. Copy myorgca.pem to initial working directory on host (if not already there)
+if [ "$WORKDIR" != "$CA_DIR" ]; then
+  cp "$CA_DIR/myorgca.pem" "$WORKDIR/myorgca.pem"
+fi
+
+# 7. Move certificates and configure nginx for SSL on VM
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/nginx_ip.crt /etc/ssl/certs/nginx_ip.crt"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/nginx_ip.key /etc/ssl/private/nginx_ip.key"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo mv /home/vagrant/myorgca.pem /etc/ssl/certs/myorgca.pem"
+
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo bash -c 'cat > /etc/nginx/sites-available/default <<EOF
+server {
+    listen 443 ssl;
+    server_name ${VM_IP};
+
+    ssl_certificate /etc/ssl/certs/nginx_ip.crt;
+    ssl_certificate_key /etc/ssl/private/nginx_ip.key;
+    ssl_trusted_certificate /etc/ssl/certs/myorgca.pem;
+
+    location / {
+        root /var/www/html;
+        index index.html index.htm;
+    }
+}
+EOF
+'"
+
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo nginx -t"
+$SSHPASS ssh -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP} "sudo systemctl restart nginx"
+
+echo "SSL certificate installed and nginx restarted on ${VM_IP}"
+if [ "$WORKDIR" != "$CA_DIR" ]; then
+  echo "CA certificate (myorgca.pem) copied to $WORKDIR/myorgca.pem"
+else
+  echo "CA certificate (myorgca.pem) is already in $WORKDIR"
+fi
+
+# 8. Copy nginx_ip.crt from VM to certs subdirectory in initial working directory
+CERTS_DIR="$WORKDIR/certs"
+mkdir -p "$CERTS_DIR"
+$SSHPASS scp -o StrictHostKeyChecking=no ${VM_USER}@${VM_IP}:/etc/ssl/certs/myorgca.pem "$CERTS_DIR/myorgca.pem"
+echo "nginx_ip.crt copied from VM to $CERTS_DIR/nginx_ip.crt"
+
+# 9. Add myorgca.pem to trusted store on the client (Ubuntu/Debian)
+if [ -f "$CERTS_DIR/myorgca.pem" ]; then
+  echo "Adding myorgca.pem to trusted store..."
+  sudo cp "$CERTS_DIR/myorgca.pem" /usr/local/share/ca-certificates/myorgca.crt
+  sudo update-ca-certificates
+  echo "myorgca.pem added to trusted store."
+else
+  echo "myorgca.pem not found in $CERTS_DIR, skipping trusted store update."
+fi
\ No newline at end of file
diff --git a/test_vm/mock_ethtool.sh b/test_vm/mock_ethtool.sh
new file mode 100755
index 000000000..10110a3a4
--- /dev/null
+++ b/test_vm/mock_ethtool.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+sudo tee /usr/local/bin/ethtool > /dev/null <<'EOF'
+#!/bin/bash
+if [[ "$1" == "enbr99" ]]; then
+  cat <<EOT
+Settings for enbr99:
+    Supported ports: [ TP ]
+    Supported link modes:   1000baseT/Full
+    Supported pause frame use: No
+    Supports auto-negotiation: Yes
+    Advertised link modes:  1000baseT/Full
+    Advertised pause frame use: No
+    Advertised auto-negotiation: Yes
+    Speed: 1000Mb/s
+    Duplex: Full
+    Port: Twisted Pair
+    PHYAD: 0
+    Transceiver: internal
+    Auto-negotiation: on
+    Link detected: yes
+EOT
+else
+  /usr/sbin/ethtool "$@"
+fi
+EOF
+
+sudo chmod +x /usr/local/bin/ethtool
+hash -r
\ No newline at end of file
diff --git a/test_vm/provision-compliant.yml b/test_vm/provision-compliant.yml
new file mode 100644
index 000000000..4a6716576
--- /dev/null
+++ b/test_vm/provision-compliant.yml
@@ -0,0 +1,320 @@
+---
+- hosts: all
+  become: true
+  tasks:
+
+    # Common setup tasks
+
+    - name: Install Python3, pip, venv, and setcap utility
+      apt:
+        name:
+          - python3
+          - python3-pip
+          - python3-venv
+          - libcap2-bin
+          - net-tools
+          - isc-dhcp-client
+          - git
+          - gcc
+          - make
+          - bison
+          - flex
+          - libpcap-dev
+          - chrony
+          - openssl
+          - nginx
+        state: present
+        update_cache: yes
+
+    # Set up networking on ens5
+
+    - name: Run dhclient on ens5 (in background)
+      shell: nohup dhclient ens5 &
+      async: 0
+      poll: 0
+
+    # BACnet stack setup
+
+    - name: Clone BACnet stack repository
+      git:
+        repo: https://github.com/bacnet-stack/bacnet-stack.git
+        dest: /opt/bacnet-stack
+        version: master
+
+    - name: Build BACnet stack
+      make:
+        chdir: /opt/bacnet-stack
+        target: all
+
+    - name: Copy bacserv-wrapper.sh
+      copy:
+        dest: /usr/local/bin/bacserv-wrapper.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          IFACE=ens5
+          while true; do
+            IP=$(ip -4 addr show $IFACE | awk '/inet / {print $2}' | cut -d/ -f1)
+            if [ -n "$IP" ]; then
+              export BACNET_IP=$IP
+              exec /opt/bacnet-stack/bin/bacserv
+            fi
+            sleep 2
+          done
+
+    - name: Create systemd unit for bacserv
+      copy:
+        dest: /etc/systemd/system/bacserv.service
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=BACnet Server (auto-restart on IP change)
+          After=network-online.target
+          Wants=network-online.target
+
+          [Service]
+          Type=simple
+          ExecStart=/usr/local/bin/bacserv-wrapper.sh
+          Restart=always
+          RestartSec=5
+
+          [Install]
+          WantedBy=multi-user.target
+
+    - name: Reload systemd and enable bacserv service
+      systemd:
+        name: bacserv
+        enabled: yes
+        state: restarted
+        daemon_reload: yes
+
+    # Modbus TCP server setup
+
+    - name: Create venv for modbus
+      become: no
+      command: python3 -m venv /home/vagrant/modbus-venv
+      args:
+        creates: /home/vagrant/modbus-venv
+
+    - name: Create venv for modbus
+      become: no
+      command: python3 -m venv /home/vagrant/modbus-venv
+      args:
+        creates: /home/vagrant/modbus-venv
+
+    - name: Install pyModbusTCP in venv
+      become: no
+      command: /home/vagrant/modbus-venv/bin/pip install pyModbusTCP
+
+    - name: Find real python binary path
+      shell: readlink -f /home/vagrant/modbus-venv/bin/python
+      register: real_python_path
+
+    - name: Allow system python to bind to port 502
+      become: true
+      command: setcap 'cap_net_bind_service=+ep' {{ real_python_path.stdout }}
+
+    - name: Copy Modbus TCP server script (pyModbusTCP)
+      copy:
+        src: ./python/src/modbus_server.py
+        dest: /home/vagrant/modbus_server.py
+        owner: vagrant
+        group: vagrant
+        mode: '0644'
+
+    - name: Ensure modbus server is running (systemd)
+      copy:
+        dest: /etc/systemd/system/modbus-server.service
+        content: |
+          [Unit]
+          Description=Modbus TCP Server (pyModbusTCP)
+          After=network.target
+
+          [Service]
+          Type=simple
+          User=vagrant
+          ExecStart=/home/vagrant/modbus-venv/bin/python /home/vagrant/modbus_server.py
+          Restart=always
+
+          [Install]
+          WantedBy=multi-user.target
+
+    - name: Reload systemd
+      systemd:
+        daemon_reload: yes
+
+    - name: Enable and start modbus-server
+      systemd:
+        name: modbus-server
+        enabled: yes
+        state: started
+
+    # NTP client setup
+
+    - name: Remove static NTP servers from chrony.conf
+      lineinfile:
+        path: /etc/chrony/chrony.conf
+        regexp: '^(server|pool)'
+        state: absent
+
+    - name: Ensure sourcedir for DHCP is present
+      lineinfile:
+        path: /etc/chrony/chrony.conf
+        line: 'sourcedir /run/chrony-dhcp'
+        state: present
+
+    - name: Restart chrony
+      service:
+        name: chrony
+        state: restarted
+        enabled: yes
+
+    - name: Wait for chrony to sync sources
+      wait_for:
+        timeout: 10
+
+    # DNS request setup
+
+    - name: Create systemd service for curl
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/curl-google.service
+        content: |
+          [Unit]
+          Description=Curl google.com
+
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/bin/curl -s -L -o /dev/null -w "%{http_code}\n" https://www.google.com
+
+    - name: Create systemd timer for curl
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/curl-google.timer
+        content: |
+          [Unit]
+          Description=Run curl google.com every 5 seconds
+
+          [Timer]
+          OnBootSec=5
+          OnUnitActiveSec=5
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Reload systemd daemon
+      ansible.builtin.systemd:
+        daemon_reload: yes
+
+    - name: Enable and start curl-google.timer
+      ansible.builtin.systemd:
+        name: curl-google.timer
+        enabled: yes
+        state: started
+
+    # mDNS traffic setup
+
+    - name: Ensure avahi-utils is installed
+      ansible.builtin.apt:
+        name: avahi-utils
+        state: present
+        update_cache: yes
+
+    - name: Create systemd service for mDNS traffic
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/mdns-traffic.service
+        content: |
+          [Unit]
+          Description=Generate mDNS traffic using avahi-publish
+
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/bin/avahi-publish -s "TestService" _http._tcp 8080
+
+    - name: Create systemd timer for mDNS traffic
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/mdns-traffic.timer
+        content: |
+          [Unit]
+          Description=Run mDNS traffic generator every 5 seconds
+
+          [Timer]
+          OnBootSec=5
+          OnUnitActiveSec=5
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Reload systemd daemon
+      ansible.builtin.systemd:
+        daemon_reload: yes
+
+    - name: Enable and start mdns-traffic.timer
+      ansible.builtin.systemd:
+        name: mdns-traffic.timer
+        enabled: yes
+        state: started
+
+    # Outbound TLS traffic setup
+
+    - name: Copy TLS emulation script and make it executable
+      ansible.builtin.copy:
+        dest: /usr/local/bin/tls_emulate.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          # Wait for IP
+          while true; do
+              IP=$(ip -4 addr show ens5 | awk '/inet / {print $2}' | cut -d/ -f1)
+              if [[ -n "$IP" ]]; then
+                  break
+              fi
+              sleep 1
+          done
+          # TLS 1.0
+          openssl s_client -connect tls-v1-0.badssl.com:1010 -tls1 -bind "$IP"
+          # TLS 1.2
+          openssl s_client -connect tls-v1-2.badssl.com:1012 -tls1_2 -bind "$IP"
+          # TLS 1.3
+          openssl s_client -connect tls13.badssl.com:443 -tls1_3 -bind "$IP"
+
+    - name: Create systemd service for TLS emulation
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/tls-emulate.service
+        content: |
+          [Unit]
+          Description=Emulate outgoing TLS connections via ens5
+
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/local/bin/tls_emulate.sh
+
+    - name: Create systemd timer for TLS emulation
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/tls-emulate.timer
+        content: |
+          [Unit]
+          Description=Run TLS emulation every 5 seconds
+
+          [Timer]
+          OnBootSec=5
+          OnUnitActiveSec=5
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Reload systemd daemon
+      ansible.builtin.systemd:
+        daemon_reload: yes
+
+    - name: Enable and start tls-emulate.timer
+      ansible.builtin.systemd:
+        name: tls-emulate.timer
+        enabled: yes
+        state: started
+
+    # Install and start nginx for HTTP traffic
+
+    - name: Ensure nginx is running
+      service:
+        name: nginx
+        state: started
+        enabled: yes
\ No newline at end of file
diff --git a/test_vm/provision-non-compliant-tls.yml b/test_vm/provision-non-compliant-tls.yml
new file mode 100644
index 000000000..dc9388202
--- /dev/null
+++ b/test_vm/provision-non-compliant-tls.yml
@@ -0,0 +1,178 @@
+---
+- name: Non-compliant TLS handshakes from 10.10.10.14 via ens5 every 2s (with pause and logging)
+  hosts: all
+  become: yes
+  vars:
+    fail_tls_script: /usr/local/bin/fail_tls_handshake.sh
+    bind_ip: "10.10.10.14"
+    iface: "ens5"
+    target_host: "www.google.com"
+    target_port: "443"
+    ssl_cert: /etc/ssl/certs/nginx-selfsigned.crt
+    ssl_key: /etc/ssl/private/nginx-selfsigned.key
+
+  tasks:
+    - name: Ensure openssl, dhclient, and nginx are installed
+      apt:
+        name:
+          - openssl
+          - isc-dhcp-client
+          - nginx
+        state: present
+        update_cache: yes
+
+    - name: Run dhclient on ens5 (in background)
+      shell: nohup dhclient {{ iface }} &
+      async: 0
+      poll: 0
+
+  # NGINX
+
+    - name: Ensure openssl, dhclient, and nginx are installed
+      apt:
+        name:
+          - openssl
+          - isc-dhcp-client
+          - nginx
+        state: present
+        update_cache: yes
+
+    - name: Generate self-signed SSL certificate for nginx
+      command: >
+        openssl req -x509 -nodes -days 365 -newkey rsa:2048
+        -keyout {{ ssl_key }} -out {{ ssl_cert }}
+        -subj "/CN=localhost"
+      args:
+        creates: "{{ ssl_cert }}"
+
+    - name: Create nginx HTTPS config
+      copy:
+        dest: /etc/nginx/sites-available/ssl_default
+        content: |
+          server {
+              listen 443 ssl;
+              server_name _;
+              ssl_certificate     {{ ssl_cert }};
+              ssl_certificate_key {{ ssl_key }};
+              ssl_protocols       TLSv1.2 TLSv1.3;
+              ssl_ciphers         HIGH:!aNULL:!MD5;
+              location / {
+                  return 200 'nginx HTTPS is up\n';
+              }
+          }
+          server {
+              listen 80;
+              server_name _;
+              location / {
+                  return 200 'nginx HTTP is up\n';
+              }
+          }
+
+    - name: Enable nginx HTTPS config
+      file:
+        src: /etc/nginx/sites-available/ssl_default
+        dest: /etc/nginx/sites-enabled/ssl_default
+        state: link
+        force: yes
+
+    - name: Remove default nginx config (if exists)
+      file:
+        path: /etc/nginx/sites-enabled/default
+        state: absent
+
+    - name: Ensure nginx is started and enabled
+      systemd:
+        name: nginx
+        state: restarted
+        enabled: yes
+
+
+    - name: Copy fail_tls_handshake.sh script
+      copy:
+        dest: "{{ fail_tls_script }}"
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          iface="{{ iface }}"
+          ip_addr="{{ bind_ip }}"
+          host="{{ target_host }}"
+          port="{{ target_port }}"
+          LOG="/tmp/tls_test.log"
+          echo "=== $(date) ===" >> $LOG
+          echo "IP on $iface:" >> $LOG
+          ip -4 addr show dev $iface >> $LOG
+          echo "Routing table:" >> $LOG
+          ip route >> $LOG
+          # Wait for IP to appear on ens5
+          for i in {1..60}; do
+            if ip -4 addr show dev $iface | grep -q "$ip_addr"; then
+              break
+            fi
+            sleep 2
+          done
+          if ! ip -4 addr show dev $iface | grep -q "$ip_addr"; then
+            echo "No IP $ip_addr on $iface" >> $LOG
+            exit 1
+          fi
+          # TLS 1.2
+          echo "Running TLS 1.2 handshake..." >> $LOG
+          openssl s_client -connect $host:$port -tls1_2 -cipher "CAMELLIA256-SHA256" -bind $ip_addr -ign_eof < /dev/null >> $LOG 2>&1
+
+    - name: Create systemd service for failing TLS handshake
+      copy:
+        dest: /etc/systemd/system/fail-tls-handshake.service
+        content: |
+          [Unit]
+          Description=Fail TLS handshake via ens5 from {{ bind_ip }}
+
+          [Service]
+          Type=oneshot
+          ExecStart={{ fail_tls_script }}
+
+    - name: Create systemd timer for failing TLS handshake
+      copy:
+        dest: /etc/systemd/system/fail-tls-handshake.timer
+        content: |
+          [Unit]
+          Description=Run fail TLS handshake every 2 seconds
+
+          [Timer]
+          OnBootSec=5
+          OnUnitActiveSec=2
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Reload systemd
+      shell: systemctl daemon-reload
+
+    - name: Enable and start fail-tls-handshake.timer
+      systemd:
+        name: fail-tls-handshake.timer
+        enabled: yes
+        state: started
+
+    # BLOCK ICMP 
+
+    - name: Ensure UFW is installed
+      apt:
+        name: ufw
+        state: present
+
+    - name: Set UFW default policy to deny incoming
+      command: ufw default deny incoming
+
+    - name: Set UFW default policy to allow outgoing
+      command: ufw default allow outgoing
+
+    - name: Allow SSH
+      command: ufw allow 22/tcp
+
+    - name: Allow HTTP
+      command: ufw allow 80/tcp
+
+    - name: Allow SNMP
+      command: ufw allow 443/tcp
+
+    - name: Reload UFW
+      command: ufw reload
diff --git a/test_vm/provision-non-compliant.yml b/test_vm/provision-non-compliant.yml
new file mode 100644
index 000000000..e3bc8a446
--- /dev/null
+++ b/test_vm/provision-non-compliant.yml
@@ -0,0 +1,698 @@
+---
+- hosts: all
+  become: true
+  vars:
+    dhcp_iface: ens5
+    dhcp_subnet: "10.10.10.0"
+    dhcp_netmask: "255.255.255.0"
+    dhcp_range_start: "10.10.10.100"
+    dhcp_range_end: "10.10.10.200"
+    dhcp_router: "10.10.10.1"
+    dhcp_dns: "8.8.8.8, 8.8.4.4"
+    device_mac: "54:53:52:51:50:49"   
+    wrong_ip: "10.10.10.99"           
+    target_ip: "10.10.10.1"       
+    iface: "ens5"
+    vars:
+    scapy_venv_path: /opt/scapy-venv
+    ntp_script_path: /usr/local/bin/send_ntp_both.py
+    ntp_service_path: /etc/systemd/system/ntp-both-sender.service
+    dst_mac: "ff:ff:ff:ff:ff:ff"
+    dhcp_ntp_ip: "10.10.10.5"
+    other_ntp_ip: "8.8.8.8"
+
+  tasks:
+
+    # Common setup tasks
+
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+      ignore_errors: yes
+      timeout: 100
+
+    - name: Install Python3, pip, venv, and netcat
+      apt:
+        name:
+          - python3
+          - python3-pip
+          - python3-venv
+          - libcap2-bin
+          - net-tools
+          - netcat-openbsd
+          - isc-dhcp-client
+        state: present
+
+    # Set up networking on ens5
+   
+    - name: Run dhclient on ens5 (in background)
+      shell: nohup dhclient ens5 &
+      async: 0
+      poll: 0
+
+    # NTP 
+
+    - name: Create Python venv for scapy
+      command: python3 -m venv {{ scapy_venv_path }}
+      args:
+        creates: "{{ scapy_venv_path }}/bin/activate"
+      changed_when: false
+
+    - name: Install scapy in venv
+      command: "{{ scapy_venv_path }}/bin/pip install scapy"
+      changed_when: false
+
+    - name: Copy NTP sender script to VM (dynamic src_ip, both servers)
+      copy:
+        dest: "{{ ntp_script_path }}"
+        mode: '0755'
+        content: |
+          from scapy.all import Ether, IP, UDP, NTP, sendp, get_if_addr
+          import time
+
+          iface = "{{ iface }}"
+          src_mac = "{{ device_mac }}"
+          dst_mac = "{{ dst_mac }}"
+          dhcp_ntp_ip = "{{ dhcp_ntp_ip }}"
+          other_ntp_ip = "{{ other_ntp_ip }}"
+
+          while True:
+              src_ip = get_if_addr(iface)
+              # Send to DHCP-provided NTP server
+              pkt1 = Ether(src=src_mac, dst=dst_mac) / \
+                     IP(src=src_ip, dst=dhcp_ntp_ip) / \
+                     UDP(sport=123, dport=123) / \
+                     NTP(version=3)
+              sendp(pkt1, iface=iface, verbose=False)
+              print(f"Sent NTPv4 packet to DHCP NTP server {dhcp_ntp_ip} from {src_ip}")
+
+              # Send to non-DHCP NTP server
+              pkt2 = Ether(src=src_mac, dst=dst_mac) / \
+                     IP(src=src_ip, dst=other_ntp_ip) / \
+                     UDP(sport=123, dport=123) / \
+                     NTP(version=3)
+              sendp(pkt2, iface=iface, verbose=False)
+              print(f"Sent NTPv4 packet to non-DHCP NTP server {other_ntp_ip} from {src_ip}")
+
+              time.sleep(1)
+
+    - name: Create systemd unit for continuous NTP both sender
+      copy:
+        dest: "{{ ntp_service_path }}"
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Continuous NTP Packet Sender (DHCP and non-DHCP)
+          After=network.target
+
+          [Service]
+          Type=simple
+          ExecStart={{ scapy_venv_path }}/bin/python {{ ntp_script_path }}
+          Restart=always
+
+          [Install]
+          WantedBy=multi-user.target
+
+    - name: Reload systemd for NTP both sender
+      systemd:
+        daemon_reload: yes
+
+    - name: Enable and start NTP both sender service
+      systemd:
+        name: ntp-both-sender
+        enabled: yes
+        state: started
+
+    - name: Assign temporary static IP to ens5 for DHCP server startup
+      command: ip addr add 10.10.10.14/24 dev ens5
+      ignore_errors: yes
+
+    # Custom Modbus TCP server NON-COMPLIANT
+
+    - name: Copy Modbus TCP server script (pyModbusTCP)
+      copy:
+        src: ./python/src/modbus_server_non_compliant.py
+        dest: /home/vagrant/modbus_server_non_compliant.py
+        owner: vagrant
+        group: vagrant
+        mode: '0644'
+
+    - name: Create systemd unit for custom Modbus server
+      copy:
+        dest: /etc/systemd/system/custom-modbus-server.service
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Custom Modbus TCP Error Server
+          After=network.target
+
+          [Service]
+          Type=simple
+          ExecStart=/usr/bin/python3 /home/vagrant/modbus_server_non_compliant.py
+          Restart=always
+
+          [Install]
+          WantedBy=multi-user.target
+
+    - name: Reload systemd
+      systemd:
+        daemon_reload: yes
+
+    - name: Enable and start custom Modbus server
+      systemd:
+        name: custom-modbus-server
+        enabled: yes
+        state: started
+
+    - name: Show custom Modbus server status
+      systemd:
+        name: custom-modbus-server
+      register: modbus_status
+      changed_when: false
+
+    # FTP server
+
+    - name: Kill old fake FTP netcat processes
+      shell: pkill -f 'nc -l -s .* -p 21' || true
+
+      ignore_errors: yes
+    - name: Copy fake FTP netcat script
+      copy:
+        dest: /usr/local/bin/fake-ftp-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "220 Fake FTP server ready\r\n" | nc -l -s $ens5_IP -p 21
+          done
+    - name: Run fake FTP netcat script as background process
+      shell: nohup /usr/local/bin/fake-ftp-netcat-ens5.sh > /var/log/fake-ftp-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-ftp-netcat-ens5.log
+
+
+    # SSH server configuration
+
+    - name: Gather facts
+      setup:
+
+    - name: Set ens4_ip from Ansible facts
+      set_fact:
+        ens4_ip: "{{ ansible_ens4.ipv4.address | default('') }}"
+
+    - name: Fail if ens4_ip is not set
+      fail:
+        msg: "ens4_ip is not set! Please check network configuration."
+      when: ens4_ip == ''
+
+    - name: Debug ens4 IP
+      debug:
+        msg: "ens4 IP is {{ ens4_ip }}"
+
+    - name: Stop and disable ssh.socket (prevents auto-start on all interfaces)
+      service:
+        name: ssh.socket
+        state: stopped
+        enabled: no
+      ignore_errors: yes
+
+    - name: Ensure only ens4 is in ListenAddress for sshd
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^ListenAddress'
+        line: "ListenAddress {{ ens4_ip }}"
+        state: present
+        insertafter: '^#Port'
+
+    - name: Remove all other ListenAddress lines from sshd_config
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^ListenAddress (?!{{ ens4_ip }})'
+        state: absent
+
+    - name: Restart sshd
+      service:
+        name: ssh
+        state: restarted
+
+    - name: Show what is listening on port 22
+      shell: ss -tlnp | grep :22 || netstat -tlnp | grep :22 || true
+      register: port22
+      changed_when: false
+
+    - debug:
+        var: port22.stdout_lines
+
+
+    - name: Create fake SSH banner systemd service for ens5:22
+      copy:
+        dest: /etc/systemd/system/fake-ssh-banner.service
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Fake SSH Banner on ens5:22
+          After=network-online.target
+          Wants=network-online.target
+
+          [Service]
+          Type=simple
+          ExecStart=/bin/bash -c '\
+            while true; do \
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP "(?<=inet\s)\d+(\.\d+){3}"); \
+              if [[ -n "$ens5_IP" ]]; then \
+                echo "ens5 IP detected: $ens5_IP"; \
+                break; \
+              fi; \
+              echo "Waiting for ens5 IP..."; \
+              sleep 2; \
+            done; \
+            while true; do echo -e "SSH-1.99-OpenSSH_1.99\r\n" | nc -l -s $ens5_IP -p 22; done'
+          Restart=always
+
+          [Install]
+          WantedBy=multi-user.target
+
+    - name: Reload systemd
+      systemd:
+        daemon_reload: yes
+
+    - name: Restart fake-ssh-banner service
+      systemd:
+        name: fake-ssh-banner.service
+        state: restarted
+        enabled: yes
+
+    # Telnet server setup
+
+    - name: Kill old fake Telnet netcat processes
+      shell: pkill -f 'nc -l -s .* -p 23' || true
+      ignore_errors: yes
+    - name: Copy fake Telnet netcat script
+      copy:
+        dest: /usr/local/bin/fake-telnet-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "Fake Telnet server\r\n" | nc -l -s $ens5_IP -p 23
+          done
+    - name: Run fake Telnet netcat script as background process
+      shell: nohup /usr/local/bin/fake-telnet-netcat-ens5.sh > /var/log/fake-telnet-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-telnet-netcat-ens5.log
+
+    # SMTP (TCP/25)
+
+    - name: Kill old fake SMTP netcat processes
+      shell: pkill -f 'nc -l -s .* -p 25' || true
+      ignore_errors: yes
+    - name: Copy fake SMTP netcat script
+      copy:
+        dest: /usr/local/bin/fake-smtp-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "220 fake-smtp ESMTP Postfix\r\n" | nc -l -s $ens5_IP -p 25
+          done
+    - name: Run fake SMTP netcat script as background process
+      shell: nohup /usr/local/bin/fake-smtp-netcat-ens5.sh > /var/log/fake-smtp-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-smtp-netcat-ens5.log
+
+    # POP3 (TCP/110)
+
+    - name: Kill old fake POP3 netcat processes
+
+      shell: pkill -f 'nc -l -s .* -p 110' || true
+      ignore_errors: yes
+    - name: Copy fake POP3 netcat script
+      copy:
+        dest: /usr/local/bin/fake-pop3-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "+OK Fake POP3 server ready\r\n" | nc -l -s $ens5_IP -p 110
+          done
+    - name: Run fake POP3 netcat script as background process
+      shell: nohup /usr/local/bin/fake-pop3-netcat-ens5.sh > /var/log/fake-pop3-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-pop3-netcat-ens5.log
+
+    # IMAP (TCP/143)
+
+    - name: Kill old fake IMAP netcat processes
+      shell: pkill -f 'nc -l -s .* -p 143' || true
+      ignore_errors: yes
+    - name: Copy fake IMAP netcat script
+      copy:
+        dest: /usr/local/bin/fake-imap-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "* OK Fake IMAP4rev1 Service Ready\r\n" | nc -l -s $ens5_IP -p 143
+          done
+    - name: Run fake IMAP netcat script as background process
+      shell: nohup /usr/local/bin/fake-imap-netcat-ens5.sh > /var/log/fake-imap-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-imap-netcat-ens5.log
+
+    # HTTP (TCP/80)
+
+    - name: Kill old fake HTTP netcat processes
+      shell: pkill -f 'nc -l -s .* -p 80' || true
+      ignore_errors: yes
+    - name: Copy fake HTTP netcat script
+      copy:
+        dest: /usr/local/bin/fake-http-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nOK" | nc -l -s $ens5_IP -p 80
+          done
+    - name: Run fake HTTP netcat script as background process
+      shell: nohup /usr/local/bin/fake-http-netcat-ens5.sh > /var/log/fake-http-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-http-netcat-ens5.log
+
+    # SNMP (UDP/161)
+
+    - name: Kill old fake SNMP netcat processes
+      shell: pkill -f 'nc -u -l -s .* -p 161' || true
+      ignore_errors: yes
+    - name: Copy fake SNMP netcat script
+      copy:
+        dest: /usr/local/bin/fake-snmp-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              head -c 48 /dev/zero | nc -u -l -s $ens5_IP -p 161
+          done
+    - name: Run fake SNMP netcat script as background process
+      shell: nohup /usr/local/bin/fake-snmp-netcat-ens5.sh > /var/log/fake-snmp-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-snmp-netcat-ens5.log
+
+    # VNC (TCP/5901)
+
+    - name: Kill old fake VNC netcat processes
+      shell: pkill -f 'nc -l -s .* -p 5901' || true
+      ignore_errors: yes
+    - name: Copy fake VNC netcat script
+      copy:
+        dest: /usr/local/bin/fake-vnc-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "RFB 003.008\n" | nc -l -s $ens5_IP -p 5901
+          done
+    - name: Run fake VNC netcat script as background process
+      shell: nohup /usr/local/bin/fake-vnc-netcat-ens5.sh > /var/log/fake-vnc-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-vnc-netcat-ens5.log
+
+    # TFTP (UDP/69)
+
+    - name: Kill old fake TFTP netcat processes
+      shell: pkill -f 'nc -u -l -s .* -p 69' || true
+      ignore_errors: yes
+    - name: Copy fake TFTP netcat script
+      copy:
+        dest: /usr/local/bin/fake-tftp-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              echo -ne "\x00\x05\x00\x01File not found\x00" | nc -u -l -s $ens5_IP -p 69
+          done
+    - name: Run fake TFTP netcat script as background process
+      shell: nohup /usr/local/bin/fake-tftp-netcat-ens5.sh > /var/log/fake-tftp-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-tftp-netcat-ens5.log
+
+    # NTP (UDP/123)
+
+    - name: Kill old fake NTP netcat processes
+      shell: pkill -f 'nc -u -l -s .* -p 123' || true
+      ignore_errors: yes
+    - name: Copy fake NTP netcat script
+      copy:
+        dest: /usr/local/bin/fake-ntp-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then break; fi
+              sleep 2
+          done
+          while true; do
+              head -c 48 /dev/zero | nc -u -l -s $ens5_IP -p 123
+          done
+    - name: Run fake NTP netcat script as background process
+      shell: nohup /usr/local/bin/fake-ntp-netcat-ens5.sh > /var/log/fake-ntp-netcat-ens5.log 2>&1 &
+      args:
+        creates: /var/log/fake-ntp-netcat-ens5.log
+
+    # BACnet
+
+    - name: Copy fake BACnet netcat script
+      copy:
+        dest: /usr/local/bin/fake-bacnet-netcat-ens5.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          while true; do
+              ens5_IP=$(ip -4 addr show ens5 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+              if [[ -n "$ens5_IP" ]]; then
+                  echo "ens5 IP detected: $ens5_IP"
+                  break
+              fi
+              echo "Waiting for ens5 IP..."
+              sleep 2
+          done
+          while true; do
+              echo -ne "Fake BACnet server\n" | nc -u -l -s $ens5_IP -p 47808
+          done
+
+
+     
+
+    # DHCP
+    
+    - name: Install ISC DHCP server
+      apt:
+        name: isc-dhcp-server
+        state: present
+        update_cache: no
+
+    - name: Configure DHCP server to listen on {{ dhcp_iface }}
+      lineinfile:
+        path: /etc/default/isc-dhcp-server
+        regexp: '^INTERFACESv4='
+        line: 'INTERFACESv4="{{ dhcp_iface }}"'
+        state: present
+
+    - name: Configure DHCP subnet for ens5
+      copy:
+        dest: /etc/dhcp/dhcpd.conf
+        content: |
+          default-lease-time 10;
+          max-lease-time 10;
+          authoritative;
+          subnet {{ dhcp_subnet }} netmask {{ dhcp_netmask }} {
+            range {{ dhcp_range_start }} {{ dhcp_range_end }};
+            option routers {{ dhcp_router }};
+            option domain-name-servers {{ dhcp_dns }};
+          }
+
+    - name: Ensure {{ dhcp_iface }} is up (required for dhcpd to start)
+      command: ip link set {{ dhcp_iface }} up
+
+    - name: Restart and enable isc-dhcp-server
+      service:
+        name: isc-dhcp-server
+        state: restarted
+        enabled: yes
+
+    - name: Check DHCP server status
+      shell: systemctl is-active isc-dhcp-server
+      register: dhcp_status
+
+    - name: Show DHCP server status
+      debug:
+        msg: "DHCP server status: {{ dhcp_status.stdout }}"
+
+
+
+    # BLOCK ICMP 
+
+    - name: Ensure UFW is installed
+      apt:
+        name: ufw
+        state: present
+
+    - name: Set UFW default policy to deny incoming
+      command: ufw default deny incoming
+
+    - name: Set UFW default policy to allow outgoing
+      command: ufw default allow outgoing
+
+    - name: Allow FTP
+      command: ufw allow 21/tcp
+
+    - name: Allow SSH
+      command: ufw allow 22/tcp
+
+    - name: Allow Telnet
+      command: ufw allow 23/tcp
+
+    - name: Allow SMTP
+      command: ufw allow 25/tcp
+
+    - name: Allow POP3
+      command: ufw allow 110/tcp
+
+    - name: Allow IMAP
+      command: ufw allow 143/tcp
+
+    - name: Allow HTTP
+      command: ufw allow 80/tcp
+
+    - name: Allow SNMP
+      command: ufw allow 161/udp
+
+    - name: Allow VNC
+      command: ufw allow 5901/tcp
+
+    - name: Allow TFTP
+      command: ufw allow 69/udp
+
+    - name: Allow NTP
+      command: ufw allow 123/udp
+
+    - name: Allow BACnet
+      command: ufw allow 47808/udp
+
+    - name: Allow Modbus (if TCP)
+      command: ufw allow 502/tcp
+
+    - name: Allow DHCP server port
+      command: ufw allow 67/udp
+
+    - name: Allow DHCP client port
+      command: ufw allow 68/udp
+
+    - name: Enable UFW
+      command: ufw --force enable
+
+
+    - name: Reload UFW
+      command: ufw reload
+
+    - name: Release DHCP lease and flush IP from ens5
+      shell: dhclient -r ens5 && ip addr flush dev ens5
+      ignore_errors: yes
+
+    - name: Block all ICMP echo requests (ping) using sysctl (IPv4)
+      sysctl:
+        name: net.ipv4.icmp_echo_ignore_all
+        value: 1
+        state: present
+        sysctl_set: yes
+        reload: yes
+
+    - name: Block ICMPv6 echo-request (ping) on all interfaces (IPv6)
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: ipv6-icmp
+        icmp_type: echo-request
+        jump: DROP
+        state: present
+        ip_version: ipv6
+
+    - name: Disable IPv6 system-wide via sysctl
+      sysctl:
+        name: net.ipv6.conf.all.disable_ipv6
+        value: 1
+        state: present
+        sysctl_set: yes
+        reload: yes
+
+    - name: Disable IPv6 on default interface via sysctl
+      sysctl:
+        name: net.ipv6.conf.default.disable_ipv6
+        value: 1
+        state: present
+        sysctl_set: yes
+        reload: yes
+
+    - name: Disable IPv6 on loopback via sysctl
+      sysctl:
+        name: net.ipv6.conf.lo.disable_ipv6
+        value: 1
+        state: present
+        sysctl_set: yes
+        reload: yes
+
+
+    - name: Remove temporary static IP from ens5
+      command: ip addr del 10.10.10.14/24 dev ens5
+      ignore_errors: yes
+
+  handlers:
+    - name: Restart vsftpd
+      service:
+        name: vsftpd
+        state: restarted
\ No newline at end of file
diff --git a/test_vm/provision-not-detected.yml b/test_vm/provision-not-detected.yml
new file mode 100644
index 000000000..4f9f6472c
--- /dev/null
+++ b/test_vm/provision-not-detected.yml
@@ -0,0 +1,82 @@
+---
+- hosts: all
+  become: true
+  tasks:
+
+    # Set up networking on ens5
+    - name: Install dependencies
+      apt:
+        name: 
+          - isc-dhcp-client
+          - ufw
+        state: present
+        update_cache: yes
+
+    - name: Run dhclient on ens5 (in background)
+      shell: nohup dhclient ens5 &
+      async: 0
+      poll: 0
+
+    # ARP packet control
+    - name: Copy arp_control.sh script
+      copy:
+        dest: /usr/local/bin/arp_control.sh
+        mode: '0755'
+        content: |
+          #!/bin/bash
+          iface="ens5"
+          ip_addr=""
+          while true; do
+            ip_addr=$(ip -4 addr show dev $iface | awk '/inet / {print $2}' | cut -d/ -f1)
+            if [[ -n "$ip_addr" ]]; then
+              ip link set dev $iface arp off
+              echo "$(date): IP $ip_addr detected, ARP disabled on $iface"
+            else
+              ip link set dev $iface arp on
+              echo "$(date): No IP on $iface, ARP enabled"
+            fi
+            sleep 2
+          done
+
+    - name: Run arp_control.sh in background
+      shell: nohup /usr/local/bin/arp_control.sh &
+      async: 0
+      poll: 0
+
+    # DNS request setup
+
+    - name: Create systemd service for curl
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/curl-google.service
+        content: |
+          [Unit]
+          Description=Curl google.com
+
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/bin/curl -s -L -o /dev/null -w "%{http_code}\n" https://www.google.com
+
+    - name: Create systemd timer for curl
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/curl-google.timer
+        content: |
+          [Unit]
+          Description=Run curl google.com every 5 seconds
+
+          [Timer]
+          OnBootSec=5
+          OnUnitActiveSec=5
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Reload systemd daemon
+      ansible.builtin.systemd:
+        daemon_reload: yes
+
+    - name: Enable and start curl-google.timer
+      ansible.builtin.systemd:
+        name: curl-google.timer
+        enabled: yes
+        state: started
+
diff --git a/test_vm/provision.yml b/test_vm/provision.yml
deleted file mode 100644
index ed666c0f1..000000000
--- a/test_vm/provision.yml
+++ /dev/null
@@ -1,113 +0,0 @@
----
-- hosts: all
-  become: true
-  tasks:
-    - name: Install DHCP client
-      apt:
-        name: isc-dhcp-client
-        state: present
-        update_cache: yes
-
-    - name: Run dhclient on eth1 (in background)
-      shell: nohup dhclient eth1 &
-      async: 0
-      poll: 0
-
-    - name: Install netstat for network troubleshooting
-      apt:
-        name: net-tools
-        state: present
-        update_cache: yes
-
-    - name: Install BACnet dependencies
-      apt:
-        name:
-          - git
-          - gcc
-          - make
-          - bison
-          - flex
-          - libpcap-dev
-        state: present
-        update_cache: yes
-      tags: bacnet
-
-    - name: Clone BACnet stack repository
-      git:
-        repo: https://github.com/bacnet-stack/bacnet-stack.git
-        dest: /opt/bacnet-stack
-        version: master
-      tags: bacnet
-
-    - name: Build BACnet stack
-      make:
-        chdir: /opt/bacnet-stack
-        target: all
-      tags: bacnet
-
-    - name: Copy bacserv-wrapper.sh
-      copy:
-        dest: /usr/local/bin/bacserv-wrapper.sh
-        mode: '0755'
-        content: |
-          #!/bin/bash
-          IFACE=eth1
-          while true; do
-            IP=$(ip -4 addr show $IFACE | awk '/inet / {print $2}' | cut -d/ -f1)
-            if [ -n "$IP" ]; then
-              export BACNET_IP=$IP
-              exec /opt/bacnet-stack/bin/bacserv
-            fi
-            sleep 2
-          done
-      tags: bacnet
-
-    - name: Create systemd unit for bacserv
-      copy:
-        dest: /etc/systemd/system/bacserv.service
-        mode: '0644'
-        content: |
-          [Unit]
-          Description=BACnet Server (auto-restart on IP change)
-          After=network-online.target
-          Wants=network-online.target
-
-          [Service]
-          Type=simple
-          ExecStart=/usr/local/bin/bacserv-wrapper.sh
-          Restart=always
-          RestartSec=5
-
-          [Install]
-          WantedBy=multi-user.target
-      tags: bacnet
-
-    - name: Reload systemd and enable bacserv service
-      systemd:
-        name: bacserv
-        enabled: yes
-        state: restarted
-        daemon_reload: yes
-      tags: bacnet
-
-    - name: Check if bacserv process is running
-      shell: pgrep -fl bacserv
-      register: bacserv_process
-      changed_when: false
-      tags: bacnet
-
-    - name: Show information about bacserv process
-      debug:
-        var: bacserv_process.stdout_lines
-      tags: bacnet
-
-    - name: Show last lines of bacserv log
-      shell: tail -n 20 /opt/bacnet-stack/bacserv.log
-      register: bacserv_log
-      changed_when: false
-      ignore_errors: true
-
-    - name: Display bacserv log
-      debug:
-        var: bacserv_log.stdout_lines
-      tags: bacnet
\ No newline at end of file
diff --git a/test_vm/python/requirements.txt b/test_vm/python/requirements.txt
new file mode 100644
index 000000000..8e7a8b454
--- /dev/null
+++ b/test_vm/python/requirements.txt
@@ -0,0 +1 @@
+pyModbusTCP==0.3.0
\ No newline at end of file
diff --git a/test_vm/python/src/modbus_server.py b/test_vm/python/src/modbus_server.py
new file mode 100644
index 000000000..cc47e019c
--- /dev/null
+++ b/test_vm/python/src/modbus_server.py
@@ -0,0 +1,20 @@
+"""Modbus TCP server implementation."""
+from pyModbusTCP.server import ModbusServer, DataBank
+
+if __name__ == "__main__":
+  # Run server on port 502
+
+  server = ModbusServer(host="0.0.0.0", port=502, no_block=True)
+  server.start()
+  print("Modbus TCP server started on port 502")
+
+  # Initialize data bank with zeros
+  DataBank.set_words(0, [0]*100)  # Holding registers
+  DataBank.set_bits(0, [0]*100)   # Coils
+
+  try:
+    while True:
+      pass  # Keep the server running
+  except KeyboardInterrupt:
+    print("Stopping server...")
+    server.stop()
diff --git a/test_vm/python/src/modbus_server_non_compliant.py b/test_vm/python/src/modbus_server_non_compliant.py
new file mode 100644
index 000000000..698d0ec85
--- /dev/null
+++ b/test_vm/python/src/modbus_server_non_compliant.py
@@ -0,0 +1,60 @@
+"""
+test_vm.python.src.modbus_server_non_compliant
+"""
+
+import socket
+import struct
+
+
+MODBUS_PORT = 502
+MODBUS_EXCEPTION_CODE = 0x02  # Illegal Data Address
+
+
+def parse_mbap_header(data):
+  if len(data) < 7:
+    return None
+  tid, pid, length, uid = struct.unpack(">HHHB", data[:7])
+  return tid, pid, length, uid
+
+
+def build_exception_response(request, function_code, exception_code):
+  tid, pid, _, uid = parse_mbap_header(request)
+  resp_fc = function_code | 0x80
+  pdu = struct.pack("BB", resp_fc, exception_code)
+  mbap = struct.pack(">HHHB", tid, pid, len(pdu) + 1, uid)
+  return mbap + pdu
+
+
+def handle_request(conn, data):
+  if len(data) < 8:
+    return
+  # tid, pid, length, uid = parse_mbap_header(data)
+  function_code = data[7]
+  response = build_exception_response(
+    data, function_code, MODBUS_EXCEPTION_CODE)
+  conn.sendall(response)
+
+
+def run_server():
+  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+  sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+  sock.bind(("0.0.0.0", MODBUS_PORT))
+  sock.listen(5)
+  print(f"Modbus server started on port {MODBUS_PORT}")
+  while True:
+    conn, addr = sock.accept()
+    print(f"Connection from {addr}")
+    try:
+      while True:
+        data = conn.recv(1024)
+        if not data:
+          break
+        handle_request(conn, data)
+    except Exception as e:
+      print(f"Error: {e}")
+    finally:
+      conn.close()
+
+
+if __name__ == "__main__":
+  run_server()
diff --git a/test_vm/restore_ethtool.sh b/test_vm/restore_ethtool.sh
new file mode 100755
index 000000000..2a65b601f
--- /dev/null
+++ b/test_vm/restore_ethtool.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+echo "=== Removing mock ethtool from /usr/local/bin (if exists) ==="
+if [ -f /usr/local/bin/ethtool ]; then
+  sudo rm /usr/local/bin/ethtool
+  echo "Mock ethtool removed."
+else
+  echo "No mock ethtool found in /usr/local/bin."
+fi
+
+echo "=== Resetting Bash command hash ==="
+hash -r
+
+echo "=== Checking which ethtool is now active ==="
+which ethtool
+type ethtool
+
+echo "=== Testing ethtool enbr99 ==="
+ethtool enbr99 || echo "If you see 'No such file or directory', open a new
+ terminal and try again."
+
+echo "=== Done! If you still see the mock error, open a new terminal or run 'hash -r' again. ==="
\ No newline at end of file