1.5.4 Network Devices
Understand the hardware that moves, filters, and protects traffic
Protocols and ports showed what services are listening. Network devices show where traffic actually travels, where it can be filtered, and where defenders can place controls or monitoring.
1. Overview
Why Understanding Devices Matters for Security
- Attack Surface: Each device is a potential entry point for attackers
- Traffic Control: Devices determine what can communicate with what
- Visibility: Know where to place monitoring and defenses
- Vulnerabilities: Different devices have different weaknesses
Device Placement in Network Architecture
Network devices are organized by OSI layers - understanding which layer a device operates at tells you what it can "see" and control:
- Layer 1 (Physical): Deals with electrical signals and cables
- Layer 2 (Data Link): Works with MAC addresses
- Layer 3 (Network): Routes by IP addresses
- Layer 7 (Application): Understands protocols like HTTP
2. Layer 1 Devices (Physical)
2.1 Hub
What it does: A "dumb" device that receives data on one port and broadcasts it to ALL other ports.
How It Works
+-----------------+
| HUB |
| +---+---+---+ |
| | 1 | 2 | 3 | |
+--+-+-+-+-+-+-+--+
| | |
PC1 PC2 PC3
Data sent to PC2 goes to ALL ports (PC1, PC3, etc.)
Problems
- Single Collision Domain: All devices compete for bandwidth
- Half-duplex: Can't send and receive simultaneously
- Performance degrades as devices increase
Security risk: All traffic is visible to every connected device. An attacker on the same hub can sniff traffic without special switch configuration.
Status: Obsolete - replaced by switches in all modern networks.
2.2 Repeater
What it does: Amplifies and regenerates signals to extend network range.
- Works at the physical layer - just boosts electrical signals
- Used to overcome cable distance limitations
- No intelligence - doesn't filter or route
2.3 Modem
Modulator-demodulator: Converts digital signals to analog signals, and analog signals back to digital, for transmission over phone or cable lines.
| Type | Medium | Speed |
|---|---|---|
| DSL | Phone line | Up to 100 Mbps |
| Cable | Coaxial cable | Up to 1 Gbps |
| Fiber | Fiber optic | Up to 10 Gbps+ |
3. Layer 2 Devices (Data Link)
3.1 Switch
What it does: Intelligently forwards frames based on MAC addresses. Each port is its own collision domain.
How a Switch Learns
- Flooding: Initially, switch doesn't know where devices are - broadcasts to all ports
- Learning: Records source MAC address + port in MAC address table
- Forwarding: Once learned, sends frames only to the correct port (unicast)
MAC Address Table: +-------------------------------------+ | MAC Address | Port | +---------------------+---------------+ | AA:BB:CC:DD:EE:01 | Port 1 | | AA:BB:CC:DD:EE:02 | Port 2 | | AA:BB:CC:DD:EE:03 | Port 5 | +---------------------+---------------+
Managed vs Unmanaged Switches
| Feature | Unmanaged | Managed |
|---|---|---|
| Configuration | Plug and play | Full configuration via CLI/GUI |
| VLANs | No | Yes |
| Port Security | No | Yes |
| Monitoring | Limited | SNMP, port mirroring |
| Cost | Cheaper | More expensive |
| Use Case | Home/Small office | Enterprise |
VLANs (Virtual LANs) - Intro
Logically segment a physical switch into multiple broadcast domains:
- VLAN 10: Accounting (ports 1-5)
- VLAN 20: Engineering (ports 6-10)
- Devices on different VLANs can't communicate without a router
Switch Security Attacks:
- MAC Flooding: Overflow MAC table -> switch acts like hub
- VLAN Hopping: Access traffic from other VLANs
- ARP Spoofing: Not stopped by switches
Cisco Switch Commands
# View MAC address table
show mac address-table
# Configure port security
interface FastEthernet0/1
switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown
3.2 Bridge
What it does: Connects two network segments, filtering traffic by MAC address.
- Mostly obsolete - replaced by switches
- Software bridges still used (Linux bridge for VMs)
3.3 NIC (Network Interface Card)
What it does: Hardware interface between computer and network.
- Has unique MAC address burned in (OUI + Device ID)
- Promiscuous Mode: Captures ALL traffic, not just addressed to it - used for packet sniffing
Enable Promiscuous Mode (Linux)
# Enable promiscuous mode
sudo ip link set eth0 promisc on
# Verify
ip link show eth0
# Disable
sudo ip link set eth0 promisc off
4. Layer 3 Devices (Network)
4.1 Router
What it does: Routes packets between different networks using IP addresses. Creates separate broadcast domains.
Key Concepts
- Routing Table: Maps destination networks to next-hop addresses
- Default Gateway: Where packets go when no specific route matches
- Each Interface: Different IP network (e.g., 192.168.1.x and 10.0.0.x)
Static vs Dynamic Routing
| Type | Description | Pros | Cons |
|---|---|---|---|
| Static | Manually configured routes | Simple, predictable, secure | Doesn't adapt to changes |
| Dynamic | Routers learn routes automatically | Adapts to network changes | More complex, CPU overhead |
Common Routing Protocols
| Protocol | Type | Metric | Use Case |
|---|---|---|---|
| RIP | Distance Vector | Hop count (max 15) | Small networks |
| OSPF | Link State | Cost (bandwidth) | Enterprise |
| EIGRP | Hybrid | Composite | Cisco networks |
| BGP | Path Vector | AS path | Internet backbone |
NAT (Network Address Translation)
Translates private IPs to public IPs, allowing multiple devices to share one public IP:
Internal Network Router (NAT) Internet
+--------------+ +----------+ +----------+
| 192.168.1.10 |---------| | | |
| 192.168.1.11 |---------| NAT |----------| Web |
| 192.168.1.12 |---------| 203.0.113.5 | Server |
+--------------+ +----------+ +----------+
Private IPs Public IP appears Destination
as source
Router Security:
- Default credentials: Change vendor default usernames and passwords before the device goes live
- ACLs: Access Control Lists filter traffic by IP/port
- Misconfigurations: Open admin interfaces, weak passwords
- Firmware: Keep updated for security patches
View Routing Table
# Linux
ip route
route -n
netstat -rn
# Windows
route print
netstat -rn
# Find default gateway
ip route | grep default # Linux
ipconfig | findstr Gateway # Windows
4.2 Layer 3 Switch (Multilayer Switch)
What it does: A switch with built-in routing capability. Routes between VLANs at wire speed.
- Faster than separate router for inter-VLAN routing
- Use when: High-speed routing needed within campus network
- Common in enterprise data centers
5. Security Devices
5.1 Firewall
What it does: Controls incoming and outgoing network traffic based on security rules.
Firewall Types
| Type | OSI Layer | How it Works | Pros/Cons |
|---|---|---|---|
| Packet Filtering | 3-4 | Filters by IP/port (stateless) | Fast, but no context |
| Stateful Inspection | 3-4 | Tracks connection state | Smarter, more secure |
| Application/Proxy | 7 | Inspects application data | Deep inspection, slower |
| NGFW (Next-Gen) | 3-7 | All above + IPS, app awareness | Best protection, expensive |
Firewall Rule Structure
+------------------------------------------------------------------+ | Source IP | Dest IP | Protocol | Port | Action | +-------------+-----------+------------+--------+-----------------+ | any | 10.0.0.5 | TCP | 22 | ALLOW | | any | any | TCP | 23 | DENY (Telnet) | | 192.168.x | any | any | any | ALLOW | | any | any | any | any | DENY (default) | +------------------------------------------------------------------+ Rules are processed top-to-bottom, and the first match wins.
DMZ (Demilitarized Zone)
Network segment between external and internal networks for public-facing servers:
Internet -> [Firewall] -> DMZ (Web/Mail Servers) -> [Firewall] -> Internal Network
| |
+------------ Attackers blocked here ----------------------+
Common Firewalls
- pfSense: Open-source, BSD-based
- iptables/nftables: Linux built-in
- Windows Firewall: Built into Windows
- Cisco ASA: Enterprise hardware
- Palo Alto: NGFW leader
Firewall Commands
# Linux iptables
iptables -L -n -v # List rules
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Allow SSH
iptables -A INPUT -p tcp --dport 23 -j DROP # Block Telnet
iptables -P INPUT DROP # Default deny
# Windows Firewall
netsh advfirewall show allprofiles
netsh advfirewall firewall add rule name="Block Telnet" dir=in action=block protocol=tcp localport=23
5.2 IDS (Intrusion Detection System)
What it does: Monitors network traffic and alerts on suspicious activity. It does not block traffic because it is passive monitoring.
Detection Methods
- Signature-based: Matches known attack patterns (like antivirus)
- Anomaly-based: Detects deviations from normal behavior
Types
- NIDS: Network-based IDS (monitors network traffic)
- HIDS: Host-based IDS (monitors individual host)
Examples: Snort, Suricata, OSSEC, Zeek (Bro)
5.3 IPS (Intrusion Prevention System)
What it does: Monitors AND blocks malicious traffic. Deployed inline (traffic passes through it).
IDS vs IPS Comparison
| Aspect | IDS | IPS |
|---|---|---|
| Action | Detect & Alert | Detect & Block |
| Deployment | Passive (span/tap) | Inline (traffic flows through) |
| Latency | None | Slight increase |
| Risk | Can miss attacks | False positives block legit traffic |
5.4 WAF (Web Application Firewall)
What it does: Layer 7 firewall specifically for web applications. Inspects HTTP/HTTPS traffic.
Protects Against
- SQL Injection
- Cross-Site Scripting (XSS)
- CSRF Attacks
- File Inclusion
- OWASP Top 10
Examples: ModSecurity, Cloudflare WAF, AWS WAF, Imperva
5.5 Proxy Server
What it does: Intermediary between clients and servers. Can filter, cache, and anonymize traffic.
Forward Proxy vs Reverse Proxy
Forward Proxy
Sits between internal users and internet
- Content filtering
- Caching for performance
- Anonymity for users
- Access control
Reverse Proxy
Sits between internet and internal servers
- Load balancing
- SSL termination
- Hides server details
- DDoS protection
Examples: Squid, NGINX, HAProxy, Burp Suite (pentesting)
6. Wireless Devices
6.1 Access Point (AP)
What it does: Connects wireless devices to wired network. Acts as a bridge between WiFi and Ethernet.
Key Concepts
- SSID: Network name (Service Set Identifier)
- Channels: Frequency ranges (1-11 for 2.4GHz)
- Bands: 2.4GHz (range) vs 5GHz (speed) vs 6GHz (WiFi 6E)
Security note: The next lesson covers AP security, WPA2/WPA3, and wireless hardening in detail.
6.2 Wireless Controller
What it does: Centrally manages multiple access points in enterprise deployments.
- Unified configuration across all APs
- Seamless roaming between APs
- Central logging and monitoring
- Examples: Cisco WLC, Aruba, Ubiquiti
7. Other Important Devices
7.1 Gateway
What it does: Connects networks using different protocols. Performs protocol translation.
- Often used interchangeably with "default gateway" (router)
- True gateways convert between different network types
7.2 Load Balancer
What it does: Distributes incoming traffic across multiple servers for performance and availability.
- Algorithms: Round Robin, Least Connections, IP Hash
- Health Checks: Removes failed servers from pool
- Examples: HAProxy, F5, AWS ELB, NGINX
+-----------------+
| Load Balancer |
+--------+--------+
|
+------------------+------------------+
v v v
+----------+ +----------+ +----------+
| Server 1 | | Server 2 | | Server 3 |
+----------+ +----------+ +----------+
7.3 VPN Concentrator
What it does: Handles multiple VPN connections, terminating encrypted tunnels.
- Central point for remote access VPNs
- Encrypts/decrypts traffic at scale
- Often built into firewalls/routers today
8. Network Device Placement
Typical enterprise network architecture showing device placement:
+--------------+
| INTERNET |
+------+-------+
|
+------+-------+
| ROUTER | <-- Border Router (BGP)
+------+-------+
|
+------+-------+
| FIREWALL | <-- Perimeter Defense
+------+-------+
+---------------+---------------+
| | |
+------+-------+ +-----+------+ +------+-------+
| DMZ | | IDS/IPS | | Internal |
| (Web/Email) | | (Inline) | | Network |
+--------------+ +------------+ +------+-------+
|
+------+-------+
| Core Switch | <-- Layer 3 Switch
| (L3) |
+------+-------+
+-----------------------+-----------------------+
| | |
+------+-------+ +------+-------+ +------+-------+
| Access Switch| | Access Switch| | Access Switch|
| VLAN 10 | | VLAN 20 | | VLAN 30 |
+------+-------+ +------+-------+ +------+-------+
| | |
Workstations Servers WiFi APs
Key Placement Principles:
- Defense in Depth: Multiple layers of security
- DMZ Concept: Public servers isolated from internal
- Segmentation: VLANs separate different departments/functions
- Monitoring Points: IDS/IPS at network boundaries
9. Device Comparison Table
| Device | OSI Layer | Forwards By | Collision Domain | Broadcast Domain |
|---|---|---|---|---|
| Hub | 1 | N/A (broadcasts all) | Single (shared) | Single |
| Repeater | 1 | N/A (regenerates) | Extends | Single |
| Bridge | 2 | MAC Address | Per segment | Single |
| Switch | 2 | MAC Address | Per port | Single (or per VLAN) |
| Router | 3 | IP Address | Per interface | Per interface |
| L3 Switch | 2-3 | MAC/IP | Per port | Per VLAN |
| Firewall | 3-7 | Rules-based | Per interface | Per zone |
10. Security Hardening Checklist
Apply these to all network devices:
- Change default credentials (admin/admin, cisco/cisco)
- Disable unused ports and services
- Update firmware regularly for security patches
- Enable logging and send to central SIEM
- Implement ACLs to restrict traffic
- Configure VLANs for network segmentation
- Use SSH instead of Telnet for management
- Enable HTTPS for web interfaces
- Physical security - lock server rooms
- Backup configurations regularly
- Disable CDP/LLDP or limit scope
- Set login banners with legal warnings
11. Device Interaction Commands
Find Network Devices
# Find default gateway
ip route | grep default # Linux
ipconfig | findstr Gateway # Windows
# ARP table - find devices on local network
arp -a
# Trace path through routers
traceroute 8.8.8.8 # Linux
tracert 8.8.8.8 # Windows
# Discover network topology
nmap -sn 192.168.1.0/24 # Ping sweep
Device-Specific Commands
# Linux - View interfaces
ip addr show
ip link show
# Check NIC info (including MAC)
ip link show eth0
ipconfig /all # Windows
# Flush routing cache
ip route flush cache # Linux
# Release/renew DHCP
sudo dhclient -r && sudo dhclient # Linux
ipconfig /release && ipconfig /renew # Windows
12. Knowledge Check Quiz
Q1: Which device operates at Layer 1 and broadcasts to all ports?
Q2: A switch forwards traffic based on:
Q3: Which security device monitors AND blocks malicious traffic?
Q4: What is the purpose of a DMZ?
Q5: A router creates separate:
Q6: Which attack targets a switch's MAC address table?
Q7: A WAF protects against:
Q8: What does NAT stand for?
Q9: Which routing protocol is used for the internet backbone?
Q10: A forward proxy sits between:
Q11: Which firewall type inspects at Layer 7?
Q12: Why are hubs a security risk?
Q1: Hub
Q2: MAC Address
Q3: IPS (Intrusion Prevention System)
Q4: Isolate public-facing servers from internal network
Q5: Both collision and broadcast domains
Q6: MAC Flooding
Q7: SQL Injection and XSS
Q8: Network Address Translation
Q9: BGP (Border Gateway Protocol)
Q10: Internal users and internet
Q11: Application/Proxy Firewall
Q12: All traffic is visible to all ports