Routers and Switches

Lesson 9: Routers and Switches

Routers and switches are two of the most important devices in modern
computer networks. Although they perform different jobs, they work
together to allow devices and networks to communicate.

For cybersecurity professionals, understanding routers and switches is
essential because these devices control, direct and sometimes record
large amounts of network traffic.

1. What Is a Network Switch?

A network switch is a device that connects multiple
devices within a local network.

Examples of devices that may connect to a switch include:

• Desktop computers
• Laptops
• Servers
• Printers
• Wireless access points
• IP phones
• Security appliances
• Network storage devices

A typical Ethernet switch forwards network frames based on
MAC addresses.

Computer A
     |
     |
+---------+
| Switch  |
+---------+
  |   |   |
  |   |   +---- Printer
  |   |
  |   +-------- Server
  |
  +------------ Computer B

2. What Is a Router?

A router is a network device that connects different
IP networks and forwards packets between them.

For example, a router may connect:

Local Network
192.168.1.0/24
       |
       v
    Router
       |
       v
Internet / Other Network

A router makes forwarding decisions using IP addresses and routing
information.

3. Switch vs Router

Modern network devices can combine functions, so the traditional
Layer 2 and Layer 3 distinction should be understood as a foundation
rather than a description of every modern device.

4. Ethernet Frames and MAC Addresses

Switches commonly operate with Ethernet frames.

An Ethernet frame contains information including source and destination
MAC addresses.

For example:

Source MAC:
AA:BB:CC:11:22:33

Destination MAC:
AA:BB:CC:44:55:66

The switch examines the destination MAC address to determine where the
frame should be forwarded.

5. MAC Address Table

A switch maintains a forwarding database commonly called a
MAC address table.

The table associates MAC addresses with switch ports.

Example:

This allows the switch to forward frames more efficiently.

6. How a Switch Learns

A switch can learn MAC addresses by examining the source MAC address
of incoming frames.

For example, if a frame arrives through Port 3 with:

Source MAC:
AA:BB:CC:12:34:56

The switch can associate that MAC address with Port 3.

AA:BB:CC:12:34:56
        |
        v
      Port 3

As devices communicate, the switch builds and updates its forwarding
information.

7. What Happens When a Destination Is Unknown?

If a switch receives a frame for a destination MAC address that is not
currently known, the switch may flood the frame within the appropriate
broadcast domain, subject to the switch’s forwarding behavior.

Once the switch learns the destination’s location, future frames can
be forwarded more directly.

This behavior is one reason MAC address tables are important in network
operations and security.

8. Broadcast Traffic

A broadcast frame is intended for devices within the relevant broadcast
domain.

The traditional Ethernet broadcast MAC address is:

FF:FF:FF:FF:FF:FF

Broadcast traffic can be useful for network protocols, but excessive
broadcast traffic can affect network performance.

Network segmentation and VLANs can help control the size of broadcast
domains.

9. VLANs

VLAN stands for Virtual Local Area Network.

VLANs allow a physical switching infrastructure to be divided into
logical network segments.

For example:

VLAN 10
Staff

VLAN 20
Students

VLAN 30
Guest Devices

VLAN 40
Servers

These logical segments can have different security policies and
access requirements.

10. VLANs and Cybersecurity

VLANs can support network segmentation, which is an important security
concept.

For example, guest devices may not need unrestricted access to internal
servers.

Guest VLAN
     |
     X
     |
Internal Server VLAN

Access between segments can be controlled through routing and security
policies.

VLANs are not by themselves a complete security boundary. Proper
configuration of switching, routing, authentication and security
controls is still required.

11. What Is a Routing Table?

A router uses a routing table to determine where
network traffic should be forwarded.

A simplified table might look like:

The exact routing table depends on the device’s configuration.

12. Default Route

A default route is used when a more specific route does not match the
destination.

A common IPv4 default route is represented as:

0.0.0.0/0

A typical home network might have:

Computer
192.168.1.25
     |
     v
Default Gateway
192.168.1.1
     |
     v
Internet

13. Default Gateway

The default gateway is commonly the router or Layer 3
device that a host uses to reach destinations outside its local subnet.

For example, if a computer has:

IP Address:     192.168.1.25
Subnet Mask:    255.255.255.0
Gateway:        192.168.1.1

The computer normally sends traffic for remote networks toward
192.168.1.1.

14. Routing Between Networks

Consider two networks:

Network A
192.168.10.0/24

Network B
192.168.20.0/24

A router or Layer 3 device can provide communication between the
networks when appropriate routing and security policies allow it.

192.168.10.0/24
       |
       v
     Router
       |
       v
192.168.20.0/24

15. Switches and Routers Working Together

In many networks, switches and routers work as part of the same
infrastructure.

PC 1 ----\
PC 2 ----- Switch ----- Router ----- Internet
PC 3 ----/

The switch provides local connectivity while the router provides
connectivity to other networks.

16. Layer 2 and Layer 3

The OSI model provides a useful way to understand switching and routing.

Layer 2 — Data Link

Switching commonly operates at Layer 2 using MAC addresses and
Ethernet frames.

Layer 3 — Network

Routing commonly operates at Layer 3 using IP addresses and packets.

Layer 3
IP
 |
 v
Router

Layer 2
Ethernet / MAC
 |
 v
Switch

17. Layer 3 Switches

Modern enterprise switches can also perform Layer 3 routing.

A Layer 3 switch can combine high-speed switching with routing
functionality.

This is common in enterprise networks where routing between VLANs is
required.

18. Inter-VLAN Routing

Devices in separate VLANs normally require Layer 3 routing if they
need to communicate.

For example:

VLAN 10
Staff
   |
   +----\
         \
          Layer 3 Device
         /
   +----/
   |
VLAN 20
Students

Security policies can determine which communication is permitted
between the VLANs.

19. Router Security

Routers are important security devices because they sit at boundaries
between networks.

Security considerations include:

• Strong administrative credentials.
• Secure management protocols.
• Updated firmware.
• Appropriate firewall rules.
• Restricted management access.
• Disabled unnecessary services.
• Accurate routing configuration.
• Logging and monitoring.

20. Switch Security

Switches should also be protected.

Important controls may include:

• Secure management access.
• Strong administrator credentials.
• Unused-port shutdown where appropriate.
• VLAN segmentation.
• Port security where appropriate.
• DHCP snooping where supported.
• Spanning Tree security controls where appropriate.
• MAC address monitoring.
• Logging and configuration backups.

21. Unused Switch Ports

An unused switch port can represent unnecessary physical access to the
network.

Organizations may disable unused ports or place them into an isolated
configuration according to their security policy.

This reduces the number of active connection points available to
unauthorized users.

22. Port Security

Some managed switches support port security
features that can restrict which devices are allowed to use a switch
port.

Policies may be based on MAC addresses or other switch-level controls,
depending on the platform.

Port security must be carefully configured because overly restrictive
settings can also block legitimate devices.

23. Router Access Control

Network devices often support access-control mechanisms that determine
which traffic is allowed or denied.

For example, a router may be configured to permit required application
traffic while blocking unnecessary connections.

This concept forms part of network security policy enforcement.

24. Network Device Management

Network administrators need secure methods for managing routers and
switches.

Management interfaces may include web interfaces, command-line
interfaces and dedicated network-management systems.

Organizations should avoid exposing administrative interfaces
unnecessarily.

Where supported, secure protocols should be preferred over insecure
management protocols.

25. Router and Switch Logs

Network devices can produce logs that are useful during monitoring and
incident response.

Examples include:

• Authentication attempts
• Interface state changes
• Configuration changes
• Routing changes
• Port events
• Security alerts
• System errors

Centralized logging can help security teams correlate network events
with endpoint and authentication activity.

26. Network Monitoring

Monitoring routers and switches can provide visibility into the health
and security of a network.

Monitoring may include:

• Interface utilization
• Packet errors
• Link status
• Unexpected devices
• Configuration changes
• Routing changes
• Unusual traffic patterns

27. MAC Address Table Security

A switch’s MAC address table can provide useful information about
where devices are connected.

Unexpected changes can sometimes indicate:

• A newly connected device.
• A legitimate device move.
• A network reconfiguration.
• A switching problem.
• A possible security event.

An unusual MAC address entry is an indicator for investigation, not
proof of malicious activity by itself.

28. MAC Flooding — Concept

MAC flooding is an attack concept involving attempts
to overwhelm a switch’s MAC address table with many source addresses.

The purpose of studying this technique in an introductory cybersecurity
course is to understand the security importance of switch forwarding
tables.

Students should not perform MAC flooding against networks or devices
without explicit authorization.

Defensive controls depend on the switch platform and may include port
security and other network protections.

29. Routing Misconfiguration

A routing configuration error can cause:

• Connectivity failures.
• Unexpected traffic paths.
• Traffic loops.
• Unintended access between networks.
• Security policy bypasses.

Network administrators should carefully document and review routing
changes.

30. Network Segmentation

Network segmentation separates systems into different network areas.

For example:

Internet
   |
Firewall
   |
   +---- Staff Network
   |
   +---- Server Network
   |
   +---- Guest Network
   |
   +---- Management Network

Segmentation can reduce unnecessary communication and limit the
possible spread of an incident.

31. Routers, Switches and Firewalls

These technologies can work together to enforce network security.

Internet
   |
   v
Firewall
   |
   v
Router / Layer 3 Device
   |
   v
Switch
   |
   +---- Workstations
   +---- Servers
   +---- Printers
   +---- Access Points

The exact architecture varies between organizations.

32. Basic Routing Commands

On Windows, the following command can display the routing table:

route print

Another useful command is:

ipconfig

On Linux:

ip route

These commands can help students understand how a host decides where
to send IP traffic.

33. Testing Connectivity

The ping command can help determine whether a destination
is reachable using ICMP.

ping 192.168.1.1

A successful ping can provide useful information, but failure does
not necessarily mean that a host is offline. Firewalls and security
policies can block ICMP.

34. Tracing a Network Path

Network path tracing can help identify intermediate routing devices.

Windows:

tracert example.com

Linux:

traceroute example.com

The output can help students understand how traffic moves through
multiple network hops.

35. Example Network

Consider the following organization:

Internet
    |
    v
  Router
    |
    v
 Core Switch
    |
    +----------------+
    |                |
    v                v
Staff VLAN        Server VLAN
192.168.10.0/24   192.168.20.0/24
    |
    v
Access Switches

The router or Layer 3 infrastructure can control communication between
the different networks.

36. Cybersecurity Investigation Scenario

A security team detects suspicious traffic originating from an internal
IP address:

192.168.20.45

The investigation could involve several sources of information.

1. Check DHCP records to identify the device using the IP address.
2. Check switch MAC address information.
3. Identify the switch port.
4. Check VLAN membership.
5. Review router and firewall logs.
6. Review endpoint security logs.
7. Correlate timestamps.

This demonstrates how routers, switches and other infrastructure
can contribute to incident investigation.

37. Network Device Hardening

Hardening means reducing unnecessary exposure and strengthening the
configuration of a system.

For routers and switches, hardening may include:

• Changing default credentials.
• Using strong authentication.
• Disabling unnecessary services.
• Restricting management access.
• Updating firmware.
• Backing up configurations.
• Enabling appropriate logging.
• Using secure management protocols.
• Applying least-privilege administrative access.
• Reviewing configurations regularly.

38. Example PHP Network Device Dashboard

PHP can be used to display network-device information in an authorized
administrative dashboard.

<?php

$network_device = array(
    'device'       => 'Router',
    'ip_address'   => '192.168.1.1',
    'interface'    => 'LAN',
    'status'       => 'UP',
    'network_role' => 'Default Gateway',
);

foreach ( $network_device as $key => $value ) {

    $label = ucwords(
        str_replace( '_', ' ', $key )
    );

    echo '<strong>' .
        htmlspecialchars(
            $label,
            ENT_QUOTES,
            'UTF-8'
        ) .
        ':</strong> ' .
        htmlspecialchars(
            $value,
            ENT_QUOTES,
            'UTF-8'
        ) .
        '<br>';
}
?>

The example demonstrates safe HTML output of network information.
In a production monitoring application, device data should be
retrieved through properly authenticated and authorized mechanisms.

39. Practical Lab — Identify Your Default Gateway

Perform this exercise only on your own computer or an authorized
training environment.

Windows

ipconfig

Identify:

• Your IPv4 address.
• Your subnet mask.
• Your default gateway.

Linux

ip addr
ip route

Identify the default route and the interface associated with it.

40. Practical Lab — Trace a Network Path

Use a legitimate public domain or an authorized internal destination.

Windows

tracert example.com

Linux

traceroute example.com

Record the number of visible hops and explain what each hop represents
at a high level.

41. Practical Lab — Network Diagram

Draw a simple diagram of your training laboratory network.

Include:

• Internet connection
• Router
• Switch
• Computers
• Wireless access point if present
• Server if present
• VLANs if configured

For each device, write its role in the network.

42. Security Questions

1. What is a network switch?
2. What is a router?
3. What is the main difference between switching and routing?
4. What type of address does an Ethernet switch commonly use for forwarding?
5. What is a MAC address table?
6. How does a switch learn MAC addresses?
7. What happens when a switch does not know a destination MAC address?
8. What is a VLAN?
9. How can VLANs support network segmentation?
10. What is a routing table?
11. What is a default gateway?
12. What does the route 0.0.0.0/0 represent in IPv4?
13. What is inter-VLAN routing?
14. Why should network devices be hardened?
15. What is port security?
16. What is MAC flooding at a conceptual level?
17. Why are router and switch logs useful to security analysts?
18. What command displays the routing table on Windows?
19. What command displays routes on Linux?
20. Why should network security testing only be performed on authorized systems?

43. Key Takeaways

• Switches primarily connect devices within local network segments.
• Routers connect different IP networks and make routing decisions.
• Switches commonly use MAC addresses to forward Ethernet frames.
• Routers use IP addresses and routing tables to forward packets.
• MAC address tables help switches identify where devices are connected.
• Routing tables help routers determine where packets should go.
• VLANs can provide logical network segmentation.
• Default gateways allow hosts to reach destinations outside their local subnet.
• Port security and other controls can restrict unauthorized network access.
• Routers and switches should be hardened, monitored and securely administered.
• Network infrastructure logs can provide important evidence during investigations.
• Understanding Layer 2 and Layer 3 operations is essential for cybersecurity professionals.

44. Lesson Summary

Routers and switches form a major part of modern network
infrastructure. Switches provide local connectivity and commonly
forward Ethernet frames using MAC addresses, while routers connect
different IP networks and make forwarding decisions using routing
information.

From a cybersecurity perspective, these devices are more than simple
network hardware. They provide segmentation, access control,
visibility, logging and infrastructure information that can help
security teams protect and investigate networks.

Students who understand switching, routing, VLANs, gateways and basic
network-device security will have a stronger foundation for later
topics such as firewalls, security monitoring and incident response.