Network Devices

Cables carry signals. Network interface cards translate between computers and cables. But it's network devices—the active, intelligent equipment deployed throughout a network—that actually make large-scale, efficient, secure networking possible.

Without switches, every device on a network would hear every other device's traffic. Without routers, the Internet would be an unnavigable chaos of isolated networks. Without firewalls, every system would be exposed to attack. Each category of network device solves specific problems that arise when connecting multiple computers, and understanding these devices is essential for anyone designing, operating, or troubleshooting networks.

Network devices operate at different layers of the OSI model, and understanding this relationship is fundamental to understanding their capabilities and limitations.

The Layer Principle:

A device operating at a given layer can read and act on information from that layer and all layers below it, but typically treats higher-layer data as opaque payload.

Key Distinctions:

Layer 2 Devices:

• Forward frames based on MAC addresses
• Learn addresses from traffic (no configuration required for basic operation)
• Cannot cross network boundaries (single broadcast domain)
• Examples: Switches, Bridges, Wireless Access Points (at L2)

Layer 3 Devices:

• Forward packets based on IP addresses
• Require configuration of network/subnet information
• Connect different networks, enabling inter-network communication
• Examples: Routers, Layer 3 Switches, Gateways

Multi-Layer Devices:

Modern network devices often operate at multiple layers simultaneously:

• Layer 3 Switch: Performs both L2 switching and L3 routing in hardware
• Next-Generation Firewall (NGFW): L3/L4 filtering plus L7 application inspection
• Software Load Balancer: L4 connection distribution plus L7 content routing

Repeaters and hubs are the simplest network devices, operating entirely at the physical layer. While largely obsolete in modern wired networks, understanding them provides important context for networking concepts.

Repeater:

A repeater receives a signal on one port, regenerates it (cleaning up any degradation), and retransmits it on another port.

• Purpose: Extend distance beyond a single cable segment's limit
• Operation: Pure signal regeneration; has no awareness of data content
• Limitation: Does not filter or manage traffic; amplifies noise along with signals

Hub (Multi-Port Repeater):

A hub is essentially a multi-port repeater. A signal received on any port is regenerated and sent out all other ports.

• Simple connectivity: Connect multiple devices easily
• Shared bandwidth: All ports share the same collision domain
• No intelligence: Cannot direct traffic; all data goes everywhere

Switches are the workhorses of modern local area networks. They operate at Layer 2 (Data Link), making forwarding decisions based on MAC addresses. Unlike hubs, switches create separate collision domains per port while maintaining a shared broadcast domain.

Fundamental Switch Operation:

1. MAC Address Learning:

When a frame arrives on a port, the switch examines the source MAC address and records it in the MAC address table (also called CAM table—Content Addressable Memory):

MAC Address Table Entry:
┌─────────────────────┬──────────┬────────────────┐
│ MAC Address         │ Port     │ Timer          │
├─────────────────────┼──────────┼────────────────┤
│ 00:1A:2B:3C:4D:5E   │ Gi0/1    │ 300 seconds    │
│ AA:BB:CC:DD:EE:FF   │ Gi0/24   │ 287 seconds    │
└─────────────────────┴──────────┴────────────────┘

2. Frame Forwarding:

When forwarding a frame, the switch looks up the destination MAC address:

• Known unicast: Frame is sent only to the port where that MAC was learned
• Unknown unicast: Frame is flooded to all ports except the source port
• Broadcast (FF:FF:FF:FF:FF:FF): Frame is flooded to all ports
• Multicast: Flooded unless IGMP snooping is configured

3. Filtering:

If the source and destination are on the same port, the frame is filtered (not forwarded), as the devices can communicate directly.

Switch Features and Capabilities:

VLANs (Virtual LANs):

VLANs partition a physical switch into multiple logical switches:

• Port-based VLANs: Ports assigned to different VLANs
• Tagged VLANs (802.1Q): Frames carry VLAN ID tags for multi-switch environments
• Benefits: Traffic isolation, security segmentation, broadcast domain control

Spanning Tree Protocol (STP):

Prevents loops in networks with redundant paths:

• Elects a root bridge (lowest bridge ID)
• Calculates shortest paths to root
• Blocks redundant paths to prevent loops
• Reconverges if topology changes
• Variants: STP, RSTP (Rapid), MSTP (Multiple)

Link Aggregation (LAG/LACP):

Combines multiple physical links into one logical link:

• Increased bandwidth (additive)
• Redundancy if one link fails
• IEEE 802.3ad / 802.1AX standard

Port Mirroring (SPAN):

Copies traffic from one or more ports to a monitoring port:

• Used for network analysis and troubleshooting
• IDS/IPS integration
• Compliance monitoring

Routers are the fundamental building blocks of internetworking. They operate at Layer 3 (Network), making forwarding decisions based on IP addresses. Every packet that crosses network boundaries—including every packet on the Internet—is routed.

Router vs. Switch: Fundamental Differences:

Routing Table:

The routing table tells the router how to reach different networks:

Routing Table Example:
┌─────────────────────┬───────────────┬─────────────┬────────────┐
│ Destination Network │ Next Hop      │ Interface   │ Metric     │
├─────────────────────┼───────────────┼─────────────┼────────────┤
│ 10.0.0.0/8          │ Directly Conn │ GigE0/0     │ 0          │
│ 192.168.1.0/24      │ 10.0.0.1      │ GigE0/0     │ 1          │
│ 172.16.0.0/16       │ 10.0.0.2      │ GigE0/0     │ 2          │
│ 0.0.0.0/0           │ 203.0.113.1   │ GigE0/1     │ 1 (default)│
└─────────────────────┴───────────────┴─────────────┴────────────┘

Packet Forwarding Process:

1. Receive packet on incoming interface
2. Decrement TTL (Time to Live); drop if TTL = 0
3. Lookup destination IP in routing table
4. Find longest prefix match (most specific route)
5. Determine next hop and egress interface
6. Perform ARP lookup for next hop's MAC address (if not cached)
7. Rewrite Ethernet header with new source/destination MACs
8. Recalculate frame CRC
9. Transmit on egress interface

Routing Protocols:

Routers populate their routing tables via:

Static Routes:

• Manually configured by administrators
• Simple and predictable
• Doesn't adapt to topology changes
• Used for default routes, stub networks

Dynamic Routing Protocols:

Wireless Access Points (APs) enable wireless devices to connect to wired networks. They operate at Layer 2, bridging the 802.11 (Wi-Fi) and 802.3 (Ethernet) domains. As wireless networking becomes ubiquitous, understanding AP architecture and deployment is essential.

Basic AP Operation:

1. Beacon transmission: AP periodically broadcasts its presence (SSID, capabilities)
2. Association: Wireless client discovers AP and associates with it
3. Authentication: Security protocols verify client identity (WPA2/WPA3)
4. Frame bridging: AP converts 802.11 frames to 802.3 and vice versa
5. Channel management: AP coordinates simultaneous transmissions

AP Deployment Models:

Wi-Fi Standards Evolution:

Enterprise AP Considerations:

Radio Resource Management (RRM):

• Automatic channel selection to minimize interference
• Transmit power adjustment for coverage optimization
• Client load balancing across APs

Security Features:

• WPA3-Enterprise with 802.1X authentication
• Wireless intrusion detection/prevention (WIDS/WIPS)
• Rogue AP detection
• Client isolation

Quality of Service:

• WMM (Wi-Fi Multimedia) prioritization
• Airtime fairness
• Bandwidth limits per client/SSID

Firewalls are security devices that control traffic flow between networks based on configured rules. They form the primary perimeter defense for most organizations and have evolved from simple packet filters to sophisticated, multi-function security platforms.

Firewall Evolution:

Generation 1: Packet Filtering (Stateless)

• Inspects individual packets in isolation
• Rules based on source/dest IP, ports, protocol
• No connection awareness
• Fast but easily bypassed

Generation 2: Stateful Inspection

• Tracks connection state (TCP handshake, established, etc.)
• Allows return traffic for established connections
• Blocks packets that don't match expected state
• The standard for decades

Generation 3: Application-Aware (NGFW)

• Deep packet inspection (DPI)
• Identifies applications regardless of port
• User identity integration
• Integrated IPS, malware detection, URL filtering

Other Security Devices:

Intrusion Detection/Prevention Systems (IDS/IPS):

• IDS: Monitors and alerts on suspicious activity
• IPS: Can actively block detected threats
• Uses signature-based and anomaly-based detection
• Typically deployed inline (IPS) or via port mirror (IDS)

Web Application Firewall (WAF):

• Protects web applications from layer 7 attacks
• Defends against SQL injection, XSS, CSRF, etc.
• Often deployed in front of web servers

Network Access Control (NAC):

• Verifies device compliance before network access
• Checks posture: antivirus, patches, configuration
• Quarantines non-compliant devices

DDoS Mitigation Appliances:

• Detects and absorbs volumetric attacks
• Behavioral analysis to identify attack traffic
• Rate limiting and traffic scrubbing
• Often cloud-based for scale

Load balancers distribute incoming traffic across multiple backend servers, providing scalability, redundancy, and optimal resource utilization. Modern Application Delivery Controllers (ADCs) extend this with advanced traffic management, security, and optimization features.

Why Load Balancing Matters:

• Scalability: Handle more traffic than a single server can manage
• Availability: If one server fails, others continue serving requests
• Performance: Distribute load evenly; prevent any single server from becoming overwhelmed
• Flexibility: Add/remove servers without user impact

Load Balancing Layers:

Load Balancing Algorithms:

ADC Advanced Features:

• SSL/TLS Termination: Offload encryption from backend servers
• Content Caching: Store and serve static content
• Compression: Reduce bandwidth for text content
• Connection Multiplexing: Many client connections → fewer backend connections
• Health Checking: Monitor backend servers; remove unhealthy servers from pool
• Global Server Load Balancing (GSLB): Distribute across geographically dispersed data centers
• Rate Limiting: Protect backends from traffic spikes
• WAF Integration: Combine load balancing with application security