Devices map to layers of the OSI Model. Knowing what each does and at which layer tells you what it can see and decide on.
| Device | OSI layer | Forwards based on | Collision domains | Broadcast domains |
|---|---|---|---|---|
| Hub | 1 | Nothing, repeats to all ports | 1 | 1 |
| Repeater | 1 | Regenerates signal | n/a | n/a |
| Bridge | 2 | MAC address | 1 per port | 1 |
| Switch | 2 (L3 switch: 2+3) | MAC address (L3: IP too) | 1 per port | 1 (1 per VLAN) |
| Router | 3 | IP address | 1 per port | 1 per interface |
| Firewall | 3-7 | Rules, state, application | ||
| Load balancer | 4 / 7 | Ports, HTTP content | ||
| Access point | 1-2 | Bridges Wi-Fi to wired |
Core Devices
Switch
Learns which MAC address lives on which port (CAM / MAC address table) and sends frames only where needed. - Unknown unicast / broadcast is flooded out all ports except the source - Managed switches add VLANs, STP, port security, PoE, QoS - Layer 3 switch: switching plus routing between VLANs at wire speed - PoE (802.3af 15.4 W, 802.3at 30 W, 802.3bt up to 90 W) powers APs, phones, cameras
Router
Connects different networks, picks the best path using its routing table (Routing Protocols, Gateway Routing Protocols). Separates broadcast domains. Typically provides NAT and DHCP at the edge (Network Services).
Access Point / Wireless controller
APs connect clients to the wired LAN (Wifi). A wireless LAN controller (WLC) centrally manages many lightweight APs (channels, power, roaming, policies).
Firewall
- Packet filter / stateless: allows or denies by IP, port, protocol
- Stateful: tracks connection state; return traffic auto allowed
- Next-gen firewall (NGFW): application awareness, IPS, TLS inspection, user identity
- WAF: protects web apps (HTTP layer)
- UTM: firewall + AV + content filter in one box
IDS / IPS
- IDS: detects and alerts (out-of-band, e.g. via a SPAN / mirror port or TAP)
- IPS: inline, detects and blocks
- Detection: signature, anomaly / behaviour
Load balancer
Spreads requests across servers, with health checks and persistence. Methods: round robin, least connections, weighted, IP hash. L4 (TCP/UDP) vs L7 (HTTP). Cloud versions: 3. AWS Compute (ELB), 3. Azure Networking (Load Balancer, Application Gateway).
Proxy
- Forward proxy: clients go out through it (filtering, caching, anonymity)
- Reverse proxy: sits in front of servers (TLS termination, caching, load balancing, e.g. nginx)
Other
| Device / term | Function |
|---|---|
| Modem | Converts signals (DSL, cable, fibre ONT) to digital |
| Media converter | Converts between copper and fibre |
| VoIP phone / PBX | Voice over IP, SIP |
| NAS / SAN | File-level vs block-level network storage |
| VPN concentrator | Terminates many VPN tunnels |
| Network TAP | Passive copy of traffic for monitoring |
| Jump host / bastion | Controlled entry point to a private network |
Network Types and Topologies
| Type | Scope |
|---|---|
| PAN | Personal (Bluetooth) |
| LAN | Building / campus |
| WLAN | Wireless LAN |
| MAN | City |
| WAN | Wide area (internet, MPLS, SD-WAN) |
| SAN | Storage area |
| CAN | Campus |
Physical / logical topologies
- Star: everything to a central switch (most common, easy fault isolation, switch is a single point of failure)
- Bus: shared cable (legacy)
- Ring: each node to two neighbours (token ring, FDDI, SONET)
- Mesh: full (every node to every node, n(n-1)/2 links) or partial, highly redundant
- Hybrid: combinations
- Point-to-point, hub-and-spoke (WAN branches)
Data-center design
- Three-tier: core / distribution / access
- Collapsed core: core + distribution combined for smaller sites
- Spine-leaf: every leaf connects to every spine, predictable low latency, east-west traffic
- North-south (in/out of the DC) vs east-west (server to server) traffic
WAN technologies
- MPLS, Metro Ethernet, leased lines, SD-WAN (software-defined policy across links), broadband, 4G/5G, satellite
- Site-to-site VPN / IPsec, GRE tunnels, Direct Connect / ExpressRoute for cloud (5. AWS Networking)
Related: Cabling, Ethernet, Switching and VLANs