Switches connect devices inside a single local network. This lesson covers how a switch decides where to send data, plus VLANs and basic port security, all from a defender’s point of view.

How a switch forwards frames

A switch works at Layer 2 and uses MAC addresses, the 48-bit hardware addresses burned into network cards (for example 00:1A:2B:3C:4D:5E).

  • Learning: when a frame arrives, the switch records the source MAC and the port it came in on in its MAC address table.
  • Forwarding: if the destination MAC is in the table, the frame goes out only that port.
  • Flooding: if the destination is unknown or is a broadcast, the frame goes out all other ports in the same VLAN.

This is smarter than an old hub, which repeated everything to everyone. Each switch port is its own collision domain, but all ports in one VLAN share a broadcast domain. Routers separate broadcast domains.

You can view the table on a lab switch:

Switch# show mac address-table

VLANs

A VLAN (virtual LAN) splits one physical switch into several logical networks. Devices in different VLANs cannot talk at Layer 2 and need a router (or Layer 3 switch) between them. That makes VLANs a security tool: put students, staff and servers in separate VLANs, then control traffic between them with ACLs.

Create a VLAN and assign an access port on your own lab switch:

Switch(config)# vlan 10
Switch(config-vlan)# name STUDENTS
Switch(config-vlan)# exit
Switch(config)# interface fastEthernet 0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

A trunk port carries several VLANs between switches, tagging frames with the VLAN ID (802.1Q).

Hardening switch ports

Basic defensive habits for a lab or competition image:

  • Shut down unused ports: shutdown
  • Move unused ports into an unused “parking” VLAN
  • Use port security to limit which MAC addresses may use a port
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security violation restrict
  • Set access ports explicitly with switchport mode access so they never negotiate into trunks.

Check your understanding

1. What does a switch use to decide where to forward a frame?

  • IP address
  • MAC address
  • Hostname
  • Port speed

Answer: MAC address. Switches operate at Layer 2 and learn MAC addresses per port.

2. What happens when a switch receives a frame for an unknown destination MAC?

  • It drops the frame
  • It floods it out all other ports in the VLAN
  • It sends it to the router only
  • It asks DHCP

Answer: It floods it out all other ports in the VLAN. Once the destination replies, the switch learns its port.

3. Why are VLANs useful for security?

  • They make cables faster
  • They separate groups into different broadcast domains
  • They remove the need for passwords
  • They encrypt all traffic

Answer: They separate groups into different broadcast domains. Traffic between VLANs must pass through a router where it can be filtered.

4. Which is a good practice for unused switch ports?

  • Leave them enabled
  • Shut them down
  • Make them trunks
  • Remove the VLAN

Answer: Shut them down. A disabled port cannot be used by someone plugging in an unauthorized device.

PreviousNext