Routing, Switching & VLANs

Switches operate at Layer 2 and forward frames using a MAC address table. Routers operate at Layer 3 and forward packets between networks using routing tables and protocols such as OSPF and BGP.

VLANs segment a physical switch into isolated broadcast domains. Segmentation is a core defensive control: a compromised workstation VLAN should not reach the server VLAN without passing a firewall.

Layer-2 attacks: MAC flooding (overflow the CAM table to force fail-open), VLAN hopping (double-tagging), and DHCP starvation. Mitigations: port security, DHCP snooping, dynamic ARP inspection.

BGP is the routing protocol of the internet and is famously fragile. Route hijacks and leaks have taken major services offline. Defenders increasingly rely on RPKI to validate route origins.