1. The Router
Layer 3: NetworkWhat Is It?
The digital postmaster that connects different networks together.
Problem It Solves
Allows your home devices to talk to the outside world (Internet).
How It Works
It reads the IP Address on a packet and sends it to the best path to reach its destination. It chooses the best path using a routing table.
⚠ Common Attack Surface
- Default Credentials: Hackers try admin/admin to take control.
- Exposed Services: Leaving SSH/Telnet open to the internet.
- Outdated Firmware: Old software with known vulnerabilities.
2. The Switch
Layer 2: Data LinkWhat Is It?
A smart power strip for data that connects devices within a single network.
Problem It Solves
Stops data collisions by creating a direct line between two devices.
How It Works
It uses MAC Addresses to learn where devices are plugged in. It stores these addresses in a MAC Address Table (CAM Table).
⚠ Common Attack Surface
- VLAN Hopping: Escaping a restricted network segment.
- CAM Table Flooding: Overwhelming the switch so it fails open (acting like a Hub), allowing traffic sniffing.
3. The Firewall
Layer 3/4 (Transport)What Is It?
A security guard that approves or denies traffic based on rules.
Problem It Solves
Prevents hackers and unauthorized connections from entering your network.
⚠ Common Attack Surface
- Rule Misconfiguration: Leaving "Any/Any" allow rules enabled.
- Shadow Rules: Old rules that conflict with new security policies.
4. IDS (Intrusion Detection System)
Layer 3–7What Is It?
A burglar alarm that watches network traffic.
Problem It Solves
Detects stealthy attacks that might have slipped past the firewall.
Detection Methods
- Signature Based: Compares traffic against a database of known attacks.
- Anomaly Based: Learns "normal" traffic patterns and alerts on unusual behavior (e.g., a printer sending 10GB of data at 3 AM).
5. IPS (Intrusion Prevention System)
Layer 3–7What Is It?
An armed guard that stops attacks instantly.
Problem It Solves
Automatically blocks malicious traffic before it reaches the server.
IDS vs IPS (Quick Comparison)
IDS = Alarm (Detects).
IPS = Guard (Detects + Blocks).
6. Proxy Server
Layer 7 (Application)What Is It?
A middleman that makes requests on your behalf.
Problem It Solves
Hides your identity or filters what websites you can visit.
⚠ Common Attack Surface
Open Proxy Abuse: If not secured, hackers can use your proxy to launch attacks, masking their identity with your IP.
7. The Traffic Journey
When you request a website, your data travels through these devices in order:
8. Troubleshooting Scenario
Scenario: No Internet Access
Symptoms: Users in the office cannot access Google.com, but they CAN print documents to the office printer.
Analysis:
- Since printing works, the Switch (Layer 2) is functioning correctly.
- The issue lies beyond the local network.
- Suspects: The Router (Gateway) or the Firewall rule blocking outbound traffic.
📌 Device Comparison
| Device | Primary Layer | Function | Main Security Risk |
|---|---|---|---|
| Router | Layer 3 | Connect Networks | Misrouting / Default Creds |
| Switch | Layer 2 | Connect Devices | Flooding / VLAN Hopping |
| Firewall | Layer 3/4 | Filter Traffic | Misconfiguration |
| IDS | Passive | Detect Attacks | Missed Alerts |
| Proxy | Layer 7 | Middleman | Bypass / Open Relay |