🖧 01-07: Network Hardware & Attack Surface¶
📌 Introduction¶
Every network attack you'll study in this course ultimately targets a piece of physical or logical infrastructure — a hub, a switch, a router, a Wi-Fi access point, or a firewall. Before diving into the attacks themselves (Modules 03–05), this lesson recaps what each device does and at which OSI layer it operates, then maps each one to the attack it's most famous for enabling.
💡 A useful rule of thumb across this whole lesson: the more "intelligent" a device is about the traffic it forwards, the more state it has to maintain — and the more that state can be manipulated or exhausted by an attacker.
🔌 Hubs (Layer 1 — Physical)¶
A hub is the simplest possible network device: it takes a signal that arrives on one port and blindly repeats it out to every other port, with no intelligence about addressing at all.
- Layer: Physical (Layer 1) — it doesn't read frames, addresses, or anything; it just repeats electrical signals.
- Effect: every device connected to a hub is in the same collision domain and the same broadcast domain — every device sees every other device's traffic.
How a Hub Can Be Attacked/Misused¶
Hubs make packet sniffing trivial. Because every frame is repeated to every port, an attacker plugged into any port on the hub receives a copy of all traffic on that hub — including traffic addressed to other devices — with zero effort and no special technique required. This is why hubs have almost entirely disappeared from modern networks in favor of switches, and why understanding why they were insecure is a good entry point into Module 03's sniffing content.
🔀 Switches (Layer 2 — Data Link)¶
A switch is a smarter hub: it reads the destination MAC address in each Ethernet frame and forwards the frame only to the port where that MAC address lives, using a CAM table (Content Addressable Memory table — essentially a MAC-address-to-port lookup table it builds by watching traffic).
- Layer: Data Link (Layer 2).
- Effect: each port is its own collision domain; devices no longer see each other's unicast traffic by default, which is a real (if incidental) security improvement over hubs.
How a Switch Can Be Attacked/Misused¶
- MAC flooding: an attacker floods the switch with frames carrying thousands of fake source MAC addresses. The CAM table has finite memory, so it fills up completely. Once full, many switches fail open — falling back to hub-like behavior, flooding all frames out every port — which hands the attacker exactly the sniffing capability switches were supposed to prevent.
- CAM table attacks / MAC spoofing: an attacker can also claim someone else's MAC address, tricking the switch into redirecting that victim's traffic to the attacker's port instead.
This class of attack, and ARP-based attacks that also operate at Layer 2, are covered in depth starting at 03-03: ARP Protocol Recap and 03-04: ARP Spoofing Attacks.
🌍 Routers (Layer 3 — Network)¶
A router connects multiple different networks together and forwards packets between them based on IP addresses, using a routing table to decide the best next hop toward a packet's destination.
- Layer: Network (Layer 3).
- Effect: routers are the devices that make the internet an inter-network — a network of networks — rather than one giant flat broadcast domain.
How a Router Can Be Attacked/Misused¶
- Route injection / route hijacking: if a router trusts routing announcements from its neighbors without verification (a real, historical problem with the internet's BGP routing protocol), an attacker can announce false routes and redirect traffic — potentially through their own equipment for interception, or into a black hole for denial of service.
- IP spoofing exploitation: because routers forward packets based on the destination IP and don't typically verify that the source IP is legitimate, they become an unwitting accomplice in IP spoofing attacks (see 02-06: IP Spoofing Fundamentals).
- Default credential attacks: consumer and small-business routers are frequently compromised simply because administrators never change default admin passwords — not a protocol flaw, but a very common real-world weakness.
📶 Wireless Access Points (Layer 1/2)¶
A Wi-Fi access point (AP) bridges wireless clients to a wired network, handling radio-level transmission (Layer 1) and frame addressing/association (Layer 2) for everything connecting over 802.11.
How an AP Can Be Attacked/Misused¶
- Rogue AP: an attacker plugs an unauthorized access point into the network, creating a backdoor entry point that bypasses the organization's normal perimeter controls entirely.
- Evil twin: an attacker sets up an AP broadcasting the same network name (SSID) as a legitimate one — sometimes with a stronger signal — so victims' devices connect to the attacker's AP instead. From there, the attacker can intercept, inspect, or modify all of the victim's traffic (a Layer 2/3 man-in-the-middle position).
- Deauthentication attacks: Wi-Fi management frames used to disconnect a client from an AP are typically unauthenticated, letting an attacker forcibly disconnect victims — either as a denial of service or to force a reconnection that can be captured (e.g., to catch a WPA handshake for offline password cracking).
🧱 Firewalls (Multiple Layers)¶
A firewall is a device or piece of software that enforces a policy about which traffic is allowed to pass, based on rules — anything from simple IP/port filtering (Layer 3/4) to deep application-aware inspection (Layer 7).
- Layer: varies by type — traditional packet-filtering firewalls work at Layer 3/4; modern "next-gen" firewalls inspect up to Layer 7.
- Purpose: unlike the other devices on this list, a firewall's entire job is security — it's a defensive control, not just a piece of forwarding infrastructure.
How a Firewall Can Be Attacked/Misused¶
- Misconfiguration: overly permissive rules (e.g., "allow all traffic from this IP range") defeat the purpose of having a firewall at all — this is by far the most common real-world firewall failure.
- Rule bypass via tunneling: encapsulating disallowed traffic inside an allowed protocol (e.g., tunneling arbitrary data over DNS or HTTPS) can sneak traffic past rules that only inspect surface-level headers.
- Fragmentation/evasion attacks: carefully crafted packet fragments can sometimes be reassembled differently by the firewall than by the final destination host, letting malicious content slip through inspection undetected.
The mechanics of firewall rules and defense-in-depth design are covered fully in 05-01: Firewall Concepts & History.
🗺️ Quick Reference Table¶
| Device | OSI Layer | Reads | Primary Attack | Covered In |
|---|---|---|---|---|
| Hub | 1 (Physical) | Nothing (repeats signal) | Trivial sniffing (shared broadcast domain) | Module 03 |
| Switch | 2 (Data Link) | MAC addresses | MAC flooding / CAM table overflow | Module 03 |
| Router | 3 (Network) | IP addresses | Route injection, IP spoofing exploitation | Module 02/03/04 |
| Access Point | 1/2 | Radio signal + frames | Rogue AP, evil twin, deauth attacks | Module 03 |
| Firewall | 3/4 (or up to 7) | Rules against packet/session/app data | Misconfiguration, tunneling, fragmentation evasion | Module 05 |
📌 Key Takeaways¶
- Hubs operate at Layer 1 and repeat every signal to every port, making sniffing trivial — this is why they've been replaced by switches.
- Switches operate at Layer 2, using a CAM table to forward frames only to the correct MAC address's port — but MAC flooding can force a switch to fail open and flood traffic like a hub.
- Routers operate at Layer 3, connecting separate networks together via routing tables; they can be misled by route injection or exploited as accomplices in IP spoofing.
- Wireless access points are vulnerable to rogue AP setups, evil-twin impersonation, and deauthentication attacks because much of 802.11 management traffic lacks strong authentication.
- Firewalls are the one device on this list built specifically for security, but they're only as good as their configuration — overly permissive rules, tunneling, and fragmentation tricks can all defeat them.
- The general pattern across every device: the more trust a device places in unverified data (a MAC address, a route announcement, an SSID, a fragment reassembly), the more attackable it becomes.
- This lesson is a preview map for Modules 03–05 — as you learn each attack in detail, come back and see how it fits into the device-level picture built here.