Concept Focus
This part connects the physical and data-link layers to real design choices: which media to use and why, how topologies fail, how to harden Layer 2 as if it is hostile, and how firewall policy should be run as a lifecycle.
Media (Layer 1)
Copper and coax
| Medium | EMI resistance | Typical distance | Use |
|---|---|---|---|
| UTP (Cat5e/6/6A) | Moderate (twisting reduces crosstalk); no shielding | ~100 m | Cheapest; great for office drops; avoid heavy-EMI areas |
| STP / FTP | Better than UTP; foil or braid shield | ~100 m | Moderate-EMI zones, only if the shield is grounded end to end |
| Coaxial | Strong resistance; built-in physical shield | 100–500 m | Durable, legacy or industrial runs where you need shielding and can't pull fiber |
Fiber
| Fiber | Reach | Use |
|---|---|---|
| Single-mode (SMF) | ~80 km | Campus and metro backbones, data-center to data-center long-haul |
| Multi-mode (MMF) | ~400 m | Intra-building trunks, top-of-rack to aggregation |
| Plastic (POF) | ~100 m | Short, flexible, low-cost industrial or consumer runs |
“Immune to EMI?” Fiber. “EMI plus a strong physical shield?” Coax. Fiber is EMI-immune and harder to tap casually, but not magic, optical taps exist, so use continuous link monitoring, MACsec on critical hops, and secure pathways.
Topologies and failure domains
| Topology | Failure mode | Security angle | Reality check |
|---|---|---|---|
| Bus | Trunk break drops the whole LAN | Everyone hears broadcasts | Historical only |
| Star | Central switch failure = outage | Contained edge failure | Access default; use redundant cores |
| Ring | Single cut drops the ring unless dual-ring | Deterministic timing | Largely legacy (Token Ring, FDDI) |
| Mesh | Link or router loss tolerated | Diverse paths hinder DoS | Partial mesh in core and aggregation |
| Tree | Root or major branch failure = wide impact | Clear policy choke points | Standard enterprise layout |
| Hybrid | Depends on the mix | Tailored blast radius | Common in datacenters and campuses |
Layer 2 resiliency and segmentation
- STP family: RSTP/MSTP; define a root bridge and block loops. Guards: BPDU Guard (shuts an edge port if BPDUs appear), Root Guard, Loop Guard.
- Uplinks: LACP (802.3ad) for load-sharing and failover.
- Storm control: cap broadcast and multicast to prevent meltdown.
- Segmentation mindset: small L2, big L3, keep access VLANs small and route at L3 early. Put noisy OT gear on dedicated VLANs gated by L3 ACLs; use private VLANs to isolate east-west at the same L2.
Data-Link (Layer 2) controls
Frames carry source and destination MAC, EtherType or length, payload, and a CRC (error detection, not cryptographic integrity). The LLC sublayer handles flow and error management; the MAC sublayer handles media access and addressing. Media access is CSMA/CD on legacy Ethernet, CSMA/CA on Wi-Fi, and token passing on Token Ring and FDDI.
Hardening the link (high value): port-security (sticky MAC, violation actions), DHCP snooping feeding dynamic ARP inspection, IP source guard, BPDU guard on access ports, MACsec (802.1AE) on critical links, disable unused ports, shut auto-trunking, and lock the management VLAN.
Common L2 attacks and fixes
| Attack | Vector | Primary mitigation |
|---|---|---|
| ARP spoofing | Fake ARP replies poison the ARP cache | DHCP snooping + Dynamic ARP Inspection; static ARP for crown-jewel hosts |
| MAC flooding | CAM table overflow makes the switch flood like a hub | Port-security (limit or sticky MAC), storm control |
| VLAN hopping | Double-tagging or misconfigured trunking | Disable auto-trunking, set an unused native VLAN, prune VLANs on trunks |
| STP manipulation | Rogue root BPDUs to become the STP root | Root Guard, BPDU Guard |
Bridge to Layer 3
- IPv4: private ranges, NAT/PAT, fragmentation at L3 when MTU mismatches; set path MTU and avoid fragmentation-based evasion.
- IPv6: 128-bit addressing, IPsec-capable, no NAT (so egress policy becomes critical), scoped addresses and autoconfig.
- Egress policy: don't let hosts talk out on arbitrary ports; pair L3 ACLs with L7 firewall rules.
Copper uplinks in the CNC wing became MMF fiber with correctly grounded tails, and the CRC errors vanished. Star access with redundant LACP uplinks fed a partial-mesh core so local failures stopped nuking the floor. The CNC/OT VLAN was isolated with L3 ACLs, management moved to an out-of-band VLAN, and the link was hardened with DHCP snooping, DAI, port-security, BPDU guard, storm control, and MACsec on the aggregation-to-core hop.
Firewall policy and lifecycle
A firewall policy should rest on a comprehensive risk analysis. Block all inbound and outbound traffic by default, with explicit exceptions for desired traffic. Consider the source and destination as well as the content. Block invalid or private IPv4 addresses by default, have explicit policies for IPv6, and decide which applications may send traffic in or out.
- Plan. Identify every requirement for the firewall that enforces the security policy.
- Configure. Install hardware and software and set up the rule base.
- Test. Pilot in a lab: functionality, performance, scalability, security, and interoperability.
- Deploy. Roll the firewall into the enterprise once issues are resolved.
- Manage. Maintain and support it across its lifecycle; repeat the cycle for significant changes.
Anya's additions to make it exam-grade and operable: an egress allow-list mapped to apps with everything else blocked (kills C2 and beacons), IPv4/IPv6 parity so v6 is not a side door, rule hygiene (owner, expiry, justification, shadow-rule detection, quarterly recertification), tests for evasion (fragmentation, odd TTLs, non-SYN TCP, URL encodings), and change control that simulates in a lab and fails closed where the user experience allows.
Brain Ticklers
Q1. CRC spikes align with CNC motor starts. Which single change best removes the root cause?
- Increase port MTU to 9216 bytes
- Move uplinks to MMF fiber in the CNC zone
- Enable LACP on access ports
- Turn on 802.1X for users
Q2. A red team pulls off VLAN hopping via native VLAN tricks. What's the most surgical fix?
- Enable port-security on trunks
- Set the native VLAN to an unused ID and require tagging on trunks; prune VLANs
- Increase STP priority on access switches
- Disable IPv6 on all ports
Q3. ARP spoofing succeeds between QA and Build VLANs. Pick the best L2 control pair.
- DHCP Snooping + Dynamic ARP Inspection
- STP Root Guard + BPDU Guard
- IP Source Guard + HSRP
- 802.1X + guest VLAN
Q4. Which statement about CRC is most accurate?
- CRC delivers cryptographic integrity
- CRC prevents VLAN hopping
- CRC detects transmission errors only; it is not a security control
- CRC authenticates sender MAC
Q5. The new firewall standard says “default-deny outbound” with IPv6 parity. What's the biggest practical impact?
- Users lose internet entirely
- Egress allow-lists per app or protocol become mandatory, with mirrored rules for IPv6
- NAT66 required on the edge
- Split-tunnel VPN becomes safer
- Pick media for physics, not price: fiber in noisy or long runs, STP only if grounded right, coax when you need shielding and ruggedness.
- Shrink L2, grow L3: small VLANs, route early, prune trunks, set unused native VLANs.
- Harden L2 as if it's hostile: port-security, DHCP snooping into DAI, BPDU and Root Guard, storm control, MACsec on crown-jewel paths.
- Design for failure: redundant LACP uplinks, RSTP/MSTP tuned, partial mesh in the core.
- Firewall equals lifecycle plus parity: default-deny inbound and outbound, IPv4/IPv6 mirrored, owner and expiry on every rule.