2.4 Network Topologies, Switched Media & VLAN Segmentation

2.4 Network Topologies, Switched Media & VLAN Segmentation

Modern local area networks (LANs) rely on switched media, virtual local area networks (VLANs), and segmented perimeter zones to isolate broadcast traffic and enforce security boundaries. For the CREST CPSA candidate, understanding how switches process Ethernet frames, how VLAN tagging operates at Layer 2, and how attackers circumvent these mechanisms via switch exploitation is critical for both internal infrastructure penetration testing and architecture review.

---

1. Media Architectures: Shared vs. Switched Media

Shared Media (Hubs & Legacy Coaxial)

In legacy shared media architectures (e.g., 10BASE2/10BASE5 coaxial bus or 10BASE-T multiport repeater hubs), all connected nodes share a single physical electrical medium:

• Layer 1 Operation: Hubs operate strictly at the Physical Layer, repeating incoming electrical signals out of all other ports without inspecting frame contents.
• Half-Duplex Transmission: A station cannot transmit and receive simultaneously. Communication is governed by Carrier Sense Multiple Access with Collision Detection (CSMA/CD) (RFC 895):
  1. Carrier Sense: Host listens to the wire; transmits only if idle.
  2. Collision Detection: If two hosts transmit simultaneously, their signals collide on the wire.
  3. Jam Signal & Backoff: Transmitting hosts detect the collision, emit a high-frequency jam signal, and execute a truncated binary exponential backoff algorithm before retransmitting.
• Security Implication: The entire hub forms a single collision domain and a single broadcast domain. Any network interface configured in promiscuous mode (promisc) can passively capture every packet transmitted by any host on the segment without active attacks.

Switched Media (Layer 2 Switches)

Modern networks utilize switches that operate at Layer 2 (Data Link Layer):

• Microsegmentation: Each individual switch port represents an independent, isolated collision domain.
• Full-Duplex Operation: Because transmit (Tx) and receive (Rx) pairs operate on separate physical circuits, collisions are physically impossible, and CSMA/CD is disabled.
• Traffic Isolation: Unicast frames are delivered exclusively to the physical port hosting the destination MAC address. Passive sniffing from an access port captures only the host's own unicast traffic, plus local broadcast and multicast traffic.

---

2. Collision Domains vs. Broadcast Domains

Understanding domain boundaries is essential for network design and penetration testing scope determination:

+---------------------------------------------------------------------------------------+
|                                 ROUTER (Layer 3)                                      |
|                       Breaks / Terminates Broadcast Domains                           |
+-------------------------------------------+-------------------------------------------+
                     |                                           |
         Broadcast Domain 1 (VLAN 10)                Broadcast Domain 2 (VLAN 20)
                     |                                           |
+--------------------+--------------------+ +--------------------+--------------------+
|             SWITCH A (Layer 2)          | |             SWITCH B (Layer 2)          |
|          Breaks Collision Domains       | |          Breaks Collision Domains       |
+---------+---------------------+---------+ +---------+---------------------+---------+
          |                     |                     |                     |
   Collision Domain      Collision Domain      Collision Domain      Collision Domain
      (Port 1)              (Port 2)              (Port 1)              (Port 2)
          |                     |                     |                     |
       Host A                Host B                Host C                Host D

Summary of Domain Boundaries

---

3. Switch Forwarding Mechanics & the CAM Table

A switch determines where to forward frames using its Content Addressable Memory (CAM) table (also called the MAC Address Table). The switch operates according to three core rules:

1. Learning: When a frame enters an ingress port, the switch inspects the Source MAC address. It maps Source MAC -> Ingress Port -> VLAN ID in its CAM table and resets an aging timer (typically 300 seconds).
2. Flooding: If the frame's Destination MAC address is:
   • An Unknown Unicast (the address is not present in the CAM table),
   • A Broadcast (FF:FF:FF:FF:FF:FF), or
   • A Multicast group address, the switch floods the frame out of all ports within the same VLAN except the ingress port.
3. Forwarding (Filtering): If the Destination MAC is already mapped in the CAM table, the switch forwards the frame exclusively out of the specific mapped egress port.

---

4. Ethernet Frame Architecture

The predominant Layer 2 framing standard in enterprise TCP/IP networks is DIX Ethernet II (contrasted with IEEE 802.3 LLC):

+---------+-------+---------------+---------------+-----------+-----------------+---------+
| Preamble|  SFD  |  Dest MAC     |  Source MAC   | EtherType |     Payload     |   FCS   |
| 7 bytes | 1 byte|   6 bytes     |    6 bytes    |  2 bytes  | 46 - 1500 bytes | 4 bytes |
+---------+-------+---------------+---------------+-----------+-----------------+---------+

• Preamble (7 bytes): Repeating pattern of alternating bits (10101010) allowing physical transceivers to synchronize clock timing.
• Start of Frame Delimiter (SFD, 1 byte): The bit sequence 10101011 indicating that destination addressing immediately follows.
• Destination & Source MAC Addresses (6 bytes / 48 bits each): Expressed as twelve hexadecimal characters (e.g., 00:50:56:C0:00:08).
  • Organizationally Unique Identifier (OUI, first 24 bits): Assigned by IEEE to the hardware manufacturer (e.g., 00:0C:29 = VMware, 00:1A:A0 = Dell).
  • NIC Identifier (last 24 bits): Sequentially assigned by the manufacturer.
  • I/G Bit (Individual/Group): Bit 0 of the first octet. 0 = Unicast; 1 = Multicast (e.g., 01:00:5E:xx:xx:xx for IPv4 multicast).
  • U/L Bit (Universal/Local): Bit 1 of the first octet. 0 = Globally unique; 1 = Locally administered.
• EtherType (2 bytes): Identifies the encapsulated Layer 3 protocol:
  • 0x0800 = IPv4
  • 0x86DD = IPv6
  • 0x0806 = ARP
  • 0x8100 = IEEE 802.1Q VLAN Tagged Frame
• Payload (46 to 1500 bytes): Carries the Layer 3 datagram. The minimum Ethernet frame size is 64 bytes (from Destination MAC through FCS). If the payload is smaller than 46 bytes (such as an empty TCP ACK), padding bytes are appended to reach 64 bytes.
• Frame Check Sequence (FCS, 4 bytes): A 32-bit Cyclic Redundancy Check (CRC-32) computed over the destination MAC, source MAC, EtherType, and payload. If the receiving switch calculates a mismatched CRC, the frame is silently dropped.

---

5. Virtual Local Area Networks (VLANs) & IEEE 802.1Q

A VLAN is a logical partition of a Layer 2 switch that creates separate broadcast domains across the same physical hardware. Hosts on different VLANs cannot communicate at Layer 2; traffic between VLANs must traverse a Layer 3 routing device (Inter-VLAN Routing or "Router-on-a-stick").

IEEE 802.1Q Encapsulation

To multiplex traffic from multiple VLANs across a single inter-switch physical link (a trunk port), the switch inserts a 4-byte 802.1Q tag directly between the Source MAC address and the EtherType field:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       TPID (0x8100)           |  PCP  |D|         VID         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Tag Protocol Identifier (TPID, 16 bits): Set to the fixed value 0x8100 to identify an 802.1Q tagged frame.
• Priority Code Point (PCP, 3 bits): Class of Service (CoS) for Layer 2 Quality of Service (values 0-7, IEEE 802.1p).
• Drop Eligible Indicator (DEI, 1 bit): Indicates frames that may be dropped during network congestion.
• VLAN Identifier (VID, 12 bits): Identifies the VLAN to which the frame belongs ($2^{12} = 4,096$ values):
  • 0: Priority tagged frame (no VLAN specified).
  • 1: Default native VLAN on Cisco equipment.
  • 2 to 4094: Usable VLAN range (Normal: 1-1005, Extended: 1006-4094).
  • 4095: Reserved for system use.

Port Modes: Access vs. Trunk

• Access Port: Assigned to a single VLAN. Connects to end-user workstations, printers, and standard servers. Transmits untagged frames. When an untagged frame enters an access port, the switch tags it internally with that port's assigned VID; when exiting an access port, the tag is stripped.
• Trunk Port: Carries traffic for multiple VLANs across switches or between a switch and a router. Uses 802.1Q tagging so receiving switches know which VLAN each frame belongs to.
• Native VLAN: An 802.1Q trunk has a designated Native VLAN (default is VLAN 1). Untagged frames transmitted across a trunk are treated as belonging to the Native VLAN. Conversely, any frame on the Native VLAN is transmitted across the trunk without an 802.1Q tag.

---

6. Layer 2 Security Attacks & Exploitation Techniques

Because Layer 2 protocols were designed without built-in authentication, enterprise switches are vulnerable to specific attacks if unhardened:

1. MAC Flooding Attack (CAM Table Exhaustion)

• Mechanism: The attacker connects a machine to an access port and uses a tool such as macof (part of the dsniff suite) to generate hundreds of thousands of frames per minute, each featuring a randomized, spoofed Source MAC address.
• Impact: The switch CAM table fills to capacity. Unable to learn new MAC entries, the switch enters a fail-open state (acting like a legacy hub) by flooding all incoming unicast frames out of every port on the VLAN. The attacker places their interface in promiscuous mode to sniff confidential traffic.
• Mitigation - Port Security:

  Switch(config-if)# switchport mode access
  Switch(config-if)# switchport port-security
  Switch(config-if)# switchport port-security maximum 2
  Switch(config-if)# switchport port-security violation shutdown
  Switch(config-if)# switchport port-security mac-address sticky
  

  Violation Modes: protect (drops unauthorized frames), restrict (drops frames and increments SNMP trap counter), shutdown (disables the interface via err-disabled).

2. Switch Spoofing (VLAN Hopping)

• Mechanism: Cisco switches historically enable Dynamic Trunking Protocol (DTP) by default (switchport mode dynamic desirable or dynamic auto). An attacker connects a rogue device running software like yersinia that sends DTP Desirable packets, negotiating a formal 802.1Q trunk link with the switch.
• Impact: The attacker's port becomes a trunk port, granting the attacker access to all VLANs traversing the switch.
• Mitigation: Explicitly configure all user-facing ports as access ports and disable DTP negotiation:

  Switch(config-if)# switchport mode access
  Switch(config-if)# switchport nonegotiate
  

3. Double Tagging Attack (VLAN Hopping)

• Mechanism: Exploits the Native VLAN processing behavior of 802.1Q trunks. The attacker must be connected to an access port on the same VLAN as the trunk's Native VLAN (typically VLAN 1):
  1. The attacker crafts a frame with two 802.1Q tags:
     • Outer Tag: Set to the Native VLAN (VLAN 1).
     • Inner Tag: Set to the target victim VLAN (e.g., VLAN 20 - HR/Finance).
  2. Switch 1 inspects the outer tag (VLAN 1). Since the frame must traverse the trunk and belongs to the Native VLAN, Switch 1 strips the outer tag and transmits the frame untagged across the trunk.
  3. Switch 2 receives the frame. It reads the remaining tag (the inner tag, VLAN 20) and forwards the frame to the victim host on VLAN 20.
• Limitation: This attack is strictly unidirectional (blind injection) because return traffic from the victim is tagged with VLAN 20 and cannot hop back to VLAN 1.
• Mitigation: Change the Native VLAN on all trunks to an unused, dedicated VLAN ID (e.g., VLAN 999), ensure no access ports are assigned to the Native VLAN, and enforce tagging of Native VLAN frames (vlan dot1q tag native).

---

7. Perimeter Security & Demilitarized Zone (DMZ) Architectures

To prevent external attackers from compromising internal assets, enterprises deploy Demilitarized Zones (DMZs)—isolated subnetworks hosting publicly accessible services (e.g., Web, Mail, DNS, Reverse Proxies).

                           [ THE INTERNET ]
                                  |
                      +-----------+-----------+
                      |   PERIMETER FIREWALL  |
                      +-----------+-----------+
                                  |
           +----------------------+----------------------+
           |                                             |
    [ PUBLIC DMZ ]                                [ BACK-END FIREWALL ]
  - Web Server (80/443)                                  |
  - Mail Gateway (25)                             [ INTERNAL NETWORK ]
  - Public DNS (53)                             - Active Directory DC
                                                - Database Server (3306/1433)
                                                - Workstations

Architectural Models

1. Three-Legged / Tri-Homed Firewall (Single Firewall DMZ): A single physical firewall has three interfaces: External (Internet), DMZ, and Internal. If an attacker breaches or finds a zero-day vulnerability in the firewall firmware, both the DMZ and the internal corporate network are compromised simultaneously.
2. Screened Subnet / Dual-Firewall DMZ (Two-Tier Architecture): The DMZ is sandwiched between two distinct physical firewalls: an External / Perimeter Firewall and an Internal / Back-End Firewall. Best practice dictates using firewalls from different vendors (e.g., Palo Alto externally and Fortinet or Check Point internally) to ensure that a single software vulnerability does not grant access across both barriers.

Secure DMZ Traffic Flow Rules

• External $\rightarrow$ DMZ: Permitted strictly for necessary service ports (e.g., TCP 80, 443 to Web Servers).
• DMZ $\rightarrow$ Internal: Strictly prohibited from initiating connections! A compromised DMZ host must never be capable of establishing an outbound connection into the internal enterprise network. Communication between the DMZ and the internal network must either be initiated by internal systems (pulling data from the DMZ) or strictly confined to specific database ports (e.g., TCP 1433) directed at hardened database servers.
• Internal $\rightarrow$ DMZ: Permitted for administrative management (e.g., SSH, RDP) and database updates.
• DMZ $\rightarrow$ External: Heavily restricted to prevent compromised DMZ servers from establishing reverse shells or downloading secondary attack payloads.