2.5 Network Media, Ethernet Standards & Physical Topologies

2.5 Network Media, Ethernet Standards & Physical Topologies

Appendix B2 of the CPSA syllabus does not merely ask which cable is faster. It asks you to recognise "varying network types that could be encountered during a penetration test" — CAT 5 and fibre, 10/100/1000BaseT, Token Ring and Wireless (802.11) — and then to reason about the security implications of shared media, switched media and VLANs. On an internal engagement the physical layer decides what you can see from a wall jack, how far you can be from the target, and whether passive interception is even possible.

---

1. Copper Twisted-Pair Cabling Categories

Structured cabling is graded by the bandwidth its twisted pairs can carry before crosstalk destroys the signal. Every category below terminates in an 8P8C (RJ-45) connector and is limited to a 100-metre channel — 90 m of solid horizontal cable plus 10 m of stranded patch leads.

UTP (Unshielded Twisted Pair) relies purely on the twist rate to cancel interference. STP/FTP adds a foil or braid that must be bonded to earth at the patch panel; an unbonded shield behaves as an antenna and can make emissions worse, which is a genuine finding during a physical review.

---

2. Ethernet Transmission Standards (10/100/1000BaseT)

The BASE in a designation means baseband — the whole medium carries one signal, with no frequency-division multiplexing. The leading number is the megabit rate and the trailing letter describes the medium (T = twisted pair, X = a block-coded fibre or copper variant, F/S/L = fibre).

+---------------+---------+----------------+-------------------+---------------------------+
| Standard      | Rate    | Media          | Pairs Used        | Max Segment               |
+---------------+---------+----------------+-------------------+---------------------------+
| 10BASE-T      | 10 Mb/s | CAT 3 or better| 2 of 4 (1/2, 3/6) | 100 m                     |
| 100BASE-TX    | 100 Mb/s| CAT 5 or better| 2 of 4 (1/2, 3/6) | 100 m                     |
| 1000BASE-T    | 1 Gb/s  | CAT 5e or better| ALL 4, bidirectional | 100 m                  |
| 10GBASE-T     | 10 Gb/s | CAT 6a         | ALL 4, bidirectional | 100 m (55 m on CAT 6)  |
| 1000BASE-SX   | 1 Gb/s  | Multimode fibre| 1 pair             | 220-550 m (core dependent)|
| 1000BASE-LX   | 1 Gb/s  | Single-mode    | 1 pair             | up to 10 km               |
+---------------+---------+----------------+-------------------+---------------------------+

Two consequences matter operationally:

• 10BASE-T and 100BASE-TX leave two pairs idle. Those spare pairs are what Power over Ethernet (802.3af/at) historically used in "Alternative B", and what unscrupulous installers use to run two 100 Mb links down one cable. A jack that appears dead may simply be split onto pairs 4/5 and 7/8.
• 1000BASE-T transmits on all four pairs in both directions simultaneously, using hybrid circuits and echo cancellation to separate the directions. A passive vampire tap that works on 100BASE-TX will not cleanly recover gigabit traffic, which is why professional taps for gigabit links are active devices requiring their own power — and therefore visible during a physical walkthrough.

---

3. Fibre Optic Media

Fibre carries modulated light through a glass core surrounded by lower-refractive-index cladding.

• Multimode fibre (MMF) — 50 µm or 62.5 µm core, driven by 850 nm VCSELs or 1300 nm LEDs. Many light paths ("modes") propagate, so modal dispersion limits distance to hundreds of metres. Graded OM1 through OM5; jackets are conventionally orange (OM1/OM2), aqua (OM3/OM4) or lime green (OM5).
• Single-mode fibre (SMF) — 8–10 µm core, driven by 1310 nm or 1550 nm lasers. Only one mode propagates, so runs of tens of kilometres are routine. Jackets are conventionally yellow.

The security properties are what CPSA cares about:

1. No usable electromagnetic emanation. Copper radiates a signal that can, in principle, be recovered at a distance; a fibre strand does not. Fibre is therefore preferred for links crossing uncontrolled space.
2. Interception requires physical interruption. A fibre tap works by bending the strand past its critical angle so a fraction of the light escapes, or by splicing in a splitter. Both attenuate the link measurably, and a monitored optical budget will show the loss. This is why fibre runs between buildings should be in monitored conduit.
3. Immunity to induced interference and ground loops. Fibre carries no current, so it cannot conduct a surge between buildings and cannot be disrupted by nearby motors or fluorescent ballasts.

---

4. Token Ring and Legacy Ring Architectures

IEEE 802.5 Token Ring, developed by IBM, is explicitly named in the CPSA syllabus even though it is long obsolete in production.

• Stations pass a 3-byte token around a logical ring. Only the station holding the token may transmit, so collisions are impossible and latency is deterministic — the property that kept it alive in manufacturing and financial back offices long after Ethernet won elsewhere.
• Speeds are 4 Mbps or 16 Mbps (later 100 Mbps HSTR saw almost no deployment). A 4 Mbps station inserted into a 16 Mbps ring can beacon the ring down — an availability risk worth noting if you are asked to connect equipment.
• It is wired physically as a star into a MAU/MSAU (Multistation Access Unit) using IBM Type 1 shielded cabling and hermaphroditic IBM Data Connectors, or UTP with media filters. The ring exists logically inside the MAU.
• FDDI (Fiber Distributed Data Interface) applied the same token-passing idea to a 100 Mbps dual counter-rotating fibre ring, used for campus backbones.

The assessment relevance is that a ring is a shared medium: every frame transits every station's interface, so a station in promiscuous mode sees all traffic without any active attack.

---

5. Physical Topology vs Logical Topology

   BUS                STAR                 RING                  MESH
 ---+---+---+       +--[SW]--+          +--A--B--+          A ---- B
    |   |   |       |   |    |          |        |          | \  / |
    A   B   C       A   B    C          D        C          |  \/  |
                                         \------/           |  /\  |
                                                            D ---- C
 One collision    One collision       Token passing,     Redundant paths,
 domain, every    domain per port,    deterministic      no single point
 station hears    unicast switched    ordering           of failure
 everything

A network's physical topology (how the cable runs) and its logical topology (how frames actually flow) can differ. Token Ring is physically a star and logically a ring. Modern Ethernet is physically a star and logically a switched point-to-point fabric. 802.11 is physically a star around an access point but logically a shared broadcast medium — every associated station's radio receives every frame in the cell, which is precisely why WPA2-PSK offers no protection between clients that know the passphrase.

---

6. Shared Media vs Switched Media: What It Means for the Tester

This table is the whole point of syllabus item B2. When a scoping call tells you the client "has a flat network with a couple of old hubs in the plant room", that single sentence changes your attack plan from ARP spoofing to simply plugging in and listening.

---

7. Practical Checks During a Physical or Internal Assessment

• Trace the jack before you trust it. A live wall port in a reception area may land on a guest VLAN, a voice VLAN, or the corporate access layer. tcpdump -i eth0 -nn -e vlan will show 802.1Q tags and CDP/LLDP frames that identify the switch and port.
• Check for hubs and unmanaged switches. Cheap unmanaged switches under desks defeat port security and are a classic finding. A hub is even better for an attacker — and still turns up in lab and plant environments.
• Look at the patch panel labelling and the comms room. Unterminated fibre, unlocked cabinets, and console cables left plugged into routers are physical findings that belong in the report alongside the network ones.
• Record the media in your notes. Whether a segment was copper or fibre, shared or switched, is the evidence that justifies the risk rating you assign to a sniffing finding.