7.3 Routing & Switching Basics

Once you know ports and name services, you still need the "plumbing" that moves frames and packets across a LAN and out to other networks. The Cyber Test expects clear mental models for switching (Layer 2), routing (Layer 3), ARP, and the default gateway.

Layer 2 vs Layer 3: The Core Distinction

Switch mental model: Learn which MAC addresses live on which ports. When a frame arrives, look up the destination MAC and forward out the matching port (or flood if unknown).

Router mental model: Learn which IP prefixes live behind which interfaces or next hops. When a packet arrives, strip/rewrite L2 as needed, decrement TTL, and forward toward the best matching route.

Many modern "Layer 3 switches" do both: hardware switching inside a VLAN and routing between VLANs. Conceptually keep the jobs separate even when one chassis performs both.

---

How a Frame Crosses a Switch

1. Host A wants to send to Host B on the same VLAN/subnet.
2. Host A already has (or obtains via ARP) Host B's MAC address.
3. Host A builds an Ethernet frame: dest MAC = B, src MAC = A, ethertype for IPv4/IPv6, payload = IP packet.
4. The switch receives the frame, updates its MAC table with A's address on the ingress port, and forwards toward B's port.
5. Host B accepts the frame because the destination MAC matches.

If the destination MAC is unknown, the switch floods the frame out other ports in the VLAN (except the source port). That is normal learning behavior — not the same as a router forwarding a broadcast to another network.

Broadcast Domain Reminder

All ports in the same VLAN share a broadcast domain. ARP requests are broadcasts. Too many hosts in one VLAN means more broadcast noise. VLANs split one physical switch fabric into multiple logical L2 segments; routing is required to communicate between those segments.

---

ARP: Bridging IP and Ethernet

IP addresses live at Layer 3. Ethernet delivers frames using MACs at Layer 2. ARP (Address Resolution Protocol) answers: "What MAC address is using this IPv4 address on my local link?"

ARP Exchange (IPv4)

1. Host A needs to send a packet to IPv4 address X on the local subnet.
2. A checks its ARP cache. If a mapping exists and is fresh, use it.
3. Otherwise A broadcasts an ARP Request: "Who has X? Tell A."
4. The owner of X unicasts an ARP Reply with its MAC address.
5. A caches the mapping and can now build the Ethernet frame.

Critical exam point: ARP resolves addresses on the local link. If the destination IP is on another subnet, A does not ARP for the remote IP. Instead, A ARPs for the default gateway's IP, then sends the frame to the gateway's MAC while the IP packet still carries the remote destination IP.

(IPv6 uses Neighbor Discovery instead of ARP; know ARP solidly for IPv4-centric CT items.)

---

Default Gateway: The Door Out of Your Subnet

Every host with a normal IPv4 configuration needs:

• Its own IP address
• A subnet mask / prefix (defines "local" vs "remote")
• A default gateway — usually the LAN interface of the local router
• Often DNS servers (via DHCP)

Same Subnet vs Different Subnet Decision

Host logic (simplified):

1. Apply the subnet mask to my IP and to the destination IP.
2. Same network? Deliver locally — ARP for the destination, frame to that MAC.
3. Different network? Deliver to the gateway — ARP for the gateway, frame to the gateway MAC; IP destination remains the remote host.

If the default gateway is wrong or unreachable, local same-subnet communication may still work while Internet and other-subnet access fails. That symptom pattern is gold on troubleshooting questions.

---

Routing Basics

A router maintains a routing table: destination prefixes mapped to next hops or exit interfaces. When a packet arrives:

1. Find the longest-prefix match for the destination IP.
2. Forward out the chosen interface toward the next hop.
3. Build a new L2 frame appropriate for the next link (new dest MAC, often via ARP on Ethernet).
4. Decrement TTL (IPv4) / hop limit (IPv6); drop if it hits zero (loop protection).

Connected, Static, and Default Routes (Conceptual)

• Connected: Prefixes of networks directly attached to the router.
• Static: Manually configured paths (common for small sites).
• Default route (0.0.0.0/0): "If nothing more specific matches, send it here" — how edge routers reach the Internet.

You do not need to configure OSPF/BGP for the Cyber Test, but you should recognize that dynamic protocols exist to exchange routes automatically in larger networks.

---

End-to-End Story: Laptop to Website

Put the pieces together:

1. Laptop obtains IP, mask, gateway, and DNS via DHCP (DORA).
2. User enters a hostname; DNS returns an IP.
3. Laptop compares destination IP to its subnet — usually remote.
4. Laptop ARPs for the default gateway, not for the remote web server.
5. Frame goes to the local switch, which forwards to the gateway port by MAC.
6. Router receives the packet, routes toward the ISP/next hop, rewriting L2 each hop.
7. Remote server accepts the TCP handshake on port 443 and serves HTTPS.

Each failure point produces a different clue: DHCP → no usable IP; DNS → names fail; ARP/gateway → no off-subnet path; routing → black holes beyond the LAN; TCP/port → service filtered or down.

---

Common Exam Traps

• Claiming switches route between IP subnets — routers (or L3 functions) do that.
• Saying ARP finds MAC addresses for remote Internet hosts — ARP is local-link only.
• Mixing up gateway IP with DNS server IP — both are important; they solve different problems.
• Assuming VLANs alone provide routing — VLANs separate; routing connects.
• Forgetting TTL's role in killing loops.

---

Quick Comparison Checklist

Before the next chapter, confirm you can explain in one sentence each:

• What a switch does with a known vs unknown destination MAC
• Why ARP exists and when a host ARPs for the gateway instead of the destination
• What "default gateway" means operationally
• Why two hosts in different VLANs/subnets need a router to converse
• How L2 and L3 addressing appear together in a single outbound frame/packet pair

Master these basics and later security topics (segmentation, lateral movement paths, firewall placement) become much easier to reason about.