3.1 What Networks, Routers, Switches, and Wi-Fi Do
What a network actually provides
A network makes two promises: a way to name a device, and a way to hand bytes to that name. On a home or office LAN both promises are layered. Every frame pushed onto the cable or radio carries a 48-bit hardware address such as 3c:22:fb:1a:04:91, while the packet inside that frame carries a logical address such as 192.168.1.11. The hardware address only has to be valid on the local segment; the IP address is what survives the entire trip to a web server. Understanding which device consumes which header is the fastest way to reason about where an attacker can even see your traffic.
Switches distribute frames inside one network
A switch is a small layer 2 computer running a learning table. When 192.168.1.11 sends a frame to 192.168.1.12, the switch notes "source MAC seen on port 1" and forwards the frame only out of the port where .12 was last learned. An unknown destination is flooded to every port, which is exactly why an ARP request like who-has 192.168.1.1 is heard by all hosts. Two security consequences follow. A switch confines unicast traffic, so passive sniffing on another port is no longer trivial, but it does not confine broadcasts, so any device plugged into the LAN still observes ARP, mDNS, and LLMNR chatter. Managed switches shrink that blast radius with VLANs, for example VLAN 10 for staff and VLAN 20 for guests, each its own broadcast domain.
Routers join networks and enforce boundaries
A router has at least two interfaces and a routing table, so it is the device your hosts name as their default gateway, typically 192.168.1.1. It decrements the TTL on each hop, rewrites source and destination MAC addresses at every segment, and in a home setting performs NAPT: an internal socket 192.168.1.11:49152 becomes 203.0.113.7:1024 on the WAN side, with a translation entry mapping replies back. Because every outbound packet passes through it, the router is also where the stateful firewall, DHCP server, and local DNS resolver live, which makes its administration interface the highest-value target on the network.
Wi-Fi is a shared, half-duplex medium
An access point bridges wireless clients onto the same switch fabric. The SSID home-5G is a human label; the BSSID is the real MAC of the radio. Management frames are sent in the clear, so probe requests leak nearby SSIDs regardless of any password. Data confidentiality comes from WPA2 or WPA3-SAE key agreement, while throughput drops with distance because the medium is half-duplex and contention-based: on 2.4 GHz only channels 1, 6, and 11 do not overlap.
Architecture Diagram
Key Takeaways
- MAC addresses matter on one segment; IP addresses matter end to end.
- A switch learns MAC-to-port mappings and floods unknown or broadcast frames.
- A router is the default gateway, TTL decrementer, NAT box, and de facto firewall.
- An access point bridges radios into the switch fabric; SSID is a label, BSSID is the address.
- Wireless management frames are unencrypted, so SSIDs leak even with strong passphrases.