Switches, routers, IP addresses, MAC addresses, and ARP — the fundamental building blocks that make every network tick.
A LAN (Local Area Network) is a network that connects devices within a limited physical area — like an office, a home, or a school building. When you connect your laptop to your home Wi-Fi, you're joining a LAN. All the devices on your LAN can communicate directly with each other at high speed (typically 1 Gbps over Ethernet).
Real-world analogy: Think of a LAN like an apartment building. Each apartment (device) has a mailbox number (MAC address) and an apartment number (IP address). The building's front desk (switch) routes packages within the building. The building's exit (router/default gateway) connects to the city's mail system (the internet).
Understanding LANs is foundational to all of cybersecurity. Most attacks — ARP spoofing, DHCP starvation, VLAN hopping, Man-in-the-Middle — happen at the LAN level. If you don't understand how devices find and talk to each other locally, you can't understand how those attacks work or how to defend against them.
AA:BB:CC:11:22:33). The first 3 bytes
(OUI) identify the manufacturer (e.g., Apple, Intel). Think of it as the permanent name tag
on your network card. Used by switches to forward frames within the local network. MAC
addresses can be spoofed in software.192.168.1.10) divided into a network
portion and a host portion. Unlike MAC addresses, IPs are assigned dynamically by DHCP or manually (static). Used by
routers at Layer 3 to route between networks.255.255.255.0 (or /24) means the first 24 bits are the
network, leaving 8 bits for 254 usable hosts. If two devices share the same network portion,
they're on the same subnet and can communicate directly..1, like 192.168.1.1). When you want to
reach something outside your network (like google.com), your device sends the packet to the
default gateway, which forwards it onward. Without a gateway, you're stuck on your local
network.When you connect to a network, you need an IP address, a subnet mask, a default gateway, and a DNS server. Instead of configuring all this manually, DHCP automates the process. Here's the 4-step "DORA" process:
Your device broadcasts: "Is there a DHCP server? I need an IP!"
DHCP server replies: "I can offer you 192.168.1.50 for 24 hours."
Your device broadcasts: "I'll take 192.168.1.50, please."
Server confirms: "Done! Your IP is 192.168.1.50, gateway is .1, DNS is .1."
ARP solves a critical problem: your device knows the IP address it wants to reach, but the switch only understands MAC addresses. ARP translates between the two. Here's how it works step by step:
FF:FF:FF:FF:FF:FF
(every device on the subnet): "Who has 192.168.1.20? Tell 192.168.1.10."Subnetting is the process of dividing a network into smaller sub-networks. It's one of the most tested topics in networking and security certifications. Let's walk through a real example:
Why subnetting matters for security: Subnetting creates network boundaries. Devices on different subnets can't communicate without a router, which means you can apply firewall rules at subnet boundaries. A well-subnetted network with proper access controls can contain a breach to a single subnet instead of the entire network.
RFC 1918 defines three IP ranges reserved for private (internal) use. These addresses are not routable on the internet — your router uses NAT to translate them to your public IP when traffic leaves the network. If you see any of these ranges on the internet, something is misconfigured.
| Class | Range | CIDR | Hosts | Typical Use |
|---|---|---|---|---|
| A | 10.0.0.0 — 10.255.255.255 | 10.0.0.0/8 | 16.7M | Enterprise / Cloud |
| B | 172.16.0.0 — 172.31.255.255 | 172.16.0.0/12 | 1M | Medium Networks |
| C | 192.168.0.0 — 192.168.255.255 | 192.168.0.0/16 | 65K | Home / Small Office |
Every piece of data sent on a LAN is wrapped in an Ethernet frame. The frame has a strict structure — the switch reads the destination MAC to decide where to forward it, and the FCS at the end verifies the data wasn't corrupted in transit:
VLANs logically segment a physical switch into multiple isolated broadcast domains. Even if devices are plugged into the same physical switch, they can be placed on different VLANs and treated as if they were on completely separate networks.
Managed switches provide several security features that are essential for securing a LAN:
Limits the number of MAC addresses allowed on a port. If an attacker tries MAC flooding (sending thousands of fake MACs to overflow the CAM table), port security shuts down the port.
Builds a trusted table of legitimate DHCP transactions. Prevents rogue DHCP servers from handing out malicious configurations. Only the port connected to the real DHCP server is marked as "trusted."
Uses the DHCP snooping database to validate ARP packets. If an ARP reply doesn't match the known IP→MAC mapping, it's dropped — blocking ARP spoofing attacks.
Requires authentication before a device is granted network access. The device must present valid credentials (usually via RADIUS) before the switch port is activated. This prevents unauthorized devices from connecting to the LAN.
Click on any device to see its configuration. Hit "Send ARP" to watch an ARP request/reply flow.
All certification names are referenced for educational purposes only. This project is not affiliated with any certification body.