To defend or analyze a digital environment, a security engineer must first understand how computers interconnect, transmit raw bits across physical media, and form communication topologies.
1. What is a Computer Network?
A computer network is a collection of two or more autonomous computing devices (endpoints, servers, network appliances) connected by communication channels to share data, services, and hardware resources.
From a cybersecurity perspective, the network is the primary attack vector. Adversaries exploit network communication channels for initial access, command-and-control (C2), lateral movement, and data exfiltration.
Circuit Switching (legacy telephone networks) establishes a dedicated physical path between two nodes for the entire duration of a session. If a link fails, the call drops.
Packet Switching (modern IP networks) breaks data into discrete units called packets. Each packet contains source and destination addressing and is routed independently across intermediate nodes. This provides fault tolerance, dynamic rerouting, and optimal bandwidth utilization.
2. Network Geographic Classifications
Networks are classified according to their physical and operational scale:
- PAN (Personal Area Network): Covers an individual's workspace (e.g., Bluetooth, USB peripherals, ~10m range).
- LAN (Local Area Network): Covers a single room, office, or building. Characterized by high data transfer rates (1 Gbps to 100 Gbps) and single administrative control.
- WLAN (Wireless LAN): A LAN based on IEEE 802.11 Wi-Fi standards. Vulnerable to passive radio eavesdropping and rogue access points.
- MAN (Metropolitan Area Network): Spans a city or university campus, connecting multiple LANs over fiber rings.
- WAN (Wide Area Network): Connects geographically dispersed sites across countries or continents. The Internet is the world's largest WAN.
3. Network Topologies
A network topology defines how devices are arranged and connected, both physically (cabling layout) and logically (how data flows).
| Topology | Architecture & Operation | Security & Reliability Implications |
|---|---|---|
| Star Topology | All endpoints connect directly to a central hub or switch. Most common in modern Ethernet LANs. | Single point of failure at the central switch. However, a single host cable failure does not disrupt other nodes. Easy to monitor traffic via switch port mirroring (SPAN). |
| Mesh Topology (Full / Partial) | Every node connects to every other node (Full Mesh: n(n-1)/2 links) or multiple redundant nodes (Partial). |
Maximum fault tolerance and redundancy. Used in core ISP backbones and critical datacenter fabrics. Expensive and complex to cable physically. |
| Bus Topology | All devices tap into a single shared backbone cable terminated at both ends. | Legacy architecture. If the main trunk breaks, the entire segment fails. High collision rates. Promiscuous sniffing allows any node to capture all unencrypted packets. |
| Ring Topology | Each device connects to exactly two neighbors, passing tokens sequentially (e.g., Token Ring, FDDI). | Predictable latency, but a single link failure historically broke the ring unless dual counter-rotating rings were used. |
Attacker: Explores flat star topologies where workstations and sensitive servers reside in the same broadcast domain without internal segmentation. Once inside, an attacker moves laterally without encountering firewalls.
Defender: Implements Microsegmentation and Zero Trust Architecture. Never assumes internal network trust. Enforces Layer 3/Layer 4 access control lists (ACLs) and stateful inspection between disparate business zones.
4. Core Network Hardware Devices
Understanding the operational boundary of networking hardware is essential for incident response and packet capture:
Hub / Repeater
A dumb Layer 1 multiport repeater. When a signal arrives on one port, it is broadcast to every other port. Creates a single shared Collision Domain and broadcast domain. Highly insecure.
Network Switch
Intelligent Layer 2 device that inspects source MAC addresses to build a MAC Address Table (CAM). Forwards frames only to the specific destination port. Breaks collision domains into per-port dedicated links.
Router
Layer 3 device that inspects destination IP addresses and consults its Routing Table to forward packets between disparate subnets and networks. Routers do not forward Layer 2 broadcasts by default, dividing Broadcast Domains.
- Collision Domain: A network segment where simultaneous transmissions from two devices will collide and corrupt data (e.g., all ports on a legacy Hub, or a shared Wi-Fi channel). Switches eliminate collision domains on full-duplex Ethernet ports.
-
Broadcast Domain: The set of all devices that receive a broadcast frame (MAC
FF:FF:FF:FF:FF:FF) sent by any member node. Routers and Layer 3 switches break broadcast domains.
5. Bandwidth, Throughput, Latency, and Jitter
When diagnosing network anomalies or detecting Denial-of-Service (DoS) attacks, security analysts measure key performance metrics:
- Bandwidth: The theoretical maximum data carrying capacity of a link (e.g., 10 Gbps Ethernet).
- Throughput: The actual rate of successful data delivery over the channel (often reduced by protocol overhead, congestion, and packet drops).
- Latency (Round-Trip Time / RTT): The total time taken for a packet to travel from source to destination and return.
- Jitter: The statistical variance in packet arrival latency. High jitter degrades real-time protocols such as VoIP and video streaming.