Network Security Fundamentals [Electronic resources] نسخه متنی

Switches and Hubs

This section concentrates on switches and hubs. Many other networking devices are available, but switches and hubs are used here as an example of the network security design process. (Other devices are covered in other chapters.)

Bridged networks, with thousands of users connected, used to be large and flat (having no hierarchy), but that kind of network has almost disappeared. With the introduction of routers and switches, networks are subnetted (divided into subnets) into manageable sizes to limit broadcast domains and to manage functional workgroups. Newer, multilayer switches perform routing and other high-level security network functions at speeds formerly attainable only with large switched networks. Before delving into some of the available security features on switches that need to be considered when designing a network, you should understand the basics of hubs and switches.

Both hubs and switches are networking devices used to interconnect workstations and servers. Externally they look similar, although from an operational standpoint some remarkable differences do exist.

Hubs share all available bandwidth among all connected devices, meaning that they distribute all the data received on one port to all the network devices they are connected to on the other ports. This is a highly inefficient use of network bandwidth. However, minimum processing delay is an advantage.

Switches, on the other hand, are smarter devices. Traffic-flow decisions are made based on tables. Traffic is analyzed and forwarding decisions are made using destination addresses. Only one port receives the traffic. The tables (containing MAC addresses) are populated by the switch, which knows each host and which port it resides on, with the exception of broadcasts.

Because of the simplicity of hubs and their limited feature set, they don't need to be discussed in depth here. This section concentrates only on switches and covers some of the added security features in these devices that can counter most attacks. Table 6-1 lists some of the features and mitigation techniques.

Table 6-1 is just an example of some of the security features available on the current switches. Network security engineers can configure a rich set of switching security features to control security threats from their inception, wherever they occur in the network.