LAN — Local Area Networks

A Local Area Network (LAN) is a group of devices connected together within a limited geographic area — a home, office, school, or data centre floor. Everything you do on the internet first crosses your LAN before reaching the wider world.

Understanding LANs is foundational for security work because most internal attacks happen at Layer 2 — the Ethernet/WiFi layer — before any IP packet is even inspected.

LAN Topologies

A topology describes how devices are physically and logically connected. Topology choice affects performance, fault tolerance, and security exposure.

Star Topology

   Device A
      |
   [Switch]──── Device B
      |
   Device C

• Every device connects directly to a central switch.
• Advantage: One cable failure isolates only that device.
• Disadvantage: The switch is a single point of failure — if it goes down, the whole network goes down.
• Security implication: Traffic between two devices passes through the switch, which filters frames by MAC address. Passive sniffing from another port is prevented unless the attacker uses ARP spoofing or MAC flooding.

Bus Topology

Device A ── Device B ── Device C ── Device D
            (shared backbone)

• All devices share a single cable (the bus/backbone).
• Legacy — mostly replaced by star topology.
• Security risk: Every device sees every packet. A compromised device can passively capture all LAN traffic without sending a single packet — completely invisible to detection.

Ring Topology

Device A ──► Device B
  ▲                ▼
Device D ◄── Device C

• Data travels in one direction around a loop using token passing — only the device holding the token can transmit.
• Advantage: No collisions.
• Disadvantage: One failure breaks the ring unless dual-ring redundancy (FDDI) is used.
• Security implication: Token capture could theoretically deny others the ability to transmit.

Mesh Topology

• Every device connects directly to every other device.
• Full mesh: Maximum redundancy, extreme cabling cost.
• Partial mesh: Used in backbone networks (e.g. between routers).
• Security benefit: No single point of failure.

Ethernet Frames

Ethernet is the Layer 2 protocol that carries data across a LAN. Every packet on a wired LAN is wrapped in an Ethernet frame.

Frame Structure

┌──────────────┬──────────────┬──────┬──────────────────────┬─────┐
│ Dest MAC (6) │ Src MAC (6)  │ Type │ Payload (46–1500 B)  │ FCS │
│    bytes     │    bytes     │ (2B) │                      │ (4B)│
└──────────────┴──────────────┴──────┴──────────────────────┴─────┘

MAC Addresses

A MAC (Media Access Control) address is a 48-bit hardware identifier burned into every NIC.

00:1A:2B:3C:4D:5E
└──────┘ └────────┘
 OUI       Device ID
(vendor)

• The first 3 bytes identify the manufacturer (OUI — Organisationally Unique Identifier).
• You can look up any OUI at ieee.org/regauth.
• MAC addresses operate at Layer 2 and are not routed across networks.
• Attackers can spoof MAC addresses in software — they are not a reliable authentication mechanism.

How a Switch Learns MACs

1. Device A sends a frame
2. Switch records: Port 1 → MAC of Device A  (learning)
3. Switch looks up destination MAC in CAM table
4. If found → forward only to that port  (unicast forwarding)
5. If not found → flood to all ports     (unknown unicast flood)

The CAM table (Content Addressable Memory) is the switch's MAC-to-port lookup table. Understanding it is essential for understanding MAC flooding attacks.

WiFi — 802.11 Standards

WiFi is the wireless extension of Ethernet at Layer 2. The 802.11 standard family defines how wireless devices communicate.

Standards Overview

Frequency Bands

2.4 GHz:
- Longer range, better wall penetration.
- Only 3 non-overlapping channels (1, 6, 11).
- Crowded — used by microwaves, Bluetooth, baby monitors.
- Higher interference risk.

5 GHz:
- Shorter range, faster speeds.
- 23 non-overlapping channels.
- Less congested.

6 GHz (WiFi 6E):
- New band, fewest devices, lowest interference.
- Best performance in dense environments.

WiFi Security Protocols

WEP can be cracked in minutes with aircrack-ng — it is cryptographically broken.
WPA2 with a weak passphrase is vulnerable to offline dictionary attacks after capturing a 4-way handshake.
WPA3 uses SAE (Simultaneous Authentication of Equals) — resistant to offline dictionary attacks.

LAN Security Threats

ARP Spoofing (ARP Poisoning)

ARP has no authentication — any device can send a fake ARP reply.

Attack flow:
1. Attacker sends fake ARP reply: "192.168.1.1 is at MY-MAC"
2. Victim updates ARP cache: 192.168.1.1 → Attacker MAC
3. All traffic to 192.168.1.1 now goes to attacker first
4. Attacker forwards it on → Man-in-the-Middle (MitM)

Tool: arpspoof, ettercap, bettercap

Defence:
- Dynamic ARP Inspection (DAI) on managed switches.
- Static ARP entries for critical hosts.
- Network monitoring for duplicate MAC addresses.

MAC Flooding

Attack flow:
1. Attacker floods switch with frames using random fake MACs
2. CAM table fills up (runs out of memory)
3. Switch fails open → behaves like a hub
4. All frames broadcast to all ports
5. Attacker captures all LAN traffic passively

Tool: macof (part of dsniff)

Defence:
- Port security — limit MAC addresses per switch port.
- 802.1X authentication — require authentication before a port activates.

Passive Sniffing

On a hub or bus network (or after a MAC flood), an attacker captures all traffic without transmitting a single packet.

# Capture all frames on interface eth0
tcpdump -i eth0 -nn
wireshark -i eth0

Defence: Use switches (not hubs), encrypt all traffic (TLS/VPN), use 802.1X.

Evil Twin (Rogue Access Point)

An attacker sets up a WiFi AP with the same SSID as a legitimate network. Devices auto-connect to the strongest signal.

Legitimate AP: "OfficeWifi" ──── Internet
Evil Twin AP:  "OfficeWifi" ──── Attacker's machine ──── Internet (inspected)

Defence: Certificate-based authentication (802.1X with EAP-TLS), monitor for rogue APs.

Key Takeaways

• LAN topology determines attack surface — bus networks are trivially sniffable.
• Ethernet frames carry MAC addresses that can be spoofed; never rely on MAC for authentication.
• Switches are smarter than hubs but the CAM table is exploitable via MAC flooding.
• WEP is dead — always use WPA2 or WPA3.
• ARP has no security built in — DAI and monitoring are essential on managed networks.
• Layer 2 attacks are stealthy — they operate below IP, making detection harder.

"Most enterprise breaches start on the LAN. A compromised workstation on the same switch as a server is extremely dangerous." — Common pentester observation.