Networking › Module 6 › Lesson 1
Switches, Hubs & MAC Addresses
How Layer 2 devices forward frames—and why MAC addresses matter for security
Opening
Frames do not magically pick a cable
Before IP routing and NAT, your packet is an Ethernet (or Wi-Fi) frame on a local link. The destination field that matters on that cable is a MAC address — a 48-bit Layer 2 label, usually written AA:BB:CC:DD:EE:FF. A hub and a switch both have many ports. They do not forward the same way. That difference is why a shared hub (or an open Wi-Fi BSS) is a sniffing risk, and why switched Ethernet is quieter for casual eavesdropping — not because MACs are passwords. Carry Topic 2: a MAC is a label. It is spoofable. It is not identity. This lesson is how frames move on a LAN you own, and how to read your own NIC's MAC. You will not flood CAM tables. You will not scan other people's LANs.
1. Hub floods vs switch CAM table
A hub is a multi-port repeater. It copies every incoming frame out every other port. Collision domain is shared: two talkers at once collide. Every station that can hear the wire sees every unicast — including passwords on old cleartext protocols. Hubs are rare in 2026 closets, but the mental model still matters: "everyone on the segment sees everything." A switch learns. Each frame's source MAC is recorded against the ingress port in a CAM/MAC address table (Content Addressable Memory). When a later frame arrives destined to that MAC, the switch forwards it only out the learned port — not out every port. Unknown unicasts (destination MAC not yet learned) and broadcasts (ff:ff:ff:ff:ff:ff) still flood the VLAN. ARP requests are broadcasts; that is why they are visible to every station in the broadcast domain. Wi-Fi is not a magic switch. A typical BSS is a shared medium at radio: clients can often hear each other's frames unless isolation features exist. That is why "I am on switched Ethernet at home" and "I am on café Wi-Fi" are different sniffing stories even if both use IP and NAT. Managed switches add VLANs to split broadcast domains. Crossing VLANs needs Layer 3 (a router) — a MAC alone cannot jump the boundary.
2. MAC is an L2 label — not a login
Format: six octets. The first three are often an OUI (vendor). "Burned in" is marketing; most NICs let the driver set a different MAC. IP (Layer 3) can change with DHCP. MAC (Layer 2) sticks to the interface until someone changes it. Inventory systems key off MACs because they are stable enough to be useful — and unstable enough to be forged. MAC filtering on a guest AP is a speed bump: an attacker who can see a allowed MAC can copy it. It is not MFA, not SSH keys, not 802.1X. Duplicate MACs on a LAN cause flapping tables and outages. A MAC that suddenly moves switch ports can be a laptop that walked — or a cloned NIC. Defenders note the pair (port, MAC, last IP from ARP/DHCP) as inventory. They do not treat the hex string as proof of a person. Practical read: ip link show on YOUR NIC. Look for link/ether. That is the label the switch CAM would learn if this iface is plugged into a switch you own. You do not send crafted floods to fill a CAM table until it fails open like a hub. That is a denial-of-service technique, not a Cyberlium lab.
3. Wrong vs right: MAC as identity, hub as switch, flood as lab
Worked failure mode — Layer 2 myths. Stay on your VM/WSL. Read your own MAC. Do not MAC-flood a school or office switch.
Wrong
You treat a MAC allow-list as authentication. Or you assume a modern switch still floods all unicasts like a hub, so you capture "the whole office" from one port. Or you run a MAC-flood / CAM-overflow tool against a shared switch "to see hub behavior." That is an attack on availability, not a reading exercise.
Right
ip link show on your machine; record link/ether vs inet from ip addr — label vs Layer 3 address. Expect unicast on a healthy switch to stay on the destination port; expect broadcasts (ARP) to flood the VLAN. Treat shared Wi-Fi / leftover hubs as higher sniffing risk than switched Ethernet. Never flood, never spoof someone else's MAC on a network you do not own.
4. Practical: read the MAC on your own NIC
Inventory only. You are not changing the MAC, not bridging into another LAN, not flooding. If you have several ifaces (lo, eth0, wlan0, tun0), ignore lo — loopback has no Ethernet MAC in the usual sense.
Command guide
ip link — YOUR MAC, not a flood
Layer-2 state and MAC on THIS machine
Command — copy this
ip link show ip -br link
Optional command
Read: iface name, state UP/DOWN, link/ether aa:bb:cc:dd:ee:ff
Compare with Layer 3:
Command — copy this
ip -br addr
inet is NOT the MAC. Different layers, different jobs.
Optional: one iface only (pick YOUR NIC name)
Optional command
ip link show eth0 ip link show ens33 ip link show wlan0
Windows (your PC): Get-NetAdapter | Format-Table Name, MacAddress, Status or ipconfig /all → Physical Address
NEVER: MAC-flood / CAM overflow / "fail-open the switch" NEVER: change another host's MAC or spoof a gateway NEVER: scan the LAN for other people's MACs as a sport This is YOUR label, on YOUR NIC.
Mission: MAC vs IP on your own iface
On your VM or WSL, run ip link show and ip -br addr. Write three lines: (1) your non-lo iface name and link/ether MAC, (2) that iface's inet CIDR, (3) one sentence on why a switch CAM cares about (1) while a router cares about (2) — and why the MAC is not proof of identity. Do not change the MAC. Do not flood. Own machine only.
Stuck? Ask Cyberlium AI Mentor
If lo vs eth0 still look the same, ask Cyberlium AI Mentor for a hint — not a script that floods a switch. Try: "Hint only: ip -br link shows lo and ens33 — which line has link/ether, and why is that MAC not a password?"
You can now contrast hub flood vs switch CAM, treat MAC as a spoofable L2 label, and explain why shared media sniffing differs from switched unicast. Next — ARP — Finding Neighbors on a LAN — how a host that only knows an IP learns the MAC it must put on the frame, and how defenders notice when that mapping lies.
Knowledge Check
APPLY: Host A sends a unicast frame to Host B's MAC on a healthy switch that already learned B on port 4. What should the switch do, compared to a hub?
Multiple choice
Knowledge Check
APPLY: A café Wi-Fi allow-list uses your laptop MAC as "the password." Why is that weak compared to WPA3/802.1X, given Topic 2's MAC lesson?
Multiple choice
Knowledge Check
APPLY: True or False: Running a MAC-flood against a shared office switch is an acceptable Cyberlium lab because "then it behaves like a hub."
True or False