Networking › Module 6 › Lesson 1
Switches, Hubs & MAC Addresses
How Layer 2 devices forward frames—and why MAC addresses matter for security
Opening
Inside your local network
Before packets reach the internet, they travel your LAN as Ethernet frames. Switches, hubs, and MAC addresses decide who talks to whom on the same cable segment. Analysts who understand Layer 2 can spot misconfigurations, rogue devices, and why some attacks stay "local."
1. MAC Addresses — Hardware Identity
A MAC (Media Access Control) address is a 48-bit hardware identifier burned into (or assigned to) a network interface. Format: six pairs of hex bytes, often written as AA:BB:CC:DD:EE:FF or AA-BB-CC-DD-EE-FF. The first three octets are typically the OUI (Organizationally Unique Identifier)—who made the NIC. IP addresses can change with DHCP. MAC addresses stick with the interface (unless spoofed)—so inventory and access control often key off MACs on a LAN.
2. Hubs vs Switches
Hub
Repeats every frame out every port. Everyone on the hub sees all traffic—easy sniffing, shared collision domain. Rare in modern networks.
Switch
Learns which MAC lives on which port and forwards frames only to that port (unicast). Cuts unnecessary noise and reduces casual eavesdropping.
Broadcasts
Broadcast frames (and unknown unicasts in some cases) still flood the switch—ARP requests are a common example.
3. Broadcast Domains (Briefly)
Devices that receive each other's broadcasts share a broadcast domain. A typical home LAN behind one router is one domain: phones, laptops, and printers can ARP each other. Routers (and VLAN-aware switches) split broadcast domains. Crossing to another network needs Layer 3—an IP route—not just a MAC.
4. Why MACs Matter for Security
Defenders use MAC lists for NAC, DHCP reservations, and detecting new devices on the wire. Attackers may spoof a trusted MAC to bypass weak filters—so MAC allowlists alone are not strong authentication. When investigating incidents: odd MACs on a port, duplicate MACs, or a MAC that suddenly moves switch ports are red flags.
Knowledge Check
A MAC address is best described as:
Multiple choice
Knowledge Check
Compared to a hub, a modern switch usually:
Multiple choice
Knowledge Check
True or False: Relying only on MAC allowlists is weak because MAC addresses can be spoofed.
True or False