Skip to content
Study Hall
Lesson 4 of 4Networking
Unit 3 · Lesson 4 of 4

Network Devices, Cabling and Security

What each box in the rack actually does, how to terminate a cable correctly, and how to secure and troubleshoot the result.

5 min read9 practice questionsAsk AI about this →

Key things to remember

  1. 1Hub = layer 1, switch = layer 2 (MAC), router = layer 3 (IP).
  2. 2A switch learns MAC addresses from the source address of incoming frames, and floods when it does not know a destination.
  3. 3T568A and T568B differ only by swapping the orange and green pairs.
  4. 4Straight-through: same standard both ends. Crossover: A on one end, B on the other.
  5. 5Use WPA3, or WPA2 with AES. Never WEP.
  6. 6Hidden SSIDs and MAC filtering provide no meaningful security.
  7. 7Troubleshoot from layer 1 upward: cable, link light, IP address, gateway, internet, DNS.

Every networking device is defined by which layer it can read. That single fact tells you what it can and cannot do. A device that only reads layer 2 has no idea what an IP address is, so it can never route between networks. A device that reads layer 3 can. Work out the layer, and the capability follows.

The layer a device works at tells you what it can see.DEVICEOSI LAYERWHAT IT DOESHub1repeats every bit to every port — obsolete, collisionsSwitch2learns MAC addresses, sends a frame only to the right portRouter3joins different networks, chooses a path by IPAccess point1–2bridges Wi-Fi clients onto the wired LANFirewall3–7allows or blocks traffic against a rule setA home "router" is really four devices in one box: router, switch, access point and firewall.
Fig 1What a device can do follows from what it can read.
DeviceLayerWhat it doesWhy it matters
Hub1Repeats every incoming bit to every other portObsolete — everyone shares bandwidth and collisions occur
Switch2Learns which MAC address is on which port and forwards only thereEach port gets full bandwidth and traffic stays private
Router3Forwards between different networks using IPThe only device that can move traffic off your LAN
Access point1–2Bridges wireless clients onto the wired LANAdds Wi-Fi to an existing wired network
Firewall3–7Permits or blocks traffic against rulesThe boundary control between trusted and untrusted networks
Modem1Converts between digital data and the carrier's signalHow the LAN reaches the ISP
How a switch learns
A switch starts knowing nothing. When a frame arrives, it records the source MAC address against the port it came in on. If it already knows where the destination lives, it forwards only to that port; if not, it floods the frame to every port and learns from the reply. After a few seconds of traffic its MAC address table is complete and almost nothing needs flooding.

Terminating a cable

T568A and T568B differ only by swapping the orange and green pairs.T568AG/W1G2O/W3Bl4Bl/W5O6Br/W7Br8T568BO/W1O2G/W3Bl4Bl/W5G6Br/W7Br8Straight-throughsame standard on both endsPC → switch, switch → routerCrossoverA on one end, B on the otherPC → PC (auto-MDIX makes this rare now)Pin 1 is on the left with the clip facing away and the contacts toward you.
Fig 2T568A and T568B differ only by swapping the orange and green pairs.

An RJ-45 plug takes eight conductors in a fixed order. Two standards exist, T568A and T568B, and they differ only in swapping the orange and green pairs. Either works — what matters is being consistent. Both ends the same gives a straight-through cable, used for connecting unlike devices (computer to switch). One end A and the other B gives a crossover, historically needed for connecting like devices (computer to computer). Auto-MDIX on modern equipment detects and corrects the difference automatically, so crossover cables are now rarely needed, but you are still expected to know the wiring.

  1. Strip about 25 mm of the outer jacket without nicking the insulation on the conductors inside.
  2. Untwist each pair only as far as necessary — no more than about 13 mm, or interference rejection suffers.
  3. Arrange the eight conductors flat in the chosen standard's order, with pin 1 on the left when the clip faces away from you.
  4. Trim them square so all eight ends are exactly level.
  5. Slide them fully into the plug until each conductor is visible at the very tip, with the jacket inside the strain relief.
  6. Crimp firmly, then test with a cable tester — testing is the step that catches the fault before it is buried in a wall.

Wireless standards and security

StandardMarketing nameBandRealistic throughput
802.11nWi-Fi 42.4 / 5 GHzUp to ~150 Mb/s
802.11acWi-Fi 55 GHz400–900 Mb/s
802.11axWi-Fi 6 / 6E2.4 / 5 / 6 GHzHigher, and far better with many clients
AWireless encryption — use these
  • WPA3 — current standard, strongest
  • WPA2 with AES — still acceptable
  • A long passphrase, not a short complex one
BDo not use these
  • WEP — broken; crackable in minutes
  • WPA with TKIP — superseded and weak
  • An open network with no encryption
  • Hidden SSID or MAC filtering as your only defence — both are trivially bypassed
Security theatre
Hiding the SSID does not hide the network — client devices broadcast the name they are looking for, so it is visible to anyone watching. MAC filtering is defeated by cloning an observed MAC address, which takes one command. Both add administrative hassle and near-zero real security. Encryption and a strong passphrase are what actually protect a wireless network.
Every defence answers a specific threat.THREATWHAT IT ISDEFENCEMalware / viruscode that runs without consentpatched OS, antivirus, least privilegePhishinga fake message harvesting credentialscheck the sender domain; never click, type the URLRansomwareencrypts your files, demands paymentoffline backups you have actually restored fromMan-in-the-middletraffic read on an open Wi-FiHTTPS everywhere, VPN on public networksWeak / reused passwordone leak unlocks every accountlong passphrases, a manager, 2FAThe CIA triad names what you are protecting: Confidentiality, Integrity, Availability. Ransomware attacks all three at once.
Fig 3Each defence answers a specific threat.

Troubleshooting from the bottom up

The most efficient way to diagnose a network fault is to work up the OSI layers, because a failure at a lower layer makes everything above it fail too. Checking DNS first when the cable is unplugged wastes a lot of time.

CommandWhat it tells youLayer
ipconfig /all (Windows), ip addr (Linux)Your address, mask, gateway and DNS servers3
ping 127.0.0.1Your own TCP/IP stack is working3
ping <default gateway>You can reach your router — local network is fine3
ping 8.8.8.8You can reach the internet by IP3
nslookup example.comDNS resolution works7
tracert / tracerouteWhere along the path the failure occurs3
The single most useful diagnostic
If ping 8.8.8.8 succeeds but ping google.com fails, networking is completely fine and the problem is DNS. That one comparison separates a name-resolution problem from a connectivity problem in five seconds.

Worked examples

Reveal one step at a time and try to beat it to the next line.

Example 1
A user reports "the internet is down". Their laptop has an IP address from DHCP and can ping the router. Work through a diagnosis.
Example 2
A newly made patch cable gives no link light. The technician used T568B on one end and T568A on the other, connecting a laptop to a switch. Explain the problem and the fix.

Where marks get lost

  • Calling a home router just a router. It is a router, switch, access point, firewall and often a modem in one box.
  • Thinking a switch reads IP addresses. A plain layer 2 switch only sees MAC addresses.
  • Relying on a hidden SSID or MAC filtering for security. Both are bypassed trivially.
  • Starting troubleshooting at DNS. Check the physical link and IP configuration first.
  • Untwisting far too much cable when terminating, which destroys interference rejection and causes intermittent errors.
  • Leaving WEP or WPA/TKIP enabled on old equipment because "it still works". WEP can be broken in minutes.

Flashcards 10

What layer does a switch operate at, and what does it read?
How does a switch build its MAC address table?
What does a switch do with a frame for an unknown destination?
T568A vs. T568B
+ 6 more

Practice

1
Why does a switch provide better performance than a hub?
2
A laptop can ping 8.8.8.8 but cannot load any website by name. What service is failing?
3
A cable has T568B on both ends. What kind of cable is it?
4
Order these troubleshooting steps from lowest OSI layer to highest.
  1. 1Check the IP address and subnet mask with ipconfig
  2. 2Run nslookup to test DNS
  3. 3Ping the default gateway
  4. 4Check the cable is connected and the link light is on
5
Which wireless security measure provides essentially no real protection?
6
Match each device to the OSI layer it operates at.
Hub
Switch
Router
Application firewall
7
A switch receives a frame for a MAC address it has never seen. What does it do?
8
What is the purpose of the default gateway setting on a host?
9
Why must you avoid untwisting more than about 13 mm of each pair when terminating UTP?

Spot a mistake on this page? Let us know