By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Hubs, Switches, and Routers

Network infrastructure relies on three primary devices: hubs, switches, and routers. Each operates at different layers of the OSI model and serves distinct purposes. Understanding these devices is essential for network design, troubleshooting, and security assessment. As a pentester, knowing how traffic flows through these devices helps you understand network architecture and plan attacks.

What You'll Learn

  • What hubs, switches, and routers are
  • OSI layers where each device operates
  • How each device forwards traffic
  • Differences between the three devices
  • Security implications of each
  • When to use each device
  • Attacks targeting network devices

Overview

Device    OSI Layer    Function                Intelligence
────────────────────────────────────────────────────────────
Hub       Layer 1      Repeats signal          Dumb
Switch    Layer 2      Forwards by MAC         Smart
Router    Layer 3      Routes by IP            Smartest

Hubs (Layer 1)

A hub is the simplest network device. It operates at the Physical Layer (Layer 1).

How Hubs Work:

Hub receives signal → Repeats to ALL ports

Example:
PC1 sends to PC2

Hub:
┌───────────┐
│    HUB    │
├───┬───┬───┤
│   │   │   │
PC1 PC2 PC3 PC4

PC1 sends packet → Hub sends to PC2, PC3, PC4
Everyone receives it!
Only PC2 processes it (correct MAC)
PC3 and PC4 ignore it

Characteristics:

✗ No intelligence
✗ No filtering
✗ No MAC address table
✗ Broadcasts everything
✗ Half-duplex (collisions possible)
✗ Shared bandwidth
✗ Single collision domain

Visual:

PC1 → Hub → [Broadcast to all ports]
              ├→ PC2 ✓ (destination)
              ├→ PC3 ✗ (wrong MAC, ignores)
              └→ PC4 ✗ (wrong MAC, ignores)

Security Implications:

Huge security problem!

✗ All traffic visible to all devices
✗ Easy packet sniffing with Wireshark
✗ No privacy
✗ No security

If attacker on network:
Can see EVERYONE's traffic!

When Hubs Were Used:

1980s-1990s: Common
2000s: Mostly replaced by switches
Today: Essentially obsolete

Why obsolete:

  • Inefficient (wasted bandwidth)
  • Slow (collisions, shared bandwidth)
  • Insecure (no privacy)
  • Cheap switches replaced them

Switches (Layer 2)

A switch operates at the Data Link Layer (Layer 2). It's intelligent—learns MAC addresses and forwards traffic only to the correct port.

How Switches Work:

1. Switch receives frame
2. Looks at destination MAC address
3. Checks MAC address table
4. Forwards ONLY to correct port

MAC Address Table (CAM Table):

Port    MAC Address
────────────────────────
1       AA:BB:CC:DD:EE:01
2       AA:BB:CC:DD:EE:02
3       AA:BB:CC:DD:EE:03
4       AA:BB:CC:DD:EE:04

Learning Process:

Step 1: Switch starts with empty MAC table
Step 2: PC1 (MAC: AA:BB:CC:DD:EE:01) sends packet
Step 3: Switch learns "PC1 is on Port 1"
Step 4: Switch adds to MAC table:
        Port 1 → AA:BB:CC:DD:EE:01

Forwarding Example:

PC1 (Port 1) sends to PC3 (Port 3)

Switch:
1. Receives frame on Port 1
2. Source MAC: AA:BB:CC:DD:EE:01 → Update table
3. Destination MAC: AA:BB:CC:DD:EE:03
4. Looks up table: Port 3
5. Forwards ONLY to Port 3

┌───────────┐
│  SWITCH   │
├───┬───┬───┤
│   │   │   │
PC1 PC2 PC3 PC4
 │       │
 └───✓───┘
     Only PC3 receives it!

Unknown Destination:

If MAC not in table:
→ Floods to all ports (like a hub)
→ Learns when destination replies
→ Next time: forwards directly

Broadcast Traffic:

Destination MAC: FF:FF:FF:FF:FF:FF
→ Switch floods to all ports
→ Everyone receives (intended behavior)

Examples:
- ARP requests
- DHCP Discover
- NetBIOS broadcasts

Characteristics:

✓ Intelligent (learns MACs)
✓ Filters traffic (only to destination)
✓ Full-duplex (no collisions)
✓ Dedicated bandwidth per port
✓ Separate collision domains
✓ Same broadcast domain
✓ Fast (hardware switching)

Types of Switches:

Unmanaged Switch:

- Plug and play
- No configuration
- No VLAN support
- Cheap
- Home/small office

Managed Switch:

- Configurable
- VLANs supported
- Port mirroring
- QoS
- More expensive
- Enterprise use

Security Implications:

Better than hubs, but vulnerable:

✓ Traffic only to destination port
✓ Harder to sniff (not broadcast everywhere)

But:
✗ ARP poisoning (MITM possible)
✗ MAC flooding (revert to hub mode)
✗ VLAN hopping
✗ CAM table overflow

Routers (Layer 3)

A router operates at the Network Layer (Layer 3). It routes packets between different networks based on IP addresses.

How Routers Work:

1. Router receives packet
2. Looks at destination IP address
3. Checks routing table
4. Forwards to next hop (another network)
5. Decrements TTL

Visual:

Network A            Router           Network B
192.168.1.0/24                       10.0.0.0/24
┌────────┐                            ┌────────┐
│  PC1   │                            │  PC5   │
│.1.100  │────┐                  ┌────│.0.50   │
└────────┘    │                  │    └────────┘
              │    ┌─────────┐   │
┌────────┐    ├────│ ROUTER  │───┤    ┌────────┐
│  PC2   │    │    │         │   │    │  PC6   │
│.1.101  │────┘    │ .1.1 .0.1    └────│.0.51   │
└────────┘         └─────────┘         └────────┘
                   
Router knows:
- Left side: 192.168.1.0/24
- Right side: 10.0.0.0/24

Routing Table:

Destination      Gateway         Interface
─────────────────────────────────────────
192.168.1.0/24   0.0.0.0         eth0 (directly connected)
10.0.0.0/24      0.0.0.0         eth1 (directly connected)
0.0.0.0/0        203.0.113.1     eth2 (default route)

Routing Decision:

PC1 (192.168.1.100) → PC5 (10.0.0.50)

1. PC1 sends packet to default gateway (router)
2. Router receives packet
3. Destination: 10.0.0.50
4. Checks routing table: 10.0.0.0/24 on eth1
5. Forwards to eth1
6. PC5 receives packet

Functions:

✓ Connect different networks
✓ Route packets by IP
✓ Decrement TTL
✓ Block broadcasts (separate broadcast domains)
✓ NAT (Network Address Translation)
✓ Firewall (filtering)
✓ DHCP server (optional)
✓ QoS (Quality of Service)

Characteristics:

✓ Layer 3 intelligence
✓ Routes between networks
✓ Blocks broadcast domains
✓ Can perform NAT
✓ Often includes firewall
✓ More complex configuration
✓ More expensive than switches

Security Implications:

✓ Segments networks (security boundary)
✓ Can filter traffic (ACLs)
✓ NAT hides internal IPs
✓ Blocks broadcast attacks from spreading

But:
✗ Can be compromised
✗ Misconfigurations common
✗ Routing loops possible
✗ Default credentials (admin/admin)

Comparing the Three

Side-by-Side:

Feature            Hub          Switch        Router
─────────────────────────────────────────────────────────
OSI Layer          1            2             3
Forwards by        None         MAC           IP
Intelligence       Dumb         Smart         Smartest
Broadcast domain   One          One           Multiple
Collision domain   One          Per port      N/A
Traffic filtering  None         Yes (MAC)     Yes (IP)
Speed              Slowest      Fast          Medium
Use case           Obsolete     LANs          Between networks
Security           Terrible     Medium        Better

Traffic Flow:

Hub:
IN → Repeat to ALL ports

Switch:
IN → Check MAC table → Forward to specific port

Router:
IN → Check routing table → Forward to next network

Network Diagram:

                 Internet
                    │
                    │
                ┌───▼────┐
                │ Router │  ← Layer 3 (routes between networks)
                │(Gateway)│
                └───┬────┘
                    │
                    │ (192.168.1.0/24)
                    │
                ┌───▼────┐
                │ Switch │  ← Layer 2 (forwards by MAC)
                └─┬─┬─┬─┬┘
                  │ │ │ │
        ┌─────────┴─┴─┴─┴──────────┐
        │         │   │   │         │
      ┌─▼─┐     ┌▼──┐│ ┌▼──┐     ┌▼───┐
      │PC1│     │PC2││ │PC3│     │PC4 │  ← Layer 1 (devices)
      └───┘     └───┘│ └───┘     └────┘
                   ┌─▼──┐
                   │Hub │  ← Old device (don't use!)
                   └─┬─┬┘
                     │ │
                   ┌─▼┐▼──┐
                   │PC5│PC6│
                   └───┴───┘

Layer 2 vs Layer 3 Switches

Layer 2 Switch:

- Forwards by MAC address
- Same network/subnet
- Fast
- Cheaper

Layer 3 Switch:

- Can route between VLANs
- Uses IP addresses
- Combines switch + router features
- More expensive
- Enterprise environments

Example:

VLAN 10: 192.168.10.0/24
VLAN 20: 192.168.20.0/24

Layer 2 switch: Cannot route between VLANs
Layer 3 switch: Can route between VLANs (inter-VLAN routing)

Attacks on Network Devices

Hub Attacks:

Passive sniffing (trivial):

# Just run Wireshark
# You'll see everyone's traffic!

Switch Attacks:

1. MAC Flooding:

# Overflow MAC table
# Switch reverts to hub mode
macof -i eth0

# Result: Switch floods traffic to all ports
# Now you can sniff everything!

2. ARP Poisoning (covered in ARP lesson):

# Become man-in-the-middle
arpspoof -i eth0 -t victim_ip gateway_ip

3. VLAN Hopping:

# Exploit trunking protocols
# Access other VLANs

Router Attacks:

1. Default credentials:

Common defaults:
admin:admin
admin:password
root:root

Always change defaults!

2. Routing table manipulation:

# Exploit routing protocols (RIP, OSPF, BGP)
# Inject malicious routes

3. Exploitation:

# Search for CVEs
searchsploit router model

# Exploit web interface
# Often outdated software

Try It Yourself

Exercise 1: Identify Your Devices

# Find your router (default gateway)
# Linux:
ip route show
# Look for "default via X.X.X.X"

# Windows:
ipconfig
# Look for "Default Gateway"

# Access router web interface
# Usually http://192.168.1.1 or http://192.168.0.1

# Identify:
# - Make/model
# - Firmware version
# - Features (firewall, NAT, QoS?)

Exercise 2: View Switch MAC Table

If you have a managed switch:

# Cisco switch:
show mac address-table

# Output:
Vlan    Mac Address       Type        Ports
----    -----------       ----        -----
1       aaaa.bbbb.cccc    DYNAMIC     Gi0/1
1       dddd.eeee.ffff    DYNAMIC     Gi0/2

Exercise 3: Trace Route

# See routers between you and destination
# Linux/macOS:
traceroute google.com

# Windows:
tracert google.com

# Each hop is a router
# Observe how many routers your traffic passes through

Exercise 4: Simulate Hub Behavior

# On a switch with port mirroring (SPAN):
# Mirror traffic to your port
# This simulates hub behavior for analysis

# Cisco:
monitor session 1 source interface Gi0/1
monitor session 1 destination interface Gi0/24

# Now Gi0/24 sees all Gi0/1 traffic (for monitoring)

Choosing the Right Device

Use a Hub when:

Never. They're obsolete. Use a switch.

Use a Switch when:

✓ Connecting devices on same network
✓ Building a LAN
✓ Need better performance than hub
✓ Need security (vs hub)
✓ VLANs needed (managed switch)

Use a Router when:

✓ Connecting different networks
✓ Connecting to internet
✓ Need NAT
✓ Need firewall
✓ Segmenting networks
✓ Need routing between subnets

Use a Layer 3 Switch when:

✓ Need routing between VLANs
✓ Enterprise environment
✓ High-speed inter-VLAN routing
✓ Budget allows

Quick Command Reference

# View MAC addresses on network (ARP cache)
arp -a                  # Windows/Linux
ip neigh show           # Linux

# View routing table
route -n                # Linux
netstat -r              # Linux/macOS
route print             # Windows
ip route show           # Linux

# Trace route
traceroute <host>       # Linux/macOS
tracert <host>          # Windows

# View interface info
ifconfig                # Linux/macOS
ip addr show            # Linux
ipconfig /all           # Windows

# MAC flooding (attack - lab only!)
macof -i eth0

# ARP poisoning (attack - lab only!)
arpspoof -i eth0 -t <victim> <gateway>

Resources

Tools:

  • Wireshark: Analyze switch/router traffic
  • nmap: Discover network devices
  • macof: MAC flooding attack
  • Yersinia: Layer 2 attacks
  • routersploit: Router exploitation framework

Reading:

Practice:

  • Set up a home lab with switch and router
  • Configure VLANs on managed switch
  • Practice routing between networks
  • Try port mirroring for packet capture

Next Steps

  1. Understand Layer 2 switching and MAC address tables
  2. Learn Layer 3 routing and routing tables
  3. Practice VLAN configuration on managed switches
  4. Study routing protocols (RIP, OSPF, BGP)
  5. Learn switch/router security hardening

Understanding hubs, switches, and routers is fundamental to networking and security. These devices control how traffic flows—master them!

"Hubs broadcast, switches learn, routers route. Know the difference, own the network."

Up next

Routing Traffic Between Subnets

How routers forward packets between networks.