Network+ 2.1

When making internet requests

NAT replaces packet source IP to public IP

web server then sends info to public IP

Nat then reverses public IP to private IP

NAT Overload/Port AT

source/destination IPs now include port numbers, which allows other devices to share public IP

VLAN

a network switch separated logically into different network switches

VLAN Trunk

a single switch link that carries traffic for multiple VLANs at once.

802.1Q Trunking

Each frame gets a small tag saying which VLAN it belongs to, so the receiving switch can keep the VLANs separate.

Default VLAN

the VLAN every switch port belongs to when the switch comes out of the box

Native VLAN

the VLAN that a trunk port assigns to frames with no tag

Switch spoofing

Attacker’s device pretends to be a switch and negotiates a trunk through DTP (Dynamic Trunking Protocol).

Mitigate: Hard-set user ports to access mode, disable DTP

Double Tagging

Attacker sends a frame with two 802.1Q tags; the first switch strips the outer one and the inner one gets delivered to the target VLAN.

Mitigate: Change the native VLAN to an unused VLAN, tag the native VLAN, keep users off VLAN 1

Layer 3 (Multilayer) Switch

a switch that can also route