Routing and Switching

• Explain switching vs routing by layer and decision tables
• Trace the path of a packet through a gateway
• Place firewall controls at routing and switching boundaries

• Every 'why can't they talk' mystery is a switching (same subnet) or routing (different subnet) question.
• Routers are the enforcement points for firewalls; switches are where VLAN segmentation is actually applied.
• ARP and MAC-table anomalies are early signs of spoofing or lateral movement.
• Routing protocols (BGP) have their own security model — route hijacks happen in the control plane.

The building mailroom (switch) knows which office is in which room and delivers in-house. If the mail is addressed outside the building, the mailroom hands it to the city postal service (router), which routes it by city blocks (subnets and routes).

• Switch learning: when a frame arrives, the switch records {source MAC → ingress port} in its MAC table; unknown destinations are flooded out every port.
• Within a subnet, hosts use ARP to resolve 'who has IP X?' into a MAC address before sending a frame.
• Off-subnet: the sender addresses the frame to its default gateway (router) MAC, with the final destination IP inside.
• The router strips the frame, looks up the destination IP in its routing table, picks the next hop, and re-frames out the right interface.
• VLANs let one physical switch act as several layer-2 domains, isolating traffic as if wires were separate.

• A firewall rule pair 'allow 10.0.20.0/24 → 10.0.30.0/24:443' presupposes a router that carries those two subnets — the enforcement happens at the router boundary.
• A VLAN per department means a compromised workstation on the finance VLAN cannot ARP-scan marketing hosts.
• Route security: filtering BGP announcements and applying RPKI stops an ISP-level hijack from taking your prefixes.

• Treat the router as a control plane: authenticate routing adjacencies and filter announcements.
• Put every host only on the subnets it needs; route everything else 'permit by exception'.
• Use VLAN trunking with explicit allowed VLAN lists — a misconfigured trunk is a segmentation bypass.
• Document next-hop topology; a 'surprise route' is how some lateral movement is explainable.

• Assuming two VLANs are isolated when a route (or a mislabeled trunk port) quietly bridges them.
• Forgetting ARP is unauthenticated — a spoofed ARP reply is how some classic MITM positions get set up.
• Testing 'connectivity' with ping and concluding routing works, when the failing path is actually a firewall policy that ping can't traverse.

• Trace with `ip route get <dst>` and `traceroute` to find the exact hop where forwarding stops.
• Inspect the MAC table (`bridge fdb show`) when traffic stops despite valid IPs — it smells like switching.
• Check ARP (`ip neigh`) when a same-subnet host won't answer — missing ARP = nothing to send to.

• Segmentation only exists where you can prove the L2/L3 path is blocked: test with real traffic across boundaries.
• Route hijacking is a supply-chain attack on the routing fabric; enable BGP security (RPKI, filters) on infrastructure you control.