Switch (layer 2): what it is and how it is attacked
Connects the devices inside one building or floor, passing each message only to the machine it is addressed to.
Also known as
- layer 2
- LAN switch
Typing any of them into the editor finds this object.
Why it matters on a security diagram
Segments are created and collapsed here, often by a single port setting, so a switch decides whether two systems that should never meet can reach each other.
How it gets attacked, and what reduces it
How it gets attacked
- Ports left active in unattended rooms
- Segment settings changed to bridge networks that should stay apart
What reduces it
- Disable unused ports, and require a device to prove itself before the port carries traffic
- Review segment settings as configuration, since one port setting can collapse a boundary
- Keep management off the network the switch itself carries
Where it sits
- Group
- Network · The paths traffic travels along.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- switch
Reviewed . CC BY 4.0.
Others in network
- The internetWAN · public networkEverything outside your organisation's control.
- Routergateway · layer 3Sends information from one network to another, the way a junction sends cars down different roads.
- Remote access gatewayVPN · VPN concentrator · remote accessThe door staff use to reach the internal network from outside.
- Address rangeCIDR · subnet · IP rangeA group of numbered addresses on a network, written as a single line such as 192.0.2.0/24 rather than listed one by one.
- Internet network operatorASN · autonomous system · AS number · BGP network · peeringOne organisation's own network on the internet, identified by a number so every other network knows whose it is.
The network group lists all 6 of them side by side.
Switch on your own diagram
Open the editor, press N, and type layer 2. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker