home/fabric

fabric

networking, and the routing and switching that holds it together

Fabric is WarFi's networking bench. Every connected thing, a phone, a laptop, a server, a satellite link, rides on the same few ideas: addressing, switching, and routing. Understand them and the rest of security stops being magic, because almost every attack and every defence lives on this ground. This is the foundation, the parts worth knowing by heart, plus the few advanced pieces that matter most for defending a network and keeping it standing. It is vendor-neutral, with Linux and Cisco commands where they make a point clearer, and it is meant to be read in order the first time, then kept as a map.

01What a network actually is

A network is nothing more than a set of nodes joined by links, arranged so that any node can reach any other. A node is anything that speaks the language: a phone, a laptop, a server, a router, a smart bulb. A link is whatever carries the signal between them, copper, fibre, or radio. Everything else in networking is just the set of agreements that let a message find its way from one node to another across many links it has never seen before.

» The internet is not one network. It is a network of networks, tens of thousands of them, each run by someone different, agreeing to pass each other's traffic. That is why no single company owns it and no single failure takes it all down. Keep that picture in mind: your message crosses many independent networks to reach the other side, and each one only has to know how to hand it one step closer.

Two jobs come up again and again, and almost all of networking is one or the other. Moving a message between nodes on the same local network is switching. Moving it between different networks is routing. Learn how those two work and the rest stops being magic.

02The layered model

Networking is built in layers, each one handling a single job and trusting the layer below to carry its data. The point of layering is separation: you can swap Wi-Fi for Ethernet without changing a single web page, because the layers above do not care how the bits actually moved. Two models describe this, the seven-layer OSI model used for teaching, and the four-layer TCP/IP model that the real internet runs on.

» Three layers carry most of the weight, and this guide spends most of its time on them. The link layer (L2) moves frames between nodes on one local network, using MAC addresses. The network layer (L3) moves packets between networks, using IP addresses. The transport layer (L4) sorts traffic into conversations using port numbers, so your browser and your mail client can share one connection without their data getting mixed up.

When someone says a problem is 'a layer 2 issue' or 'layer 3', this is the ladder they are pointing at. Naming the layer is half of fixing the fault, because it tells you whether to look at switching, addressing, or routing.

03How a message is wrapped

A message does not travel as bare data. Each layer wraps what it was handed in a header of its own, like putting a letter in an envelope, then that envelope into a larger one, and so on. The receiver opens them in reverse. This wrapping is called encapsulation, and it is why the same web page can ride over fibre, then Wi-Fi, then a mobile link, untouched: only the outermost wrapper changes at each hop.

» Each header answers one question. Ethernet asks which machine on this local wire. IP asks which machine on the whole internet. TCP asks which conversation on that machine. The data is the thing you actually care about; everything around it exists only to deliver it and then be thrown away.

↑ contents

04MAC addresses and the switch

Every network interface is born with a MAC address, a 48-bit hardware identifier written as six hex pairs, like 2c:54:91:88:c9:e3. It is the name a device answers to on its local wire. A switch is the box that joins the devices of one local network, and its one clever trick is this: it learns. When a frame arrives on a port, the switch notes the source MAC and remembers which port it came from. Over a few frames it builds a table mapping every MAC to the port behind it.

With that table, the switch forwards each frame only out the one port where its destination lives, instead of shouting it everywhere. If it has not yet learned a destination, it floods the frame out every port except the one it arrived on, and learns from the reply. This is why a switch is quiet and efficient where an old hub was loud and wasteful.

05Collision and broadcast domains

Two ideas explain why modern networks scale. A collision domain is a stretch of network where two devices talking at once would garble each other. An old hub put every device in one collision domain, so only one could speak at a time. A switch gives every port its own collision domain, so every device can talk at once. That single change is most of why networks got fast.

» A broadcast domain is the set of devices that hear a broadcast, a frame addressed to everyone (ff:ff:ff:ff:ff:ff). A switch forwards broadcasts to its whole local network, so by default one LAN is one broadcast domain. Broadcasts are how devices find each other before they know addresses, but too many in one domain is noise that slows everyone down. Splitting a big flat network into smaller broadcast domains is where VLANs come in.

06VLANs: many networks on one switch

A VLAN lets one physical switch carry several separate logical networks that cannot see each other. Each port is assigned to a VLAN, and a frame tagged for VLAN 10 is never delivered to a port in VLAN 20, even on the same switch. The tag is a small field added to the frame, defined by the 802.1Q standard. A port carrying just one VLAN is an access port; a link that carries many tagged VLANs between switches is a trunk.

VLANs are one of the most practical security tools you own. Put guests, cameras, and smart devices on their own VLAN, away from your laptops and servers, and a compromised doorbell cannot reach your file server. Segmentation like this turns one break-in into a contained one. It is least privilege, drawn in network form.

» A VLAN is a broadcast domain by another name. Where you draw the VLAN boundaries is where you draw your broadcast domains, and where you decide what is allowed to talk to what. That design choice, made early, shapes both the performance and the safety of everything built on top.

07Loops and Spanning Tree

Networks want redundant links so that one dead cable does not cut everyone off. But layer 2 has no concept of distance or time-to-live, so a broadcast frame on a looped network circles forever, multiplying at every switch until the network drowns. This is a broadcast storm, and it can take down a whole site in seconds.

The Spanning Tree Protocol (STP, and its faster successor RSTP) fixes this. The switches elect a root, then quietly block just enough redundant links to leave exactly one path between any two points, no loops. If an active link fails, a blocked one is unblocked within seconds to take over. You get the safety of redundant cabling without the danger of loops. You rarely configure STP by hand, but when a network mysteriously melts down, a loop with STP disabled is a prime suspect.

↑ contents

08The IP address and its mask

A MAC address says who a device is on its local wire; an IP address says where it is on the whole internet. An IPv4 address is 32 bits, written as four decimal octets, like 192.168.1.42. It has two parts: a network portion that names the network, and a host portion that names the device on it. The subnet mask is what tells you where the split falls.

» Devices on the same network portion can talk directly, switch to switch. To reach a different network portion, traffic must go through a router. That single rule, same network means talk directly, different network means use the router, is the hinge the whole internet turns on.

09Subnetting and CIDR

The /24 after an address is CIDR notation, and it simply counts how many bits belong to the network. A /24 means the first 24 bits are network, leaving 8 bits, so 256 addresses, for hosts. A smaller number is a bigger network; a larger number is a smaller one. Subnetting is the act of borrowing host bits to split one network into several.

Subnetting is how you carve a flat network into purposeful pieces: one subnet per department, per floor, per trust level. Each becomes its own broadcast domain and its own place to apply rules. You do not have to do the binary by hand; a small tool shows the boundaries.

$ ipcalc 192.168.1.0/26

$ sipcalc 192.168.1.0/24 -s 26

» The two addresses you cannot give to a host are the first in each subnet (the network address) and the last (the broadcast address). In a /26 that is .0/.63, .64/.127, and so on. That is why a /26 holds 64 addresses but only 62 usable hosts.

10Private addresses and NAT

There are not enough IPv4 addresses for every device on earth, so most of us do not use public ones at home or in the office. Three ranges are reserved as private, usable by anyone, routable by no one on the open internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Your phone and laptop almost certainly hold one right now.

NAT is the trick that lets a whole household share one public address. The router rewrites the private source address of every outbound packet to its own public one, keeps a table of which internal device and port each conversation belongs to, and reverses the swap on the way back. It was invented to stretch a scarce resource, and as a side effect it hides your internal layout, though it is a convenience, not a firewall.

11A word on IPv6

IPv4's four billion addresses ran out years ago; IPv6 is the long answer. It uses 128-bit addresses, written as eight groups of hex, like 2001:db8:4860::8888, with a staggering number of them, enough to give every grain of sand its own. With that abundance, NAT is no longer needed: every device can hold a genuine, globally reachable address again.

» You do not have to choose. Most networks run dual stack, speaking both IPv4 and IPv6 at once, and your devices quietly prefer whichever works. IPv6 also changes some habits: addresses are often self-assigned (SLAAC) rather than handed out, and there is no broadcast, replaced by smarter multicast. It is worth being fluent in, because the long-term internet is IPv6, and security tools that only watch IPv4 are half blind.

↑ contents

12The routing table

A router is a device with a foot in several networks and a table telling it which way to send each packet. For every packet, it reads the destination IP, finds the most specific matching entry in its routing table, and forwards the packet out that interface toward the listed next hop. 'Most specific' matters: a /32 entry for one host beats a /24 for its network, which beats a /0 for everywhere. This is longest-prefix match, and it is the one rule a router lives by.

$ ip route

$ ip route get 1.1.1.1

» Read that table top to bottom and you can see the whole worldview of the machine: anything in 192.168.1.0/24 is local, out the Wi-Fi; anything in the VPN's 10.8.0.0/24 goes through the tunnel; everything else, the default, goes to the router at 192.168.1.1. On Cisco gear the same view is 'show ip route', and reading it is the first thing you do when traffic is not arriving.

13Static and dynamic routing

Routes get into the table two ways. Static routes are typed in by hand: simple, predictable, and fine for small or fixed networks, but blind to failure, since a static route keeps pointing at a dead link until someone fixes it. Dynamic routing protocols let routers talk to each other and work out the paths themselves, adapting automatically when a link drops.

» OSPF is a link-state protocol: every router learns the full map of its area and computes the shortest path itself. It is the common choice inside one organisation.

» BGP is a path-vector protocol: it exchanges reachability between whole networks and is the protocol that stitches the entire internet together. When people say the internet 'runs on BGP', this is what they mean.

» RIP is the old, simple distance-vector protocol, mostly of historical interest now, but a gentle place to first see dynamic routing work.

» The split has a name: interior gateway protocols (OSPF and friends) handle routing within a network you control, while BGP is the exterior protocol between networks run by different people. You will configure OSPF long before you ever touch BGP, but knowing BGP exists explains how a packet from Palawan reaches a server in Frankfurt across a dozen separate companies.

14The default route

No router knows the way to every network on earth, and none needs to. When nothing more specific matches, a packet follows the default route, written 0.0.0.0/0 and nicknamed the gateway of last resort. Your home router's default route points at your ISP; your ISP's points deeper into the internet's core. A packet to an unknown destination simply keeps being handed upward until it reaches a router that does know, or is dropped.

» This is why your laptop can reach a site it has never heard of with only three facts: its own address, the address of its local router, and a default route pointing at that router. It does not need a map of the internet. It only needs to know how to take one step toward someone who knows more than it does. The whole system scales because every node can be ignorant of almost everything.

15A packet's journey, end to end

Now put it together. You open a page on a server at 203.0.113.80 from your laptop at 192.168.1.42. Here is every step, using everything above.

» Nothing in that journey is new now. Step 1 is addressing and the same-network rule. Step 2 is ARP finding the local MAC. Step 3 is switching to the router. Step 4 is NAT and routing. Step 5 is longest-prefix match repeated across independent networks. Step 6 is the transport layer keeping the conversation straight on the way home. Every layer did one small job and trusted the others. That is the whole machine.

↑ contents

16ARP: finding the neighbour

IP routing decides a packet should go to 192.168.1.1, but the local wire only understands MAC addresses. The Address Resolution Protocol bridges that gap. A device shouts a broadcast, 'who has 192.168.1.1?', the owner answers with its MAC, and the asker caches the answer for next time. Every direct delivery on a local network starts with this tiny exchange.

$ ip neigh

$ ip neigh show dev wlan0

» ARP is trusting by design: it believes whoever answers. That trust is also its weakness, since a malicious device can answer for an address that is not its own and quietly sit in the middle of a conversation. You do not need to exploit that to be a good defender, but knowing ARP has no built-in proof is exactly why switched networks still need watching.

17DHCP: getting an address

When a device joins a network it usually has no address yet. DHCP hands it one automatically, in a four-step exchange often remembered as DORA.

1. Discover: the new device broadcasts, asking if any DHCP server is listening.

2. Offer: a server replies with an address it could lease.

3. Request: the device formally asks for that offered address.

4. Acknowledge: the server confirms, with a lease time, the gateway, and DNS servers to use.

» That single exchange is why plugging in a laptop just works: it receives not only an address but the local router and DNS to use, everything it needs to reach the world. The lease is temporary, renewed quietly in the background, so addresses return to the pool when devices leave.

18DNS: names to numbers

People remember warfi.net; machines route to addresses. The Domain Name System is the directory that turns one into the other. Your resolver asks a chain of servers, a root server points it at the servers for .net, those point at the servers for warfi.net, and the authoritative server there returns the address. The answer is cached at every step, so the next lookup is instant.

$ dig warfi.net

$ dig +short warfi.net

$ nslookup warfi.net

» DNS is the quiet backbone of nearly everything: when 'the internet is down', a broken resolver is as likely a cause as a broken link. It is also a rich signal for a defender, because what a machine looks up often says more about what it is doing than the traffic itself. Knowing how the lookup chain works tells you where to look when a name will not resolve.

19ICMP, ping, and traceroute

ICMP is the network's own messaging channel, used not for your data but for the network to report on itself: host unreachable, time exceeded, and the familiar echo used by ping. Ping sends an echo request and times the reply, the simplest test of whether a host is alive and how far away it feels.

$ ping -c 4 1.1.1.1

$ traceroute 1.1.1.1

$ mtr 1.1.1.1

Traceroute is a lovely trick built on one field. Every packet carries a time-to-live that each router decrements; at zero the packet is dropped and the router sends back an ICMP 'time exceeded'. Traceroute sends packets with TTL 1, then 2, then 3, and each dying packet reveals the router at that hop. The result is the actual path your traffic takes, hop by hop.

» When something is slow or unreachable, ping tells you if it is up and traceroute tells you where the path breaks or stalls. Between them they answer most 'is it the network?' questions before you touch anything else.

↑ contents

20Read your own network

You cannot defend what you cannot see. The first skill is reading the state of your own machine and network from the command line, quickly and without guessing. These are safe, read-only commands for your own systems, and they are the daily bread of anyone who runs a network.

$ ip addr # my addresses and interfaces

$ ip route # where my traffic goes

$ ip neigh # who my machine has talked to locally (ARP)

$ ss -tulpn # which ports are open and listening here

$ tcpdump -ni any host 1.1.1.1 # watch packets to a host

» On Cisco gear the same questions have the same shape: 'show ip interface brief' for addresses, 'show ip route' for routing, 'show mac address-table' for the switch's learned MACs, and 'show cdp neighbors' to see what is plugged in where. Different dialect, identical questions. Learn the questions and the vendor stops mattering.

21Segmentation and least privilege

The single most effective network defence is also the oldest idea in security: do not let everything talk to everything. Put systems in separate subnets or VLANs by trust level, and between them place a firewall or router ACL that permits only what must be permitted and denies the rest by default. A flat network where one laptop can reach every server is one compromised laptop away from a very bad day.

This is where fabric meets trustless and the rest of WarFi's theme: trust no one, verify everything. Segmentation is that principle in copper and config. Your camera does not need to reach your accounting server, so do not let it, and a break-in stays a small one instead of a whole-network one.

» Done well, segmentation is quiet: nobody notices the doors that were never opened. It is cheap insurance paid in a little design effort up front, and it is the control that most often turns a breach into a near miss.

22Resilience: standing when a link drops

WarFi's whole posture is staying up when things fail, and networks fail constantly: a cut fibre, a dead switch, a flaky uplink. Resilience is designing so that no single failure takes you down. The building blocks are all here already: redundant links held safe by RSTP, dynamic routing that reroutes around a dead path in seconds, two ISPs so one outage is an inconvenience rather than a blackout, and power and hardware you can lose one of without stopping.

» The goal is graceful degradation: when something breaks, the network gets slower or smaller, not dark. That is the same instinct behind amateur radio in the radio guide, a second way to reach the world for the day the usual ways are gone. A resilient network, like a resilient operator, assumes failure and plans to keep working through it.

23Where networking meets security

Almost every attack and every defence lives on the ground this guide just covered. Sniffing is reading frames on a wire you share. ARP spoofing abuses that trusting ARP exchange to sit in the middle. DHCP and DNS can be impersonated to point victims the wrong way. VLAN hopping tries to escape its segment. You do not learn these to use them; you learn them so the traffic on your own network is legible and the weak points are obvious before someone else finds them.

» The tools for seeing it honestly are in the arsenal: wireshark and tcpdump to read what is really on the wire, nmap to map what is reachable. Point them only at networks you own or are authorised to test. Used that way, on your own fabric, they turn this whole guide from theory into something you can watch happen, which is the fastest way there is to truly understand it.

↑ contents

24Close the front door first

Most devices are breached through a door that was never locked: a default password, a web admin page open to the whole internet, firmware years out of date. Before anything clever, close those. If you do only the five things in this first section, you have already shut out the overwhelming majority of opportunistic attacks.

1. Change every default login to something long and unique. The sticker password is public knowledge.

2. Update the firmware now, and set a reminder to check again every few months.

3. Turn off remote administration, any option that lets you manage the device from the internet (WAN) side.

4. Prefer a wired, encrypted admin path: SSH, never Telnet, which sends your password in the clear.

5. Export and keep a copy of the working configuration, so you can rebuild in minutes after a failure.

For anyone already in the command line, here is the same intent on a Cisco switch or router. The idea translates to any serious gear: strong secrets, SSH only, idle sessions dropped, the web server off unless you need it, and the config saved.

25Shrink the attack surface

Every service a device runs and every port left live is one more thing that can be attacked. The rule is least service: turn off what you do not use, and expose nothing you do not have to. A smaller surface is a smaller target, and it is the cheapest security you will ever buy, since it costs only the effort of switching things off.

» On a home router, disable UPnP and WPS, remove any port-forward you no longer need, and switch off cloud or remote-access features you do not use.

» SNMP, if you run it at all, should be version 3 with authentication and encryption, never the old public and private community strings that are the same on millions of devices.

» Shut, do not just ignore, every switch port that is not in use; an open live port in a lobby is an invitation.

Restrict management to a path only you can reach: a dedicated management VLAN, or an access list that permits SSH only from your admin subnet. The box should answer its own operator and ignore everyone else.

26Defend the switch ports

The local network attacks from earlier, ARP spoofing and broadcast loops, are not just theory to worry about; they have concrete defences you configure once and forget. These four turn the switch itself into your ally on the wire.

This is the ARP spoofing and the broadcast loop closed in config. DHCP snooping and Dynamic ARP Inspection make the trusting ARP exchange safe, and BPDU guard means a rogue switch plugged into an access port is shut down instead of hijacking your spanning tree. The weaknesses the guide warned about earlier each have an off switch, and this is it.

27Wi-Fi done right

Wireless is the easiest way into most networks, because an attacker does not even need to be in the building. Three choices carry almost all of the safety: strong encryption, a long passphrase, and WPS turned off. Use WPA3 if your gear and clients support it, or WPA2 with AES (CCMP). Never WEP, and never the old TKIP, both of which are broken.

» Set a long, random passphrase. The attacks in wardriving capture the handshake and then guess offline, so length is what beats them, not cleverness.

» Turn WPS off. A one-button or PIN join is a one-button way in.

» Put guests and smart devices on their own network, ideally a separate VLAN, with client isolation so they cannot see each other or your main LAN.

» Do not rely on hiding the SSID; it is not security, since a wardriving scanner sees the network anyway. It only inconveniences honest users.

28See it when it happens

Hardening keeps attackers out; logging tells you when someone tries, or gets in. Two small things make logs worth having: correct time, so events from different devices line up, and shipping them off the device, so they survive the device being compromised. An attacker's first move is to wipe the local logs; they cannot wipe the ones already gone.

» On a home or small-office setup you do not need enterprise kit for this. A small Linux box or a Raspberry Pi running rsyslog, with the router pointed at it, is plenty, and it means a wiped router still leaves a trail. Point your devices at a common NTP source so their clocks agree, and the story a dozen logs tell will actually fit together.

Hardening is a habit, not a one-time switch. Change the defaults, remove what you do not use, watch what remains, and revisit after every firmware update. Each step here turns a device from a soft target into one an attacker has to work for, and more often than not, that is enough to send them looking for an easier door elsewhere.

↑ contents

Authorized use only. Use these tools and techniques solely on systems you own or have explicit written permission to test. Unauthorized access to computers, networks, or data is a crime in nearly every country, including the Philippines (RA 10175), the United States (CFAA), the United Kingdom (Computer Misuse Act 1990), and across the European Union (Directive 2013/40/EU). When in doubt, get permission in writing first. This is general information, not legal advice.