Here are some of the fundamental parts of a network:
• Network - A network is a group of computers connected together in a way that allows information to be
exchanged between the computers.
• Node - A node is anything that is connected to the network. While a node is typically a computer, it can
also be something like a printer or CD-ROM tower.
• Segment - A segment is any portion of a network that is separated, by a switch, bridge or router, from
other parts of the network.
• Backbone - The backbone is the main cabling of a network that all of the segments connect to.
Typically, the backbone is capable of carrying more information than the individual segments. For
example, each segment may have a transfer rate of 10 Mbps (megabits per second), while the
backbone may operate at 100 Mbps.
• Topology - Topology is the way that each node is physically connected to the network (more on this in
the next section).
• Local Area Network (LAN) - A LAN is a network of computers that are in the same general physical
location, usually within a building or a campus. If the computers are far apart (such as across town or in
different cities), then a Wide Area Network (WAN) is typically used.
• Network Interface Card (NIC) - Every computer (and most other devices) is connected to a network
through an NIC. In most desktop computers, this is an Ethernet card (normally 10 or 100 Mbps) that is
plugged into a slot on the computer's motherboard.
• Media Access Control (MAC) address - This is the physical address of any device -- such as the NIC
in a computer -- on the network. The MAC address, which is made up of two equal parts, is 6 bytes long.
The first 3 bytes identify the company that made the NIC. The second 3 bytes are the serial number of
the NIC itself.
• Unicast - A unicast is a transmission from one node addressed specifically to another node.
• Multicast - In a multicast, a node sends a packet addressed to a special group address. Devices that
are interested in this group register to receive packets addressed to the group. An example might be a
Cisco router sending out an update to all of the other Cisco routers.
• Broadcast - In a broadcast, a node sends out a packet that is intended for transmission to all other
nodes on the network.
Networking – page 1 of 13
Some of the most common topologies in use today include:
• Bus - Each node is daisy-chained (connected one right after the other) along the same backbone,
similar to Christmas lights. Information sent from a node travels along the backbone until it reaches its
destination node. Each end of a bus network must be terminated with a resistor to keep the signal that
is sent by a node across the network from bouncing back when it reaches the end of the cable.
Bus network topology
• Ring - Like a bus network, rings have the nodes daisy-chained. The difference is that the end of the
network comes back around to the first node, creating a complete circuit. In a ring network, each node
takes a turn sending and receiving information through the use of a token. The token, along with any
data, is sent from the first node to the second node, which extracts the data addressed to it and adds
any data it wishes to send. Then, the second node passes the token and data to the third node, and so
on until it comes back around to the first node again. Only the node with the token is allowed to send
data. All other nodes must wait for the token to come to them.
Ring network topology
Networking – page 2 of 13
• Star - In a star network, each node is connected to a central device called a hub. The hub takes a signal
that comes from any node and passes it along to all the other nodes in the network. A hub does not
perform any type of filtering or routing of the data. It is simply a junction that joins all the different nodes
Star network topology
• Star bus - Probably the most common network topology in use today, star bus combines elements of
the star and bus topologies to create a versatile network environment. Nodes in particular areas are
connected to hubs (creating stars), and the hubs are connected together along the network backbone
(like a bus network). Quite often, stars are nested within stars, as seen in the example below:
A typical star bus network
Networking – page 3 of 13
The Problem: Traffic
In the most basic type of network found today, nodes are simply connected together using hubs. As a network
grows, there are some potential problems with this configuration:
• Scalability - In a hub network, limited shared bandwidth makes it difficult to accommodate significant
growth without sacrificing performance. Applications today need more bandwidth than ever before. Quite
often, the entire network must be redesigned periodically to accommodate growth.
• Latency - This is the amount of time that it takes a packet to get to its destination. Since each node in a
hub-based network has to wait for an opportunity to transmit in order to avoid collisions, the latency can
increase significantly as you add more nodes. Or, if someone is transmitting a large file across the
network, then all of the other nodes have to wait for an opportunity to send their own packets. You have
probably seen this before at work -- you try to access a server or the Internet and suddenly everything
slows down to a crawl.
• Network failure - In a typical network, one device on a hub can cause problems for other devices
attached to the hub due to incorrect speed settings (100 Mbps on a 10-Mbps hub) or excessive
broadcasts. Switches can be configured to limit broadcast levels.
• Collisions - Ethernet uses a process called CSMA/CD (Carrier Sense Multiple Access with Collision
Detection) to communicate across the network. Under CSMA/CD, a node will not send out a packet
unless the network is clear of traffic. If two nodes send out packets at the same time, a collision occurs
and the packets are lost. Then both nodes wait a random amount of time and retransmit the packets.
Any part of the network where there is a possibility that packets from two or more nodes will interfere
with each other is considered to be part of the same collision domain. A network with a large number
of nodes on the same segment will often have a lot of collisions and therefore a large collision domain.
While hubs provide an easy way to scale up and shorten the distance that the packets must travel to get from
one node to another, they do not break up the actual network into discrete segments. That is where switches
come in. In the next section, you'll find out how switches assist in directing network traffic.
The Solution: Adding Switches
Think of a hub as a four-way intersection where everyone has to stop. If more than one car reaches the
intersection at the same time, they have to wait for their turn to proceed.
Imagine that each vehicle is a packet of data waiting for an
opportunity to continue on its trip.
Now imagine what this would be like with a dozen or even a hundred roads intersecting at a single point. The
amount of waiting and the potential for a collision increases significantly. But wouldn't it be amazing if you could
take an exit ramp from any one of those roads to the road of your choosing? That is exactly what a switch does
for network traffic. A switch is like a cloverleaf intersection -- each car can take an exit ramp to get to its
destination without having to stop and wait for other traffic to go by.
Networking – page 4 of 13
A vital difference between a hub and a switch is that all the nodes connected to a hub share the bandwidth
among themselves, while a device connected to a switch port has the full bandwidth all to itself. For example, if
10 nodes are communicating using a hub on a 10-Mbps network, then each node may only get a portion of the
10 Mbps if other nodes on the hub want to communicate as well. But with a switch, each node could possibly
communicate at the full 10 Mbps. Think about our road analogy. If all of the traffic is coming to a common
intersection, then each car it has to share that intersection with every other car. But a cloverleaf allows all of the
traffic to continue at full speed from one road to the next.
Fully Switched Networks
In a fully switched network, switches replace all the hubs of an Ethernet network with a dedicated segment for
every node. These segments connect to a switch, which supports multiple dedicated segments (sometimes in
the hundreds). Since the only devices on each segment are the switch and the node, the switch picks up every
transmission before it reaches another node. The switch then forwards the frame over the appropriate segment.
Since any segment contains only a single node, the frame only reaches the intended recipient. This allows many
conversations to occur simultaneously on a switched network.
Image courtesy Cisco Networks
An example of a network using a switch
Switching allows a network to maintain full-duplex Ethernet. Before switching, Ethernet was half-duplex, which
means that data could be transmitted in only one direction at a time. In a fully switched network, each node
communicates only with the switch, not directly with other nodes. Information can travel from node to switch and
from switch to node simultaneously.
Fully switched networks employ either twisted-pair or fiber-optic cabling, both of which use separate conductors
for sending and receiving data. In this type of environment, Ethernet nodes can forgo the collision detection
process and transmit at will, since they are the only potential devices that can access the medium. In other
words, traffic flowing in each direction has a lane to itself. This allows nodes to transmit to the switch as the
switch transmits to them -- it's a collision-free environment. Transmitting in both directions can effectively double
the apparent speed of the network when two nodes are exchanging information. If the speed of the network is 10
Mbps, then each node can transmit simultaneously at 10 Mbps.
Networking – page 5 of 13
Most networks are not fully switched because of the costs incurred in replacing all of the hubs with switches.
A mixed network with two switches and three hubs
Instead, a combination of switches and hubs are used to create an efficient yet cost-effective network. For
example, a company may have hubs connecting the computers in each department and then a switch
connecting all of the department-level hubs.
Routers and Switches
You can see that a switch has the potential to radically change the way nodes communicate with each other. But
you may be wondering what makes it different from a router. Switches usually work at Layer 2 (Data or Datalink)
of the OSI Reference Model, using MAC addresses, while routers work at Layer 3 (Network) with Layer 3
addresses (IP, IPX or Appletalk, depending on which Layer 3 protocols are being used). The algorithm that
switches use to decide how to forward packets is different from the algorithms used by routers to forward
One of these differences in the algorithms between switches and routers is how broadcasts are handled. On
any network, the concept of a broadcast packet is vital to the operability of a network. Whenever a device needs
to send out information but doesn't know who it should send it to, it sends out a broadcast. For example, every
time a new computer or other device comes on to the network, it sends out a broadcast packet to announce its
presence. The other nodes (such as a domain server) can add the computer to their browser list (kind of like an
address directory) and communicate directly with that computer from that point on. Broadcasts are used any
time a device needs to make an announcement to the rest of the network or is unsure of who the recipient of the
information should be.
The OSI Reference Model consists of seven layers that build from the wire (Physical) to
the software (Application).
Networking – page 6 of 13
A hub or a switch will pass along any broadcast packets they receive to all the other segments in the broadcast
domain, but a router will not. Think about our four-way intersection again: All of the traffic passed through the
intersection no matter where it was going. Now imagine that this intersection is at an international border. To
pass through the intersection, you must provide the border guard with the specific address that you are going to.
If you don't have a specific destination, then the guard will not let you pass. A router works like this. Without the
specific address of another device, it will not let the data packet through. This is a good thing for keeping
networks separate from each other, but not so good when you want to talk between different parts of the same
network. This is where switches come in.
LAN switches rely on packet-switching. The switch establishes a connection between two segments just long
enough to send the current packet. Incoming packets (part of an Ethernet frame) are saved to a temporary
memory area (buffer); the MAC address contained in the frame's header is read and then compared to a list of
addresses maintained in the switch's lookup table. In an Ethernet-based LAN, an Ethernet frame contains a
normal packet as the payload of the frame, with a special header that includes the MAC address information for
the source and destination of the packet.
Packet-based switches use one of three methods for routing traffic:
Cut-through switches read the MAC address as soon as a packet is detected by the switch. After storing the 6
bytes that make up the address information, they immediately begin sending the packet to the destination node,
even as the rest of the packet is coming into the switch.
A switch using store-and-forward will save the entire packet to the buffer and check it for errors or other
problems before sending. If the packet has an error, it is discarded. Otherwise, the switch looks up the MAC
address and sends the packet on to the destination node. Many switches combine the two methods, using cut-
through until a certain error level is reached and then changing over to store-and-forward. Very few switches are
strictly cut-through, since this provides no error correction.
A less common method is fragment-free. It works like cut-through except that it stores the first 64 bytes of the
packet before sending it on. The reason for this is that most errors, and all collisions, occur during the initial 64
bytes of a packet.
LAN switches vary in their physical design. Currently, there are three popular configurations in use:
• Shared memory - This type of switch stores all incoming packets in a common memory buffer shared
by all the switch ports (input/output connections), then sends them out via the correct port for the
• Matrix - This type of switch has an internal grid with the input ports and the output ports crossing each
other. When a packet is detected on an input port, the MAC address is compared to the lookup table to
find the appropriate output port. The switch then makes a connection on the grid where these two ports
Networking – page 7 of 13
• Bus architecture - Instead of a grid, an internal transmission path (common bus) is shared by all of the
ports. A switch based on this configuration has a dedicated memory buffer for each port.
When we talked about bus and ring networks earlier, one issue was the possibility of a single point of failure. In a
star or star-bus network, the point with the most potential for bringing all or part of the network down is the switch
or hub. Look at the example below:
In this example, if either switch A or C fails, then the nodes connected to that particular switch are affected, but
nodes at the other two switches can still communicate. However, if switch B fails, then the entire network is
brought down. What if we add another segment to our network connecting switches A and C?
In this case, even if one of the switches fails, the network will continue. This provides redundancy, effectively
eliminating the single point of failure. But now we have a new problem.
In the last section, you discovered how switches learn where the nodes are located. With all of the switches now
connected in a loop, a packet from a node could quite possibly come to a switch from two different segments.
For example, imagine that Node B is connected to Switch A, and needs to communicate with Node A on
Segment B. Switch A does not know who Node A is, so it floods the packet.
Networking – page 8 of 13
The packet travels via Segment A or Segment C to the other two switches (B and C). Switch B will add Node B
to the lookup table it maintains for Segment A, while Switch C will add it to the lookup table for Segment C. If
neither switch has learned the address for Node A yet, they will flood Segment B looking for Node A. Each
switch will take the packet sent by the other switch and flood it back out again immediately, since they still don't
know who Node A is. Switch A will receive the packet from each segment and flood it back out on the other
segment. This causes a broadcast storm as the packets are broadcast, received and rebroadcast by each
switch, resulting in potentially severe network congestion. Which brings us to spanning trees...
To prevent broadcast storms and other unwanted side effects of looping, Digital Equipment Corporation created
the spanning-tree protocol (STP), which has been standardized as the 802.1d specification by the Institute of
Electrical and Electronic Engineers (IEEE). Essentially, a spanning tree uses the spanning-tree algorithm
(STA), which senses that the switch has more than one way to communicate with a node, determines which way
is best and blocks out the other path(s). The cool thing is that it keeps track of the other path(s), just in case the
primary path is unavailable.
Routers and Layer 3 Switching
While most switches operate at the Data layer (Layer 2) of the OSI Reference Model, some incorporate features
of a router and operate at the Network layer (Layer 3) as well. In fact, a Layer 3 switch is incredibly similar to a
Layer 3 switches actually work at the Network layer.
Networking – page 9 of 13
When a router receives a packet, it looks at the Layer 3 source and destination addresses to determine the path
the packet should take. A standard switch relies on the MAC addresses to determine the source and destination
of a packet, which is Layer 2 (Data) networking.
The fundamental difference between a router and a Layer 3 switch is that Layer 3 switches have optimized
hardware to pass data as fast as Layer 2 switches, yet they make decisions on how to transmit traffic at Layer 3,
just like a router. Within the LAN environment, a Layer 3 switch is usually faster than a router because it is built
on switching hardware. In fact, many of Cisco's Layer 3 switches are actually routers that operate faster because
they are built on "switching" hardware with customized chips inside the box.
The pattern matching and caching on Layer 3 switches is similar to the pattern matching and caching on a
router. Both use a routing protocol and routing table to determine the best path. However, a Layer 3 switch has
the ability to reprogram the hardware dynamically with the current Layer 3 routing information. This is what
allows for faster packet processing. On current Layer 3 switches, the information received from the routing
protocols is used to update the hardware caching tables.
As networks have grown in size and complexity, many companies have turned to virtual local area networks
(VLANs) to provide some way of structuring this growth logically. Basically, a VLAN is a collection of nodes that
are grouped together in a single broadcast domain that is based on something other than physical location.
You learned about broadcasts earlier, and how a router does not pass along broadcasts. A broadcast domain is
a network (or portion of a network) that will receive a broadcast packet from any node located within that
network. In a typical network, everything on the same side of the router is all part of the same broadcast domain.
A switch that you have implemented VLANs on has multiple broadcast domains, similar to a router. But you still
need a router (or Layer 3 routing engine) to route from one VLAN to another -- the switch can't do this by itself.
Here are some common reasons why a company might have VLANs:
• Security - Separating systems that have sensitive data from the rest of the network decreases the
chances that people will gain access to information they are not authorized to see.
• Projects/Special applications - Managing a project or working with a specialized application can be
simplified by the use of a VLAN that brings all of the required nodes together.
• Performance/Bandwidth - Careful monitoring of network use allows the network administrator to create
VLANs that reduce the number of router hops and increase the apparent bandwidth for network users.
• Broadcasts/Traffic flow - Since a principle element of a VLAN is the fact that it does not pass
broadcast traffic to nodes that are not part of the VLAN, it automatically reduces broadcasts. Access
lists provide the network administrator with a way to control who sees what network traffic. An access
list is a table the network administrator creates that lists which addresses have access to that network.
• Departments/Specific job types - Companies may want VLANs set up for departments that are heavy
network users (such as multimedia or engineering), or a VLAN across departments that is dedicated to
specific types of employees (such as managers or sales people).
You can create a VLAN using most switches simply by logging into the switch via Telnet and entering the
parameters for the VLAN (name, domain and port assignments). After you have created the VLAN, any network
segments connected to the assigned ports will become part of that VLAN.
While you can have more than one VLAN on a switch, they cannot communicate directly with one another on
that switch. If they could, it would defeat the purpose of having a VLAN, which is to isolate a part of the network.
Communication between VLANs requires the use of a router.
Networking – page 10 of 13
VLANs can span multiple switches, and you can have more than one VLAN on each switch. For multiple VLANs
on multiple switches to be able to communicate via a single link between the switches, you must use a process
called trunking -- trunking is the technology that allows information from multiple VLANs to be carried over a
single link between switches.
As the popularity of the Internet grew, businesses turned to it as a means of extending their own networks. First
came intranets, which are password-protected sites designed for use only by company employees. Now, many
companies are creating their own VPN (virtual private network) to accommodate the needs of remote
employees and distant offices.
Image courtesy Cisco Systems, Inc.
A typical VPN might have a main LAN at the corporate headquarters
of a company, other LANs at remote offices or facilities and
individual users connecting from out in the field.
Basically, a VPN is a private network that uses a public network (usually the Internet) to connect remote sites or users
together. Instead of using a dedicated, real-world connection such as leased line, a VPN uses "virtual" connections
routed through the Internet from the company's private network to the remote site or employee. In this article, you will
gain a fundamental understanding of VPNs, and learn about basic VPN components, technologies, tunneling and
What Makes a VPN?
A well-designed VPN can greatly benefit a company. For example, it can:
• Extend geographic connectivity
• Improve security
• Reduce operational costs versus traditional WAN
• Reduce transit time and transportation costs for remote users
• Improve productivity
• Simplify network topology
• Provide global networking opportunities
• Provide telecommuter support
• Provide broadband networking compatibility
• Provide faster ROI (return on investment) than traditional WAN
Networking – page 11 of 13
Features that are needed in a well-designed VPN:
• Network management
• Policy management
There are three types of VPN. In the next couple of sections, we'll describe them in detail.
There are two common types of VPN. Remote-access, also called a virtual private dial-up network (VPDN),
is a user-to-LAN connection used by a company that has employees who need to connect to the private network
from various remote locations. Typically, a corporation that wishes to set up a large remote-access VPN will
outsource to an enterprise service provider (ESP). The ESP sets up a network access server (NAS) and
provides the remote users with desktop client software for their computers. The telecommuters can then dial a
toll-free number to reach the NAS and use their VPN client software to access the corporate network.
A good example of a company that needs a remote-access VPN would be a large firm with hundreds of sales
people in the field. Remote-access VPNs permit secure, encrypted connections between a company's private
network and remote users through a third-party service provider.
Image courtesy Cisco Systems, Inc.
Examples of the three types of VPN
Networking – page 12 of 13
Through the use of dedicated equipment and large-scale encryption, a company can connect multiple fixed sites
over a public network such as the Internet. Site-to-site VPNs can be one of two types:
• Intranet-based - If a company has one or more remote locations that they wish to join in a single private
network, they can create an intranet VPN to connect LAN to LAN.
• Extranet-based - When a company has a close relationship with another company (for example, a
partner, supplier or customer), they can build an extranet VPN that connects LAN to LAN, and that
allows all of the various companies to work in a shared environment.
Image courtesy Cisco Systems, Inc.
Examples of the three types of VPN
Networking – page 13 of 13