Network Infrastructure Glossary

The strongest network segmentation boundary: no physical connection exists between two systems or segments. Because there is no cable, wireless link, or intermediary device connecting them, there is no network path an attacker can exploit to move laterally. An air gap cannot be defeated by software misconfiguration — it can only be bypassed by physical access (e.g., a USB drive inserted by an insider). Used for classified networks, industrial control systems, and the highest-security environments where any cross-segment communication would be catastrophic. The tradeoff is zero scalability: each isolated domain requires its own dedicated hardware.

A network architecture using entirely separate physical hardware — separate switches, routers, cabling runs, and network equipment — for each security segment. Segments may be connected through a routing or bridging device that enforces access policy, but each segment operates on its own dedicated infrastructure. Physical segmentation provides a strong, auditable security boundary: an administrator can physically trace cables to verify what is connected to what, and no software misconfiguration can accidentally bridge two segments. The drawback is cost and scale — dedicated hardware per segment means 100 customers require 100 switches minimum.

A logical segmentation technology that creates isolated broadcast domains within shared physical switch infrastructure. Devices on different VLANs cannot communicate at Layer 2, even if they are connected to the same physical switch — exactly as if they were on physically separate switches. The technical mechanism is IEEE 802.1Q tagging: the switch adds a VLAN ID to each Ethernet frame and only forwards it to ports belonging to that VLAN. VLANs solve the scalability problem of physical segmentation: one physical switch can host dozens of isolated virtual segments, making enterprise network segmentation economically practical.

The IEEE standard that defines VLAN tagging on Ethernet networks. An 802.1Q tag is a 4-byte field inserted into the Ethernet frame header, containing the VLAN identifier (VID) among other fields. Switches use this tag to determine which VLAN a frame belongs to and restrict forwarding to ports within that VLAN. Frames traveling between switches on trunk links carry their 802.1Q tags; frames delivered to end devices on access ports have the tag stripped (end devices typically do not need to be VLAN-aware). This standard enables the multi-VLAN logical segmentation model used in virtually every enterprise network.

The process of forwarding traffic between two different VLANs, which requires a Layer 3 device (a router or Layer 3 switch) because VLANs are isolated Layer 2 broadcast domains. A device in VLAN 10 cannot send a packet directly to a device in VLAN 20 — the packet must be sent to the default gateway (the Layer 3 device), routed across the VLAN boundary, and delivered to the destination. This routing hop is a security enforcement point: access control lists applied on the Layer 3 device control exactly which traffic is permitted between VLANs, which devices can reach which servers, and on which ports.

An attack technique that allows a device in one VLAN to send traffic to or receive traffic from a different VLAN without passing through the Layer 3 routing device. The most common method is switch spoofing: the attacker's device sends 802.1Q trunk negotiation frames, tricking the switch into establishing a trunk link to the attacker. A trunk port carries traffic for all VLANs — the attacker can then inject or sniff traffic on any VLAN on that switch. Prevention: statically configure all access ports as access ports for their assigned VLAN and disable auto-negotiation (DTP). Only deliberate uplinks between switches should be trunk ports.

A network architecture that separates the functions of a traditional network device (forwarding, routing decisions, and configuration) into three distinct logical layers — the data plane, control plane, and management plane — that can be implemented independently in software. SDN decouples network intelligence from physical hardware, enabling virtual network devices (firewalls, switches, routers) to be provisioned, configured, and scaled entirely through software on commodity hardware. SDN is the foundation of all cloud networking: without it, cloud customers could not create virtual networks, security groups, or load balancers with an API call.

The SDN layer responsible for the actual forwarding and processing of network traffic — the "doing" layer. When a packet arrives at a network device, the data plane handles the mechanics of moving it: looking up the destination in the forwarding table, applying NAT translations, handling VLAN tags, and performing in-line encryption or decryption. The data plane operates at high speed with minimal decision-making — the decisions have already been made by the control plane. On a physical switch, the data plane is represented by the front-panel ports where cables connect. In a cloud environment, the data plane is software running on the hypervisor's networking stack.

The SDN layer responsible for building and maintaining the tables and policies that tell the data plane how to forward traffic — the "decision" layer. The control plane never directly handles end-user traffic; it calculates and stores the forwarding intelligence. Functions include: building the IP routing table (via static routes or dynamic routing protocols like OSPF/BGP), maintaining the MAC address table on Layer 2 switches, managing NAT translation state tables, and maintaining session state for stateful firewalls. Changes to the network topology (a link goes down, a new router appears) are processed by the control plane, which updates its tables — the data plane then automatically adapts its forwarding behavior.

The SDN layer through which network administrators configure and monitor network devices — the "configuration" layer. Management plane interfaces include SSH (CLI), HTTPS (web GUI), APIs (Netconf, RESTCONF, REST APIs for automation), and SNMP (monitoring). Administrators use the management plane to define routing policies, create VLANs, write ACLs, update firmware, and view device health. Changes made via the management plane flow down to update the control plane's tables, which then changes how the data plane forwards traffic. The management plane is a high-value attack target: access to it means the ability to reconfigure the entire device's security posture.

An attack technique where an adversary who has compromised one system uses that foothold to access additional systems within the same network. Lateral movement is the mechanism that turns a single endpoint compromise into a full network breach. Network segmentation — air gaps, physical segmentation, VLANs — limits lateral movement by creating barriers that must be explicitly crossed via controlled routing paths. Without segmentation, a flat network provides no barriers: a compromised workstation has a direct Layer 2 path to every server, database, and device on the same network.

A switch port configured to carry traffic for multiple VLANs simultaneously by tagging each frame with its 802.1Q VLAN ID. Trunk ports are used on uplinks between switches and between switches and routers, where traffic for multiple VLANs must flow over the same physical link. An access port, by contrast, belongs to exactly one VLAN and does not tag frames — it is used for connections to end devices (computers, printers, servers). VLAN hopping attacks target the trunk negotiation process: by default, some switches auto-negotiate trunk links, which attackers can exploit by sending trunk negotiation frames from an access port.