A LAN (Local Area Network) is the foundation of every organization’s IT infrastructure. It is where computers, servers, printers, and IoT devices operate. It is the medium through which financial data, confidential documents, and customer personal data flow. And it is most often the first target of an attacker who has gained access to the internal infrastructure. Understanding the architecture, topologies, and above all the security of a LAN is now mandatory for every administrator and cybersecurity specialist.
What Is a LAN?
LAN (Local Area Network) is a local computer network connecting devices within a limited geographic area — an office, a building floor, or a corporate campus. Unlike a WAN, which connects distant locations, a LAN is characterized by high bandwidth (1–10 Gbps, and in modern deployments even 25–100 Gbps), minimal latency (below 1 ms), and full owner control over the infrastructure.
The first LAN was created in 1973 at Xerox PARC, where Robert Metcalfe designed Ethernet — a technology that to this day forms the basis of most local networks. Since then, LANs have undergone tremendous evolution: from shared coaxial cables with 10 Mbps bandwidth to switched 100 Gbps Ethernet environments with advanced segmentation, automation, and built-in security mechanisms.
A modern LAN is not just a data transmission medium. It is a critical element of an organization’s security infrastructure that, when properly designed, serves as the first line of defense against lateral movement, unauthorized access, and data exfiltration.
LAN Topologies
Network topology defines the physical or logical way devices are connected. The choice of topology directly affects performance, fault tolerance, and network security.
Star Topology
Star topology is the dominant model in modern LANs. All end devices (computers, printers, IP phones) connect to a central switch. The failure of a single device does not affect the others, and the central management point facilitates monitoring and security policy enforcement.
In practice, corporate LANs use an extended star topology, where access switches connect to distribution switches, and those connect to core switches. This three-layer hierarchical model (access-distribution-core) provides scalability and facilitates segmentation.
From a security perspective, star topology enables the implementation of access control on each switch port (802.1X), traffic monitoring at the level of each device, and rapid isolation of infected hosts.
Mesh Topology
In a mesh topology, each device connects directly to many (partial mesh) or all (full mesh) other devices. It provides the highest redundancy — the failure of a single link does not interrupt communication, as traffic is automatically rerouted through alternative paths.
Full mesh topology is expensive and rarely used in traditional LANs due to the number of required connections (n*(n-1)/2). However, partial mesh is standard in the core and distribution layers, where redundancy is critical. In wireless networks, mesh is gaining popularity thanks to Wi-Fi mesh systems that dynamically build an optimal topology.
Ring Topology
In a ring topology, devices are connected in a closed loop where data circulates in one or both directions. The classic ring (Token Ring IEEE 802.5) has practically disappeared from LANs, but this topology has survived in WAN/MAN networks (e.g., SONET/SDH) and in some industrial networks.
A dual ring provides redundancy — when one link fails, traffic is rerouted through the backup ring. This model is used in protocols such as ERPS (Ethernet Ring Protection Switching) in carrier networks.
Key LAN Components
Switches
The switch is the heart of a LAN. Unlike a hub, a switch forwards frames only to the destination port based on the MAC address table, eliminating unnecessary traffic and increasing security.
Managed switches offer features critical for security: VLANs, port security, DHCP snooping, Dynamic ARP Inspection, 802.1X, ACLs (Access Control Lists), port mirroring for IDS/IPS, and SNMP for monitoring. In enterprise environments, Layer 3 switches (L3 switches) are used, combining switching and routing functions and enabling inter-VLAN routing without the need for a separate router.
Routers
A router connects the LAN to the outside world — to the internet, a WAN, or other LANs. From a security standpoint, the router serves as a border gateway where access control lists (ACLs), NAT address translation, and traffic filtering are implemented.
In modern architectures, the router’s role as the network boundary is increasingly being taken over by next-generation firewalls (NGFWs), which combine routing functions with advanced packet inspection, application filtering, and threat protection.
Structured Cabling
The cable infrastructure is the physical foundation of a LAN. The most commonly used transmission media are:
- Copper cable (UTP/STP) — categories Cat5e (1 Gbps/100 m), Cat6 (1 Gbps/100 m, 10 Gbps/55 m), Cat6a (10 Gbps/100 m), and Cat8 (25–40 Gbps/30 m). Standard for horizontal office cabling.
- Single-mode fiber (SMF) — range up to tens of kilometers, used in core connections and between buildings.
- Multi-mode fiber (MMF) — range up to 550 m at 10 Gbps (OM3/OM4), used in data centers and internal connections.
From a security perspective, fiber optic cables are harder to tap than copper cables — they do not emit electromagnetic fields and cannot be “tapped” without physically breaking the connection (which is immediately detected by the monitoring system).
Wi-Fi Access Points
Access points (APs) extend the LAN with wireless access. Modern APs support the Wi-Fi 6 (802.11ax) and Wi-Fi 6E (6 GHz) standards, offering bandwidth up to 9.6 Gbps and supporting hundreds of simultaneous clients through OFDMA and MU-MIMO technologies.
A wireless LAN (WLAN) requires additional security measures: WPA3-Enterprise with 802.1X authentication, guest network segmentation from the corporate network, Wireless IDS/IPS (WIDS/WIPS) for detecting rogue access points, and signal level control to limit coverage beyond the organization’s physical boundaries.
Ethernet and IEEE 802.3 Standards
Ethernet (IEEE 802.3) is the dominant data link layer standard in LANs, defining addressing (MAC addresses), frame formatting, and medium access control.
Key Ethernet variants used in modern LANs:
| Standard | Bandwidth | Medium | Application |
|---|---|---|---|
| 1000BASE-T (802.3ab) | 1 Gbps | Cat5e/Cat6, 100 m | Workstations, APs |
| 2.5GBASE-T (802.3bz) | 2.5 Gbps | Cat5e/Cat6, 100 m | Wi-Fi 6 APs, IoT |
| 5GBASE-T (802.3bz) | 5 Gbps | Cat6, 100 m | High-performance APs, cameras |
| 10GBASE-T (802.3an) | 10 Gbps | Cat6a, 100 m | Servers, uplinks |
| 25GBASE-SR (802.3by) | 25 Gbps | MMF, 100 m | Data center |
| 100GBASE-SR4 (802.3bm) | 100 Gbps | MMF, 100 m | Core, data center |
The 802.3bz standard (2.5G/5G BASE-T) is gaining popularity because it allows using existing Cat5e/Cat6 cabling to achieve bandwidth higher than 1 Gbps without costly cable replacement — which is particularly important when deploying Wi-Fi 6 access points.
An Ethernet frame contains a source MAC address (48 bits), a destination MAC address, the upper-layer protocol type (EtherType), data, and a CRC checksum. Ethernet itself does not provide encryption or authentication — these functions are handled by upper-layer protocols (e.g., MACsec at Layer 2, IPsec at Layer 3, TLS at Layer 4).
LAN vs WAN vs WLAN — Comparison
Understanding the differences between network types is fundamental to informed infrastructure design.
| Feature | LAN | WAN | WLAN |
|---|---|---|---|
| Range | Building, campus (<1 km) | Cities, countries (unlimited) | AP coverage area (50–100 m) |
| Bandwidth | 1–100 Gbps | 1 Mbps – 10 Gbps | Up to 9.6 Gbps (Wi-Fi 6) |
| Latency | <1 ms | 10–300 ms | 1–10 ms |
| Medium | Copper cable, fiber optic | Carrier links, internet | Radio waves (2.4/5/6 GHz) |
| Ownership | Company (full control) | Carrier/ISP | Company (with regulatory limitations) |
| Security | High potential | Requires encryption (VPN) | Requires WPA3, 802.1X |
| Cost | One-time (CAPEX) | Subscription (OPEX) | CAPEX + management |
WLAN is technically a subset of LAN — an extension of the local network with wireless access. In practice, a WLAN shares the same switching infrastructure as the wired LAN and is subject to the same security policies. The difference lies in the additional attack surface introduced by the radio medium: traffic eavesdropping (wardriving), deauthentication (deauth attacks), evil twin APs, and attacks on authentication protocols.
VLAN Segmentation — The Foundation of LAN Security
Network segmentation is one of the most effective methods for limiting the impact of a security incident. A VLAN (Virtual LAN) divides a physical LAN into logically isolated segments, where devices in different VLANs cannot communicate with each other without the intermediation of a router or firewall with appropriate rules.
Why Is Segmentation Critical?
Without segmentation, compromising a single device gives the attacker access to the entire network — servers, databases, ERP systems, IoT devices. Lateral movement is one of the most dangerous phases of an attack: the attacker moves within a flat network, escalates privileges, and reaches critical assets while remaining undetected by perimeter defenses.
Proper VLAN segmentation creates boundaries that the attacker must cross — and each such boundary is a point where a firewall, IDS/IPS, or monitoring system can detect and block unauthorized activity.
Recommended Segmentation Model
A typical LAN segmentation in a company should include:
- Corporate VLAN — employee workstations with access to corporate resources
- Server VLAN — application servers, databases, backup systems
- Management VLAN — management interfaces of switches, routers, firewalls, server IPMI/iLO
- Guest VLAN — an isolated network with internet-only access, without visibility to corporate resources
- IoT VLAN — printers, cameras, sensors, BMS systems — devices with limited update capabilities and often weak security
- VoIP VLAN — IP phones with QoS priority
- DMZ VLAN — public-facing servers (web, email, DNS) separated from the internal network
Traffic between VLANs should pass through a firewall with rules based on the principle of least privilege. Only necessary communication is allowed — for example, workstations can connect to the file server on the SMB port, but not to the switch management interface.
Microsegmentation and Zero Trust
Microsegmentation is an evolution of the VLAN concept, where security policies are defined at the level of individual workloads or applications rather than network segments. In the Zero Trust model, every communication requires authentication and authorization, regardless of location within the network.
Technologies supporting microsegmentation include SDN (Software-Defined Networking), NSX (VMware), Cisco ACI, and cloud-native solutions (AWS Security Groups, Azure NSG). Combined with Zero Trust policies, they eliminate the assumption that internal traffic is trusted.
LAN Security
Securing a LAN requires a multi-layered approach encompassing access control, Layer 2 protection, monitoring, and incident response.
802.1X — Port Authentication
IEEE 802.1X is a network access control protocol at the switch port level. Before gaining network access, a device must authenticate through a RADIUS server (e.g., FreeRADIUS, Cisco ISE, Microsoft NPS).
The 802.1X authentication process involves three roles:
- Supplicant — software on the client device (built into Windows, macOS, Linux)
- Authenticator — the switch or access point that controls port access
- Authentication Server — the RADIUS server that verifies credentials
After successful authentication, RADIUS can dynamically assign the device to the appropriate VLAN based on its role, type, or user identity. Unauthenticated devices are placed in the guest VLAN or blocked entirely.
NAC (Network Access Control)
NAC extends the functionality of 802.1X with posture assessment of the device’s security status before granting network access. A NAC system checks, among others:
- Whether the operating system is up to date (security patches)
- Whether an antivirus agent is installed and active
- Whether the host firewall is enabled
- Whether the device complies with the organization’s configuration policy
Devices that do not meet the requirements are placed in a remediation VLAN, where they can download updates and improve their security posture before gaining full network access.
Port Security
Port security limits the number of MAC addresses allowed on a given switch port. An administrator can configure:
- Static MAC — manually assigned MAC addresses to ports
- Sticky MAC — the switch automatically learns and remembers the first MAC address on a port
- MAC Limit — the maximum number of MAC addresses per port (e.g., 1 for a workstation, 3 for an IP phone + computer + USB-C monitor)
A port security violation can result in port shutdown, traffic restriction, or an SNMP alarm generation — providing an early warning of a potential attack.
DHCP Snooping
DHCP snooping protects against attacks involving the insertion of an unauthorized DHCP server into the network. The switch distinguishes between trusted ports — connected to the legitimate DHCP server — and untrusted ports — user ports. DHCP responses (OFFER, ACK) from untrusted ports are dropped.
DHCP snooping builds an IP-MAC-port binding table (DHCP snooping binding table) that is used by other security mechanisms — Dynamic ARP Inspection and IP Source Guard.
Dynamic ARP Inspection (DAI)
DAI verifies ARP packets against the DHCP snooping table. ARP requests and responses with invalid IP-MAC bindings are dropped, effectively blocking ARP spoofing attacks.
MACsec (IEEE 802.1AE)
MACsec provides encryption and authentication at Layer 2 (Ethernet). Each frame is encrypted with AES-GCM-128 or AES-GCM-256 with data integrity. MACsec protects against eavesdropping, modification, and frame injection at the link level — which is particularly important in network segments carrying sensitive data.
Common Attacks on LANs
Knowledge of Layer 2 attack vectors is essential for implementing adequate defenses.
ARP Spoofing / ARP Poisoning
The attacker sends forged ARP messages, associating their MAC address with the IP address of the default gateway or another device. The result: all of the victim’s traffic passes through the attacker’s machine (a Man-in-the-Middle attack), enabling credential interception, data modification, and malicious code injection.
Defense: Dynamic ARP Inspection, static ARP entries on critical devices, VLAN segmentation limiting the attack scope.
VLAN Hopping
The attacker gains access to a VLAN they should not have access to. Two main variants:
- Switch Spoofing — the attacker configures their interface as a trunk port and negotiates DTP (Dynamic Trunking Protocol) with the switch, gaining access to all VLANs.
- Double Tagging — the attacker sends a frame with two 802.1Q headers. The first switch strips the outer tag (native VLAN), and the second forwards the frame to the target VLAN.
Defense: disable DTP on all ports (switchport nonegotiate), change the native VLAN to an unused one, explicitly configure ports as access or trunk.
MAC Flooding
The attacker floods the switch with thousands of frames with random MAC addresses, overflowing the CAM (Content Addressable Memory) table. The switch enters fail-open mode and starts acting like a hub — forwarding frames to all ports, enabling traffic eavesdropping.
Defense: port security with MAC address limits, rate limiting on access ports, CAM table size monitoring.
DHCP Starvation and Rogue DHCP
In a DHCP starvation attack, the attacker exhausts the IP address pool of the legitimate DHCP server by sending mass requests with different MAC addresses. Then they launch their own rogue DHCP server, which assigns clients addresses with a default gateway pointing to the attacker’s machine.
Defense: DHCP snooping, port security (MAC limit per port), DHCP rate limiting.
STP Manipulation
The attacker sends crafted BPDU (Bridge Protocol Data Units) messages, attempting to be elected as the root bridge in the STP (Spanning Tree Protocol) tree. Control over the root bridge allows rerouting network traffic through the attacker’s machine.
Defense: BPDU Guard on access ports, Root Guard on uplink ports, deployment of RSTP or MSTP with proper prioritization.
Monitoring and Auditing the LAN
LAN security requires continuous monitoring — even the best defenses are ineffective without the ability to detect anomalies and respond to incidents.
Network Traffic Monitoring
Port mirroring (SPAN) or dedicated TAP devices allow copying network traffic to analysis systems. IDS/IPS (Intrusion Detection/Prevention System) analyzes traffic in real time, detecting known attack signatures and behavioral anomalies.
Modern NDR (Network Detection and Response) solutions use machine learning to build a baseline communication profile of the network and detect deviations — such as unusual connections between segments, large data transfers outside working hours, or communication with suspicious addresses.
SIEM and SOC
Logs from switches, RADIUS servers, firewalls, and NAC systems should be centrally collected and correlated in a SIEM (Security Information and Event Management) system. The SOC (Security Operations Center) team analyzes alerts, conducts investigations, and responds to incidents on a 24/7 basis.
Key events to monitor in a LAN:
- Failed 802.1X authentication attempts
- Port security violations (new MAC addresses)
- STP topology changes
- Detection of unauthorized DHCP servers
- ARP table anomalies
- Unusual traffic between VLANs
- Connections from unknown MAC/IP addresses
Audits and Penetration Tests
Regular audits of switch and firewall configurations verify compliance with security policies and best practices. Layer 2 penetration tests simulate attacks (ARP spoofing, VLAN hopping, MAC flooding) and assess the effectiveness of implemented defenses.
An audit should include: verification of VLAN and trunk port configurations, review of 802.1X and NAC policies, review of firewall rules between VLANs, network device inventory, analysis of logs and alerts from the recent period, and assessment of network documentation.
Designing a Secure LAN
Building a secure LAN requires incorporating security aspects from the design stage, not only after deployment.
Design Principles
Hierarchical architecture — division into access, distribution, and core layers facilitates segmentation, management, and scalability. The access layer is where access controls are implemented (802.1X, port security). The distribution layer is the enforcement point for routing and firewalling policies between VLANs. The core layer provides fast switching without policies — its role is performance.
Defense in depth — multi-layered security where each layer serves as an independent barrier. Even if the attacker overcomes one mechanism (e.g., 802.1X through stolen credentials), VLAN segmentation, internal firewall, and NDR/SOC monitoring can detect and stop the attack at the next stage.
Principle of least privilege — every device and every user receives access only to resources necessary for performing their tasks. By default, all traffic is blocked, and only explicitly configured flows are permitted.
Management separation — management interfaces (SSH to switches, firewall console, server IPMI) should be in a dedicated management VLAN, accessible only from authorized administrative workstations.
Secure LAN Checklist
When designing and deploying a LAN, the following points should be verified:
- VLAN segmentation aligned with asset classification and user roles
- 802.1X on all access ports with fallback to guest VLAN
- Port security with MAC address limits
- DHCP snooping with trusted ports only on the uplink to the DHCP server
- Dynamic ARP Inspection enabled on user VLANs
- DTP disabled on all ports — explicit access/trunk configuration
- BPDU Guard on access ports
- Unused ports disabled and assigned to an unused VLAN
- Switch management passwords changed from defaults, SSH instead of Telnet
- Central log server (syslog) collecting events from all network devices
- Topology, VLAN, and firewall rule documentation up to date and accessible
- Regular configuration audits and Layer 2 penetration tests
LAN in the Context of Regulatory Compliance
Many regulations and security standards impose requirements on LAN segmentation and protection. The PCI DSS standard requires segmentation of the network processing payment card data. The NIS2 directive imposes network risk management obligations on essential and important entities. The ISO 27001 standard requires network access control (A.13.1). The National Cybersecurity System (KSC) places requirements on essential service operators regarding the protection of network infrastructure.
Proper VLAN segmentation, 802.1X/NAC implementation, and continuous monitoring are not just best practices — they are often regulatory requirements whose non-compliance can result in financial penalties and legal liability.
Summary
A LAN is much more than cabling and switches. It is a critical element of an organization’s security that, when properly designed, restricts an attacker’s lateral movement, enforces access control, and provides the network traffic visibility necessary for threat detection.
The key elements of a secure LAN are: VLAN segmentation aligned with the Zero Trust model, 802.1X authentication with dynamic VLAN assignment, Layer 2 protection (DHCP snooping, DAI, port security, BPDU Guard), and continuous monitoring by a SOC team.
At nFlo, we help organizations design, implement, and monitor secure LANs. Having completed over 500 projects for more than 200 clients, we have repeatedly seen how a lack of segmentation or improper switch configuration leads to the compromise of the entire infrastructure. If you need a security audit of your LAN or support in implementing segmentation and access control, contact us.
Need expert support? nFlo team can help secure your organization:
Related topics
See also:
