The Security Wheel
This article catalogs the ten security mechanisms featured in a popular circular infographic by Dan Nanni (study-notes.org). Arranged as a "wheel of security," each wedge represents a distinct control that, together, forms a comprehensive defense-in-depth strategy for Ethernet networks.
MAC Address Filtering
Blocks or permits traffic based on the source MAC address of the device. Operates on the principle of an allowlist or blocklist to restrict which endpoints can communicate through a switch port.
Port Security
Limits the number of MAC addresses allowed on a single switch port. Helps prevent MAC flooding attacks and unauthorized device connections by shutting down or restricting the port when the limit is exceeded.
802.1X — Port-Based Authentication
An IEEE standard for network access control that requires devices to authenticate (via RADIUS) before being allowed onto the network. Uses three roles: supplicant (client), authenticator (switch), and authentication server.
DHCP Snooping
Ensures that only DHCP messages from trusted ports (typically uplinks to the legitimate DHCP server) are forwarded. Frames from DHCP servers on untrusted ports are dropped, preventing rogue DHCP server attacks.
BPDU Guard
Protects Spanning Tree Protocol (STP) by disabling any port that receives a BPDU when configured for PortFast. Prevents rogue switches from being inadvertently introduced into the network topology.
Storm Control
Suppresses excessive broadcast, multicast, or unicast traffic by dropping frames once a configured threshold (as a percentage of bandwidth or packets per second) is exceeded. Prevents network storms from degrading performance.
Private VLANs
Extends VLAN segmentation by creating isolated sub-domains within a single VLAN. Promiscuous ports can talk to all; isolated ports can only talk to promiscuous ports; community ports can talk within the group.
MACsec (IEEE 802.1AE)
Provides hop-by-hop encryption and authentication at Layer 2 using AES-GCM. Protects data integrity and confidentiality between directly connected switches or hosts without relying on higher-layer protocols.
VLAN Segmentation
Logically divides a physical switch network into multiple isolated broadcast domains using VLAN tags (IEEE 802.1Q). Traffic from one VLAN cannot directly reach another without a router, reducing attack surface.
Dynamic ARP Inspection (DAI)
Prevents ARP spoofing and man-in-the-middle attacks by validating ARP packets against the DHCP Snooping binding table. Invalid ARP replies are dropped before they poison the target's cache.
Quick Reference
| Mechanism | Primary Function | Attack Mitigated |
|---|---|---|
| MAC Filtering | Allow/block by MAC | Unauthorized devices |
| Port Security | Limit MACs per port | MAC flooding |
| 802.1X | Port-based auth | Unauthorized access |
| DHCP Snooping | Validate DHCP msgs | Rogue DHCP server |
| BPDU Guard | Disable on BPDU rx | Rogue STP / loops |
| Storm Control | Rate-limit L2 floods | Broadcast storm |
| Private VLANs | Sub-VLAN isolation | Inter-host snooping |
| MACsec | L2 encryption | Eavesdropping |
| VLAN Segmentation | Logical separation | Lateral movement |
| DAI | ARP packet validation | ARP spoofing / MITM |