3.2 Creating a Network: Switching and Topologies

Picture a school where everyone shares one giant hallway. Traffic jams, chaos, and anyone can wander into any classroom. Networks have the same problem when every device sits on one big flat network. That's why we split networks into smaller pieces called segments and connect them using specific layouts called topologies. This topic covers how data actually moves through a segmented network, how to decide where to draw those dividing lines, and which physical layouts make sense for different situations.

How Data Moves Across a Segmented Network

Segmenting a network means sorting devices into smaller groups so performance, management, and security all get better. Instead of one massive network where every device hears every broadcast, you break things up. Each segment gets its own distinct range of IP addresses, and segments usually separate different user types (like staff vs guests), functions (like voice vs data), or resources (like servers vs workstations).

You can segment a network two ways:

• Physically, using separate hardware like dedicated switches, routers, or cabling
• Logically, through software configurations like VLANs or subnets

Building and Sending a Packet

Before data goes anywhere, the sending device builds a packet. The packet's header includes:

• The source IP address (where it came from)
• The destination IP address (where it's going)
• Other routing information the network needs

Once the packet is built, the sending host has to figure out one key question: is the destination on my segment, or somewhere else? It answers this by checking the destination IP against its own IPv4 address and subnet mask. The subnet mask tells the host which part of an IP address identifies the network and which part identifies the device.

Same Segment vs Different Segment

If the destination is on the same segment: A switch handles it. The switch delivers the data straight to the MAC address of the destination device. No router needed. Switches work with MAC addresses (physical hardware addresses) to move frames around inside a single segment.

If the destination is on a different segment or network: The data gets sent to the default gateway, which is the router. The router is the device that knows how to reach other networks.

The Router's Job

Every router keeps a routing table: a list of possible paths packets can take to reach different networks. When a packet arrives, the router looks at the destination IP address and matches it against entries in the routing table to decide which segment should get the data. Then it hands the packet off to a switch on the correct segment, and that switch delivers it to the right device.

So the full trip looks like this:

</>Code
Device A → Switch → Router → Switch → Device B
(builds packet)  (checks routing table)  (final delivery via MAC)

If A and B are on the same segment, you skip the router entirely and it's just: Device A → Switch → Device B.

Choosing How to Segment a Network

There's no single "right" way to segment. You pick based on what devices you have, how sensitive they are, what access they need, and how much traffic they produce. A few general rules:

• Put user workstations, internal services, IoT devices, and guest access in separate segments. This cuts down on broadcast congestion (when broadcast messages flood every device).
• Separation also limits lateral movement: if an attacker gets into one segment, they can't easily hop to others.

Here are the main segmentation tools you'll see.

Physical Segmentation

Use physical segmentation when you need the maximum level of isolation and security. Think separate departments, restricted zones, or sensitive labs. This approach uses dedicated switches, routers, or cabling to create subnetworks that are completely cut off from each other.

Example: a computer science department at a university sets up a testing lab on its own router and switch, totally separate from the hardware serving university offices and classrooms. Because the lab has dedicated equipment, its traffic is physically isolated from the rest of the network.

The trade-off: physical segmentation costs more and adds complexity (more hardware to buy, install, and manage). But the separation is rock solid.

VLANs (Virtual LANs)

VLANs let you separate devices and traffic without adding extra physical hardware. Devices plugged into the same physical switch can be grouped into different virtual networks just by configuring the switch's ports.

Example: in an office, a single managed switch connects employee computers, printers, and VoIP phones. The ports are assigned to different VLANs, so even though everything sits on one physical switch, data, voice, and print traffic stay logically apart.

VLANs are perfect when you're sharing hardware and need flexibility to group devices by type, department, or role.

Subnetting

Subnetting splits a large network into smaller address ranges that are logically separated. You use it to:

• Organize devices by IP range
• Support access control and routing
• Allocate addresses efficiently
• Enforce a firewall between IP groups
• Control broadcasts across multiple segments

If VLANs are about logically grouping devices on shared switches, subnetting is about logically dividing up IP address space. The two often work together.

Wireless Segmentation with SSIDs

For Wi-Fi, you use multiple SSIDs (the network names you see when you connect) when different user groups need separate wireless access. Classic example: one SSID for staff, another for guests. Each SSID can be mapped to its own subnet or VLAN, so you get access control and traffic isolation at the same time.

Choosing a Wired Network Topology

Topology refers to how devices in a network are physically connected and how traffic flows between them. The right choice depends on what the network actually needs: reliability, cost, and ease of maintenance all matter.

Modern networks typically use star, mesh, or hybrid designs. Older designs like bus and ring are generally avoided because they don't handle faults well and don't scale.

Star Topology

In a star topology, every device connects to a central network device (usually a switch). All traffic passes through that central point.

Pros:

• Simple to set up, expand, and troubleshoot
• Each device has its own independent connection, so one cable failing only affects one device
• Relatively cost-effective (minimal cabling and hardware)
• Great for networks with limited resources

Con:

• The central switch is a single point of failure. If it dies, the whole segment goes down.

Mesh Topology

In a mesh topology, every node has a direct link to every other node. That means data has multiple possible routes to reach any destination.

Pros:

• High fault tolerance: if one connection fails, traffic just takes another path
• More reliable overall because of the redundancy

Cons:

• Way more cabling, more devices, more management
• Expensive and complex
• Best for networks with dedicated support staff

Hybrid Topology

A hybrid topology mixes star and mesh elements. You'll find these in larger networks where different segments have different needs. Maybe the server room uses mesh for reliability, while the office floors use star because they just need something cheap and simple. Hybrid designs let you balance performance, reliability, and cost across a large LAN.

Picking the Right One

Match the topology to what matters most:

Reliability is the big one for networks where uptime is critical. Star is solid for most situations, but mesh wins when you absolutely cannot afford downtime. Cost pushes most small and mid-sized setups toward star, while hybrid shows up when a single approach doesn't fit every part of the network.

Evaluating an AI-Generated LAN Configuration

AI tools can be useful for network design. They can suggest topologies, propose ways to segment a LAN, and recommend what devices you'll need. But AI output is a starting point, not a finished plan.

Writing a Good Prompt

The quality of an AI suggestion depends heavily on the quality of your prompt. A good prompt spells out technical requirements clearly, including things like:

• How traffic flows (which segments talk to which)
• What security policies apply
• How much redundancy is needed
• Limits imposed by the physical layout (building size, cable runs, existing hardware)

These are examples of requirements, not the full list. If your prompt leaves out important details, you'll get a design that's incomplete or just plain wrong.

What Can Go Wrong

Even with a solid prompt, AI-generated configurations have common issues:

• Missing or half-finished segments: it might forget a guest network entirely, or suggest a VLAN without configuring routing between segments.
• Partial coverage of requirements: it addresses some of what you asked for and quietly drops the rest.
• Suboptimal device or link choices: it recommends hardware that works but isn't the best fit for your situation.
• Unnecessary complexity or cost: the design is technically correct but overbuilt, adding mesh redundancy where a simple star would have been fine.

Verify Before You Deploy

The core rule: any AI output must be checked and confirmed before you put it in place. Verify that the design actually fits the network's needs, goals, and constraints. Use AI to generate ideas and spot potential issues or improvements, then apply your own judgment to decide what actually gets built. AI is a brainstorming partner, not the final authority.