2.5 Network Media, Ethernet Standards & Physical Topologies

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

2.5 Network Media, Ethernet Standards & Physical Topologies

Key Takeaways Explain This Topic AI

10BASE-T, 100BASE-TX and 1000BASE-T all run over twisted-pair copper with a 100-metre maximum segment length; only 1000BASE-T uses all four pairs bidirectionally.

CAT 5 is rated to 100 MHz and Fast Ethernet; CAT 5e is the minimum for reliable 1000BASE-T, and CAT 6/6a extend to 250 MHz and 500 MHz respectively.

Multimode fibre carries 850/1300 nm light over hundreds of metres; single-mode fibre uses 1310/1550 nm lasers over tens of kilometres and neither radiates a readable electromagnetic signal.

Token Ring (IEEE 802.5) is a deterministic token-passing ring running at 4 or 16 Mbps through an MAU, physically wired as a star — legacy, but still examinable.

Shared media (hubs, coax, 802.11) expose every frame to every station; switched media force an attacker to poison ARP, flood the CAM table or obtain a SPAN port.

Last updated: September 2026

2.5 Network Media, Ethernet Standards & Physical Topologies

Appendix B2 of the CPSA syllabus does not merely ask which cable is faster. It asks you to recognise "varying network types that could be encountered during a penetration test" — CAT 5 and fibre, 10/100/1000BaseT, Token Ring and Wireless (802.11) — and then to reason about the security implications of shared media, switched media and VLANs . On an internal engagement the physical layer decides what you can see from a wall jack, how far you can be from the target, and whether passive interception is even possible.

1. Copper Twisted-Pair Cabling Categories

Structured cabling is graded by the bandwidth its twisted pairs can carry before crosstalk destroys the signal. Every category below terminates in an 8P8C ( RJ-45 ) connector and is limited to a 100-metre channel — 90 m of solid horizontal cable plus 10 m of stranded patch leads.

Category Rated Bandwidth Typical Ethernet Support Shielding Assessment Note
CAT 3 16 MHz 10BASE-T UTP Obsolete data cabling; still found carrying analogue voice and alarm circuits
CAT 5 100 MHz 100BASE-TX UTP The syllabus baseline; gigabit is out of specification and unreliable
CAT 5e 100 MHz (tighter crosstalk limits) 1000BASE-T UTP The realistic minimum for gigabit access layers
CAT 6 250 MHz 1000BASE-T, 10GBASE-T to 55 m UTP or F/UTP Common in refurbished UK office floors
CAT 6a 500 MHz 10GBASE-T to 100 m Usually shielded Data-centre and high-density access

CAT 7 / 7a 600 / 1000 MHz 10GBASE-T and beyond S/FTP (individually shielded pairs) Uses GG45/TERA connectors, rare in UK enterprise

UTP (Unshielded Twisted Pair) relies purely on the twist rate to cancel interference. STP/FTP adds a foil or braid that must be bonded to earth at the patch panel; an unbonded shield behaves as an antenna and can make emissions worse , which is a genuine finding during a physical review.

2. Ethernet Transmission Standards (10/100/1000BaseT)

The BASE in a designation means baseband — the whole medium carries one signal, with no frequency-division multiplexing. The leading number is the megabit rate and the trailing letter describes the medium ( T = twisted pair, X = a block-coded fibre or copper variant, F / S / L = fibre). +---------------+---------+----------------+-------------------+---------------------------+

| Standard | Rate | Media | Pairs Used | Max Segment |
+---------------+---------+----------------+-------------------+---------------------------+
| 10BASE-T | 10 Mb/s | CAT 3 or better| 2 of 4 (1/2, 3/6) | 100 m |
| 100BASE-TX | 100 Mb/s| CAT 5 or better| 2 of 4 (1/2, 3/6) | 100 m |
| 1000BASE-T | 1 Gb/s | CAT 5e or better| ALL 4, bidirectional | 100 m |
| 10GBASE-T | 10 Gb/s | CAT 6a | ALL 4, bidirectional | 100 m (55 m on CAT 6) |
| 1000BASE-SX | 1 Gb/s | Multimode fibre| 1 pair | 220-550 m (core dependent)|
| 1000BASE-LX | 1 Gb/s | Single-mode | 1 pair | up to 10 km |
+---------------+---------+----------------+-------------------+---------------------------+

Two consequences matter operationally:

10BASE-T and 100BASE-TX leave two pairs idle. Those spare pairs are what Power over Ethernet (802.3af/at) historically used in "Alternative B", and what unscrupulous installers use to run two 100 Mb links down one cable. A jack that appears dead may simply be split onto pairs 4/5 and 7/8.

1000BASE-T transmits on all four pairs in both directions simultaneously , using hybrid circuits and echo cancellation to separate the directions. A passive vampire tap that works on 100BASE-TX will not cleanly recover gigabit traffic, which is why professional taps for gigabit links are active devices requiring their own power — and therefore visible during a physical walkthrough.

3. Fibre Optic Media

Fibre carries modulated light through a glass core surrounded by lower-refractive-index cladding.

Multimode fibre (MMF) — 50 µm or 62.5 µm core, driven by 850 nm VCSELs or 1300 nm LEDs. Many light paths ("modes") propagate, so modal dispersion limits distance to hundreds of metres. Graded OM1 through OM5; jackets are conventionally orange (OM1/OM2), aqua (OM3/OM4) or lime green (OM5).

Single-mode fibre (SMF) — 8–10 µm core, driven by 1310 nm or 1550 nm lasers. Only one mode propagates, so runs of tens of kilometres are routine. Jackets are conventionally yellow.

The security properties are what CPSA cares about:

No usable electromagnetic emanation. Copper radiates a signal that can, in principle, be recovered at a distance; a fibre strand does not. Fibre is therefore preferred for links crossing uncontrolled space.

Interception requires physical interruption. A fibre tap works by bending the strand past its critical angle so a fraction of the light escapes, or by splicing in a splitter. Both attenuate the link measurably, and a monitored optical budget will show the loss. This is why fibre runs between buildings should be in monitored conduit.

Immunity to induced interference and ground loops. Fibre carries no current, so it cannot conduct a surge between buildings and cannot be disrupted by nearby motors or fluorescent ballasts.

4. Token Ring and Legacy Ring Architectures

IEEE 802.5 Token Ring , developed by IBM, is explicitly named in the CPSA syllabus even though it is long obsolete in production.

Stations pass a 3-byte token around a logical ring. Only the station holding the token may transmit, so collisions are impossible and latency is deterministic — the property that kept it alive in manufacturing and financial back offices long after Ethernet won elsewhere.

Speeds are 4 Mbps or 16 Mbps (later 100 Mbps HSTR saw almost no deployment). A 4 Mbps station inserted into a 16 Mbps ring can beacon the ring down — an availability risk worth noting if you are asked to connect equipment.

It is wired physically as a star into a MAU/MSAU (Multistation Access Unit) using IBM Type 1 shielded cabling and hermaphroditic IBM Data Connectors, or UTP with media filters. The ring exists logically inside the MAU.

FDDI (Fiber Distributed Data Interface) applied the same token-passing idea to a 100 Mbps dual counter-rotating fibre ring, used for campus backbones.

The assessment relevance is that a ring is a shared medium : every frame transits every station's interface, so a station in promiscuous mode sees all traffic without any active attack.

5. Physical Topology vs Logical Topology BUS STAR RING MESH
--+---+---+ +--[SW]--+ +--A--B--+ A ---- B
| | | | | | | | | \ / |
A B C A B C D C | \/ |
\------/ | /\ |
D ---- C
One collision One collision Token passing, Redundant paths,
domain, every domain per port, deterministic no single point
station hears unicast switched ordering of failure
everything

A network's physical topology (how the cable runs) and its logical topology (how frames actually flow) can differ. Token Ring is physically a star and logically a ring. Modern Ethernet is physically a star and logically a switched point-to-point fabric. 802.11 is physically a star around an access point but logically a shared broadcast medium — every associated station's radio receives every frame in the cell, which is precisely why WPA2-PSK offers no protection between clients that know the passphrase.

6. Shared Media vs Switched Media: What It Means for the Tester

Medium Who sees a given unicast frame Interception method Typical detection

Coax / hub / Token Ring / FDDI Every station on the segment Put the NIC in promiscuous mode and capture Almost none — the capture is entirely passive

Switched Ethernet Only the two ports in the CAM entry ARP cache poisoning, MAC flooding to fail the switch open, or a configured SPAN/mirror port Dynamic ARP Inspection, port security, MAC-move alarms

802.11 wireless Every radio in range of the cell Monitor mode plus channel hopping; decryption needs the key or a captured handshake WIDS detecting a card in monitor mode is unreliable; deauth floods are loud

Fibre point-to-point Only the two endpoints Optical splitter or bend tap, requiring physical access and causing measurable loss Optical power budget monitoring

This table is the whole point of syllabus item B2. When a scoping call tells you the client "has a flat network with a couple of old hubs in the plant room", that single sentence changes your attack plan from ARP spoofing to simply plugging in and listening.

7. Practical Checks During a Physical or Internal Assessment

Trace the jack before you trust it. A live wall port in a reception area may land on a guest VLAN, a voice VLAN, or the corporate access layer. tcpdump -i eth0 -nn -e vlan will show 802.1Q tags and CDP/LLDP frames that identify the switch and port.

Check for hubs and unmanaged switches. Cheap unmanaged switches under desks defeat port security and are a classic finding. A hub is even better for an attacker — and still turns up in lab and plant environments.

Look at the patch panel labelling and the comms room. Unterminated fibre, unlocked cabinets, and console cables left plugged into routers are physical findings that belong in the report alongside the network ones.

Record the media in your notes. Whether a segment was copper or fibre, shared or switched, is the evidence that justifies the risk rating you assign to a sniffing finding.