DEV Community: Enoch Franco

Hub, Switch, and Router — Explained Using a Game of Cricket

Enoch Franco — Mon, 24 Aug 2026 21:13:05 +0000

Networking terms can feel like alphabet soup when you're starting out — Hub, Switch, Router, MAC address, IP address, Subnet Mask — thrown at you all at once, usually with zero real-world context. Here's how I finally made sense of it, using something a lot more familiar: cricket.

The Cricket Analogy

Imagine a cricket team with three players: a hub, a switch, and a router. All three are part of the same game, but each has a completely different job — one's a batsman, one's a bowler, one's a fielder. Networking devices work the same way: they're all part of one network, but each does something distinct.

Hub — The One Who Shouts to Everyone

A hub is the simplest of the three. If only two devices need to talk, you don't even need one — but the moment more than two devices are connected, a hub becomes necessary to relay traffic between them.

Here's the catch: a hub has no idea who's talking to whom. If Device A wants to send data to Device B, it sends that data to the hub — and since the hub doesn't know which device Device A actually wants to reach, it just broadcasts the data to every single connected device.

So a hub's "functionality" is really a lack of intelligence — it doesn't figure out who wants to speak with whom; it just floods the message everywhere and lets the devices sort it out.

Switch — The One Who Knows Everyone by Name

A switch does the same basic job as a hub — moving data between connected devices — but with one major upgrade: it actually knows who's who.

Instead of blindly broadcasting to every device, a switch keeps a table of each connected device's MAC address, so it can send data directly to the right recipient.

What Is a MAC Address?

Every device that connects to a network — a laptop, phone, router, anything — has a Network Interface Card (NIC). That NIC comes with a MAC address: a permanent ID burned in by the manufacturer.

If your laptop has an Ethernet port, the NIC lives right behind it. If you're connecting over Wi-Fi instead, the NIC is built into the Wi-Fi card. Either way, that hardware is what gives your device its MAC address.

Router — The One Who Connects Networks Together

While hubs and switches move data within one network, a router's job is to connect one network to another. The clearest everyday example: your router is what connects your home network to the wider internet.

Network Adapter and RJ45

Two more pieces worth knowing:

Network Adapter (NIC): The hardware inside your device that lets it join a network at all — wired via Ethernet or wireless via Wi-Fi. Think of it as the bridge between your device and the network. Every NIC carries its own unique MAC address.
RJ45: The physical connector at the end of an Ethernet cable (the connector itself, not the cable) — used to plug into ports on NICs, switches, and routers.

IP Address and Its Components

An IP address is a numerical label assigned to every device on a network. An IPv4 address looks like this:

192.168.1.50

Every IP address is made up of two parts:

Part	What it identifies	Analogy
Network ID	The network segment the device belongs to	The street name
Host ID	The specific device within that network	The house number

For example, given 192.168.1.50 with subnet mask 255.255.255.0:

Network ID: 192.168.1.0
Host ID: 50

The Role of the Subnet Mask

The subnet mask is what actually splits an IP address into its Network ID and Host ID. With 255.255.255.0, the first three numbers (192.168.1) mark the network, and the last number (50) marks the specific host — the device — within it.

(Worth flagging: this clean "three numbers for network, one for host" split only happens with a /24 mask like this one. Other subnet masks can split the address at different points — sometimes within a single number rather than neatly along the dots — but that's a topic for a future post.)

IP Address vs. MAC Address — The Pen Name Analogy

This is the comparison that made it click for me:

An IP address is like a pen name — it identifies a device, but it can change over time, just like an author might use different pen names.
A MAC address is like the author's real name — it's assigned permanently to the hardware by the manufacturer and doesn't change under normal use. (One exception worth knowing: MAC addresses can technically be overridden at the software level — a technique called MAC spoofing — but the original, hardware-burned address itself never changes.)

An IP address itself splits into the same two pieces mentioned above:

Network ID — shared by every device on the same network, showing they all belong to one group.
Host ID — unique to each individual device, identifying exactly which one is communicating.

Key Takeaways

Hub: dumb but simple — broadcasts to everyone, every time.
Switch: smart — knows each device's MAC address and sends data only where it needs to go.
Router: connects separate networks together, most commonly your home network to the internet.
MAC address: permanent, hardware-based identity assigned by the manufacturer — technically spoofable in software, but the original hardware address itself never changes.
IP address: logical, assignable identity — can change, and is split into a Network ID and Host ID via the subnet mask.

Understanding these basics is the foundation for pretty much everything else in networking — VLANs, routing tables, subnetting — so if this is where you're starting too, you're in the right place.

Tags: #networking #beginners #tutorial #ccna

How I Found My First CTF Flag Hidden in an Image's Metadata

Enoch Franco — Mon, 24 Aug 2026 20:28:58 +0000

Why I Tried This

I've been working through picoCTF's Forensics module lately, and "information" was the very first challenge in it — a beginner-level puzzle meant to ease you into digital forensics. The prompt was simple but a little cryptic:

"Files can always be changed in a secret way. Can you find the flag?"

Along with the prompt was a single file: cat.jpg. That's it. No obvious clues in the image itself — just a photo of a cat sitting on a laptop. So the challenge was clearly not about looking at the image, but about looking inside it.

This post walks through exactly how I solved it, the mistakes I hit along the way, and why each step actually works — not just what to type.

Setting Up ExifTool on Windows

Since every photo carries hidden metadata (camera info, timestamps, sometimes a lot more), my first move was to inspect the file's metadata using ExifTool, a free command-line tool for reading and editing this kind of data.

Here's how I set it up on Windows:

Downloaded the Windows build from exiftool.org.
The extracted executable was named exiftool(-k).exe — not exiftool.exe. I renamed it, which meant first turning on file name extensions in File Explorer (View tab → check "File name extensions"), since Windows hides them by default and that was silently blocking my rename attempts.
Moved exiftool.exe into the same folder as cat.jpg.
Opened PowerShell in that folder (Shift + right-click → "Open PowerShell window here").

Hitting My First Snag

Naturally, I typed the obvious command:

exiftool cat.jpg

And got hit with:

exiftool : The term 'exiftool' is not recognized as the name of a cmdlet, function, script file, or operable program.

Confusing, since the file was right there in the folder. Turns out: PowerShell doesn't search your current folder for programs by default — it only checks a trusted list of folders called the PATH. Windows does this deliberately, as a security measure. If it auto-ran anything sitting in your current directory, it'd be trivially easy for malware to drop a fake file named dir.exe in a folder you're likely to open and trick you into running it.

The fix is to explicitly tell PowerShell "run this file from right here":

.\exiftool.exe cat.jpg

The .\ prefix bypasses the PATH search and points directly at the file. That worked immediately.

Spotting the Flag in the Metadata

Running ExifTool dumped a long list of metadata fields — most of it completely mundane: file size, image dimensions, bits per sample, resolution. Normal stuff every JPEG has.

But a few fields stood out as unusual for a random photo of a cat:

Copyright Notice   : PicoCTF
Rights             : PicoCTF
License            : cGljb0NURnt0aGVbfbTN0YWRhdGFfMXNfbW9kaWZ...

A cat photo has no legitimate reason to carry a "License" field — that's a strong sign someone planted something there on purpose. And the value wasn't normal text; it was a long, uniform jumble of letters and numbers with no spaces. That specific shape is the classic fingerprint of Base64 encoding.

A Quick Note on Base64

Base64 isn't encryption — it's just a way of representing data using a safe set of 64 characters (A–Z, a–z, 0–9, +, /). It doesn't hide meaning or require a key; it just reformats data so it survives being passed through systems that can't handle raw binary safely (old email protocols, metadata fields, URLs, etc.). Anyone can decode it instantly.

It shows up constantly in beginner forensics CTFs as a light layer of obfuscation — enough that you can't just grep the file for picoCTF{ in plain text, but easy to reverse once you recognize the pattern:

Random-looking letters and numbers, often padded with = or ==
Length is always a multiple of 4
No spaces or unusual symbols

Decoding the Flag

Since I was already in PowerShell, I decoded the string directly with .NET's built-in Base64 decoder — no extra tools needed:

[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('PASTE_FULL_LICENSE_STRING_HERE'))

That printed the flag in plain text, in the format picoCTF{...} — ready to submit.

Key Takeaways

Metadata is a real attack surface. Files carry more information than what you see on screen — EXIF data is a good first place to check in any forensics challenge.
Anything that looks "out of place" in metadata is worth investigating. A License or Copyright field on a personal photo doesn't belong there naturally.
Recognize Base64 by shape, not by guessing. Random-looking text with no spaces, uniform character set, length divisible by 4 — that's your cue to decode.
Understand why a command works, not just that it works. The PowerShell PATH issue is a perfect example — knowing why .\ was needed means I won't get stuck on it again.

What's Next

I'm planning to keep working through picoCTF's forensics and general skills categories and documenting each solve here. If you're also starting out with CTFs, I'd love to hear what tripped you up first — metadata challenges, encoding puzzles, or something else entirely.

Tags: #ctf #cybersecurity #forensics #beginners #picoCTF