A visitor left alone in a meeting room plugs into the live wall socket — what does that port hand them, and what does shutting unused ports cost?

## Two estates, one cable A building has a physical estate — rooms, wall plates, floor boxes, patch panels, wiring closets — and a network has a logical estate — VLANs, subnets, zones, access rules. The wall socket is the single point where those two estates touch, and it is the one place where a person's physical access converts directly into network access. Everything on this topic follows from that: whoever may stand in the room may plug into the socket, and the switch cannot tell who is standing there. ## Why the socket is live in the first place Floors are usually cabled once, generously, when the building is fitted out: every plate is patched, every patch is landed on a switchport, and every switchport is enabled and assigned a VLAN. Then the building is used. Rooms are repurposed, a training room becomes a visitor lounge, a corner of open plan becomes a waiting area with a sofa in front of a plate nobody remembers. The cabling does not move. The result is a socket in a public room that is still patched, still enabled, and still assigned to whatever VLAN the floor was built with — typically a staff or voice VLAN, because that is what the floor was for. ## What link-up actually gives When a laptop comes up on such a port: - The switch learns the laptop's source MAC address and begins forwarding for it. A switch's default behaviour is to learn and forward, not to deny. - The laptop broadcasts a DHCP request and, if a relay or server serves that VLAN, receives an address, a gateway and DNS servers. - It now has layer-2 adjacency to every other host in that VLAN: ARP, discovery and multicast traffic, printers, phones, and anything else that trusts being on the same segment. - Beyond the VLAN, it reaches whatever the gateway's access rules allow that VLAN to reach — which, for a staff VLAN, is usually a great deal. None of this requires a tool or an exploit. The adversary here is not a tooled intruder; it is a visitor with a laptop, a legitimate reason to be in the room, and ten unattended minutes. ## "Enabled" is not "in use" The critical direction-of-claim: a port being administratively up tells you nothing about whether anyone uses it, and link being down tells you nothing about whether the socket matters. A port with no link may serve an AV cart wheeled in twice a month, an auditor's desk used one week a quarter, or a floor box under a carpet tile. That asymmetry is precisely why ports stay enabled: nobody can prove a port is safe to shut, so nobody shuts it. ## The postures and what each costs - **Administratively shut by default.** The cheapest control and the strictest. It costs a record — someone must know which port serves what — and it costs friction: a re-cabled room on Friday is a ticket on Monday. That friction is exactly what erodes it, because the fastest way to close the ticket is to enable a block of ports and never revisit them. - **Give public sockets a zone a stranger's laptop cannot use.** Defensible, but it is a permanent thing to run: a routed path, addressing, and an ongoing decision about which rooms count as public. The room's own phone and video kit still need the corporate side, so you still need per-port decisions. - **Require the port to authenticate the device before forwarding.** The strongest, and a programme rather than a setting — it needs a credential on every device that will ever be plugged in, which most estates do not have on day one. ## What an interviewer is listening for That you treat the socket as an access-control boundary rather than as plumbing; that you say plainly what a live port grants; and that you name the running cost of the fix rather than proposing default-deny as though it were free. Candidates who answer "we'd just shut them all" and stop have not thought about who turns them back on, or about the fact that the list of which ports to shut does not currently exist anywhere trustworthy.