The Traffic Inside

## What actually happens on the wire In most campus estates a floor of wall sockets lands in one VLAN and one IP subnet - say `10.20.4.0/22`. When `10.20.4.31` opens a session to `10.20.4.87`, the sending host compares the destination address against its own address and mask, concludes the destination is local, and resolves the destination's MAC address with ARP. It then addresses the frame to that MAC directly. The frame travels up the access-switch port, possibly across a wiring-closet uplink to a second access switch, and back down to the target. It never carries the default gateway's MAC address, which means no router, no layer-3 interface and no firewall is ever handed the packet. A host consults its default gateway only for destinations **outside** its own subnet. That single rule is what decides whether an interior flow meets an enforcement point, and in a flat office VLAN the answer is that it does not. ## Why the border sees nothing A perimeter firewall is a device positioned on the path between the campus and the internet. It logs what it forwards and what it drops. Traffic that never leaves the subnet is never offered to it. There is no rule it could have carried, no signature it could have matched, no log line it could have emitted. Silence here is not a tuning failure, a licensing gap or an analyst missing something - it is a statement about where the device stands. This is the direction-of-claim mistake that gets made in review rooms: an empty border log proves that traffic did not cross the border. It proves nothing whatsoever about traffic that had no reason to. ## Why an intruder gets this for free An intruder who has a foothold on one office PC - a workstation on the same floor as the one they want next - is not evading anything. There is nothing in the path to evade. Credential reuse, a file share, a remote-management port, a scan of the local range: all of it happens between two hosts that are layer-2 adjacent. The controls the organisation bought sit at the edge of a bubble the intruder is already inside. Switches forward frames at line rate in hardware; they are not built to journal every conversation, and nothing in the default configuration produces a per-flow record for intra-subnet traffic. ## What it would take to produce a record The only thing that manufactures an interior chokepoint is the addressing. Put the two populations in different IP subnets, and traffic between them must go to a default gateway; put policy on that gateway - a filtering layer-3 interface or a firewall the routed path traverses - and now every crossing is inspected, permitted or denied, and logged. That is a real bill, and it is why so many estates have not done it: | What you must add | What it costs | |---|---| | A second subnet and re-addressing | DHCP scopes, statically addressed printers and appliances, host firewall rules, monitoring targets | | A routed hop between them | Traffic that stayed on a switch backplane now crosses a device link, twice on a one-armed design | | A device that filters it | Purchase, sizing, depreciation, and a redundant partner so an interior outage does not stop the office | | An exception list | Every flow that used to work and now has to be explicitly permitted | ## The honest interview answer Say the mechanism first (same subnet means no routed hop, so no device in the path), then the consequence (the border log is empty for a truthful reason), then the price (a record exists only where you have paid to put something in the path). A candidate who says the firewall *missed* it, or that the rules need reviewing, has the model backwards and will size the wrong solution.