Cybersecurity Foundations (Grades 6–8) · lesson 15 of 48 · 12 min
The Infrastructure of the Internet
When you type a URL and a webpage appears in under a second, it looks like magic. It is not. It is a precisely engineered system of hardware devices, protocols, and databases working together. This lesson covers the three most important components of that system: switches, routers, and DNS.
Understanding these components matters for cybersecurity because they are all attack targets. DNS can be poisoned to redirect you to fake sites. Routers can be compromised to intercept your traffic. Switches can be exploited to eavesdrop on a local network. Knowing how they work is the first step to knowing how to defend them.
Network Devices — What Each One Does
Networks are built from specialised devices. Each has a specific job.
Switch vs. Router — the key distinction: A switch works within a single network. It knows which device is connected to which port (using MAC addresses) and sends data directly to the right device. A router works between networks. It knows the paths between networks (using IP addresses) and decides the best route for data to travel from source to destination.
Your home network has both: a router that connects your home to the internet, and a switch (often built into the router) that connects your devices to each other. When you print to a network printer, the switch handles it. When you load a webpage, the router handles it.
MAC addresses vs. IP addresses
A MAC address (Media Access Control) is a hardware address burned into every network interface card — it identifies the physical device. It looks like: 00:1A:2B:3C:4D:5E. An IP address is a logical address assigned by software — it identifies the device’s location on a network. MAC addresses are used within a local network; IP addresses are used across the internet. Switches use MAC addresses; routers use IP addresses.
DNS — The Internet’s Phone Book
Computers communicate using IP addresses (like 142.250.80.46), but humans remember names (like google.com). DNS (Domain Name System) is the system that translates between the two.
When you type “google.com” in your browser, here is exactly what happens:
This entire process typically takes 20–120 milliseconds — faster than you can blink. The caching at each step means most lookups are much faster because the answer is already stored nearby.
DNS Record Types
DNS is not just about translating domain names to IP addresses. Different record types serve different purposes.
Activity 1 — Network Device Matching
Network Device Functions
DNS Security — Attacks and Defences
DNS is a critical infrastructure component — and a significant attack target. Here are the main DNS-based attacks and how to defend against them.
Encrypted DNS — DoH and DoT
Traditional DNS queries are sent in plain text — your ISP and anyone on your network can see every domain you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries so they cannot be eavesdropped. Cloudflare’s 1.1.1.1 and Google’s 8.8.8.8 both support encrypted DNS. You can enable DoH in your browser settings (Firefox and Chrome both support it).
Activity 2 — DNS Attack Scenarios
DNS Security Scenarios
Activity 3 — Sort the DNS Facts
True or False: DNS and Network Devices
A router connects devices within the same local network. false A switch connects devices within the same local network. A router connects different networks together. DNS translates domain names to IP addresses. true DNS is the internet’s phone book — it converts human-readable names to machine-readable IP addresses. MAC addresses are used by routers to route traffic across the internet. false Routers use IP addresses. MAC addresses are used by switches within a local network. DNS poisoning can redirect you to a malicious site even when you type the correct URL. true DNS poisoning corrupts the DNS cache so a legitimate domain name resolves to a malicious IP address. DNS over HTTPS encrypts your DNS queries to prevent eavesdropping. true DoH encrypts DNS queries so your ISP and network observers cannot see which domains you are looking up. A modem connects different networks together using IP addresses. false A modem converts your ISP’s signal for your router. A router connects networks using IP addresses.
Activity 4 — Flashcard Review
Routers, Switches, and DNS — Key Terms
Switch A network device that connects devices within the same local network. Uses MAC addresses to send data directly to the correct device. Operates at OSI Layer 2 (Data Link).
- Device
- Router
A network device that connects different networks together. Uses IP addresses to determine the best path for data. Your home router connects your local network to the internet.
- Device
- MAC Address
A hardware address burned into every network interface card. Identifies the physical device on a local network. Format: 00:1A:2B:3C:4D:5E. Used by switches; not used across the internet.
- Concept
- DNS (Domain Name System)
The internet’s phone book. Translates human-readable domain names (google.com) to machine-readable IP addresses (142.250.80.46). Without DNS, you would need to memorise IP addresses for every website.
- System
- DNS Poisoning
An attack that corrupts a DNS cache with false records. When you type a legitimate URL, you are redirected to a malicious site. Defended against by DNSSEC and encrypted DNS (DoH/DoT).
- Attack
- DNS over HTTPS (DoH)
A protocol that encrypts DNS queries using HTTPS. Prevents your ISP and network observers from seeing which domains you look up. Supported by Cloudflare (1.1.1.1), Google (8.8.8.8), Firefox, and Chrome.
- Defence
- Authoritative Nameserver
The DNS server that holds the actual DNS records for a domain. The final authority on what IP address a domain resolves to. Managed by the domain owner. Concept
Activity 5 — DNS and Routing Quiz
Routers, Switches, and DNS — Knowledge Check
You type “google.com” in your browser. What happens first?
- Your browser connects directly to Google’s server
- Your browser asks a DNS server to translate “google.com” to an IP address
- Your router sends the request to your ISP
- Your computer checks its firewall rules
Answer: Your browser asks a DNS server to translate “google.com” to an IP address
DNS resolution is the first step. Your browser needs an IP address to connect to. It checks its local cache first, then asks your router’s DNS server, which may ask upstream DNS servers until it gets the IP address for google.com.
What is the difference between a switch and a router?
- Switches are faster; routers are slower
- Switches connect devices within the same network using MAC addresses; routers connect different networks using IP addresses
- Switches are for wired connections; routers are for wireless
- Switches are for homes; routers are for businesses
Answer: Switches connect devices within the same network using MAC addresses; routers connect different networks using IP addresses
A switch operates within a local network, directing traffic between devices using MAC addresses. A router connects different networks (like your home network to the internet) using IP addresses to determine the best path for data.
DNS over HTTPS (DoH) prevents your ISP from seeing which websites you visit.
- True
- False
Answer: True
Without DoH, DNS queries are sent in plain text — your ISP can see every domain you look up. DoH encrypts DNS queries using HTTPS, hiding them from your ISP and network observers. Note: DoH hides domain lookups but your ISP can still see the IP addresses you connect to.
Previous lesson: IP addresses explained
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Ports and protocols