Quick Answer: Network security is the practice of protecting computer networks and the data traveling across them from unauthorized access, attacks, and damage. Modern best-practice guides describe this as defense in depth — stacking several controls so that if one fails, others still stand in the way of an attacker, much like a school combining locked entrances, visitor badges, and staff oversight rather than relying on a single latch on the front door. This guide covers every core concept a beginner needs: how networks actually work, the protocols that carry traffic, the threats that target them, the defenses that stop those threats, and how each topic maps to the Security+ certification that opens the door to your first cybersecurity role. When you are ready to test your knowledge, CertMage’s Security+ practice tests are built around the exact topics this guide covers.
Why Network Security Matters More Than Ever in 2026
With 82 percent of organizations now operating in hybrid or multi-cloud infrastructures and remote work becoming the standard, the concept of a secure network boundary no longer exists.
Every device you connect to a network is a potential entry point for an attacker. Every packet of data traveling across the internet passes through infrastructure that someone could intercept, redirect, or corrupt. Every employee clicking a link, downloading a file, or authenticating to a system creates a potential vulnerability.
Cybersecurity threats in 2026 are escalating, with ransomware attacks becoming more sophisticated and financially damaging. AI-powered phishing, deepfake voice calls, polymorphic malware, and supply chain compromises make these attacks harder to detect and contain, affecting thousands of organizations simultaneously.
Understanding network security basics is not just for security professionals. It is foundational knowledge for every IT professional working in 2026. And for anyone pursuing a cybersecurity career, it is the starting point before any certification, any job application, and any interview.
How Networks Actually Work: The Foundation You Need
Before understanding how to secure a network, you need to understand how a network works. This section covers the absolute fundamentals.
What Is a Network?
A network is two or more computers or devices connected together so they can share data and resources. Your home Wi-Fi is a network. Your company’s office infrastructure is a network. The internet is the largest network in the world, connecting billions of devices through shared infrastructure.
Networks are classified by size and scope. A Local Area Network (LAN) covers a small physical area like a single office or building. A Wide Area Network (WAN) spans large geographic areas and connects multiple LANs together. The internet is the global WAN that connects everything.
IP Addresses: The Foundation of Network Communication
Every device on a network has an IP address, a numerical label that identifies it and enables other devices to find it and send data to it.
IPv4 addresses use four numbers separated by dots, like 192.168.1.1. The internet is gradually moving to IPv6, which uses a longer hexadecimal format to accommodate the vastly larger number of connected devices. Private IP addresses are used inside organizations and homes (ranges like 192.168.x.x and 10.x.x.x). Public IP addresses are assigned by internet service providers for external communication.
Understanding IP addressing is foundational for network security because every firewall rule, every access control, and every network log entry references IP addresses. A security analyst who cannot read an IP address and understand what it means cannot investigate a security incident.
Ports and Services
If an IP address is like the address of a building, a port number is like the apartment number inside that building. Ports identify specific services running on a device.
Every networked application communicates on specific ports. HTTP web traffic uses port 80. HTTPS encrypted web traffic uses port 443. SSH remote access uses port 22. DNS name resolution uses port 53. Email protocols SMTP, IMAP, and POP3 use ports 25, 143, and 110 respectively.
Security professionals scan for open ports to understand what services are running on a network device. An open port is a potential attack surface. Every unnecessary open port on a server is a service that could be exploited if it contains a vulnerability.
The OSI Model: A Framework for Understanding Network Communication
The OSI model divides network communication into seven layers. Each layer handles a specific function and passes data to the layer above or below it. Security controls exist at every layer.
Layer 1 (Physical) handles cables, switches, and wireless signals. Physical security controls including locked server rooms and disabled unused network ports apply here.
Layer 2 (Data Link) handles MAC addresses and frame transmission. MAC address filtering and switch port security apply here.
Layer 3 (Network) handles IP addressing and routing. Firewalls and routers that filter based on IP addresses operate here.
Layer 4 (Transport) handles TCP and UDP connections and port numbers. Stateful firewalls that track connection state operate here.
Layer 5 (Session) handles session establishment and teardown.
Layer 6 (Presentation) handles encryption and data formatting. TLS encryption operates here.
Layer 7 (Application) handles user-facing applications and protocols. Web application firewalls and application-layer security controls operate here.
Modern network security guides describe traffic directions as north-south for users entering and leaving the building (internet to internal) and east-west for movement between internal systems. Recent campaigns showed that once an attacker slips past the front door, the real damage usually comes from moving east-west through unmonitored internal paths.
Essential Network Protocols and Their Security Implications
A protocol is a set of rules that governs how devices communicate. Understanding protocols means understanding both how they work and how attackers exploit them.
TCP vs. UDP
TCP (Transmission Control Protocol) is a connection-oriented protocol that establishes a connection before sending data and confirms delivery. The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes connections. TCP is reliable but slower. HTTP, HTTPS, SSH, and email protocols use TCP.
UDP (User Datagram Protocol) sends data without establishing a connection and without confirming delivery. UDP is faster but unreliable. DNS, DHCP, streaming video, and VoIP use UDP.
Security relevance: SYN flood attacks target TCP’s handshake mechanism by sending massive numbers of SYN packets without completing the handshake, exhausting server resources. UDP amplification attacks abuse connectionless UDP protocols to reflect and amplify DDoS traffic.
DNS (Domain Name System) — Port 53
DNS translates human-readable domain names like certmage.com into IP addresses that computers use to route traffic. Without DNS, you would need to memorize the IP address of every website you visit.
Security threats to DNS include DNS poisoning, which corrupts cache entries to redirect legitimate domain lookups to malicious servers. DNS tunneling embeds data inside DNS queries to exfiltrate information or maintain command-and-control communications while bypassing security controls that do not inspect DNS traffic.
Security controls include DNSSEC, which adds digital signatures to DNS records, and DNS filtering services that block known malicious domains before connections are established.
HTTP vs. HTTPS — Ports 80 and 443
HTTP (Hypertext Transfer Protocol) carries web traffic in plaintext, meaning anyone who intercepts the traffic can read it. HTTPS is HTTP secured with TLS encryption, protecting the contents of web communications from interception.
The difference between HTTP and HTTPS is one of the most fundamental security concepts in network security. A website using HTTP is transmitting your login credentials, form data, and browsing activity in plaintext across every router and switch between your device and the server.
Security relevance: HTTPS ensures confidentiality in transit. The lock icon in your browser’s address bar indicates a valid TLS certificate is in use. Certificate validity is verified through the Public Key Infrastructure (PKI) chain of trust. Certificate spoofing and man-in-the-middle attacks can compromise HTTPS if certificate validation fails.
SSH (Secure Shell) — Port 22
SSH provides encrypted remote access to servers and network devices. It replaced Telnet, which transmitted sessions in plaintext including passwords.
SSH uses public key authentication or password authentication. Public key authentication is significantly more secure because it is not vulnerable to brute force attacks against passwords. Disabling password authentication for SSH and requiring public key authentication is a security baseline recommendation.
Security relevance: SSH on port 22 is a constant target for brute force attacks from automated scanning tools across the internet. Changing SSH to a non-standard port, implementing fail2ban to block repeated failed attempts, and requiring key-based authentication are standard hardening measures.
DHCP (Dynamic Host Configuration Protocol) — Port 67/68
DHCP automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to devices when they join a network. Without DHCP, every device would need manually configured network settings.
Security relevance: DHCP starvation attacks exhaust the pool of available IP addresses by flooding the DHCP server with requests from spoofed MAC addresses, preventing legitimate devices from obtaining addresses. Rogue DHCP servers can distribute malicious default gateway addresses, redirecting all traffic through an attacker-controlled device.
SMTP, IMAP, POP3 — Email Protocols
SMTP (Simple Mail Transfer Protocol) on port 25 handles sending email between servers. IMAP (Internet Message Access Protocol) on port 143 and POP3 (Post Office Protocol) on port 110 handle email retrieval by clients.
Security relevance: Email protocols are the primary delivery mechanism for phishing, malware, and business email compromise attacks. Email authentication standards including SPF, DKIM, and DMARC verify that email claiming to come from a domain actually originated from an authorized server for that domain, preventing email spoofing.
SNMP (Simple Network Management Protocol) — Port 161/162
SNMP allows network administrators to monitor and manage network devices including routers, switches, and servers. It reads and writes device configuration and status information.
Security relevance: Older SNMP versions (v1 and v2c) transmit data including device configuration in plaintext and use simple community strings (essentially passwords) for authentication. These community strings are frequently left at default values. SNMPv3 adds authentication and encryption. Disabling SNMP on devices that do not require it and upgrading to SNMPv3 where it is needed are standard hardening measures.
Firewall Types: Your First Line of Defense
A next-generation firewall (NGFW) builds on first-generation firewalls, providing deep packet inspection capability that can allow it to enforce security policies at application, port, and protocol levels, not just at the IP level. NGFWs are application aware, meaning they can detect and block malicious applications in the network.
Understanding the different types of firewalls and what each one does is a core Security+ Domain 3 concept.
Packet Filtering Firewalls
The simplest and oldest type of firewall. A packet filtering firewall inspects the header of each packet and compares it against a set of rules. Rules are based on source IP, destination IP, source port, destination port, and protocol.
What it does well: Fast, lightweight, and effective at blocking traffic from known malicious IP addresses or to unnecessary ports.
What it does not do: It cannot see the contents of packets (the payload). A malicious payload inside a legitimate-looking packet header will pass through. It has no understanding of the connection state.
Stateful Inspection Firewalls
A stateful firewall tracks the state of network connections. It knows which connections have been established and only allows return traffic that belongs to an established connection.
This is a significant improvement over pure packet filtering because it prevents a common attack where an attacker crafts a packet designed to look like return traffic for a connection that was never established.
Next-Generation Firewalls (NGFW)
In addition to stateful inspection, NGFWs provide additional capabilities such as web content filtering, network address translation, virtual private networks, and malware detection.
NGFWs can identify applications regardless of port. An attacker trying to tunnel malicious traffic over port 443 (normally HTTPS) will be identified by the application signature even though the port appears legitimate. NGFWs can also decrypt and inspect TLS traffic, apply user identity to firewall rules, and integrate threat intelligence to block known malicious content.
Web Application Firewalls (WAF)
A WAF specifically filters HTTP and HTTPS traffic to and from web applications. Where network firewalls protect at the network level, a WAF protects at the application level, blocking attacks including SQL injection, cross-site scripting, and CSRF attempts.
WAFs are deployed in front of web applications and are essential for any organization that operates public-facing websites or APIs.
Firewall as a Service (FWaaS)
FWaaS vendors provide cloud-based network traffic inspection capabilities that enable organizations to augment or decommission on-premises network firewall appliances, reducing the management burden on in-house security staff.
FWaaS has become increasingly popular as organizations shift workloads to the cloud and require security controls that follow traffic regardless of whether it flows through a physical network.
Network Segmentation: Containing the Blast Radius
Segmenting a network helps mitigate the impact of a breach in one part of the network, restricting its access to the rest of the network. Traditional segmentation approaches use a combination of firewalls, Virtual Local Area Networks (VLANs), and Access Control Lists (ACLs).
Network segmentation divides a large flat network into smaller isolated zones. Each zone has defined rules governing what traffic can enter and leave it. A device compromised in one zone cannot freely communicate with devices in other zones.
VLANs (Virtual Local Area Networks)
VLANs logically separate network traffic at Layer 2 even when devices share the same physical infrastructure. A VLAN for finance, a VLAN for HR, and a VLAN for general users can all run on the same physical switch hardware but be completely isolated from each other at the network level.
VLAN configuration is a standard network security control. Separating sensitive systems onto isolated VLANs limits the exposure of those systems to the rest of the network. VLAN hopping attacks attempt to bypass this isolation by crafting frames that jump between VLANs, which properly configured switches prevent.
DMZ (Demilitarized Zone)
A DMZ is a network segment that sits between the public internet and the internal private network. Public-facing services including web servers, email servers, and DNS servers are placed in the DMZ where they can be reached from the internet without exposing the internal network directly.
Two firewalls create the classic DMZ architecture: an outer firewall between the internet and the DMZ, and an inner firewall between the DMZ and the internal network. Even if a web server in the DMZ is compromised, the inner firewall prevents the attacker from pivoting directly into the internal network.
Microsegmentation
Microsegmentation extends the concept of VLANs to individual workloads and applications. Zero trust architecture and micro-segmentation are key strategies to prevent lateral movement and data exfiltration. Where traditional segmentation creates broad security zones, microsegmentation creates granular boundaries that limit communication between individual servers, containers, or even specific application processes.
VPN Types and When to Use Each
A VPN (Virtual Private Network) creates an encrypted tunnel between two points, protecting the confidentiality and integrity of traffic that travels across untrusted networks like the public internet.
Site-to-Site VPN
Connects two entire networks together over an encrypted tunnel. A company’s main office and a branch office connected by a site-to-site VPN can communicate as if they are on the same local network, with all traffic encrypted across the internet connection between them. IPsec is the most common protocol used for site-to-site VPNs.
Remote Access VPN
Connects individual remote users to the corporate network. An employee working from home connects their device to the corporate network through a VPN client. All traffic from that device is routed through the encrypted tunnel to the corporate network, where normal security controls apply.
SSL/TLS VPN
Uses the same TLS protocol that secures HTTPS web traffic to create a VPN tunnel. SSL VPNs are often accessible through a web browser without requiring a dedicated client, making them more flexible for remote access scenarios.
Zero Trust Network Access (ZTNA)
ZTNA replaces broad VPN access with identity-aware ZTNA. Instead of connecting a remote user to the entire corporate network, ZTNA connects them directly and only to the specific application they need. As discussed in the context of zero trust security, ZTNA is increasingly replacing traditional VPNs because it provides application-specific access rather than network-level access, limiting the exposure of internal systems to remote users.
Wireless Network Security
Wireless networks present unique security challenges because the signal broadcasts through the air and can be intercepted by anyone within range.
Wireless Security Protocols
WEP (Wired Equivalent Privacy) was the original wireless security standard and is now completely broken. It uses weak encryption that can be cracked in minutes. WEP should never be used.
WPA (Wi-Fi Protected Access) improved on WEP but has known vulnerabilities. WPA should not be used for new deployments.
WPA2 is the current minimum acceptable standard for wireless security. It uses AES encryption and is significantly more secure than its predecessors. WPA2-Personal uses a pre-shared key. WPA2-Enterprise uses 802.1X authentication with a RADIUS server, requiring each user to authenticate with individual credentials rather than a shared password.
WPA3 is the newest standard, adding improved protections including stronger encryption and protection against offline dictionary attacks. WPA3 is recommended for new deployments where all devices support it.
Wireless Attacks
Evil twin attacks create a rogue access point with the same SSID as a legitimate network, tricking devices into connecting to the attacker’s controlled access point. Certificate-based authentication in 802.1X prevents devices from connecting to access points that cannot present a valid certificate.
Deauthentication attacks forcibly disconnect devices from a wireless network by spoofing management frames. The disconnected device then attempts to reconnect, potentially to a rogue access point.
PMKID attacks and KRACK attacks target vulnerabilities in WPA2’s handshake mechanism. WPA3 addresses these vulnerabilities.
War driving is the practice of scanning for wireless networks while moving through an area, identifying unsecured or weakly secured networks as potential targets.
The Most Common Network Attacks: Recognize Them Before You Face Them
Denial of Service (DoS) and Distributed Denial of Service (DDoS)
A DoS attack attempts to overwhelm a target system with traffic or requests until it becomes unavailable to legitimate users. A DDoS attack coordinates thousands or millions of compromised systems to amplify the attack volume.
Volumetric attacks saturate bandwidth. Protocol attacks exploit weaknesses in network protocol implementations. Application layer attacks target specific application functions with requests designed to consume excessive server resources.
DNS monitoring for repetitive DNS queries helps identify anomalous DNS activity indicating DDoS.
Man-in-the-Middle (MITM) Attacks
A man-in-the-middle attack intercepts communications between two parties without their knowledge. The attacker receives, and potentially modifies, all traffic between the two parties before forwarding it.
ARP spoofing poisons the ARP cache of devices on a local network to redirect traffic through the attacker’s system. DNS spoofing redirects domain lookups to attacker-controlled servers.
TLS encryption with certificate validation prevents most MITM attacks by ensuring that communications are encrypted end-to-end and that the certificate presented by the server is genuine.
Port Scanning
Port scanning systematically probes a range of network ports on a target system to identify which services are running. Attackers use port scanning in reconnaissance to identify potential attack vectors. Security professionals use it to audit their own networks and identify unexpected open ports.
Nmap is the most widely used port scanning tool. Understanding how to read Nmap output is a foundational skill for anyone entering network security.
Packet Sniffing
Packet sniffing captures network traffic for analysis. Legitimate uses include network troubleshooting and security monitoring. Malicious uses involve capturing credentials and sensitive data from unencrypted traffic.
Wireshark is the standard packet analysis tool. Encryption (HTTPS, SSH, TLS) renders sniffed traffic unreadable to an attacker, making encryption the primary defense against packet sniffing.
ARP Spoofing
The Address Resolution Protocol maps IP addresses to MAC addresses on a local network. ARP spoofing sends forged ARP messages that associate the attacker’s MAC address with a legitimate IP address, causing traffic intended for the legitimate device to be sent to the attacker instead.
ARP spoofing is the most common method for enabling man-in-the-middle attacks on local networks. Dynamic ARP inspection on managed switches detects and blocks forged ARP messages.
IP Spoofing
IP spoofing constructs packets with a falsified source IP address. It is used to impersonate trusted systems, bypass IP-based access controls, and make attack traffic harder to trace.
Ingress filtering at network edges, which blocks packets with source addresses that could not legitimately originate from outside the network, is the standard defense.
DNS Poisoning
DNS poisoning corrupts the cache of a DNS resolver so that it returns malicious IP addresses for legitimate domain names. Users trying to reach legitimate websites are redirected to attacker-controlled servers that may look identical to the legitimate site.
DNSSEC mitigates DNS poisoning by adding cryptographic signatures to DNS records that resolvers can verify.
IDS and IPS: Detection and Prevention
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) monitor network traffic for signs of malicious activity.
An IDS acts as a network security camera, passively capturing traffic for analysis. An IPS takes that a step further by sitting inline, blocking or dropping traffic that matches known attack patterns. Both rely on signatures like wanted posters for known attacks and, increasingly, anomaly detection to catch behavior that does not look like normal network traffic.
Signature-based detection compares traffic against a database of known attack signatures. It is highly accurate for known attacks but cannot detect new or modified attacks that do not match existing signatures.
Anomaly-based detection establishes a baseline of normal network behavior and alerts when traffic deviates significantly from that baseline. It can detect unknown attacks but produces more false positives than signature-based detection.
Host-based IDS/IPS (HIDS/HIPS) monitors activity on individual endpoints rather than network traffic. It watches for suspicious processes, file system changes, and registry modifications.
Network-based IDS/IPS (NIDS/NIPS) monitors traffic on the network as a whole. It is positioned to observe all traffic flowing through a network segment rather than the activity on a single device.
Network Monitoring: Visibility is Security
Network traffic monitoring of unidirectional traffic streams including source and destination ports, protocols, and IP addresses provides the visibility needed to detect security incidents. Contextualizing events depends on established knowledge of the network. If systems that do not usually communicate with each other suddenly start to, it may indicate botnet traffic or a malware attack.
SIEM (Security Information and Event Management)
SIEM platforms like Splunk and IBM QRadar aggregate logs for real-time threat analysis. They collect logs from firewalls, endpoints, servers, and applications and correlate events across all sources to identify patterns that indicate security incidents.
A SIEM is the central nervous system of a Security Operations Center. Security analysts spend the majority of their working time looking at SIEM dashboards, investigating alerts, and building correlation rules that detect new threat patterns.
Netflow and Traffic Analysis
Netflow captures metadata about network connections including source IP, destination IP, ports, protocols, byte counts, and connection duration, without capturing the actual content of the traffic. This metadata is enough to identify suspicious patterns including unusual connection volumes, connections to known malicious destinations, and unexpected internal east-west traffic.
Packet Capture
Full packet capture records the complete content of every packet flowing across a monitored network segment. It provides the most detailed visibility into network activity but generates enormous data volumes and requires significant storage infrastructure.
Network Hardening: The Practical Checklist
Network hardening is the process of securing network devices and configurations to reduce the attack surface.
Disable all unnecessary services and protocols on every device. Every running service is a potential attack vector. If a service is not needed, it should not be running.
Change all default credentials on every network device immediately after deployment. Default usernames and passwords are publicly documented and are among the first things attackers try.
Apply security patches promptly. Preventing ransomware attacks requires regular security audits and proactive strategies including rapid patching of known vulnerabilities.
Implement network access control to verify device health before allowing network connections. Devices that are not patched, not running endpoint protection, or not enrolled in management should not receive full network access.
Enable logging on all network devices and forward logs to a centralized SIEM. Logs are useless if they are not collected and monitored.
Use encrypted protocols exclusively. Replace Telnet with SSH. Replace HTTP with HTTPS. Replace FTP with SFTP. Replace SNMPv1/v2 with SNMPv3. Every cleartext protocol is a liability.
Implement 802.1X port-based network access control on wired and wireless networks to require authentication before network access is granted.
Network Security and the Security+ Exam
Every topic covered in this guide maps directly to Security+ SY0-701. Understanding where each concept appears on the exam helps you prioritize your study time.
Domain 3: Security Architecture (18%) covers network security design including firewall types, DMZ architecture, network segmentation, VPN types, and wireless security standards. This is the domain most directly aligned with the content in this guide.
Domain 2: Threats, Vulnerabilities, and Mitigations (22%) covers network attack types including DDoS, MITM, ARP spoofing, DNS poisoning, and port scanning. Understanding these attacks well enough to identify them from scenario descriptions is the exam skill being tested.
Domain 4: Security Operations (28%) is the heaviest domain and covers network monitoring, IDS and IPS, SIEM, and incident response for network security events.
Domain 1: General Security Concepts (12%) covers protocols, cryptography, and the foundational concepts that make secure network communication possible.
The connection between the foundational knowledge in this guide and the Security+ exam domains is direct. Everything covered here is tested on Security+. And Security+ is the certification that opens the door to your first cybersecurity role.
CertMage’s Security+ exam questions cover all five SY0-701 domains with scenario-based questions that test exactly the kind of knowledge you have been building in this guide. The practice tests include full answer explanations so you understand the reasoning behind each correct answer, not just the answer letter. Scoring 80 percent or higher consistently on CertMage before booking your exam date is the benchmark that correlates most strongly with first-attempt pass rates.
Frequently Asked Questions
What is network security in simple terms?
Network security is the practice of protecting the infrastructure that devices use to communicate and the data that travels across that infrastructure. It combines hardware controls like firewalls, software controls like antivirus and IDS, and procedural controls like access policies and monitoring to prevent unauthorized access, detect attacks, and respond to incidents.
What are the most important network security concepts for beginners?
The most important foundational concepts are IP addressing, port numbers, the difference between TCP and UDP, how DNS works, what a firewall does, the difference between HTTP and HTTPS, how encryption protects data in transit, and what network segmentation achieves. Every other network security concept builds on these fundamentals.
What is the difference between a firewall and an IPS?
A firewall controls what traffic is allowed in and out of a network based on rules. An IPS sits inline in the traffic flow and actively blocks traffic that matches known attack patterns. A firewall decides whether traffic should be permitted based on who it is from and where it is going. An IPS decides whether traffic is malicious based on what it contains and how it behaves.
What is the most common network attack in 2026?
Phishing still figures in about 16 percent of breaches and ransomware shows up in roughly 44 percent of attacks. At the network level, DDoS attacks remain the most volumetrically significant threat while credential-based attacks exploiting stolen credentials are the most common method of initial access.
How does encryption protect network traffic?
Encryption transforms plaintext data into an unreadable format using a mathematical algorithm and a key. Only a party with the correct key can decrypt the data back to readable form. TLS encryption on HTTPS connections ensures that even if an attacker intercepts traffic between your browser and a website, they receive only encrypted ciphertext that is computationally infeasible to decrypt without the key.
What certification covers network security basics?
CompTIA Security+ SY0-701 is the most widely held entry-level certification that covers network security fundamentals. It covers firewall types, network segmentation, VPN types, wireless security, common network attacks, and network monitoring across multiple domains. Our Security+ study guide is the most efficient way to verify you understand these concepts at the level the exam tests before booking your exam date.
What is the difference between a hub, a switch, and a router?
A hub broadcasts every packet it receives to every connected device, which is inefficient and creates a security risk because all devices can see all traffic. A switch forwards packets only to the specific device they are addressed to, using MAC address tables. A router forwards packets between different networks using IP addresses and routing tables. In practice, hubs are obsolete. Modern networks use switches for local connectivity and routers for connectivity between networks.
