A2.2.4 · Network architecture
A2.2.4 · 网络架构
Network Segmentation
网络分段
A school's staff devices and student devices can run on the exact same switches and cabling, yet a student's laptop can never see the staff printer or the staff file share. That deliberate separation is network segmentation.
一所学校的教职工设备和学生设备可以运行在完全相同的交换机和布线上,但学生的笔记本电脑永远无法看到教职工的打印机或教职工的文件共享。这种刻意的分离就是网络分段。
Explainer
讲解
Network segmentation is dividing one larger network into smaller, isolated parts (segments), so that traffic and devices in one segment are kept separate from another.
网络分段是指将一个较大的网络划分为更小、相互隔离的部分(网段),使得一个网段中的流量和设备与另一个网段保持分离。
| Reason to segment | What it actually achieves |
|---|---|
| Security | A device in one segment cannot reach resources in another, so a compromised guest device, for example, can never directly touch a sensitive internal segment. |
| Performance | Heavy traffic generated inside one segment (a big video call, a large file transfer) stays contained there instead of slowing down every other segment too. |
| Reducing congestion | Splitting one large group of devices into smaller segments means each segment has fewer devices competing for the same shared bandwidth. |
| Managing resources efficiently | An administrator can monitor, troubleshoot or upgrade one segment on its own, without needing to touch or disrupt the rest of the network. |
| 分段的原因 | 实际达成的效果 |
|---|---|
| 安全性 | 一个网段中的设备无法访问另一个网段中的资源,因此例如一台被入侵的访客设备,永远无法直接触及敏感的内部网段。 |
| 性能 | 在一个网段内产生的大量流量(例如一场大型视频通话、一次大文件传输)会被限制在该网段内,而不会拖慢其他所有网段的速度。 |
| 减少拥堵 | 将一大群设备拆分成较小的网段,意味着每个网段中竞争同一共享带宽的设备数量更少。 |
| 高效管理资源 | 管理员可以单独监控、排查或升级某一个网段,而无需触及或干扰网络的其余部分。 |
Two specific techniques are commonly used to actually create these segments: subnetting and VLANs.
通常使用两种具体技术来实际创建这些网段:子网划分(subnetting)和虚拟局域网(VLAN)。
Worked example
示例讲解
Subnetting: computing a network address
子网划分:计算网络地址
Subnetting divides a network into smaller subnetworks based on ranges of IP addresses (Internet Protocol addresses), using a subnet mask to mark which part of an address identifies the network, and which part identifies the individual device.
子网划分(subnetting)根据 IP 地址(网际协议地址)的范围,将一个网络划分为更小的子网络,并使用子网掩码来标记地址中哪一部分标识网络,哪一部分标识单个设备。
Convert to binary. Chloe's laptop has IP address 10.14.6.42 and subnet mask 255.255.255.0. Both get converted into binary so they can be lined up and compared, one position at a time.
转换为二进制。Chloe 的笔记本电脑的 IP 地址是 10.14.6.42,子网掩码是 255.255.255.0。两者都被转换为二进制,以便逐位对齐并比较。
Apply a bitwise AND. Every position lines the IP address up against the subnet mask directly above it: a 1 only survives into the result if the mask ALSO has a 1 sitting right there, anything else becomes a 0.
执行按位与(AND)运算。每一位都将 IP 地址与其正上方的子网掩码对齐:只有当掩码在同一位置也是 1 时,结果中的这一位才会保留为 1,其他情况一律变为 0。
Convert back to decimal. The result identifies the network Chloe's laptop belongs to. Anything sharing that exact network address is grouped into the same subnet with her.
转换回十进制。结果标识了 Chloe 的笔记本电脑所属的网络。任何拥有完全相同网络地址的设备,都与她被归入同一个子网。
Checking two other devices. Lachlan's desktop has address 10.14.6.200: run the same bitwise AND and its network portion also comes out as 10.14.6, so it can talk to Chloe's laptop directly, no router needed. Mia's tablet has address 10.14.9.15: its network portion comes out as 10.14.9 instead, a different subnet entirely, so a router has to get involved before it can reach Chloe's laptop at all.
核对另外两台设备。Lachlan 的台式机地址为 10.14.6.200:执行相同的按位与运算后,其网络部分同样得出 10.14.6,因此它可以直接与 Chloe 的笔记本电脑通信,无需路由器。Mia 的平板电脑地址为 10.14.9.15:其网络部分得出的却是 10.14.9,完全是另一个子网,因此必须经过路由器才能到达 Chloe 的笔记本电脑。
A school could use exactly this technique to put staff devices on 10.14.6.X and student devices on 10.14.9.X. Both groups can share the same physical switches and cabling, but neither subnet can directly see the other.
一所学校可以正是利用这项技术,将教职工设备划入 10.14.6.X,学生设备划入 10.14.9.X。两组设备可以共用相同的物理交换机和布线,但两个子网彼此都无法直接看到对方。
Explainer
讲解
VLANs
虚拟局域网(VLAN)
A virtual local area network (VLAN) takes one physical network and splits it into several logically separate ones, entirely through configuration, no extra switches or cabling required for each split.
虚拟局域网(VLAN)将一个物理网络拆分为若干个逻辑上彼此独立的网络,完全通过配置实现,每一次拆分都不需要额外的交换机或布线。
Real example: a school assigning staff and students to different IP address ranges.
真实示例:一所学校将教职工和学生分配到不同的 IP 地址范围。
- Based on IP addressing (which subnet a device belongs to is determined by its own IP address)
- 基于 IP 地址划分 (一台设备属于哪个子网,由其自身的 IP 地址决定)
- Can be changed from the device itself (a device that manually changes its own IP address can potentially move itself into a different subnet)
- 可从设备自身更改 (手动更改自己 IP 地址的设备,有可能将自己移动到另一个子网)
Real example: the same school instead grouping devices by which switch port, MAC address or login they use.
真实示例:同一所学校改为根据设备使用的交换机端口、MAC 地址或登录账号来对设备进行分组。
- Based on switch configuration, not IP address (a device's VLAN is usually decided by its MAC address or login credentials, not something the device itself can simply change)
- 基于交换机配置,而非 IP 地址 (一台设备所属的 VLAN 通常由其 MAC 地址或登录凭据决定,并非设备自身能轻易更改的内容)
- Not tied to physical location (a VLAN can group devices that aren't even connected to the same switch, and can extend across multiple physical sites)
- 与物理位置无关 (一个 VLAN 甚至可以将并未连接到同一台交换机的设备分到一组,并可跨越多个物理场所延伸)
Because assignment to a VLAN isn't something an ordinary device can simply change by editing its own settings, VLANs are generally considered the more secure of the two approaches.
由于普通设备无法通过修改自身设置来轻易更改自己所属的 VLAN,VLAN 通常被认为是这两种方法中更安全的一种。
Check your understanding
检验你的理解
A company wants to separate its finance department's traffic from its general staff traffic, but the finance team's desks are physically scattered across three different floors, each floor sharing the same switches as general staff. Which segmentation technique fits this specific requirement, and why?
一家公司想要将财务部门的流量与普通员工的流量分开,但财务团队的工位分散在三个不同的楼层,每一层都与普通员工共用相同的交换机。哪种分段技术符合这一具体需求,为什么?
Common mistake
常见错误
RecurringA genuinely documented pattern: candidates use "segmentation," "subnetting" and "VLAN" interchangeably, as if they were three names for the same thing, rather than one general goal achieved by two specific, genuinely different techniques.
反复出现这是一个真实记录在案的模式:考生将"分段(segmentation)""子网划分(subnetting)"和"VLAN"这三个术语互换使用,仿佛它们是同一件事的三个名称,而不是一个通过两种具体且确实不同的技术来实现的总体目标。
Treated as synonyms: "Segmentation, subnetting and VLANs all mean splitting a network into smaller parts." Not wrong exactly, but never distinguishes segmentation (the general goal) from the two specific methods used to achieve it.
被当作同义词处理: "分段、子网划分和 VLAN 都是指将网络拆分成更小的部分。" 这话不能说完全错误,但完全没有区分分段(总体目标)与用于实现它的两种具体方法。
Clearly distinguished: "Segmentation is the general goal of dividing a network into isolated parts. Subnetting achieves this by grouping devices according to their IP address. VLANs achieve it instead through switch configuration, grouping devices logically regardless of their physical location." Names segmentation as the goal, and correctly separates the two distinct techniques used to reach it.
清晰区分: "分段是将网络划分为相互隔离部分的总体目标。子网划分通过按 IP 地址对设备分组来实现这一目标。VLAN 则通过交换机配置来实现,不论设备的物理位置如何,都能对其进行逻辑分组。" 明确指出分段是目标,并正确区分了用于实现该目标的两种不同技术。
Revision questions
复习题
Past-paper style. Write an answer, then reveal the marking points and mark yourself.
采用历年真题风格。写下答案,然后展开评分要点给自己打分。
[2]Define the term network segmentation.
[2]定义术语网络分段(network segmentation)。
Marking points
评分要点
- Network segmentation is dividing one larger network into smaller, isolated parts (segments), so that traffic and devices in one segment are kept separate from another.
- 网络分段是把一个较大的网络划分成更小的、彼此隔离的部分(段),使一个段内的流量和设备与另一个段保持分开。
[4]A device has IP address 172.16.5.30 and subnet mask 255.255.255.0. Calculate its network address, showing your working.
[4]一台设备的 IP 地址为 172.16.5.30,子网掩码为 255.255.255.0。计算其网络地址,并展示你的运算过程。
Marking points
评分要点
- Convert to binary and line up the IP address against the subnet mask.
- 255.255.255.0 is 24 ones then 8 zeros, so the first three octets are the network part and the last is the host part.
- Bitwise AND: 172 AND 255 = 172, 16 AND 255 = 16, 5 AND 255 = 5, 30 AND 0 = 0.
- Network address: 172.16.5.0.
- 转换成二进制,把 IP 地址与子网掩码对齐。
- 255.255.255.0 是 24 个 1 再 8 个 0,所以前三个八位组是网络部分,最后一个是主机部分。
- 按位与:172 AND 255 = 172,16 AND 255 = 16,5 AND 255 = 5,30 AND 0 = 0。
- 网络地址:172.16.5.0。
[4]Explain why VLANs are generally considered more secure than subnetting alone.
[4]解释为什么 VLAN 通常被认为比仅使用子网划分更安全。
Marking points
评分要点
- A VLAN separates traffic at the switch itself, so devices in different VLANs cannot see each other's traffic at all, even though they share the same physical switches and cabling.
- With subnetting alone, all the devices are still on the same physical network, so a device could be reconfigured with an address in another subnet and reach it.
- A VLAN also lets segments be organised by role rather than by physical location.
- VLAN 在交换机本身处隔离流量,所以不同 VLAN 的设备即使共享相同的物理交换机和布线,也完全看不到对方的流量。
- 只用子网划分时,所有设备仍然在同一个物理网络上,所以一台设备可以被重新配置成另一个子网的地址并访问它。
- VLAN 还能让分段按角色而不是按物理位置来组织。
Flashcards
记忆卡片
Active recall for this statement’s key terms.
针对本条考纲陈述关键术语的主动回忆练习。
Keep this statement’s practice with you
把这条考纲陈述的练习保存下来
Free account: unlock every revision question and flashcard for A2.2.4, and every other IB CS 2027 statement.
免费账户:解锁 A2.2.4 以及所有其他 IB CS 2027 考纲陈述的全部复习题和记忆卡片。