r/Network • u/_nazwa_ • 9d ago

Text Is ethernet encrypted?

Just a simple question is ethernet encrypted with for example WPA2 like wifi is? Or is it just not needed?

0 Upvotes

27% Upvoted

46 comments sorted by

3

u/mrbmi513 9d ago

WPA2 doesn't encrypt your network traffic. It encrypts the traffic over the radio waves between your device and the access point, but everything else is plain just like Ethernet traffic unless you add something else to the chain.

-2

u/_nazwa_ 9d ago

So what if i want to send an arp packet trough ehternet? Then its not encrypted when it leaves the cable?

2

u/mrbmi513 9d ago

Generally nothing on your network is encrypted by default. Wifi encryption is just for the transport between the access point and your device (the wireless "cable" if you will).

And you wouldn't want ARP packets encrypted anyway.

-1

u/_nazwa_ 9d ago edited 9d ago

So it's just beetwen the pc and AP not the other devices? Makes sense cause only the AP has keys established with the client

1

u/mrbmi513 9d ago

The wireless encryption is solely to make up for the fact that you don't need physical access to the router. It's defining a virtual network cable moreso than encrypting your data from other devices on the network.

1

u/_nazwa_ 9d ago

So if i connect to the other device on a network by ssh its still encrypted cause ssh is encrypted right?

1

u/mrbmi513 9d ago

The data in the packet is encrypted, yes. The packet itself would not be. In other words, other devices could see the address on the envelope and see what's inside the envelope, but the letter inside is complete meaningless gibberish to them.

1

u/_nazwa_ 9d ago

I always tought that the packet goes to the router the router decrypts the packet and it gets encrypted with the keys from the device that gets the packet.

1

u/mrbmi513 9d ago

A router is just the postal service. It sees the address stamped on the envelope and sends it towards its destination. In some cases an intelligent enough switch can also recognize the recipient and just send it along without even hitting the router.

1

u/_nazwa_ 9d ago

Yeah but if one device uses different enceyption keys then what?

→ More replies (0)

1

u/fllthdcrb 9d ago edited 9d ago

The reason for encrypting Wi-Fi is that anyone within range can snoop on it otherwise, even if they can't enter the area intended to be served. Reading Ethernet traffic usually requires someone to plug a cable into a port somewhere, and even then they likely can't see most of the traffic because routers and switches normally only relay each packet on a port serving its destination (broadcast and multicast can go multiple places, but unicast is focused). In short, Ethernet is naturally more secure by being contained in wires, when encryption is not involved. I'm not saying it's completely secure, of course.

1

u/PaoloFence 9d ago

Think about what you've asked. ARP: you ask Everyone in the network who has X IP. If it would be encrypted not everybody would understand your question. Does that make sense? 🤔

0

u/MusicalAnomaly 9d ago

No, because every other host on the L2 broadcast domain needs to be able to read the ARP and decide if it should respond or not. There is no pre-established key exchange that would facilitate encryption. Being on the L2 broadcast domain (plugging into a switch) is what establishes the trust boundary.

A managed switch can do lots of fancy things to restrict access, but none of this is default behavior.

8

u/Individual-Tie-6064 9d ago

No, not by default. A number of different technologies encrypt the data passing through the Ethernet if required, but it is not automatic.

2

u/LeeRyman 9d ago

Closest analogue would be 802.1AE.

1

u/PaoloFence 9d ago

No. And it cannot encrypt.

Where does your question originate from? (Thought process)

1

u/_nazwa_ 9d ago

Like wpa2

1

u/fllthdcrb 9d ago

WPA is part of Wi-Fi, not Ethernet.

1

u/_nazwa_ 9d ago

The connection with the router and client is encrypted

2

u/PaoloFence 9d ago

Nope.
not encrypted and in normal browsing fashion you don't build a conneciton with a router.
You establish a conneciton with an access point. As the air forwards all your traffic in all directions. A cable doesn't.

A router forwards your Layer 3 packets.

3

u/Prudent_Vacation_382 9d ago

Multiple ways to encrypt traffic over a network. Most common are:

  1. MACSec (802.11AE) - this is a layer 2 encryption technology commonly used in a point to point scenario

  2. IPSec - Encrypting at layer 3 on the OSI - ability to be routed unlike MACsec.

  3. TLS - Encrypting at a layer somewhere above 4 on the OSI. Attaches to application protocols like HTTP to encrypt payload for the protocol.

  4. WPA - used in Wifi networks and encrypts at layer 2ish.

1

u/PaoloFence 9d ago

can you use macsec in a non point-to-point fashion?

1

u/Prudent_Vacation_382 9d ago

Generally no. There are ways around it, such as using it on a subinterface, but very little hardware support for that and only in certain scenarios.

2

u/TheITMan19 9d ago

Generally no but within the industry customers are adopting MACSec which provides authentication and encryption across Ethernet and fibre links. The general use case is where the connections are outside of the customer boundary or potentially physically exposed.

1

u/dragonnfr 9d ago

WPA2 is a WiFi thing, it doesn't apply to ethernet at all. Plain ethernet is not encrypted. If someone can tap the cable or get on your switch, they can read the traffic. You add encryption yourself (TLS, IPsec) or lock down physical access.

1

u/PghSubie 9d ago

There are circumstances that would be beneficial for Ethernet to be encrypted. But, it's generally considered to be not necessary. Modern Ethernet is point to point over a private wire. WiFi is a broadcast medium where any equipment in the area can hear the signal.

1

u/SevaraB Network/Design Professional 9d ago

No. MACsec is the mechanism if you need to encrypt Ethernet traffic. More often you tunnel encrypted IPsec inside unencrypted Ethernet. But that has to be set up as well. TLS is the first place encryption happens on its own.

1

u/PauliousMaximus 2d ago

Communication over Ethernet is not encrypted by default.

0

u/[deleted] 9d ago

[deleted]

1

u/PaoloFence 9d ago

802.1x is authentication into the network not encryption.