Skip to content
Knowledge Hub/Article
Article

What Is a Network Switch? Types and Switch vs Router

We explain how a switch learns MAC addresses, layer 2 vs layer 3 switching, PoE, STP and LACP, leaf-spine designs and how to secure a switch.

Oğuzhan Gerçek··10 min read
What Is a Network Switch? Types and Switch vs Router

Short answer: A network switch connects devices on the same local network and forwards each frame only to the port where the destination device is connected. It learns which device sits on which port from the source MAC addresses of incoming frames. A layer 2 switch looks at MAC addresses; a layer 3 switch can also forward by IP address and route between VLANs. Managed switches offer settings such as VLANs, traffic prioritization and port security, and PoE models power connected devices over the cable. Unlike a router, a switch works within a network, not between networks.

What is a network switch?

In Cloudflare's definition, a network switch forwards data packets between devices; according to Cisco, it lets connected devices share information and talk to each other. We cover the other building blocks of a LAN, such as routers, access points and cabling, in our LAN article. There is a short definition of switch in our glossary, and of network in its network entry.

How does a switch work? The MAC address table

According to Cloudflare, a layer 2 switch keeps a table in memory that matches MAC addresses to its Ethernet ports:

  1. Learning: When a frame arrives on a port, the switch records the frame's source MAC address and the port it came in on.
  2. Forwarding: As Cisco explains, if the destination MAC address is in the table, the frame goes out only on the port associated with that address.
  3. Flooding: If the destination is not in the table, the switch sends the frame out all other ports in the same VLAN. Broadcast frames are flooded to all ports as well.
  4. Aging: Entries are not kept forever; according to Cisco's command reference, the default aging time is 300 seconds.

A hub does no learning. As Cisco describes it, a hub is an OSI layer 1 (physical layer) device that hears the electrical signal on the wire and passes it along to the other ports, so the devices connected to it share the bandwidth. On a switch, each device gets dedicated bandwidth.

Layer 2 vs layer 3 switches

According to Cloudflare, layer 2 switches forward data based on the destination MAC address and layer 3 switches based on the destination IP address; some switches can do both. The difference shows up with VLANs: according to Cisco, layer 2 switches need a layer 3 routing device for communication between VLANs, and that device can be built into the switch. We cover the two ways of routing between VLANs, router-on-a-stick and the layer 3 switch with switch virtual interfaces (SVIs), in our VLAN article.

Managed vs unmanaged switches

According to Cisco, an unmanaged switch is designed to be plugged in and work with no configuration and is typically used for basic connectivity; as Cloudflare puts it, it simply adds more Ethernet ports to a LAN. A managed switch is configured to fit the network. According to Cisco, it offers more security, features and flexibility; according to Cloudflare, it gives administrators much more control over how traffic is prioritized and lets them set up VLANs.

PoE: powering devices from the switch

With PoE (Power over Ethernet), the switch port also supplies electricity to the connected device over the data cable; the access points we mention in our LAN article, as well as IP phones, can draw their power this way. IEEE 802.3af, approved in June 2003, calls for a detection step before power is applied, so that non-compatible devices are not powered and possibly damaged. Later standards raised the power a port can deliver:

  • IEEE 802.3at (PoE+, 2009): According to Cisco, it raised the maximum power a powered device can draw from 15.4 W to 30 W per port.
  • IEEE 802.3bt (2018): According to the IEEE, it increased the power available to the device by using all four pairs in the cable. According to Cisco, up to 60 W can be supplied to Type 3 devices and up to 90 W to Type 4 devices.

The total power a switch can devote to PoE is limited, though: according to Cisco, the switch tracks this power budget and denies power to a port if granting it would exceed the budget.

A redundant link between switches creates a loop. As Cisco explains, flooded frames such as broadcasts are then passed from switch to switch around the loop forever and may multiply exponentially. The Spanning Tree Protocol (STP) prevents this: according to Cisco, it guarantees one and only one active path between two network devices. Ports on redundant paths are blocked, and if a link fails, a blocked port can move to forwarding.

STP was standardized in IEEE 802.1D (MAC Bridges). According to Cisco, that standard was designed at a time when recovering connectivity within a minute or so after an outage was considered adequate; 802.1w (Rapid STP), published in 2001, can converge in a properly configured network sometimes within a few hundred milliseconds. 802.1w was first incorporated into 802.1D-2004, and 802.1D-2004 was in turn superseded by 802.1Q (current edition: 802.1Q-2022).

Link aggregation, on the other hand, puts the redundant link to work. Under IEEE 802.1AX-2020, parallel links are used as if they were a single link; according to the IEEE 802.1 working group, this brings higher aggregate bandwidth and better resilience to failures. The group can be defined manually on both ends or formed automatically with LACP; according to Microsoft, LACP is the IEEE 802.1AX Link Aggregation Control Protocol, formerly known as IEEE 802.3ad. According to Cisco, if one link fails, traffic shifts to the remaining links without intervention, and STP treats the whole group as a single port.

Leaf-spine architecture in the data center

According to RFC 7938 (August 2016), the traditional data center network looks like an upside-down tree with redundant uplinks and three layers of hierarchy. Until recently, it was common for most traffic to enter and leave the data center (north-south); today, many large data centers carry significant server-to-server (east-west) traffic.

In the Clos topology, which the RFC notes is often called a "Leaf and Spine" network, servers connect to top-of-rack leaf switches, and according to Cisco's ACI installation guide, each leaf switch connects to every spine switch. According to RFC 7938, ECMP (equal-cost multipath) is the fundamental load-sharing mechanism in this design, and capacity can be scaled horizontally by adding more links and devices of the same type. STP's active/standby approach to path selection, by contrast, makes STP hard to deploy in horizontally scaled topologies; in the RFC's words, designs utilizing STP usually fail the requirements of large-scale operators.

We cover the facility side in our data center article, and rack and cabling design in our datacenter & infrastructure engineering service.

Switch security: port security, 802.1X and DHCP snooping

Managed switches have three core features for controlling physical access to the network:

  • Port security: According to Cisco, it restricts input to a port by limiting and identifying the MAC addresses of the devices allowed to use it. By default, a port allows one secure MAC address and shuts down when the limit is exceeded.
  • 802.1X: With IEEE 802.1X, a device must authenticate before it can communicate through the port; we cover it, along with NAC, in our network security article.
  • DHCP snooping: According to Cisco, it filters untrusted DHCP messages, and it is disabled by default. We explain how it works against rogue DHCP servers in our DHCP article.

The rules on default passwords and updates apply to switches too (router article). We handle campus and branch switch design in our network & traffic engineering service and day-to-day operations in our infrastructure management service.

Switch vs router

Devices on the same switch and the same VLAN share a broadcast domain: the switch floods broadcast frames to all its ports. A router marks the edge of that domain; under RFC 919 (October 1984), a broadcast to 255.255.255.255 belongs to the local network and must not be forwarded. We cover routing tables and the difference from a modem in our router article; VLANs are the way to create more than one broadcast domain on the same switch.

Frequently asked questions

What does a network switch do? It connects devices on the same local network, such as computers, servers, printers and access points, and forwards each frame only to the destination's port.

What is the difference between a switch and a hub? A hub passes incoming signals to all ports, and devices share the bandwidth. A switch learns which device is on which port and sends traffic only to that port.

What is the difference between a switch and a router? A switch works inside a single broadcast domain and forwards frames by MAC address. A router sits at the edge of broadcast domains and routes packets to other networks by IP address.

What is a managed switch? A switch you can configure to fit your network, with support for VLANs, traffic prioritization and security settings. An unmanaged switch works out of the box with no configuration.

What is a PoE switch? A switch that also supplies electricity to connected devices over the data cable, so devices such as IP phones and access points can run without a separate power adapter.

What is a layer 3 switch? A switch that can forward by IP address as well as MAC address, which lets it route between VLANs.

Sources