Routing vs switching: how routers and switches differ

A switch forwards Ethernet frames between devices on the same local network, using their MAC addresses. A router forwards IP packets between different networks, using IP addresses and a routing table. In OSI terms, switching happens at layer 2 and routing at layer 3.

The box most homes call a router is several devices in one: a router, a small switch, a Wi-Fi access point, a DHCP server and a NAT gateway. In offices and data centers these are usually separate, and layer 3 switches blur the line by routing between VLANs in hardware.

Every network interface has a MAC address, a 48-bit hardware address written as six pairs of hex digits, such as 3c:22:fb:7a:10:4e. Each Ethernet frame carries a source and a destination MAC address.

A switch learns where devices are by watching traffic. It records the source MAC address of each frame against the port it arrived on, which builds a MAC address table. Entries that see no traffic age out after a few minutes.

To forward a frame, the switch looks up the destination MAC address. If it knows the port, it sends the frame only there. If the address is unknown, or the frame is a broadcast to ff:ff:ff:ff:ff:ff, it floods the frame out of every port except the one it came in on.

VLANs split one physical switch into separate layer 2 networks, and traffic between VLANs has to pass through a router. Ethernet frames have no hop limit, so managed switches run the Spanning Tree Protocol to block redundant links that would otherwise loop broadcasts forever.

A router reads the destination IP address and looks it up in its routing table, a list of address prefixes with the next hop or interface for each. When several routes match, it uses the most specific one, which is called longest prefix match. A default route, 0.0.0.0/0 in IPv4 or ::/0 in IPv6, matches anything no other route covers.

At each hop the router lowers the hop limit, wraps the packet in a new frame with the MAC addresses for the next link, and sends it on. The source and destination IP addresses stay the same along the path unless a NAT device rewrites them.

Routes come from networks connected directly to the router, from static routes an administrator enters, and from dynamic routing protocols. Inside one organization that is usually OSPF or IS-IS, and between organizations it is BGP.

Your device has a small routing table of its own, which ip route prints on Linux. It usually holds two entries: the local subnet, which is reachable directly, and a default route to the default gateway, the router's address on your network. DHCP normally supplies the gateway.

To put a packet on the wire, the device needs the MAC address of the next hop. That is the destination itself on the local subnet, or the gateway for anything else.

ARP (Address Resolution Protocol) finds it. The device broadcasts a request for the owner of an address such as 192.168.1.1, and the owner replies with its MAC address. The answer is cached in the ARP table.

IPv6 replaces ARP with Neighbor Discovery, which sends ICMPv6 neighbor solicitations to a multicast address instead of a broadcast. Neighbor Discovery also carries the router advertisements that IPv6 hosts use to find their gateway and address prefix.

Neither ARP nor basic Neighbor Discovery authenticates replies. On a shared network, an attacker can answer for the gateway and pull traffic through their own machine, a technique called ARP spoofing. That is one reason to rely on TLS, rather than the local network, to keep data private.

Between the autonomous systems that make up the internet, routing runs on BGP, the Border Gateway Protocol. Each network announces the address prefixes it can deliver to, and its neighbors pass those announcements on. Every network picks among the paths it hears by its own policy rather than by measured speed.

BGP trusts announcements by default, so one network's mistake or hijack can pull other networks' traffic the wrong way. RPKI route origin validation allows a network to check that an autonomous system is authorized to announce a prefix and to drop announcements that fail.