A switch is a box with many Ethernet ports (often 8, 24 or 48) that connects devices into a local area network (LAN). It looks much like a hub, but it works very differently. It reads the MAC address in each frame and sends the frame only out of the port that leads to the destination.
💡 In simple terms: a hub shouts every message to the whole room. A switch is like a post room that knows which desk each person sits at, and takes each letter straight to the right desk.
Why switches exist
Hubs made every device share one channel. Only one device could send at a time, collisions were common, and every device could see every other device's traffic. A switch solves all three problems:
- Speed: each port gets its own full bandwidth, so several pairs of devices can communicate at the same time.
- No collisions: each port is its own collision domain, and with full duplex, collisions cannot happen at all.
- Less snooping: once the switch has learned where PC B is, a frame for PC B goes only to PC B's port, not to every device.
Where switches are used
At home
Most homes already have a switch, even if nobody knows it: the LAN ports on the back of the home router are a small built-in switch. People add a separate switch when they run out of ports, for example behind the TV.
- 1. The console goes online. The switch passes its frames over the single cable to the home router, which routes the packets to the internet.
- 2. The TV streams to the console. Traffic between two devices on the same switch does not need to go through the router.
In an office
Offices use larger switches, arranged in layers. Access switches on each floor connect desks, phones, printers and wireless access points. They connect up to a core (or distribution) switch, which links the floors together and connects to the router and firewall.
- 1. A PC on floor 1 opens a file. Floor 1 switch → core switch → floor 2 switch → server. It is all one LAN, so every switch forwards the frame by MAC address.
- 2. A PC on floor 2 opens a website. The switches carry the frame to the firewall/router, which sends the packet towards the internet.
Important parts of a switch
Ports
Copper RJ45 ports for devices, and often a few SFP slots for fibre uplinks to other switches.
MAC address table
A list in memory of which MAC address was last seen on which port. Also called the CAM table.
Switching chip
Special hardware (an ASIC) that looks up the table and forwards frames at full speed on all ports at once.
Buffers
Memory that holds frames briefly when an output port is busy.
Uplink ports
Faster ports used to connect to other switches or to the router.
Management (managed switches)
A web page or command line, with its own IP address, for settings and monitoring.
How a switch works, step by step
A switch makes its decisions using a MAC address table. It builds the table by itself, simply by watching traffic. For every frame that arrives, it does two things:
- Learn from the source MAC address: “this device is reachable through the port the frame came in on.” It writes that into the table.
- Decide using the destination MAC address:
- If the destination is in the table on another port, forward the frame out of that one port.
- If the destination is not in the table yet (an unknown unicast), or it is a broadcast (
ff:ff:ff:ff:ff:ff), flood it out of every port except the one it came in on. - If the destination is on the same port the frame arrived on, filter it (drop it): the destination has already received it on that segment.
Watch a switch that has just been powered on, with an empty table:
- 1. PC A sends a frame to Printer D. The switch learns: 02:00:00:00:00:0a is on port 1.
- 2. Destination unknown: flood. Printer D isn't in the table yet, so the frame goes out of ports 2, 3 and 4. PC B and PC C ignore it because it isn't addressed to them.
- 3. Printer D replies to PC A. The switch learns: 02:00:00:00:00:0d is on port 4.
- 4. Destination known: forward. PC A is in the table on port 1, so the reply goes out of port 1 only. PC B and PC C never see it.
After those two frames, the switch's table looks like this:
| MAC address | Port | How it got there |
|---|---|---|
02:00:00:00:00:0a | 1 | Learned from PC A's frame |
02:00:00:00:00:0d | 4 | Learned from Printer D's reply |
Entries that are not refreshed are removed after a few minutes (commonly 5), so the table stays correct when a device moves or is switched off. A later lesson covers this in detail, with an interactive demo.
Learn more: How a Switch Learns MAC Addresses
What the switch reads in the frame
A switch reads the Ethernet frame header: the destination and source MAC addresses. It checks the frame check sequence (FCS) and drops damaged frames. It does not change the MAC or IP addresses: the frame leaves with the same addresses it arrived with. This is a key difference from a router, which builds a new frame before forwarding each packet.
| Field | Used by the switch? | Changed by the switch? |
|---|---|---|
| Destination MAC | Yes: to choose the output port | No |
| Source MAC | Yes: to learn where devices are | No |
| IP addresses | No (on a Layer 2 switch) | No |
| FCS | Yes: damaged frames are dropped | No |
| OSI layer | Hubbits | Switchframes + MACs |
|---|---|---|
| L7 ApplicationHTTP, DNS | – | – |
| L6 PresentationEncoding, encryption | – | – |
| L5 SessionSessions | – | – |
| L4 TransportTCP/UDP ports | – | – |
| L3 NetworkIP addresses | – | – |
| L2 Data LinkFrames, MAC addresses | – | ✓ |
| L1 PhysicalBits on cable or radio | ✓ | ✓ |
Collision domains and broadcast domains
Every switch port is its own collision domain. With full duplex (sending and receiving at the same time), there are no collisions at all. But a switch still floods broadcasts to every port, so all the ports of a switch (and of any switches connected to it) form one broadcast domain. Only a router, or splitting the switch into VLANs (virtual LANs), separates broadcast domains.
| Device | Collision domains | Broadcast domains |
|---|---|---|
| Hub with 8 PCs | 1 | 1 |
| Switch with 8 PCs | 8 (one per port) | 1 |
| Router with 2 LAN interfaces | 2 | 2 |
Learn more: Collision DomainsBroadcast Domains
A real-world example: printing in the office
PC A (192.168.10.11) prints to Printer D (192.168.10.40) on the same switch. Here's what happens:
- PC A sees that the printer is on its own subnet, so it needs the printer's MAC address. It sends an ARP request as a broadcast.
- The switch learns PC A's MAC address on port 1 and floods the broadcast out of every other port.
- Only the printer recognises its own IP address, so only the printer sends an ARP reply, addressed directly to PC A. The switch learns the printer's MAC address on port 4 and forwards the reply out of port 1 only.
- PC A now sends the print job in frames addressed to the printer's MAC address. The switch forwards them out of port 4 only.
- Meanwhile, PC B and PC C can communicate with each other at full speed: their traffic uses different ports and doesn't interfere.
Learn more: Same-Subnet Communication
Managed and unmanaged switches
| Unmanaged switch | Managed switch | |
|---|---|---|
| Setup | Plug and play: no settings at all | Configured through a web page or command line |
| IP address | None | One, for management only |
| Features | Learn and forward frames | VLANs, port security, monitoring, port mirroring, loop protection, and more |
| Monitoring | Only the port lights | Port status, error counters, logs, alerts |
| Typical use | Home, small desk extensions | Offices, schools, data centres |
| Price | Low | Higher |
Between the two are “smart” or web-managed switches, which offer a small set of settings through a simple web page.
Going further (CCNA): configuring VLANs, trunks and loop protection on a managed switch is part of the CCNA course.
Learn more: VLANs and TrunksSpanning Tree
Power over Ethernet (PoE)
Some switches can send electrical power over the same Ethernet cable as the data. This is Power over Ethernet (PoE). It powers small devices that are often mounted where there is no power socket, such as wireless access points, IP phones and security cameras. One cable does both jobs. A standard PoE switch only sends power after detecting that the device at the other end supports PoE, so plugging a normal laptop into a PoE port is safe.
Learn more: Power over Ethernet
When a switch fails or misbehaves
| Symptom | Likely cause | What to check |
|---|---|---|
| Everything on the switch is offline | The switch has no power, or its uplink to the router is down | Power light; the uplink port's link light |
| One device is offline | Cable, port, or the device's NIC | Link light on that port; try another port and cable |
| The whole network suddenly becomes very slow, and all port lights flash rapidly | A switching loop: a second path between the same switches | Look for a cable from the switch back into itself, or a second link between two switches, and unplug it |
| One device is slow, with errors | Speed or duplex mismatch, or a damaged cable | Link speed and duplex on the device; swap the cable |
| Devices on the switch have a link but can't reach each other | Different subnets, or (on a managed switch) different VLANs | IP settings on both devices; the switch's VLAN settings |
⚠️ Switching loops are the classic switch disaster. Broadcasts are flooded round the loop forever, because Ethernet frames have no “time to live” counter. Within seconds, the network is overloaded. Managed switches use Spanning Tree Protocol (STP) to prevent this; low-cost unmanaged switches often don't.
Useful checks from a PC
You can't log in to an unmanaged switch, so you test through it. Check the link speed the PC negotiated with the switch, then ping another device on the same switch:
C:\>ping 192.168.10.40 Pinging 192.168.10.40 with 32 bytes of data: Reply from 192.168.10.40: bytes=32 time<1ms TTL=64 Reply from 192.168.10.40: bytes=32 time<1ms TTL=64 Reply from 192.168.10.40: bytes=32 time<1ms TTL=64 Reply from 192.168.10.40: bytes=32 time<1ms TTL=64 Ping statistics for 192.168.10.40: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
What to look for: four Reply from 192.168.10.40 lines and 0% loss mean frames are crossing the switch in both directions. time<1ms is normal through a switch. If this works but the internet doesn't, the switch is fine: look at the router or the default gateway settings.
C:\>arp -a Interface: 192.168.10.11 --- 0xc Internet Address Physical Address Type 192.168.10.1 02-00-00-00-00-01 dynamic 192.168.10.40 02-00-00-00-00-0d dynamic 192.168.10.255 ff-ff-ff-ff-ff-ff static
What to look for: the PC's ARP cache lists the MAC addresses it has learned through the switch. The dynamic entry for 192.168.10.40 (the printer) proves the ARP request and reply both crossed the switch. The 192.168.10.255 entry is the subnet broadcast, which is always present.
Common mistakes
- Thinking a switch connects you to the internet. It only connects devices on the local network; a router is needed to reach other networks.
- Thinking a switch blocks broadcasts. It floods them out of every other port. Only routers (or VLANs) separate broadcast domains.
- Plugging both ends of a cable into the same switch, or connecting two unmanaged switches with two cables. That creates a switching loop, and without Spanning Tree, broadcasts circle forever.
- Expecting a switch to change MAC addresses. It forwards frames without changing their addresses. Only a router builds a new frame.
- Buying a 100 Mb/s switch for gigabit devices. Each link runs at the speed both ends support, so every device on that switch is limited to 100 Mb/s.
- A switch is a Layer 2 device that forwards frames using MAC addresses.
- It learns from source MAC addresses and decides using destination MAC addresses: forward, flood or filter.
- Unknown destinations and broadcasts are flooded to every other port.
- Each port is its own collision domain; the whole switch is one broadcast domain.
- Unmanaged switches are plug and play; managed switches add VLANs, monitoring and security.
- PoE switches power access points, phones and cameras through the network cable.
Knowledge check
A switch has just been powered on. PC A sends a frame to PC B. What does the switch do with it?
PC A sends an ARP request with destination MAC ff:ff:ff:ff:ff:ff into a 24-port switch. Where does the switch send it?
How many collision domains does a 24-port switch with 20 devices plugged in create?
Someone plugs both ends of a spare cable into two ports of the same unmanaged switch. What happens?
Where to go next
A switch only connects devices on one network. To reach other networks, you need a router, the next device in this unit. Later in the course, you will look at how a switch learns MAC addresses in more detail.
Learn more: How a Switch Learns MAC Addresses