Network-device architecture: what each box is responsible for
Switches, routers, and firewalls can all forward traffic, but they make decisions using different information and serve different design goals. Understanding those roles prevents a common beginner mistake: treating every device as a generic "Internet box."
Collision domain
A region where simultaneous transmissions could historically collide on shared half-duplex Ethernet. Modern switch ports isolate collision domains.
Broadcast domain
A Layer 2 scope in which broadcast frames are flooded. VLANs define broadcast domains; routers separate them.
1. Layer 2 switch: micro-segmentation inside the LAN
An Ethernet switch forwards frames according to destination MAC addresses and VLAN membership. Each switch port is normally its own collision domain, while all ports in the same VLAN remain part of the same broadcast domain.
Switches learn source MAC addresses from incoming frames. They do not need IP routing information to forward ordinary Layer 2 traffic inside a VLAN.
The MAC address table: the heart of switching
Learning and forwarding
When a frame arrives, the switch records the source MAC and incoming port/VLAN. It then checks the destination MAC. A known unicast is forwarded toward the learned port; an unknown unicast is flooded within the VLAN; broadcast is flooded to the VLAN by design.
The table ages over time so the switch can adapt when devices move. Managed switches expose this table for troubleshooting.
Collision domains: why switches replaced hubs
Hub (historical)
A hub repeats incoming signals to all ports, creating one shared collision domain. Half-duplex Ethernet required CSMA/CD to deal with collisions.
Switch (modern)
A switch provides independent point-to-point links. Full-duplex operation removes collisions from normal switched Ethernet and lets endpoints send and receive simultaneously.
2. Router: Layer 3 forwarding between IP networks
A router receives a Layer 2 frame, removes that link-layer header, examines the destination IP address, performs a routing-table lookup, chooses an outgoing interface/next hop, and builds a new Layer 2 frame for the next link.
Routing process step by step
- Validate and decapsulate the incoming frame.
- Read the destination IP address.
- Use longest-prefix matching in the routing/forwarding table.
- Determine the next hop and outgoing interface.
- Resolve the next-hop Layer 2 address when necessary.
- Encapsulate the packet in a new frame and transmit it.
Broadcast domains: routers create boundaries
Layer 2 broadcasts stay within their VLAN. A router does not normally forward Ethernet broadcasts from one IP network to another. This is why adding VLANs and routing between them creates separate broadcast domains.
Broadcast boundaries improve control and scalability, but they also mean hosts need a gateway to communicate between subnets.
ARP: the glue between Layer 2 and Layer 3 in IPv4
Before a device can send an IPv4 packet over Ethernet, it needs the MAC address of the local next hop. ARP resolves that mapping. For a local destination the next hop is the destination itself; for a remote destination it is normally the default gateway.
See MAC and ARP for the complete resolution process.
3. Layer 3 switch (multilayer switch)
A multilayer switch combines high-speed Ethernet switching with routing functions. In campus networks it can provide VLAN gateways through switched virtual interfaces and route between VLANs without sending every flow to an external router.
Advantage
Routing close to the access/distribution layer can provide high throughput and a clean hierarchical design.
Typical limitation
A Layer 3 switch is not automatically a replacement for every edge router or firewall. WAN connectivity, advanced NAT, VPN, and stateful security requirements may belong on other platforms.
4. Firewall: policy and stateful inspection
A firewall enforces security policy between trust zones or networks. Modern firewalls can inspect Layer 3/4 flow state and often understand applications at higher layers.
Stateful vs stateless
Stateless controls (ACLs)
A stateless ACL evaluates each packet against rules such as source, destination, protocol, and port without maintaining a full connection state table.
Stateful firewall
A stateful firewall tracks flows and can automatically permit expected return traffic for an allowed connection. It can also apply NAT, VPN, inspection, and logging functions depending on the platform.
Comparison table
| Device | Main decision | Typical boundary/function |
|---|---|---|
| L2 switch | MAC + VLAN | Local Ethernet forwarding |
| Router | Destination IP/prefix | Connects IP networks |
| L3 switch | MAC and IP | Campus switching + routing |
| Firewall | Policy + flow state | Security boundary |
Real scenario: traffic flow
A PC sends traffic to a server in another subnet. The PC uses ARP to learn its gateway MAC, then sends an Ethernet frame to the access switch. The switch forwards it toward the gateway. The router or L3 switch performs a route lookup and creates a new frame for the next network. If a firewall lies on the path, it evaluates policy and connection state before forwarding.
What next?
Once the device roles are clear, study VLANs and switching for Layer 2 segmentation, then routing and firewalls for Layer 3 connectivity and policy.
Keep learning with SubnetMaster
Pair this guide with Ethernet, MAC/ARP, and network architecture.