Network Devices

Endpoints and intermediary devices

Every device on a network falls into one of two roles. Endpoints (also called end devices or hosts) are where traffic starts and ends: laptops, servers, phones, printers, IP cameras. Intermediary devices sit in between and move that traffic along: switches, routers, access points, firewalls. When a ticket says "users on floor 3 cannot reach the file server", the endpoints are the users' laptops and the server; the problem is usually somewhere in the intermediary devices between them.

Intermediary devices differ in how much of a message they look at before they pass it on. That is exactly what the layers of the OSI model describe: a layer 1 device only sees bits, a layer 2 device reads the Ethernet frame header with its MAC addresses, and a layer 3 device reads the IP packet header with its IP addresses. The higher the layer a device works at, the smarter its forwarding decision, and the more work it does per packet.

Hubs and switches

Hub (layer 1)

A hub is a multiport repeater: every electrical signal that arrives on one port is regenerated and sent out of all other ports. It does not read addresses at all, which makes it a physical-layer (layer 1) device. Every host connected to a hub receives every frame, and only one host can send at a time. If two send at once, their signals collide and both have to try again, so a hub runs in half duplex and uses the collision-handling rules of early Ethernet (CSMA/CD, Carrier Sense Multiple Access with Collision Detection).

Hubs are obsolete. Switches became cheap in the late 1990s, and they are faster (full duplex, no collisions), more private (a host no longer sees everyone else's traffic) and scale much better. You will not find a hub for Gigabit Ethernet in practice. The concept still matters, because it explains collision domains and why switches were such an improvement.

Switch (layer 2)

A switch connects devices within one local network and forwards each Ethernet frame only to the port where its destination lives. It reads the destination MAC address in the frame header, which makes it a data-link-layer (layer 2) device. It learns which MAC address sits behind which port by looking at the source address of frames it receives. Frames for an unknown destination, and broadcasts, go out of every other port.

Because each port has its own link, a switch port can run in full duplex: sending and receiving at the same time, with no collisions. The access switch in a wiring closet, the one users' desk sockets are patched into, is the device a network operations (NetOps) team touches most. The details of MAC learning, VLANs and Spanning Tree are on Switching and VLANs.

Routers and layer 3 switches

Router (layer 3)

A router connects different networks and forwards packets between them based on the destination IP address, which makes it a network-layer (layer 3) device. For every packet it looks up the destination in its routing table, picks the best matching route, and sends the packet out of the interface toward the next hop. On the way it removes the old Ethernet header, writes a new one for the next link, and lowers the packet's time-to-live counter by one.

Each router interface belongs to a different network (subnet). The router is what hosts use as their default gateway: the address they send traffic to when the destination is not on their own subnet. Routers do not forward broadcasts, which is why a router is the boundary of a broadcast domain. How routers build and use their routing tables is explained on Routing Basics.

Layer 3 switch

A layer 3 switch (multilayer switch) is a switch that can also route. It has many Ethernet ports like a normal switch, but it can route between VLANs using virtual interfaces, one per VLAN, called switched virtual interfaces (SVIs). It routes in hardware, using specialized chips (ASICs, application-specific integrated circuits), so routing between VLANs runs at the same speed as switching.

In a campus network, layer 3 switches usually do the routing between internal VLANs in the distribution or core layer, while a dedicated router or firewall handles the connection to the WAN and the internet. Routers still offer features a typical layer 3 switch lacks, such as many kinds of WAN interfaces, virtual private networks (VPNs) and large-scale address translation.

Collision domains and broadcast domains

Two terms describe how far traffic spreads, and each device type affects them differently.

• A collision domain is a network segment in which frames can collide because devices share the same medium, so only one of them can send at a time. A hub and everything connected to it form one collision domain. Every switch port and every router interface is its own collision domain; on a full-duplex link there are no collisions at all.
• A broadcast domain is the set of devices that receive a broadcast sent by any one of them. Hubs and switches forward broadcasts, so everything behind them is one broadcast domain (per VLAN). Routers stop broadcasts, so every router interface is its own broadcast domain.

Why it matters: every host in a broadcast domain has to receive and process every broadcast, such as ARP requests and Dynamic Host Configuration Protocol (DHCP) discovers. A broadcast domain of a few hundred hosts is fine; one of many thousands wastes bandwidth and CPU time on every device. Splitting a network with routers or VLANs keeps broadcast domains small.

Counting domains in a topology like this is a classic exam question. Work link by link: a switch or router port starts a new collision domain, a hub does not; a router interface starts a new broadcast domain, a switch or hub does not.

Firewalls, access points and load balancers

Firewall

A firewall is a device or program that permits or blocks traffic between networks according to a set of rules, the security policy. It usually sits at the edge between the internal network and the internet, and more and more between internal zones as well. A basic packet filter checks each packet on its own against addresses and port numbers (layers 3 and 4). A stateful firewall also remembers the connections it has allowed, so it lets reply traffic back in automatically and drops packets that do not belong to any known connection. A next-generation firewall (NGFW) adds inspection up to the application layer: it can recognize applications, decrypt and scan traffic and block known attacks.

Firewall rules, access control lists and network zones are covered on Network Security Basics.

Access points and wireless LAN controllers

An access point (AP) connects wireless clients to the wired network. It speaks Wi-Fi (IEEE 802.11) on its radio side and Ethernet (IEEE 802.3) on its cable side, and bridges frames between the two, so it works at layer 2. An access point is usually connected to an access switch port and powered over that same cable with Power over Ethernet.

A home or small office has one or a few autonomous access points, each configured on its own. A company building can have hundreds, so they are usually lightweight APs managed centrally by a wireless LAN controller (WLC), which pushes the configuration, chooses channels and power levels and helps clients roam between APs. The controller can be a hardware appliance, software on a switch, or a cloud service. See Wireless Networking for how this works.

Load balancer

A load balancer spreads incoming client connections over a group of servers that offer the same service, so that no single server is overloaded and a failed server can be taken out of the rotation. Clients connect to one virtual IP address (VIP) on the load balancer; it picks a server (round robin, least connections, and so on) and passes the connection on. It sends regular health checks to every server and stops using one that does not answer.

A layer 4 load balancer decides on IP addresses and port numbers only. A layer 7 load balancer understands the application protocol, usually the Hypertext Transfer Protocol (HTTP), so it can route /images to one group of servers and /api to another, or end the Transport Layer Security (TLS) encryption itself. In monitoring you often see load balancers as the place where a "server down" alert first shows up, because the health check failed.

Modems, ONTs and the home router

Connections to an internet service provider (ISP) need one more device: something that turns the signal on the provider's line into Ethernet.

• A modem (modulator-demodulator) converts digital data to the signal of the provider's medium and back: DSL (digital subscriber line) over a telephone line, or DOCSIS (Data Over Cable Service Interface Specification) over a cable TV coaxial line.
• An ONT (optical network terminal) does the same for fiber to the home: it converts light on the provider's fiber into Ethernet.

The box most people call their "router" at home combines several devices that are separate in a company network:

• a router with one interface to the ISP and one to the home network;
• network address translation (NAT), so the whole home shares one public IPv4 address (see NAT and PAT);
• a small switch, usually four Ethernet ports;
• a Wi-Fi access point;
• a basic stateful firewall;
• a DHCP server that hands out addresses (see DHCP) and a Domain Name System (DNS) forwarder;
• often the modem or ONT as well.

Physical and virtual devices

Every device on this page is, in the end, a function implemented in software on some hardware, and more and more of them run without dedicated hardware at all.

• Virtual switches. A hypervisor host running twenty virtual machines has a software switch inside it that connects the VMs' virtual network cards to each other and to the host's physical ports. Examples are the VMware vSphere switches, the Hyper-V virtual switch, the Linux bridge and Open vSwitch. They learn MAC addresses and carry VLAN tags just like a physical switch.
• Virtual appliances. Routers, firewalls and load balancers are sold as VM images that run on standard servers, an approach called network functions virtualization (NFV).
• Cloud networking. In a public cloud you never see a switch or router. You create a virtual network, subnets, route tables, security groups (a stateful firewall per VM) and managed load balancers through a web console or an application programming interface (API), and the provider's software implements them.

The concepts do not change: a virtual switch still forwards on MAC addresses, a cloud route table still does longest prefix match, and a security group is still a stateful firewall.

Device overview