Switching and Switches

The meaning of the term switch, which originally referred to an OSI Layer 2 device, has been blurred recently with the introduction of devices known as "Layer 3 switches", and even "Layer 4 switches". These are actually marketing terms. The following is an explanation of each type of device.

It will help to remember the name for PDUs (Protocol Data Units) at each layer of the OSI model. Layer 2 (Data Link Layer) PDUs are called frames. Layer 3 (Network Layer) PDUs are called packets. Layer 4 (Transport Layer) PDUs are called segments (for TCP) or datagrams (for UDP).

The contents, or payload, of a frame is a packet. The payload of a packet is either a TCP segment, or a UDP datagram. You will read many texts where the PDU at the Link Layer is referred to as a "packet" when it is actually a frame. This can be confusing.

Layer 2 Switches

In the normal context of networking, a switch is an OSI Layer 2 device. It operates at the Data Link layer. A switch is just a bridge with more than two ports. A switch operates by examining the contents of a frame to determine the MAC (Media Access Control) address of a frame. The switch then determines which interface the destination address can be reached through. It then establishes a hardware connection to that interface and the frame proceeds to its destination.

Switches replace hubs (concentrators) in the network. Hubs transmit everything they receive on all interfaces (ports), and typically a segment connected via a hub is called a shared segment. Switches prevent frame collisions from occuring. Their use reduces the size of an Ethernet Collision Domain and extends the size of an Ethernet network.

Switches utilize one of three methods to examine frames. The three methods are Store-and-Forward, Cut-Through, and Modified-Cut-Through.


Utilizing this method, a switch reads an entire frame into an internal buffer. It then examines the MAC address. It compares the MAC address against an internal table of addresses which tells the device which MAC addresses are on each interface. Once it has the interface identified, it sends the frame out that interface. The advantage to this method is that corrupted frames are identified and discarded without being forwarded. The disadvantage is that a great deal of buffer memory is required to store frames arriving on busy interfaces. Most modern switches are so fast that they use store and forward exclusively.


With this method, the switch only examines enough of a frame to determine the destination MAC address. It then establishes a connection to the interface through which that address can be reached and the frame is sent out. The advantage of this method is very fast operation. The disadvantage is that corrupted frames will be forwarded.


Using this method, the switch examines the first 64 bytes of a frame. It reads the MAC address and then establishes a connection to the interface through which that address can be reached and the frame is transmitted. By examining the first 64 bytes of a frame, corrupted frames are identified and discarded.

Since switches isolate traffic, they render RMON probes and promiscuous-mode protocol analyzers useless. If you need to have RMON or Sniffer support in a switched network, you must make sure the switch is capable of port-mirroring or conversation-steering. These techniques allow RMON information to reach the management agent. Cisco Systems refers to this as SPAN for Switch Port ANalyzer.

When buying a switch, make sure to find out how many MAC addresses each port can address. Some switches are intended to address only one MAC address. Others have the capability to address as many as 1,024 MAC addresses. The former type is used for switching down to the desktop level, since an individual machine has only one MAC address. The latter is used at the backbone and to connect to other switches. Almost all switches sold today support 1,024 MAC addresses per port.

Layer 3 Switches - Routers

These devices are often called "IP Switches". Since IP is a connectionless protocol, is it contradictory to refer to the process of IP "switching", since the term switching implies a connection-oriented protocol.

These devices are actually routers. They derive their great speed from the fact that the logic used to make routing decisions is in hardware, and not in software as with traditional routers. There is no end-to-end switch connection in this scenario as there is with a Layer 2 switch. The router is dealing with IP packets, whereas Layer 2 switches deal with Ethernet frames.

Layer 4 Switches

Devices marketed with this terminology are actually routers which look deeper into the payload of an IP packet to examine the TCP segment header or UDP datagram header information.

WAN Page Ray's Home Page E-Mail Me

Creation Date: Monday, October 19, 1998
Last Modified: Monday, January 28, 2002
Copyright © Ray Smith, 1998, 2002