Table of Contents
Role of Switches in a Network
Switches are central devices used mainly in local area networks. Their job is to connect multiple hosts on the same network so they can send frames to each other efficiently. In a typical small office or home, most wired devices connect first to a switch, then the switch connects toward the rest of the network and the router.
Unlike simple repeaters or hubs, a switch pays attention to the addressing information inside each Ethernet frame. This lets it decide which physical port should receive the frame, instead of sending it everywhere. The result is more efficient use of bandwidth, fewer collisions, and better overall performance for all connected devices.
Switches operate primarily at the Data Link layer, using MAC addresses, but some advanced models also understand IP information and can work at higher layers. At a basic level, though, it is enough to remember that a switch is a multiport device that forwards frames intelligently within the same network segment.
How a Switch Forwards Frames
When a frame arrives at one of the switch ports, the switch examines the source and destination MAC addresses in the Ethernet header. It uses these addresses to decide what to do.
First, the switch learns where devices are located. Every time it receives a frame, it looks at the source MAC address and records which port that MAC address came from. It stores this information in a table inside the switch, often called the MAC address table or CAM table. Over time this table maps MAC addresses to ports.
Then the switch uses this table to forward traffic. When the switch receives a frame, it checks the destination MAC address and looks in its table. If it finds a match, it knows exactly which port to use. It forwards the frame only out that single port. This is called unicast forwarding.
If the switch does not have an entry for the destination MAC address, it needs another method. In that case it sends the frame out all ports except the one it arrived on. This process is called flooding. When the unknown destination device finally responds, the switch learns its MAC address and port, and future frames no longer need to be flooded.
A basic rule:
A switch forwards frames based on destination MAC address, and learns MAC locations from source MAC addresses.
Switching Domains and Traffic Types
Switches influence how traffic is shared in a network. They separate collision domains but, at the basic level, they keep one broadcast domain for all ports in the same VLAN. Collisions and broadcast behavior are explained in their own chapters, but here it is important to understand how a switch treats different kinds of frames.
A unicast frame has a single destination MAC address. A switch forwards a unicast frame to exactly one port, once it has learned that MAC address.
A broadcast frame uses a special destination MAC address of $FF:FF:FF:FF:FF:FF$. A switch always floods broadcasts to all active ports in the same VLAN, because by design all devices in that broadcast domain must receive it.
There is also multicast traffic, which uses specific multicast MAC addresses. Basic switches often treat multicast frames similarly to broadcasts and flood them, while more advanced switches can be configured to handle multicast in a more efficient way.
In summary, a switch tries to keep most traffic as unicast between the sending and receiving ports, but certain address types cause it to replicate frames to multiple or all ports.
Store-and-Forward vs Cut-Through
Switches do not all forward frames in exactly the same way. There are two main forwarding methods used in Ethernet switching: store-and-forward and cut-through.
In store-and-forward switching, the switch receives the entire frame into its memory before it forwards it. After the full frame arrives, the switch can run checks on it, such as verifying the frame check sequence, to detect errors. If the frame has errors, the switch can discard it instead of forwarding a damaged frame. This method provides better error handling but adds a small amount of delay because the switch must wait for the whole frame.
In cut-through switching, the switch does not wait for the entire frame. It starts forwarding the frame as soon as it has read enough of the header to know the destination MAC address and the output port. This reduces latency, which is useful for environments where speed is more important than error checking. However, if the incoming frame is corrupted, the switch might still forward it.
Some switches can use a hybrid method that tries to balance these two approaches, but as a beginner it is helpful to simply recognize that these two basic modes exist and that they affect delay and error behavior.
Managed vs Unmanaged Switches
Switches come in different types depending on how much control and visibility they offer. For beginners, the main distinction is between unmanaged and managed switches.
An unmanaged switch is a simple plug and play device. You connect cables and it starts forwarding frames with no configuration. It usually has no console port, no web interface, and no command line. These switches are common in small offices and home networks where advanced features are not required.
A managed switch offers configuration and monitoring options. You can log into it by console, web, or other management protocols. Managed switches let you create VLANs, configure port settings, monitor traffic, and apply security policies. They are the standard choice in enterprise networks, data centers, and more complex environments.
The extra capabilities of managed switches become important in many later topics, such as VLANs, spanning tree, and security features, but at this point it is enough to see that managed switches can be controlled and observed, while unmanaged ones simply forward traffic automatically.
Access, Trunk, and Uplink Ports
On many switches, especially managed ones, you will see certain logical roles for ports, even if the physical connectors look the same. These roles are related to how traffic is tagged and where it is meant to go.
An access port connects to an end device, such as a computer or printer. It typically carries traffic for a single VLAN. Frames leaving an access port are usually untagged from the point of view of the end device.
A trunk port connects the switch to another switch or to a router or firewall that understands VLAN tags. A trunk can carry traffic for multiple VLANs simultaneously. The details of how tags are added and removed are part of VLAN and trunking topics, but the key idea is that trunk ports carry multiple logical networks over one physical link.
An uplink is a more general term that refers to the port or ports used to connect one switch upward toward the rest of the network. An uplink can be configured as an access port or a trunk port depending on network design. It often uses a higher speed or different type of connector, such as fiber.
These roles do not change what a switch fundamentally does, but they strongly affect how frames are handled between switches and toward other network devices.
Hardware Features and Interfaces
Switches offer various physical interfaces and hardware options that influence where and how they are deployed. Most access switches provide multiple copper Ethernet ports, such as 1 Gbps ports using twisted pair cabling. Many also include a smaller number of high speed ports, often using fiber, for uplinks to distribution or core switches.
Fixed configuration switches have a set number of ports built into the chassis. Modular switches provide slots that can accept different line cards, so the total number and types of ports can be customized. In enterprise networks, modular switches are common in central locations, while fixed switches are often used at the edge where end devices connect.
Some switches support Power over Ethernet. These can deliver electrical power along with data on the same Ethernet cable, which is useful for powering devices such as IP phones, wireless access points, or security cameras. The switch must support the appropriate PoE standard for the devices it powers.
Finally, switches often provide out of band management interfaces, such as a dedicated management Ethernet port or a console port. These interfaces are used to configure and monitor the switch, and they are separate from the regular data forwarding ports that carry user traffic.
Basic Security and Control on Switch Ports
Although detailed security topics are covered elsewhere, it is useful to know that switches can enforce some basic controls on individual ports. Since a switch knows which MAC addresses appear on each port, it can be configured to limit or monitor that behavior.
A simple example is port security, where a switch can be told which MAC addresses are allowed on a port, or how many MAC addresses can appear there. If the switch detects unapproved or excessive devices on that port, it can log an event or even disable the port.
Switches can also control port speed and duplex settings, whether manually or through automatic negotiation. Correct duplex and speed matching help avoid performance problems on links between the switch and connected devices.
These capabilities show that a switch is more than just a traffic forwarder. It can also act as a control point that helps enforce policies and maintain stable connections across the network.