Overview
A switch is the device that connects hosts within a local network and forwards frames intelligently between them. Understanding switches explains how a LAN actually moves data and sets up the security topics of segmentation and Layer 2 attacks.
Learning objectives
- Define a network switch and its function.
- Explain how a switch learns and forwards by MAC address.
- Distinguish a switch from a hub and a router.
Core concept
A switch is a Layer 2 device that connects multiple hosts on a LAN and forwards frames based on MAC addresses. Unlike an old hub (which blindly repeated every frame to every port), a switch is selective: it sends each frame only to the port where the destination device lives. This makes switched networks far more efficient and private than hub-based ones.
A switch differs from a router: switches forward frames within a local network (Layer 2), while routers forward packets between networks (Layer 3).
How it works
A switch builds a MAC address table (also called a CAM table) by learning which MAC address is reachable on which port:
- When a frame arrives, the switch records the source MAC and the port it came in on.
- To forward, it looks up the destination MAC in its table and sends the frame out only that port.
- If the destination is unknown, it floods the frame to all ports (except the source) until it learns the location.
Over time the table fills in, and traffic is delivered precisely port-to-port.
Practical example
Three PCs connect to a switch. When PC-A first sends to PC-B, the switch does not yet know where B is, so it floods the frame; B replies, and now the switch has learned both A's and B's ports. Subsequent A↔B traffic goes directly between their two ports, never reaching PC-C. The switch quietly learned the topology from the traffic itself.
Cybersecurity relevance
Switch behavior underlies several Layer 2 security topics: MAC flooding attacks try to overflow the MAC table so the switch fails open and floods traffic (letting an attacker sniff it), and VLANs on switches provide segmentation to isolate groups of hosts. Managed switches also offer port security to limit these attacks.
Common mistakes
- Confusing a switch (L2, within a LAN) with a router (L3, between networks).
- Assuming switched traffic is unsniffable — attacks like MAC flooding or ARP poisoning can defeat that isolation.
Key takeaways
- A switch connects LAN hosts and forwards frames by MAC address, learning locations into a MAC table.
- It is selective (port-to-port) unlike a hub, and operates at Layer 2 unlike a Layer 3 router.
- Switch behavior enables segmentation (VLANs) but is targeted by Layer 2 attacks like MAC flooding.
Check your understanding
- How does a switch decide which port to send a frame out of?
- What does a switch do when it receives a frame for a destination MAC it has not yet learned?