Switches and VLANs

Plug six computers into one old hub and you have rebuilt the dinner-party microphone: a hub is an electrical repeater that shouts every incoming bit out of every other port, so all six machines share one noisy channel and must run CSMA/CD to take turns. Plug the same six into a switch and something quietly magical happens: each machine gets the wire to itself, collisions vanish, and any two pairs can talk at the same time at full speed. The switch looks identical from the outside — same ports, same cables — but inside it is a completely different kind of animal. This page is about that animal: how it learns, why it abolishes collisions, and how VLANs let one physical box pretend to be many separate LANs.

Hub, switch, router: three boxes, three layers

The three devices are easy to confuse because they all have ports and pass traffic around. The difference is how much they understand about what flows through them.

Hub (layer 1) — understands nothing. It repeats raw bits out every port. One shared medium, one collision domain, half-duplex, CSMA/CD required. Obsolete.
Switch (layer 2) — understands frames and MAC addresses. It reads each frame's destination MAC and forwards it out only the one port that reaches it. Every port is its own collision domain, so the whole switch is collision-free and full-duplex.
Router (layer 3) — understands IP addresses. It forwards packets between different networks, choosing routes across the internet, and separates broadcast domains. Slower per packet, but it is what lets networks scale beyond one LAN.

A useful one-liner: a switch moves frames within a LAN by MAC address; a router moves packets between LANs by IP address. A switch never looks at IP; a router does not care about your MAC beyond the next hop.

The self-learning switch table

A switch is not configured with a map of who is plugged in where — it teaches itself, by watching traffic, using a switch (or MAC/CAM) table mapping MAC address → port. The algorithm is three small rules, applied to every arriving frame:

Learn — record the frame's source MAC against the port it arrived on. Now the switch knows how to reach that station.
Forward or flood — look up the destination MAC. If it is in the table, send the frame out only that port (a "forward"). If it is unknown (or a broadcast), flood it out every port except the one it came in on — the switch does not yet know where the target lives, so it asks everywhere.
Age — every table entry carries a timer; if a MAC goes silent for the timeout (typically ~5 minutes) its entry is deleted, so the table tracks machines that move or unplug.

Because normal replies flow back, the table fills within a frame or two of a conversation starting, and flooding quickly gives way to precise forwarding. The simulation below fills a table live as frames arrive.

// A self-learning layer-2 switch. It watches (srcMac, dstMac, inPort) // for each frame and prints whether it FORWARDS to a known port or FLOODS. type Frame = { src: string; dst: string; inPort: number }; function runSwitch(frames: Frame[], numPorts: number): void { const table = new Map<string, number>(); // MAC -> port for (const f of frames) { // 1) LEARN the source const learned = table.get(f.src) !== f.inPort; table.set(f.src, f.inPort); // 2) FORWARD if we know the destination, else FLOOD const outPort = table.get(f.dst); let action: string; if (outPort === undefined) { const flood = []; for (let p = 1; p <= numPorts; p++) if (p !== f.inPort) flood.push(p); action = "FLOOD to ports " + flood.join(",") + " (dst unknown)"; } else if (outPort === f.inPort) { action = "DROP (dst is on the same port)"; } else { action = "FORWARD to port " + outPort; } const note = learned ? " [learned " + f.src + "@" + f.inPort + "]" : ""; console.log(`${f.src}->${f.dst} in p${f.inPort}: ${action}${note}`); } console.log("\nFinal switch table:"); for (const [mac, port] of table) console.log(` ${mac} -> port ${port}`); } // A, B, C, D on ports 1..4 exchange a few frames. runSwitch([ { src: "A", dst: "B", inPort: 1 }, // B unknown -> flood { src: "B", dst: "A", inPort: 2 }, // now A known -> forward { src: "C", dst: "A", inPort: 3 }, // A known -> forward { src: "A", dst: "C", inPort: 1 }, // C now known -> forward { src: "D", dst: "B", inPort: 4 }, // B known -> forward ], 4);

Watch the first frame flood (nobody knows where B is), then every later frame forward precisely as the table fills. This tiny algorithm — learn the source, forward-or-flood the destination, age the entries — is the entire brain of an unmanaged switch.

Why switched Ethernet is full-duplex and collision-free

On a hub, host and hub share one wire, so a host must not transmit while receiving — half duplex, with CSMA/CD refereeing the shared medium. A switch changes the physics: a modern link is a point-to-point connection with separate transmit and receive pairs between exactly two devices — the host and the switch port. With only two endpoints and dedicated wires each way, both can transmit simultaneously (full duplex) and there is no one to collide with. The switch buffers frames arriving on busy ports and serves them when the outgoing port is free.

So on fully-switched, full-duplex Ethernet, CSMA/CD is switched off entirely — there are no collisions to detect. The collision-management machinery that defined classic Ethernet becomes vestigial; the switch's buffering and per-port isolation do the job instead. This is why a switched LAN can run every link at line rate at once, where a hubbed LAN's total throughput was capped at one shared channel.

Two confusions to nail down. First, a switch is not a router: a switch forwards by MAC within a single LAN and never inspects IP; a router forwards by IP between LANs. Calling the box in your cupboard a "router" is often half-wrong — most home "routers" are a router, a switch, and a Wi-Fi access point fused into one case.

Second — and this trips up many — a plain switch does not reduce broadcast traffic. A switch confines collisions (one collision domain per port), but a broadcast frame (destination FF:FF:FF:FF:FF:FF, or an unknown-destination flood, or every ARP query) is sent out every port. The whole switch — and every switch chained to it — is one big broadcast domain. Broadcast storms still cross switches freely. To split a broadcast domain you need either a router or a VLAN — which is exactly what the next section is for.

VLANs: many logical LANs in one box

A big organisation wants Engineering, Finance and Guests kept apart — separate broadcast domains, so a guest laptop can never even see Finance's broadcast traffic. The old way was three physical switches. The modern way is one switch sliced into three virtual LANs (VLANs). You assign each port a VLAN number; the switch then behaves as if it were three independent switches that happen to share a chassis. A frame from a port in VLAN 10 is only ever flooded or forwarded to other VLAN 10 ports — VLAN 20 never hears it. Each VLAN is its own broadcast domain.

To carry many VLANs over a single cable between switches (or up to a router), you use a trunk link, and each frame on it is tagged with its VLAN. The IEEE 802.1Q standard defines this tag: a 4-byte field inserted into the Ethernet header carrying a 12-bit VLAN ID (so up to 4094 usable VLANs). Access ports (to end hosts) carry untagged frames for one VLAN; trunk ports carry tagged frames for many. Crossing between VLANs still requires a router (or a layer-3 switch) — because different VLANs are different IP subnets, and moving between subnets is, by definition, routing.

A switch port separates collision domains (one per port) but not broadcast domains.
A VLAN separates broadcast domains logically, on one physical switch, via 802.1Q tags — no extra hardware.
A router separates broadcast domains too, and is the only way to move traffic between VLANs / IP subnets.

Spanning Tree: surviving loops

For resilience, network designers wire redundant links between switches — if one cable fails, another path remains. But a physical loop is catastrophic for a layer-2 network. Recall that switches flood unknown-destination and broadcast frames out every port. In a loop, a single broadcast is flooded around the ring, arrives back, is flooded again, and multiplies forever — a broadcast storm that melts the network in seconds. Ethernet frames have no time-to-live field to stop them, unlike IP packets.

The Spanning Tree Protocol (STP, IEEE 802.1D) solves this automatically. The switches elect a root, measure distances, and cooperatively disable just enough redundant ports to break every loop — leaving a single loop-free tree that still connects everything. The blocked links sit in reserve; if an active link dies, STP recomputes and brings a standby link up. You get redundancy's safety without the loop's danger, at the cost of a little idle capacity and a few seconds of reconvergence (modern Rapid STP is far quicker).

IP routers handle loops gracefully because every IP packet carries a TTL that decrements at each hop and hits zero, so a looping packet eventually dies. The Ethernet frame has no such field — it was designed for a simple shared cable with no loops in sight. A frame caught in a layer-2 loop therefore circulates forever, and because switches duplicate broadcasts out multiple ports, one frame becomes two becomes four — exponential growth, not a single stubborn straggler. That asymmetry is exactly why layer 2 needs an explicit loop-breaker (STP) while layer 3 does not.