Switches vs Routers
A switch forwards frames within one network using MAC addresses and a learned table; a router forwards packets between networks using IP addresses and a routing table, decrementing TTL and rebuilding the frame at every hop — and the box under your desk is a router, a switch, an access point, a NAT and a DHCP server in one case.
The problem
What a switch does with a frame
A switch receives a frame and reads 14 bytes: destination MAC, source MAC, EtherType. It learns the source (MAC → this port), looks up the destination in its MAC table, and copies the frame — unchanged, byte for byte — out of the port where that MAC lives, or out of every port if it does not know. It never reads the IP header, never changes anything, never sends a frame to a different network, and holds no state about connections. Its universe is one broadcast domain. Everything it does happens in hardware in a few microseconds.
Because it changes nothing, a switch is invisible to every layer above: traceroute does not show it, TTL does not notice it, and two hosts on either side of ten switches are still "directly connected" as far as IP is concerned. It is a faster, private replacement for one shared cable, and that is all.
What a router does with a packet
A router receives a frame addressed to its own MAC (frames for other MACs are not for it — the switch would not even have delivered them). It strips the Ethernet header entirely. Now it has an IP packet with a destination address on a different network. It decrements the TTL (dropping the packet and sending ICMP *Time Exceeded* if it reaches 0), recomputes the IPv4 header checksum, and looks the destination up in its routing table by longest-prefix match to get two things: an outgoing interface and a next-hop IP. It resolves that next hop to a MAC (ARP/ND cache), builds a new frame with its own outgoing interface’s MAC as source and the next hop’s as destination, and transmits. The IP packet inside is the same except for TTL and checksum; the frame around it is entirely new.
A router therefore ends a broadcast domain (broadcasts are not forwarded), joins IP networks, and is visible: it appears in traceroute, it is where the TTL changes, and it is where packets are dropped with an error (no route, TTL expired, too big) rather than silently. It may also be where the policy lives — access control lists, NAT, rate limits — because it is the first device that reads the IP header.
dst MAC src MAC src IP dst IP TTL
laptop sends gw:0a lap:01 10.0.0.4 203.0.113.10 64
switch forwards gw:0a lap:01 10.0.0.4 203.0.113.10 64 ← identical bytes, one port
router forwards isp:1f gw:0b 10.0.0.4 203.0.113.10 63 ← new frame, TTL−1
(198.51.100.7 if the router also does NAT)Side by side
The interview answer is one sentence: a switch forwards frames within a network by MAC and changes nothing; a router forwards packets between networks by IP and rebuilds the frame. Everything in the table follows from what each one reads.
| Switch | Router | |
|---|---|---|
| Reads | Ethernet header (14 B) | IP header (20 / 40 B) |
| Forwards on | destination MAC | destination IP, longest-prefix match |
| Table | MAC → port, learned from traffic | prefix → next hop, configured or learned via routing protocols |
| Changes | nothing | TTL, IP checksum, entire link header (and addresses if NAT) |
| Scope | one broadcast domain | between networks |
| Forwards broadcasts? | yes (floods) | no — ends the broadcast domain |
| Visible to traceroute? | no | yes |
| Typical speed | wire speed on all ports, hardware | hardware in the core; software in home and virtual routers |
| When the table misses | floods the frame | uses the default route, or drops with ICMP unreachable |
Where the line blurs
A layer-3 switch is a switch with routing in the same ASIC: it switches within each VLAN by MAC and routes between VLANs by IP, at wire speed, without a separate router. In an office or data-centre core it *is* the router for the local networks and hands only external traffic to a "real" router. The distinction that survives is functional, not physical: whenever a packet crosses from one IP network to another, *something* did a router’s job — TTL−1, new frame — whatever the box is called.
The home router is the opposite blur: a Linux box (usually) running a router (between the LAN and the ISP link), a four-port switch (the LAN ports and the Wi-Fi are one bridge, one broadcast domain), a Wi-Fi access point, a NAT (see NAT: Many Private Hosts Behind One Public Address), a DHCP server handing out 192.168.1.x, a DNS forwarder, and a firewall. When it "doesn’t work" the question is which of those six roles failed: DHCP (you have a 169.254 address), the switch/AP (you cannot reach the gateway), routing or NAT (you reach the gateway but nothing beyond), or DNS (you reach 1.1.1.1 by number but not by name). See Why Can’t I Connect?.
In the cloud the blur is total: a VPC "router" is a distributed function in the hypervisors, a security group is a stateful firewall attached to a virtual NIC, and a "switch" is a software bridge in the host kernel — see Network Namespaces and Container Networking. The vocabulary still works because it describes what is done to the packet, not what the box looks like.
Key points
- Switch: reads the Ethernet header, forwards by destination MAC using a learned table, changes nothing, stays inside one broadcast domain, invisible to IP.
- Router: receives frames for its own MAC, strips them, decrements TTL, looks up the destination IP by longest-prefix match, builds a new frame for the next hop.
- The IP packet crosses many routers; the frame lives for exactly one hop.
- Routers end broadcast domains, appear in traceroute, and are where drops come with an ICMP error.
- A layer-3 switch routes between VLANs in hardware; a home router is router + switch + AP + NAT + DHCP + DNS forwarder. Diagnose by role.
Why does this exist?
Mechanisms are answers to constraints. Open each question before reading the answer.
▸Why have two kinds of device instead of routing everything?
Routing costs more per packet (a prefix lookup, a TTL rewrite, a new frame, a bigger table) and needs configuration. Inside one network a MAC table is cheaper and self-configuring. Switches make the common local case fast; routers handle the rarer crossing.
▸Why does a router build a new frame instead of patching the old one?
The next link may be a different medium (Wi-Fi in, fibre out), with different endpoints and possibly a different MTU. The old frame’s addresses are meaningless there. Only the IP packet is the durable object.
▸Why does a switch flood but a router drops?
A switch’s miss means "I have not yet learned where this neighbour is" — flooding will find out. A router’s miss means "no network I know of contains this address" — there is nowhere to send it, so it says so with ICMP.
Switch vs router
How it fails
What the failure looks like from inside real software.
- Two subnets on one switch with no router between them: hosts on
10.0.0.0/24and10.0.1.0/24share a cable and cannot talk; ARP requests are seen but never answered for the "other" network. - Default gateway wrong or missing: local hosts reachable,
ping 1.1.1.1fails with "network unreachable" or times out. - Home router’s DHCP dies while its switch works: devices get 169.254 link-local addresses and can see each other but not the internet.
- A layer-3 switch with inter-VLAN routing but no route to the firewall: VLANs reach each other, none reaches the outside.
- Asymmetric routing through two routers on one segment: packets leave via A and return via B; a stateful firewall on A never sees the reply and drops the connection.