Hubs, switches, and routers all connect network links, but they process traffic at different layers.

A hub repeats incoming signals to every other port. A switch examines Ethernet frames and forwards them within a Layer 2 network. A router examines IP packets and forwards them between IP networks.

These differences determine which addresses a device reads, whether it learns forwarding state, how it handles broadcasts, and where one local network ends.

Each device makes a different forwarding decision:

A hub does not understand Ethernet addresses. A switch understands Ethernet frame fields but does not need the enclosed IP destination for ordinary Layer 2 forwarding. A router removes the incoming link-layer framing and makes a new decision from the IP header.

The device's function matters more than its physical appearance. A small plastic box with several Ethernet ports could provide switching, routing, or a combination of both.

The table describes functions. A multilayer device can implement more than one column in the same chassis.

An Ethernet hub is a multiport repeater. It operates on the physical signal rather than on complete frames.

When a signal arrives on one port, the hub regenerates that signal and sends it out every other active port:

Every connected interface receives the transmission. Each interface then checks the destination MAC address and decides whether to accept the frame.

The hub performs no address learning and has no forwarding table. It does not distinguish unicast, multicast, and broadcast frames. It also does not verify the Frame Check Sequence because it repeats signals before interpreting a complete frame.

Shared Bandwidth and Collisions

All hub ports share one physical Ethernet segment. Only one attached device can transmit successfully at a time.

If two devices transmit at the same time, their signals collide. The senders detect the collision, stop transmitting, wait for randomized intervals, and try again through Ethernet's historical CSMA/CD mechanism.

Hub-connected Ethernet therefore uses half-duplex operation. One device can send or receive at a time on the shared segment, but it cannot use independent transmit and receive paths simultaneously.

The advertised link rate is shared capacity. Connecting ten hosts to a 100 Mbps hub does not give each host a dedicated 100 Mbps path. Their transmissions compete for the same medium, and collisions consume additional time as load increases.

Why Hubs Disappeared

Hubs have several structural limits:

Ethernet switches removed these limits while preserving compatibility with Ethernet hosts. Hubs now appear mainly in old networks, specialized labs, and discussions of shared-medium Ethernet.

A Layer 2 switch connects Ethernet links and forwards frames based on MAC addresses. It is functionally a multiport transparent bridge.

Transparent means attached hosts do not send ordinary local traffic to the switch's own address. A host creates a frame for another host, and the switch moves that frame through the Layer 2 network without becoming an IP endpoint in the exchange.

A basic switch performs two related operations:

The switch stores learned mappings in a MAC address table, also called a forwarding database or forwarding table.

Some hardware documentation uses the term CAM table because switching hardware can use content-addressable memory for fast lookups. MAC address table and forwarding database describe the logical role regardless of hardware implementation.

A switch learns from the source address of each frame it receives.

When a frame from source 02:00:00:00:00:0a arrives on port 1, the switch records:

If a later frame with that source arrives on port 4, the switch updates the mapping to port 4. This behavior allows the table to follow a device that moves to another port.

The switch does not need a registration message from every host before forwarding traffic. Normal frame transmission provides the learning information.

Learned entries age out after a period without matching traffic. Aging removes stale locations and gives the switch a way to relearn devices after topology changes. Static entries can also exist, but dynamic learning handles ordinary endpoint traffic.

The switch learns from source addresses and forwards according to destination addresses. Reversing those two roles leads to an incorrect model of switching.

After learning the source, the switch examines the destination MAC address.

The outcomes are:

Known unicast: The table contains the destination on another port. The switch forwards the frame through that port.

Same-port destination: The table places the destination on the incoming port. The switch filters the frame because sending it back would provide no useful delivery.

Unknown unicast: The table has no destination entry. The switch floods the frame through other eligible ports in the same Layer 2 network.

Broadcast: The switch floods the frame through the Layer 2 network, except through the port that received it.

Multicast: A basic switch can flood the frame. A switch with additional group information can limit transmission to interested ports.

Flooding is a local Layer 2 operation. It does not send the frame into every network or across ordinary router boundaries.

Three hosts connect to an empty switch:

Host A sends the first frame to Host B.

The switch learns A -> port 1 from the source. It has no entry for B, so it floods the frame through ports 2 and 3. Host B accepts the destination. Host C receives the physical transmission but rejects the frame because the destination address does not match.

Host B replies to Host A.

The switch learns B -> port 2. It already knows that A is on port 1, so it forwards the reply only through port 1.

Host C then sends a frame to Host A.

The switch learns C -> port 3 and forwards the frame only through port 1. Its dynamic table now contains all three source locations.

Unknown-unicast flooding is normal during learning. Once active sources have populated the table, known unicast traffic can follow specific ports.

Each switch port creates an independent Ethernet link. Modern endpoint links normally operate in full-duplex mode, allowing simultaneous transmission and reception without collisions.

This changes both isolation and capacity. Traffic on one port does not consume the physical link capacity of every other port. Several port pairs can communicate at the same time, subject to the switch's internal forwarding capacity and any shared outgoing link.

If several incoming frames need the same outgoing port faster than that port can transmit them, the switch queues frames. A full queue causes drops. Switching removes shared-medium collisions, but it cannot create more capacity than the selected outgoing link provides.

A switch separates collision domains per port. A basic Layer 2 switch still carries broadcasts across its Layer 2 network, so it does not create a new broadcast boundary on every port.

A switch can begin forwarding at different points in frame reception.

Store-and-forward switching receives the complete frame before forwarding it. The switch can verify the frame size and FCS, then discard a damaged frame rather than transmitting it onto another link. The complete-frame wait adds serialization delay.

Cut-through switching begins forwarding after reading enough of the header to identify the destination. It reduces forwarding delay, especially for large frames, but can begin transmitting before the incoming FCS is available. A damaged frame can therefore reach the outgoing link.

Many switches use store-and-forward behavior or combine techniques based on hardware and configuration. Both modes use the destination MAC address for the Layer 2 forwarding decision.

Ordinary switching preserves the frame's source MAC, destination MAC, EtherType, and payload. The switch regenerates the physical signal on the outgoing link. Store-and-forward hardware can discard a frame with an invalid FCS before transmission, while cut-through hardware can propagate that invalid FCS to the next receiver.

Redundant physical links can improve availability, but an active Layer 2 loop creates a forwarding problem.

Ethernet frames contain no hop count. A flooded broadcast or unknown-unicast frame can circulate repeatedly through a loop. Each returning copy can be replicated again, consuming link capacity and causing unstable MAC-table entries.

Loop-prevention protocols keep a loop-free active forwarding topology while retaining redundant links for failure recovery. The Spanning Tree Protocol, or STP, is the traditional Ethernet mechanism for this purpose.

This requirement follows directly from switch behavior: flooding sends a frame along every eligible path, and the Ethernet header provides no field that expires a circulating frame.

A router connects IP networks. Each routed interface participates in an IP network and has the link-layer information needed for that interface's medium.

When an Ethernet frame carries an IP packet to a router, the router:

The incoming and outgoing Ethernet frames have different local address pairs. In an ordinary path without address translation, the source and destination IP addresses continue to identify the endpoint hosts. The TTL or Hop Limit changes at every router so a packet cannot circulate forever.

A routing table maps IP prefixes to outgoing interfaces or next hops:

This differs from a switch's forwarding database:

The router chooses between IP networks. The switch chooses a path within one Layer 2 network.

A router interface terminates the incoming Layer 2 frame. The router forwards the enclosed IP packet rather than extending the original Ethernet frame through every interface.

As a result:

The router can apply policies while forwarding, but filtering and address translation are separate functions from the basic routing decision.

Routers also prevent Layer 2 loops from extending across their interfaces. IP packets have a TTL or Hop Limit, while Ethernet frames do not. A routing loop eventually expires the packet when that field reaches zero.

Consider Host A and Host B on one IP network, with Host C on another.

Host A Sends to Host B

Host A determines that Host B is local and creates:

The first switch forwards the frame based on B's MAC address. The router does not process the packet because the Ethernet frame targets B within the local Layer 2 network.

Host A Sends to Host C

Host A determines that Host C is remote and creates the first frame for the router's left interface:

The first switch forwards the frame toward the router. The router removes the Ethernet header, makes an IP forwarding decision, and creates a frame on the right-hand network:

The second switch forwards that frame based on C's MAC address. The switch transitions preserve local Ethernet addresses. The router transition replaces them while carrying the IP packet into another network.

A collision domain is a part of an Ethernet network where simultaneous transmissions can interfere.

A broadcast domain is the Layer 2 scope through which an Ethernet broadcast is forwarded.

With a hub, all connected ports share one collision domain and one broadcast domain.

With a full-duplex switch, each port has an independent link, so collisions do not occur during normal operation. The switch still forwards broadcasts across its Layer 2 network.

A router separates both link-layer scopes. It receives a local frame on one interface and creates a different frame when forwarding an IP packet through another interface. It does not ordinarily copy an incoming Ethernet broadcast to its other networks.

This distinction explains why replacing a hub with a switch improves bandwidth and collision isolation, while adding a router creates a boundary between IP and Layer 2 networks.

A managed switch can have an IP address for configuration, monitoring, and software updates. That management address does not participate in ordinary Layer 2 forwarding between attached hosts.

For example, Host A can send a frame to Host B through a switch without using the switch's management IP or management MAC as the frame destination. The switch reads the frame's destination MAC and forwards transparently.

A router's interface address plays a different role. A host uses the router interface as an IP next hop for remote destinations and sends the local Ethernet frame to that interface's MAC address.

A hub requires no forwarding address because it performs no address-based decision. Some managed physical devices may expose an address for administration, but that management function remains separate from signal repetition.

A typical home networking device often combines:

Calling the box a "router" describes its most visible role, not every internal function. Traffic between two wired LAN ports may pass through the switching component without an IP routing decision. Traffic leaving the local IP network passes through the routing function.

Enterprise hardware can combine functions as well. A Layer 3 switch performs Ethernet switching and IP routing, often in the same high-speed hardware. It acts as a switch for traffic within one Layer 2 network and as a router when traffic crosses configured IP network boundaries.

Device names therefore provide an initial clue. The inspected header and forwarding table identify the function used for a particular packet.

A host capture can show whether the current frame targets a local endpoint or a router.

For local traffic, the Ethernet destination should be the peer's local MAC address:

For remote traffic, the Ethernet destination should be a local router interface while the IP destination remains remote:

The switch's address normally does not appear in these ordinary data frames. A transparent switch forwards the existing source and destination MAC fields.

A capture taken on the far side of a router shows a different Ethernet header around the forwarded IP packet. Comparing captures from both sides exposes the Layer 2 boundary directly.

Linux can display the route selected for a destination:

A result can identify an outgoing interface and a gateway:

The gateway IP identifies the local next hop. The host then needs that next hop's link-layer address to create the first Ethernet frame.

The device layer narrows a connectivity investigation.

Hub or shared-medium failure: High collision counts, half-duplex behavior, or one faulty participant can disrupt the entire shared segment.

Switch link failure: A disconnected cable, disabled port, or physical error affects the link attached to that port.

Switch forwarding failure: Incorrect or unstable MAC-table state, a Layer 2 loop, or an overloaded outgoing port can misdirect, duplicate, or drop frames.

Router configuration failure: A missing route, incorrect interface addressing, unavailable next hop, or filtering policy can prevent packets from reaching another IP network.

Successful local switching does not prove that routing works. Two hosts can communicate within one local network while every remote destination remains unreachable because the gateway or route is unavailable.

Likewise, a working router does not repair a failed local link. The host must first deliver a frame to the router's local interface before the router can process the enclosed packet.

A switch does more than repeat signals. It learns source locations and uses destination MAC addresses to select forwarding ports.

Unknown unicast flooding is normal during learning. The switch floods because it lacks a destination entry, then learns from source addresses in later traffic.

A switch usually preserves endpoint MAC addresses. Hosts address each other or a local router interface; they do not normally address the transparent switch itself.

A router changes link-layer framing at a network boundary. The incoming and outgoing Ethernet frames use addresses from different local networks.

A router's MAC address does not replace a remote destination IP. The MAC identifies the local next hop, while the IP header continues to identify the remote endpoint.

Broadcast and collision boundaries differ. A switch isolates full-duplex links per port but still forwards broadcasts within its Layer 2 network. A router separates Layer 2 broadcast scopes.

A physical device can implement several functions. Forwarding behavior determines whether a given traffic flow uses switching or routing.

A hub operates at Layer 1 and repeats incoming signals to every other port. Its ports share bandwidth and one collision domain, limiting scalability and duplex operation.

A Layer 2 switch learns source MAC-to-port mappings and forwards using destination MAC addresses. It sends known unicasts through one selected port but floods broadcasts and unknown unicasts within the Layer 2 network. Independent full-duplex switch links eliminate normal shared-medium collisions.

A router removes the incoming frame, examines the destination IP through its routing table, selects another network, and creates new link-layer framing. Unlike switches, routers normally stop Layer 2 broadcasts at the network boundary. One device may perform several of these roles, but each forwarding decision still belongs to a specific layer.

Hubs repeat without examining an address, switches use destination MAC addresses, and routers use destination IP addresses.