Free lesson · Computer Networking
Switches And Hubs Moving Data On A Local Network
Two Devices, One Purpose, Completely Different Intelligence
Both hubs and switches serve the same purpose: connecting multiple devices on a local network so they can communicate with each other. But the way they accomplish this is fundamentally different, and that difference explains why hubs are obsolete and switches are everywhere.
A hub is a Physical layer (Layer 1) device. It receives an electrical signal on one port and blindly retransmits that signal out every other port. It has no understanding of addresses, frames, or protocols. It does not read MAC addresses. It does not make forwarding decisions. It is an electronic amplifier that connects multiple cables into a shared medium.
A switch is a Data Link layer (Layer 2) device. It receives a frame on one port, reads the destination MAC address, consults its MAC address table, and forwards the frame only to the port where the destination device is connected. It is an intelligent forwarding device that creates isolated communication paths between pairs of devices.
This distinction matters because it determines every performance and security characteristic of the local network.
How a Hub Works
When Device A sends a frame to Device B through a hub, the hub copies the signal to every other port - Device B receives it (as intended), but so do Devices C, D, and E (even though the frame was not addressed to them). Devices C, D, and E examine the destination MAC address, see that it does not match their own, and discard the frame. But the signal still consumed bandwidth on every port and every device still had to process it enough to reject it.
This creates several problems:
Shared bandwidth. All devices share the hub's total bandwidth. A 100 Mbps hub with 10 connected devices provides effectively 100 Mbps divided among all of them. If two devices are actively transmitting, each gets only a fraction of the total capacity.
Collisions. Because all devices share the same electrical medium through the hub, only one device can transmit at a time. If two devices transmit simultaneously, a collision occurs - both signals are corrupted, both transmissions fail, and both devices must wait and retry using the CSMA/CD backoff algorithm. The more devices on the hub, the more collisions occur, and the worse the performance gets.
No privacy. Every device on the hub receives every frame. Any device running packet capture software (like Wireshark) can capture and read all traffic on the network, not just traffic addressed to it. This is a significant security concern and one of the reasons hubs were phased out of any environment where data confidentiality matters.
Single collision domain. The entire hub and all its connected devices form one collision domain - any two devices can potentially collide with each other.
How a Switch Works
A switch transforms the networking landscape. Instead of blindly repeating signals, it makes intelligent forwarding decisions based on MAC addresses.
The Learning Process
When a switch is first powered on, its MAC address table is empty. It learns through observation:
-
Device A sends a frame. The switch reads the source MAC address (say
AA:AA:AA:AA:AA:AA) and notes it arrived on Port 1. It records this mapping in its MAC address table:AA:AA:AA:AA:AA:AA → Port 1. -
The destination MAC is unknown. The switch checks its table for the destination MAC. If it is not there (the switch has never seen traffic from the destination device), the switch floods the frame - sending it out every port except the one it arrived on. This ensures the frame reaches the destination wherever it is.
-
Device B responds. The response comes in on Port 3 with source MAC
BB:BB:BB:BB:BB:BB. The switch records:BB:BB:BB:BB:BB:BB → Port 3. -
Now the switch knows both devices. Future frames from A to B go only to Port 3. Future frames from B to A go only to Port 1. No other device sees this traffic.
Within seconds of being connected, a switch has learned the location of every active device and can forward frames precisely without flooding. This self-learning behavior requires zero manual configuration, making switches remarkably easy to deploy.
sequenceDiagram
participant A as Device A<br/>Port 1
participant SW as Switch
participant B as Device B<br/>Port 3
participant C as Device C<br/>Port 4
Note over SW: MAC table: empty
A->>SW: Frame (Src: AA, Dst: BB)
Note over SW: Learns AA → Port 1<br/>BB unknown → flood
SW->>B: Frame (Src: AA, Dst: BB)
SW->>C: Frame (Src: AA, Dst: BB)
Note over C: Not for me - discard
B->>SW: Reply (Src: BB, Dst: AA)
Note over SW: Learns BB → Port 3<br/>AA known → Port 1
SW->>A: Reply (Src: BB, Dst: AA)
Note over C: Does not receive this frame
Note over SW: MAC table:<br/>AA → Port 1<br/>BB → Port 3
A->>SW: Next frame (Src: AA, Dst: BB)
SW->>B: Forwarded directly to Port 3
Note over C: Does not receive this frame
This sequence diagram shows how a switch learns MAC addresses. Initially the MAC table is empty. When Device A sends a frame to Device B, the switch learns Device A's MAC is on Port 1. Since Device B's MAC is unknown, the switch floods the frame to all other ports, including Port 3 (Device B) and Port 4 (Device C). Device C discards the frame because it is not addressed to it. When Device B replies, the switch learns Device B is on Port 3 and forwards the reply only to Port 1 (Device A). Device C does not receive the reply. From then on, all frames between A and B are forwarded directly without flooding.
What Switches Give You
Dedicated bandwidth. Each port gets the full link speed. A 24-port Gigabit switch provides 1 Gbps to each connected device simultaneously - not shared. This is possible because the switch creates dedicated communication paths between pairs of ports using its internal switching fabric - a high-speed internal bus or crossbar circuit that can forward multiple frames between different port pairs at the same time. A switch with sufficient internal backplane bandwidth to handle all ports at full speed simultaneously is called a non-blocking switch, and most modern enterprise switches are non-blocking.
No collisions. Each port is its own collision domain. Because each device has a dedicated cable to the switch, there is no shared medium and no possibility of collision. Two pairs of devices can communicate simultaneously without interfering with each other.
Improved privacy. Under normal operation, a switch delivers frames only to the destination port. Other devices do not see traffic that is not addressed to them. This is not perfect security - MAC address table overflow attacks can force a switch to flood all traffic - but it is a major improvement over hubs.
Full-duplex operation. With no collision concern, each port can operate in full-duplex mode - sending and receiving simultaneously. A Gigabit switch port provides 1 Gbps send and 1 Gbps receive for 2 Gbps of aggregate throughput per port.
Collision Domains vs Broadcast Domains
These two concepts define the scope of different types of network traffic and are fundamental to understanding how networks scale.
Collision Domain
A collision domain is the set of devices that can interfere with each other when transmitting simultaneously. With a hub, every connected device is in the same collision domain - any two devices transmitting at once will collide. With a switch, each port is its own collision domain - collisions are impossible because each device has a dedicated link.
Rule: A hub creates one big collision domain. A switch creates one collision domain per port. Routers also separate collision domains because they operate at Layer 3 - they process and re-transmit frames rather than sharing a medium. Every Layer 3 boundary (router interface) is a collision domain boundary.
Broadcast Domain
A broadcast domain is the set of devices that receive a broadcast frame (destination MAC FF:FF:FF:FF:FF:FF). A switch forwards broadcast frames to every port - so all devices connected to a switch (or a group of interconnected switches) share a broadcast domain. A router does not forward broadcasts - it stops them. Each router interface defines a separate broadcast domain.
This is an important distinction: switches eliminate collision domains but do not eliminate broadcast domains. In a network with hundreds of devices connected through switches, a single broadcast frame is still delivered to every device. This is why very large flat networks (all devices in one broadcast domain) perform poorly - the volume of broadcast traffic (ARP requests, DHCP discovers, other broadcast protocols) consumes bandwidth and processing time on every device.
The scaling problem is real. In a network with N devices, each sending periodic broadcast traffic (ARP, DHCP, mDNS, NetBIOS), the total broadcast load on each device grows linearly with N. At some point - typically a few hundred devices on a single broadcast domain - the broadcast overhead becomes a noticeable drag on performance. This is one of the primary motivations for network segmentation strategies.
The solution is VLANs (covered in the next topic) or routers, which divide a large network into smaller broadcast domains.
graph TD
subgraph HubNetwork["Hub Network"]
direction TB
HUB["Hub"]
H1["PC 1"] --- HUB
H2["PC 2"] --- HUB
H3["PC 3"] --- HUB
H4["PC 4"] --- HUB
HC["1 Collision Domain<br/>1 Broadcast Domain"]
end
subgraph SwitchNetwork["Switch Network"]
direction TB
SW["Switch"]
S1["PC 1"] --- SW
S2["PC 2"] --- SW
S3["PC 3"] --- SW
S4["PC 4"] --- SW
SC["4 Collision Domains<br/>1 Broadcast Domain"]
end
subgraph RouterNetwork["Router + Switches"]
direction TB
R["Router"]
SW1["Switch A"] --- R
SW2["Switch B"] --- R
R1["PCs"] --- SW1
R2["PCs"] --- SW2
RC["Multiple Collision Domains<br/>2 Broadcast Domains"]
end
style HUB fill:#a78bfa,stroke:#8b5cf6,color:#fff
style SW fill:#7c3aed,stroke:#6d28d9,color:#fff
style R fill:#4f46e5,stroke:#4338ca,color:#fff
style SW1 fill:#7c3aed,stroke:#6d28d9,color:#fff
style SW2 fill:#7c3aed,stroke:#6d28d9,color:#fff
This diagram shows three network configurations. In a hub network, all four PCs share one collision domain and one broadcast domain because the hub repeats everything. In a switch network, each of the four PCs has its own collision domain because each port is isolated, but they still share one broadcast domain because the switch forwards broadcasts to all ports. In a router-plus-switches network, the router separates the network into two broadcast domains - one for each switch - while each switch port still provides its own collision domain.
Store-and-Forward vs Cut-Through Switching
Switches use different methods to forward frames, each with different performance and reliability characteristics:
Store-and-forward: The switch receives the entire frame, verifies the FCS checksum, and then forwards it to the destination port. This is the safest method because corrupted frames are caught and discarded. However, it adds latency because the switch must wait for the entire frame to arrive before forwarding. This method is used by most managed switches and is the default in enterprise environments.
Cut-through: The switch begins forwarding the frame as soon as it reads the destination MAC address (the first 14 bytes). This dramatically reduces latency because the switch does not wait for the full frame. However, corrupted frames are forwarded because the FCS checksum at the end of the frame has not been read yet. Some switches use a variation called fragment-free switching, which waits for the first 64 bytes (the minimum frame size) before forwarding - catching most collision-caused errors while still being faster than store-and-forward.
In modern data centers with low error rates and high-speed links, the practical latency difference between store-and-forward and cut-through is measured in microseconds - significant for high-frequency trading but irrelevant for most applications.
Managed vs Unmanaged Switches
Switches come in two broad categories:
Unmanaged switches are plug-and-play devices with no configuration interface. You connect devices, and they work. The switch learns MAC addresses automatically, forwards frames based on its table, and handles basic Layer 2 forwarding without any administrative input. These are common in home networks and small offices.
Managed switches provide a configuration interface (web UI, CLI, or SNMP) and support advanced features: VLANs for broadcast domain segmentation, port security to limit which MAC addresses can connect to each port, Quality of Service (QoS) to prioritize certain types of traffic, link aggregation to combine multiple physical links into one logical link for increased bandwidth, port mirroring to copy traffic from one port to another for monitoring, and Spanning Tree Protocol to prevent loops in networks with redundant paths.
In enterprise and data center environments, managed switches are the standard. The configuration capabilities they provide are essential for network segmentation, security enforcement, traffic management, and troubleshooting. Most cloud provider data centers use high-end managed switches with sophisticated programmable forwarding planes, sometimes running custom software.
Layer 3 switches blur the line between switches and routers. They perform standard Layer 2 switching but can also make Layer 3 routing decisions using IP addresses. This allows them to route traffic between VLANs without sending packets to a separate router - a significant performance optimization in enterprise networks where inter-VLAN traffic is common.
Interview: Switches and hubs are unlikely to appear directly in System Design interviews. However, the concepts they embody - dedicated vs shared resources, collision domains, broadcast domains - appear in different forms:
"How would you handle the thundering herd problem?" - This is essentially a broadcast domain problem at the application layer. When a cache expires and 1000 servers simultaneously request the same data, it is analogous to broadcast traffic overwhelming a flat network.
"How would you isolate traffic between microservices?" - Network segmentation using VLANs (switch-level) or subnets (router-level) is the Layer 2/3 answer. In cloud environments, VPCs, security groups, and network policies serve the same function.
Understanding that switches provide isolation while hubs provide sharing helps you reason about these higher-level architectural patterns.
What Comes Next
The next topic introduces VLANs - virtual partitions that divide a single physical switch into multiple logical networks, each with its own broadcast domain. VLANs are how modern networks achieve the broadcast isolation that would otherwise require separate physical switches and routers.
Exercise: Starter: Count the number of network ports visible on your home router. Most consumer routers have 4 LAN ports and 1 WAN port. The LAN ports act as a built-in switch. If you plug two computers into two LAN ports and transfer a file between them, does the traffic need to leave the router and go to the internet? Why or why not?
Intermediate: Imagine a network with 100 devices connected through switches (no routers, no VLANs - a single flat network). If each device sends one ARP request every 30 seconds, how many broadcast frames per second does each device have to process? Now imagine 1000 devices. How does this scale, and at what point does broadcast traffic become a performance problem?
Advanced: Research the Spanning Tree Protocol (STP). When multiple switches are connected in a loop (Switch A connected to Switch B, Switch B to Switch C, Switch C back to Switch A), broadcast frames would circulate endlessly. STP prevents this by disabling redundant links. How does STP work, what problem does it solve, and why has it been partially replaced by newer protocols like TRILL and SPB in modern data centers?