A switch connects devices to each other inside one network. A router connects that network to other networks, including the internet. The switch forwards frames by MAC address at layer 2.
The router forwards packets by IP address at layer 3 and decides which way traffic leaves. An office needs one routing function and as many switch ports as it has wired devices.
- A switch builds the local network. A router joins networks together
- Switches read MAC addresses. Routers read IP addresses
- More wired devices means another switch, not another router
- A layer 3 switch routes between VLANs inside the building
- The box from your internet provider is a router with a small switch built in
On this page
The switchWhat a network switch does
A network switch is the device the cables from your computers, printers, phones and access points plug into. Its whole job is to move data between the multiple devices connected to it on a LAN, and to do that without sending that data to anybody who should not get it.
It works by learning. Every frame that arrives carries the MAC address of the device that sent it. The switch records which port that address lives on in its MAC address table, and from then on it sends traffic for that device out of that port only.
Traffic for an address it has not seen yet goes out of every port, and the reply fills in the gap.
That is layer 2 of the OSI model, the data link layer, and it has two consequences. A switch is fast, because looking up a MAC address in hardware is simple.
And a switch is local, because MAC addresses mean nothing beyond the network they sit on. A switch cannot reach the internet, hand out addresses or tell one network from another.
Switches come in two kinds that matter when buying.
Unmanaged switches. No configuration at all. Plug it in and every port is in the same network. Fine for adding four ports under a desk.
Managed switches. A configuration interface, VLANs to split one physical switch into several networks, port security, monitoring, link aggregation and usually Power over Ethernet for phones and access points. This is what a business network is built from.
The routerWhat a router does
A router sits at the edge of a network and connects it to other networks. In an office that usually means connecting the local network to the internet, and sometimes to other sites over a VPN.
It works at layer 3 of the OSI model, the network layer, and it reads IP addresses. For every data packet, the router looks at the destination address, consults its routing table and chooses the interface that leads toward that destination.
Routers make that forwarding decision packet by packet. Devices on the local network send anything that is not local to the router, which is what the default gateway setting means.
Because it stands between networks, a router is also where the services that need that position live.
- Network address translation, which lets every device share one public IP address.
- DHCP, which hands each device its IP address and settings, on small networks.
- A firewall, which decides what may come in from the internet.
- VPN termination, for remote staff and links between sites.
- Traffic rules, such as prioritizing voice calls.
A router also ends broadcast domains. A broadcast from one device reaches everything on its switch, and stops at the router. That is the reason large networks are divided into subnets with routing between them.
In practiceThe differences that matter in practice
The difference between switch and router is easy to state in networking terms: different layers, different addresses, different jobs. The comparison table below lists those technical differences. These are the ones that change a decision.
A switch gives you ports. A router gives you a way out. If the problem is more wired devices than sockets, the answer is a switch. If the problem is connecting to the internet, to another office, or separating two networks that still need to talk, the answer is routing.
You need one routing function, however large the office. A ten person office and a two hundred person office both have one internet edge. The larger one has more switches, not more routers. Buying a second consumer router to get more ports is the most common mistake, and it creates a second network behind the first.
Speed inside the building is the switch's job. Data moving between a workstation and a file server within the same LAN never touches the router. If file transfers are slow, look at the switch ports and cabling, not at the router.
Security boundaries are the router's job. A switch will happily carry data between any two devices in the same network, because communication inside a LAN is what it is for. Keeping guests away from servers, or cameras away from workstations, takes VLANs on the switch and a router or firewall between them.
Layer 3 switchWhere a layer 3 switch fits
A layer 3 switch is a switch that can also route. It has the port count and hardware speed of a switch, plus a routing table, and it exists for one job: moving traffic between VLANs inside a building without sending it to the router and back.
In the layer 3 switch vs router question, the two are not rivals, and larger networks use multiple layer 3 switches with one or two routers. The layer 3 switch does inter-VLAN routing at the core of the local network, at wire speed across dozens of ports.
The router, or the firewall acting as one, stays at the edge and handles the internet connection, address translation, VPNs and inspection, which a layer 3 switch does poorly or not at all.
A small office with two or three VLANs does not need one. The firewall can route between them. A layer 3 switch earns its price when traffic between VLANs is heavy, such as workstations in one VLAN using servers in another all day.
What to buyDo you need a switch, a router, or both
Every network that reaches the internet has a router, even when nobody bought one: it is inside the box the provider supplied, as the page on modem vs router explains. So the router vs switch decision is rarely either or. The practical question is when to add a switch.
A home office or a handful of people. The provider's box, or a small business router, has four or so switch ports built in. That is a router and a switch already. Add nothing until you run out of ports.
An office of ten to fifty. One business router or firewall at the edge, and one or two managed switches with PoE for the desks, phones and access points. Use VLANs to separate staff, guests, phones and anything untrusted such as cameras.
Several floors or a larger site. Access switches on each floor connect back to a pair of core switches, often layer 3, with the firewall and internet connection at the edge. The design pages on top of rack switching and spanning tree cover what changes at that size.
PitfallsWhere people go wrong
Buying a second router to get more ports. It works, badly. The devices behind it sit in a separate network with double address translation, printers become unreachable from the other side, and nobody remembers why six months later. Buy a switch.
Chaining small unmanaged switches. Each one is a point of failure nobody monitors, and a single loop between two of them can take the network down. One properly sized managed switch is cheaper than the outage.
Expecting a switch to provide security. Without VLANs and a router or firewall between them, every device on a switch can reach every other device. A flat network is how one infected laptop reaches the server.
Blaming the router for slow local transfers. Local traffic does not pass through it. Check the switch port speed, the cable category and whether the link negotiated at 100 megabits instead of a gigabit.
Ignoring the PoE budget. A switch has a total power budget as well as a per port limit. Twenty four PoE ports do not mean twenty four powered cameras.
ComparisonSwitch, router and layer 3 switch, and which job belongs to which
| Criterion | Switch | Router | Layer 3 switch |
|---|---|---|---|
| Connects | Devices in one network | Different networks | VLANs inside one site |
| Forwards by | MAC address | IP address | Both |
| OSI layer | Layer 2 | Layer 3 | Layers 2 and 3 |
| Typical port count | 8 to 48 | 2 to 8 | 24 to 48 |
| NAT and internet edge | No | Yes | No |
| Firewall and VPN | No | Usually | No |
| Stops broadcasts | Only with VLANs | Yes | Between VLANs |
| What you add as you grow | More of these | Rarely | One or two at the core |
Two rows settle most purchases. If the row you need is NAT and internet edge, you need a router or a firewall, and no switch will substitute. If the row you need is port count, you need a switch, and a second router is the wrong tool.
FAQFrequently asked questions
What is the difference between a switch and a router?
A switch connects devices within one network and forwards frames by MAC address. A router connects separate networks, such as an office network and the internet, and forwards packets by IP address. Most networks use both: a router at the edge and switches behind it.
Router vs switch: which one do I need for internet access?
A router. Only a router, or a firewall doing the same job, can connect your network to your provider and share one public address among your devices. A switch on its own cannot reach the internet at all.
Do I need a switch if I have a router?
Only when you need more wired ports than the router has, or features it lacks such as PoE and VLANs. Most small routers include a four port switch, which is enough for a very small office.
Can a switch replace a router?
No. A layer 2 switch cannot route between networks or perform address translation. A layer 3 switch can route inside your site, but it still does not replace the router or firewall at the internet edge.
Can I use a router as a switch?
Partly. The LAN ports on a small router are a built in switch, and you can plug devices into them. Using a second router purely for its ports only works cleanly if you turn off its routing and DHCP, and at that point a switch is simpler and cheaper.
What is a layer 3 switch vs router?
A layer 3 switch routes between VLANs inside a building at hardware speed across many ports. A router connects the site to the outside and provides NAT, VPN and firewall functions. Larger networks use both, each in its own place.
What is a network switch in simple terms?
A box with many Ethernet ports that lets the devices plugged into it talk to each other. It learns which device is on which port and sends traffic only where it needs to go.
What is the difference between a managed and an unmanaged switch?
An unmanaged switch has no settings and puts every port in one network. A managed switch can be configured: VLANs, port security, monitoring, link aggregation and PoE control. Business networks use managed switches.
Does a switch slow down the internet?
No. A working gigabit switch is far faster than almost any internet connection. A slow link behind a switch usually means a bad cable, a port that negotiated a low speed, or a loop.
Does a switch assign IP addresses?
No. Addresses come from a DHCP server, which on small networks is the router. A switch forwards the DHCP messages and takes no part in them, although managed switches have an IP address of their own for administration.
How many switches can I connect to one router?
As many as you need, because the router sees them as one network. The practical limits are design ones: avoid long chains, avoid loops, and connect access switches back to a central switch instead of to each other.
Is a hub the same as a switch?
No. A hub repeats everything it receives out of every port, so all devices share the same capacity and see each other's traffic. A switch sends traffic only to the port that needs it. Hubs are obsolete.
Keep readingRelated concepts
Read next · Fundamentals Modem and Router, and What the Box From Your Internet Provider Does The other half of the box on the wall: what the modem does, and why one case hides four functions. Open this next10 min- Switching · 14 min What Is a VLAN? VLANs are what turn one managed switch into several separate networks, and the reason a router has to sit between them.
- Switching · 9 min Inter VLAN Routing, and Why Two VLANs Cannot Talk Without It What a layer 3 switch actually does all day, and the two ways to set it up.