Core CS · Computer Networks

A hub shouts, a switch remembers, a router rewrites

Every device on the syllabus is answering one question: how far into the arriving frame does it read? Answer that for a device and its layer, the address it forwards on, and what it does or does not split all follow from it.

Send one frame through a hub, a switch and a router →

Two of these devices can sit in the same plastic box and look identical from outside. What separates them is depth: a hub copies voltage, a switch reads the destination MAC, and a router reads the destination IP and builds a brand new frame to carry the packet onward.

01 The idea

How far into the frame does it read

A message leaving your machine is wrapped in layers, and the outermost wrapper is the frame: a destination MAC address, a source MAC address, a type field, the payload, and a four-byte checksum at the end. Inside the payload sits the IP packet, with its own source and destination addresses. On Ethernet that frame header is 14 bytes and the checksum is 4 more, and the payload it carries is at most 1500 bytes.

Now take any device in this lesson and ask one question: how much of that does it read? A repeater reads none of it. It sees a weak electrical signal, works out whether each interval was a one or a zero, and puts a clean copy back on the wire. It is not an amplifier, which would boost the noise along with the signal; it rebuilds the bits, so the noise does not accumulate. A hub is a repeater with more than two ports, and it has exactly the same amount of understanding, which is none.

A bridge and a switch read the first twelve bytes: the destination MAC to decide where the frame goes, and the source MAC to learn where it came from. They never open the IP header. A router does the opposite. It reads the frame only far enough to confirm the frame was addressed to it, discards the frame entirely, reads the destination IP inside, decides which of its networks that address belongs to, and builds a new frame for the next hop. Every remaining device on the syllabus is one of these three behaviours in a different package.

Ask one question about any network device: how deep does it read? Layer 1 reads voltage, layer 2 reads the destination MAC, layer 3 reads the destination IP. Its layer, its addressing and what it separates are all consequences of that one answer.

MAC addressThe 48-bit address burned into a network card, written as six hex bytes such as 00:1A:A0:00:00:0A. It is flat, with no structure a device can route on, and FF:FF:FF:FF:FF:FF is the broadcast address that every card accepts.

Collision domainThe set of ports whose signals can overlap on a shared medium and destroy each other, forcing both senders to back off and retry. A hub is one collision domain; a switch gives every port its own.

Broadcast domainThe set of devices a frame sent to FF:FF:FF:FF:FF:FF reaches. It stops only where a device refuses to carry it further, and the only device on this list that refuses is the router.

02 Worked example

One frame from A to C, through a switch that knows nothing

Four hosts, one device in the middle, one frame. This is the scene for the rest of the lesson, including the console in section 04, so learn the four addresses now. Only the last byte of each MAC changes, and it matches the host letter.

Host	MAC address	IPv4	Port on the device
A	`00:1A:A0:00:00:0A`	`10.0.0.1`	1
B	`00:1A:A0:00:00:0B`	`10.0.0.2`	2
C	`00:1A:A0:00:00:0C`	`10.0.0.3`	3
D	`00:1A:A0:00:00:0D`	`10.0.0.4`	4

A sends one frame to C. The middle device is a switch that was powered on a moment ago, so its MAC address table — the list of which address it has seen on which port — is empty. Follow it left to right.

1 · A builds itdst 00:1A:A0:00:00:0C, src 00:1A:A0:00:00:0A; it leaves A on port 1

→

2 · The switch learnsit reads the SOURCE and writes down: ...:0A is on port 1

→

3 · It floodsthe destination is not in the table, so out of ports 2, 3 and 4

→

4 · The cards decideB and D see a MAC that is not theirs and drop it; C accepts

→

5 · C repliesA is known now, so the reply leaves on port 1 only. Nothing wasted

Node 2 is the one to memorise, and it is the one students leave out. The switch learns from the source address, never from the destination. That is not an arbitrary design choice: a destination address is a claim about somewhere the switch has never seen, while a source address is proof about the port sitting right in front of it. A frame arriving on port 1 from ...:0A is evidence that ...:0A is reachable through port 1, and nothing else in the frame is evidence of anything.

Node 3 is what an empty table costs. Flooding is not a failure and not a fallback bug; it is the only safe action, because the alternative is dropping a frame for a host that exists. Node 5 is the payoff, and it arrives sooner than students expect: the reply already leaves on one port, because A was learned from the very frame that was flooded. The reply then teaches the switch where C is too, so from that second frame onward every delivery between A and C uses exactly one port. A hub in the same position would repeat node 3 forever, because it has nowhere to put what it learned and nothing to learn with.

03 Mechanics

Nine devices, and the two domains that tell them apart

One row per device. The two middle-right columns are where marks are won and lost, because collision domain and broadcast domain are different questions and the answers do not move together. Read the last column as the device’s entire personality: what it does with a frame that arrives is all it ever does.

Device	Layer	Forwards on	Collision domains	Broadcast domains	What it does with an incoming frame
Repeater	1	no address at all	`1 for both segments`	`1`	Reads the weakened signal, decides one or zero, and puts a clean copy on the other segment. Extends distance, understands nothing.
Hub	1	no address at all	`1 for the whole device`	`1`	A multiport repeater. Copies every bit out of every other port. Half duplex, so two senders at once corrupt each other.
Bridge	2	destination MAC	`1 per port (2 to a few)`	`1`	Forwards to the other segment only if the destination is not on the arriving side, otherwise filters it. Decided in software.
Switch	2	destination MAC	`1 per port`	`1 for the whole switch`	A multiport bridge in hardware. Learns the source, then forwards on one port, filters if the destination is on the arriving port, or floods if it does not know.
Router	3	destination IP	`1 per interface`	`1 per interface`	Discards the frame, decrements TTL, looks the destination network up in the routing table, and builds a new frame for the next hop.
Modem	1	no address at all	`one point-to-point link`	`counts as part of the link`	Modulates the outgoing bits onto an analogue carrier for the line and demodulates the incoming waveform back into bits. Forwards nothing on its own.
NIC	1 and 2	its own MAC	`it is one host in one`	`it is one host in one`	Carries the burned-in MAC. Accepts a frame whose destination is that MAC or the broadcast address, and drops everything else in hardware.
Access point	2	destination MAC	`1 for the whole radio channel`	`1, shared with the wired LAN`	A wireless bridge. Every station on the channel shares one medium, and 802.11 avoids collisions rather than detecting them, because a radio cannot listen while it transmits.
Gateway	up to 7	whatever the two stacks use	`depends where it sits`	`depends where it sits`	Translates between two different protocol stacks, re-encoding the payload rather than only choosing an outgoing port.

A switch does not break up broadcast domains. It cannot. A frame addressed to FF:FF:FF:FF:FF:FF is not a lookup failure, it is an instruction: send this to everyone. The switch obeys it out of every port, and a full MAC table makes no difference at all, because there is no single port that address belongs to. Nothing in a switch knows what an IP network is, so it has no basis on which to refuse.

A router does. It never forwards a frame; it destroys the one that arrives and builds a new one on the far side, and it only builds one when the routing table gives it a destination network. A broadcast has no destination network, so the router never rebuilds it, and the broadcast stops. That is why every interface of a router is a separate broadcast domain, and why you count broadcast domains by counting router interfaces rather than switches or hubs, which never create one. A network with no router in it at all is a single broadcast domain however many switches you chain together.

Collisions and broadcasts are separate questions. A hub is one of each. A four-port switch is four collision domains and still one broadcast domain. A two-interface router is two of each. The numbers only move together on the router, which is exactly why the router is the device that gets confused with the switch. Real switches complicate this with VLANs, which let one physical switch act as several broadcast domains, but that is configuration you add and not something a switch does on its own.

One port can hold many addresses. A MAC table row maps an address to a port, not a port to an address, so if another switch or a hub hangs off port 3 then every host under it is learned on port 3. That is also why the table has to age: entries expire after a few minutes of silence, 300 seconds on a Cisco switch by default, so a laptop that moves to another port is found again instead of being sent to the old one forever.

05 Cheat sheet

The eight things they ask, and the eight traps

What they ask	The answer	The trap
Layer of each device	`repeater 1, hub 1, modem 1, bridge 2, switch 2, NIC 1 and 2, access point 2, router 3, gateway up to 7`	Putting a NIC at layer 1 only, or treating gateway as a synonym for router.
What a switch forwards on	`the destination MAC in the frame header`	`saying IP — a switch never opens the IP header`
What a switch learns from	`the source MAC of every frame that arrives`	`saying the destination — that is what it looks up, never what it stores`
Destination not in the table	`flooded out of every port except the arrival port`	Saying it is dropped. Dropping would lose a frame for a host that exists.
Destination on the arrival port	`filtered — it leaves on no port at all`	Forgetting the third outcome exists and answering forward or flood.
Counting collision domains	`1 per switch or bridge port, 1 per router interface, 1 for an entire hub`	Counting hosts instead of ports, and forgetting the uplink cable is a port too.
Counting broadcast domains	`1 per router interface, and nothing else creates one`	`saying a switch splits them — it does not`
What a router changes	`both MAC addresses, the TTL and the header checksum; neither IP address`	Saying it forwards the frame. It destroys the arriving frame and builds another.

Layer decides depthHow far into the frame the device reads. Layer 1 reads a signal, layer 2 reads the twelve bytes of MAC addressing, layer 3 opens the packet inside. Nothing a device does contradicts its layer, so if you can name the layer you can reconstruct the behaviour.

Address decides forwardingA device can only forward on an address it is able to read. That is why a hub cannot be selective however much you spend on it, and why a switch cannot route between two IP networks however many ports it has.

Domains decide separationSplitting collision domains is a performance question and splitting broadcast domains is a scope question. A switch answers the first and is silent on the second; only a router answers the second.

06 Where & why

Where each of these is a real command you can run

None of this is historical. The MAC table, the routing table and the address resolution cache are all live objects you can print on a machine in front of you, and the box on the wall at home contains four of these devices pretending to be one.

Cisco IOS · Catalyst switch

The MAC address table is one command away

show mac address-table prints exactly what section 04 builds: one row per learned address with the port it was learned on and whether it was learned dynamically. Entries age out after 300 seconds of silence by default, so a host that goes quiet gets flooded to again the next time somebody wants it.

Wi-Fi 6 · IEEE 802.11ax

An access point is a bridge onto a medium it cannot divide

A switch can give each port its own collision domain because each port has its own cable. An access point cannot, because every station on the channel shares the air. 802.11 therefore uses CSMA/CA and avoids collisions in advance, since a radio transmitting on a channel cannot hear a collision on it.

Linux · ip route and ip neigh

Your laptop makes the same decision A made

ip route shows the table of destination networks that section 04’s router consults, including the default route. ip neigh shows the cache mapping an on-network IP to the MAC a frame will actually be addressed to. Those two tables are the whole of A’s decision in the router run.

OpenWrt · home gateway

One box, four devices, and only one of them routes

The box from your ISP holds a modem for the line, a small switch, an access point and a router. OpenWrt shows the seams: the LAN ports and the Wi-Fi interface are bridged together into br-lan, one broadcast domain, and the wan interface is a separate one that traffic is routed to. Everyone calls the whole box the router.

Two sentences to be able to defend on the spot. A switch does not break up broadcast domains, because a frame sent to FF:FF:FF:FF:FF:FF is an instruction it has no basis to refuse. A router does, because it never forwards a frame at all: it discards the one that arrived and only builds a new one when the routing table names a destination network, and a broadcast names none.

07 Interview questions

What they actually ask

Devices and layers are the opening questions of almost every networking round, because they are quick to ask and instantly separate the memorised list from the understood one. Expect to be handed a small topology and asked to count domains out loud.

What is the actual difference between a hub and a switch?

A hub is a layer 1 device and a switch is a layer 2 one. The hub repeats every incoming bit out of every other port because it cannot read an address; the switch reads the destination MAC and sends the frame out of the single port that address sits on. Say the consequences too: a hub is one collision domain and runs half duplex, while a switch gives every port its own collision domain and runs full duplex, so on a switch port a collision cannot happen at all.

Name the layer of a repeater, a hub, a bridge, a switch and a router.

Repeater and hub are layer 1, bridge and switch are layer 2, router is layer 3. The two layer 1 devices read no address of any kind, the two layer 2 devices forward on the destination MAC, and the router forwards on the destination IP. A hub is a multiport repeater and a switch is a multiport bridge, so the list is really three behaviours with two of them scaled up.

What is a collision domain, and why do people say it stopped mattering?

It is the set of ports whose signals can overlap on a shared medium and destroy each other, forcing both senders to back off and retry. It mattered on hubs, where every port shared one wire and throughput per host fell as hosts were added. On a switch each port is its own collision domain and runs full duplex, so nothing can collide there; the idea survives because Wi-Fi still shares a medium and because exams still ask you to count them.

Does a switch break up broadcast domains?

No. A switch splits collision domains and leaves the whole switch as a single broadcast domain. A frame addressed to FF:FF:FF:FF:FF:FF is not a lookup failure, it is an instruction to reach everyone, and the switch has no basis on which to refuse it — nothing in a switch knows what an IP network is. Only a router refuses to carry a broadcast further. The real-world footnote is VLANs, which let one physical switch behave as several broadcast domains, and that is configuration you add rather than something a switch does by itself.

How does a switch build its MAC address table?

By reading the source address of every frame that arrives and recording it against the port it arrived on. It never learns from a destination, because a destination is a claim about somewhere it has never seen while a source is proof about the port in front of it. Entries age out after a few minutes of silence, 300 seconds by default on Cisco switches, so a host that is moved to another port is found again rather than sent to the old one forever.

What does a switch do with a frame whose destination it has never seen?

It floods it out of every port except the one it arrived on, which is exactly what a hub would have done. That is not a failure mode; it is the only safe action, because the alternative is dropping a frame for a host that exists. The reply then teaches the switch where that host is, so for any given destination this normally happens once.

A bridge and a switch do the same job. Why do both words exist?

They are the same idea at two scales. A bridge came first: two or a few ports, the forwarding decision made in software, used to cut one crowded segment into two collision domains. A switch is a bridge with many ports and the decision made in hardware, fast enough to run every port at full speed at once. The sentence they want is that a switch is a multiport bridge.

What happens when a packet’s TTL reaches zero?

The router that decremented it to zero discards the packet and sends an ICMP Time Exceeded message back to the source. TTL is an 8-bit field in the IPv4 header, decremented by one at every router, so it is a hop counter rather than a clock. Traceroute is built directly on it: send packets with TTL 1, then 2, then 3, and read the address of whichever router complains each time.

Why can you not keep chaining hubs to build a bigger network?

Because chaining hubs grows the collision domain, not the network. Every host you add shares the same medium, so collisions rise and the usable throughput per host falls, and the whole thing stays half duplex however many hubs you buy. Distance bites as well, because a sender has to still be transmitting when a collision from the far end reaches it, which is what the 64-byte minimum frame size is protecting. Split the segment with a switch and each part gets its own collision domain.

Is a gateway another name for a router?

Hard

Two switches are joined by two cables instead of one, for redundancy. A host sends a single frame to FF:FF:FF:FF:FF:FF. Describe what the two switches do with it, explain why that frame never stops, explain why the same wiring between two routers would not have the problem, and say what a redundant second cable can still be worth if something has to switch it off to keep the network alive.

Follow-up

Neither switch does anything wrong. Both follow exactly the flooding and learning rules from section 04, so the failure is produced by two correct devices and the fix cannot be a better rule inside one of them.

Show the hint

Put the Ethernet header next to the IPv4 header and look for the field that lets something die of old age. Then ask what the MAC table does when the same source address keeps arriving on two different ports.