Routing and switching

Local delivery and delivery between networks

Switching and routing describe related forwarding responsibilities. A conventional Layer 2 Ethernet switch forwards frames using local-link information such as MAC addresses and its forwarding table. An IP router forwards packets between networks using destination addresses and routing information. Modern devices can perform both functions.

The distinction is therefore about behavior rather than the number of physical boxes in a diagram. A multilayer switch can route between networks, and a home gateway often combines routing, switching, wireless access, address translation, and firewall functions.

Send a packet to a remote service

Imagine a laptop on a training network requests a website outside its local subnet. The laptop determines that the destination requires a gateway. On an IPv4 Ethernet network, it may use ARP and local address resolution to learn the local-link address needed to reach that gateway.

The local frame is addressed to the gateway's interface, while the IP destination remains the remote service. At the next routing step, the packet is forwarded using the appropriate route and encapsulated for the next link. The frame carrying it can change as it moves across different links.

This helps explain why a remote website's MAC address is not normally something your laptop resolves directly across the internet. Local-link delivery and end-to-end network addressing serve different scopes.

What forwarding tables tell you

A switch's forwarding information can help locate where a MAC address was learned on a particular network. A route table can show the selected next hop for a destination prefix. Neither observation by itself proves which human used a device or that an application request was legitimate.

For a fictional troubleshooting case, a correct route narrows one question, but the next device could still reject traffic, a service could be unavailable, or the application could deny access. Record the exact observation rather than turning “route exists” into “the whole connection works.”

Boundaries need policies

VLANs describes a way to separate Layer 2 broadcast domains. If the network then routes freely between every VLAN, the separation does not automatically create a restrictive security boundary. Network segmentation connects the topology to the intended communication policy.

A useful design identifies which systems should communicate, the purpose of each connection, and where restrictions are enforced. Management access to forwarding devices also matters because configuration changes can alter many paths at once.

Draw two different journeys

Sketch a laptop reaching a peer on the same local network, then the laptop reaching a service on another network. Mark the relevant next-hop decision and the role of each device. Label the IP destination separately from the local frame destination.

Use invented addresses and a lab you control if you inspect actual tables. Compare what changes between the local and remote journeys. Continue with IP addresses for prefixes and Network segmentation for deciding which reachable paths should be permitted.