Networking

Low-end network switches appear nearly identical to network hubs, but a switch contains more "intelligence" (and comes with a correspondingly slightly higher price tag) than a network hub. Network switches are capable of inspecting data packets as they are received, determining the source and destination device of that packet, and forwarding it appropriately. By delivering each message only to the connected device it was intended for, a network switch conserves network bandwidth and offers generally better performance than a hub.

In the past, it was faster to use Layer 2 techniques to switch, when only MAC addresses could be looked up in content addressable memory (CAM). With the advent of ternary CAM (TCAM), it was equally fast to look up an IP address or a MAC address. TCAM is expensive, but very appropriate for enterprise switches that use default routes plus a moderate number of other routes. For routers that need a full Internet routing table, TCAM may not be cost-effective.

Role of switches in networks

Network switch is a marketing term rather than a technical one. Switches may operate at one or more OSI layers, including physical, data link, network, or transport (i.e., end-to-end). A device that operates simultaneously at more than one of these layers is called a multilayer switch, although use of the term is diminishing.

In switches intended for commercial use, built-in or modular interfaces makes it possible to connect different types of networks, for example Ethernet, Fibre Channel, ATM, and 802.11. This connectivity can be at any of the layers mentioned. While Layer 2 functionality is adequate for speed-shifting within one technology, interconnecting technologies such as Ethernet and token ring are easier at Layer 3.

Again, "switch" is principally a marketing term; interconnection of different Layer 3 networks is done by routers. If there are any features that characterize "Layer-3 switches" as opposed to general-purpose routers, it tends to be that they are optimized, in larger switches, for high-density Ethernet connectivity.

In some service provider and other environments where there is a need for much analysis of network performance and security, switches may be connected between WAN routers as places for analytic modules. Some vendors provide firewall, network intrusion detection, and performance analysis modules that can plug into switch ports. Some of these functions may be on combined modules.

In other cases, the switch is used to create a "mirror" image of data that can go to an external device. Since most switch port mirroring provides only one mirrored stream, network hubs can be useful for fanning out data to several read-only analyzers. This is especially popular when using open-source network analysis tools running over Linux, such as the Snort intrusion detection system and the Wireshark (formerly ethereal) protocol analyzer.