Network switch

A network switch, packet switch (or just switch) plays an integral part in the vast majority of current Ethernet local area networks.

A switch is an data link layer networking device connecting segments of a packet network. Switches perform transparent bridging (connection of multiple network segments with forwarding based on MAC addresses). Typical Ethernet port speeds are 10, 100, or 1000 megabits per second (Mbit/s), and half or full duplex. Half duplex means that the device can only send or receive at any given time, whereas full duplex can send and receive at the same time. Addition of expansion cards makes it possible to connect different types of networks, for example Ethernet, Fibre Channel, ATM, and 802.11.

Types of network

A switch can connect Ethernet, token ring, Fibre Channel or other types of packet switched network segments together to form an internetwork. Late in the 20th century, switches replaced multiport repeaters in order to reduce congestion.

If a network has only switches and no hubs then the collision domains are either reduced to a single link or, if both ends support full duplex, eliminated altogether. The principle of a fast hardware forwarding device with many ports can be extended to higher layers giving the multilayer switch.

Forwarding methods

There are four forwarding methods a switch can use:

Store and forward - The switch buffers and, typically, performs a checksum on each frame before forwarding it on.
Cut through - The switch only reads up to the frame's hardware address before starting to forward it. There is no error checking with this method.
Fragment free - A method which attempts to retain the benefits of both "Store and Forward" and "Cut-through". Fragment Free checks the first 64 bytes of the frame, where addressing information is stored. This way the frame will always reach its intended destination. Error checking of the actual data in the packet is left for the end device in Layer 3 or Layer 4 (OSI), typically a router.
Adaptive switching - A method of automatically switching between the other three modes.

Note that "cut through" switches have to fall back to "store and forward" if the outgoing port is busy at the time the packet arrives.

Note that these forwarding methods are not controlled by the user and are configured only by the switch itself.

Types of switches

Form factor

Rack mounted
Non rack mounted

Configuration options

Unmanaged
Managed
Smart / intelligent

Unmanaged switches have no configuration interface or options. They are typically found in SOHO or home environments. Managed switches are ones which allow access to one or more interfaces for the purpose of configuration or management of features such as Spanning Tree Protocol, Port Speed, VLANS, etc. High-end or "enterprise" switches, provide a serial console and command-line access via telnet and ssh, as well as management via SNMP. More recent devices also provide a web interface. Limited functions, such as a complete reset by pushing buttons on the switch are usually also provided.

Managed switches are found in medium/large "enterprise" networks and though more expensive are of higher quality (e.g. with a backplane with higher transfer speeds). The task of managing usually requires understanding of Layer 2 networks (e.g. Ethernet). Smart (or intelligent) switches are usually managed switches with a limited set of features.

Typical Switch management features

(In order of basic to advanced):

Turn some particular port range on or off
Link speed and duplex settings
Priority settings for ports
MAC filtering
Use of Spanning Tree Protocol
SNMP monitoring of device and link health
Port mirroring (also named: Port monitoring, spanning port, SPAN port, Roving Analysis Port, link mode port)
Link aggregation (also called: bonding/trunking)
VLAN settings

Link aggregation allows you to use multiple ports for the same connection achieving higher data transfer speeds. Creating VLANs can serve security and performance goals by reducing the size of the Broadcast domain.

Form of power source

Standard
Power over Ethernet

Hubs vs switches

An Ethernet hub, or repeater, is a fairly unsophisticated broadcast device. Hubs do not manage any of the traffic that comes through them, and any packet entering any port is broadcast out on every other port (every port other than the port of entry). Since every packet is being sent out through every other port, packet collisions result--which greatly impedes the smooth flow of traffic.

A switch isolates ports, meaning that every received packet is sent out only to the port on which the target may be found (assuming the proper port can be found; if it is not, then the switch will broadcast the packet to all ports except the port from which the request originated). Since the switch intelligently sends packets where they need to go, the performance of the network can be greatly increased.

More expensive switches can also do several other operations, such as isolating ports from each other by placing them in different VLANs, or allowing snooping by copying all packets on some set of ports to a special "sniffer" port.

This leaves the question of when a switch is most appropriate, versus a hub. If most of the network traffic involves only a few ports, then there will be little performance gain achieved by upgrading from a hub to a switch. But if the traffic involves more than a few ports, using a switch can yield a significant improvement in performance. Also, modern Fast Ethernet switches designed for small office / home office (SOHO) use are priced comparably to hubs, making use of a hub somewhat pointless if new equipment must be purchased anyway.

Because data is routed through the correct ports and not broadcast indiscriminately as with hubs, switches are somewhat more secure. Were a user with the intent of capturing other users' data to run a packet sniffer while connected through a switch, they'd usually see only their own data. In contrast, a hub would broadcast all traffic to all users. This said, even the extra security provided by switches can still be breached with techniques such as MAC flooding and ARP spoofing.

Traffic Monitoring on a Switched Network

It is difficult to monitor traffic that is bridged using a switch, because all ports are isolated until one transmits data, and even then only the sending and receiving ports can see the traffic.

Two popular methods that are specifically designed to allow a network analyst to monitor traffic are:

Port mirroring - the switch sends a copy of network packets to a monitoring network connection.
SMON - "Switch Monitoring" is described by RFC 2613 and is a protocol for controlling facilities such as port mirroring.

External links