← Enterprise IT & Networks Studio
Concept Explainer · Enterprise IT & Networks

Switching vs. Routing — Why One Device Reads MAC Addresses and the Other Reads IP Addresses

A switch can move a frame anywhere inside its own subnet in microseconds. It cannot get that frame one hop past the subnet boundary — that job belongs to something else entirely.

"Switching" and "routing" get used almost interchangeably in casual conversation — both move traffic, both live in a network closet, both show up as boxes with a lot of blinking lights. But they are not two flavors of the same job. A switch operates at Layer 2 (the Data Link layer) and forwards frames using nothing but destination MAC addresses, entirely within a single broadcast domain. A router operates at Layer 3 (the Network layer) and forwards packets using destination IP addresses, specifically to get traffic from one subnet into a different one. Neither device can do the other's job. A switch has no concept of a subnet at all — it doesn't know what an IP address is. A router's entire reason for existing is to recognize that a destination lives outside the current subnet and forward it toward the right next hop.

The Setup

Two tables, two address types, two completely different questions

A switch builds a MAC address table (sometimes called a CAM table) simply by watching traffic go by. Every time a frame arrives on a port, the switch notes the source MAC address and remembers "this MAC lives out this port." The first time it sees a frame addressed to a MAC it hasn't learned yet, it floods that frame out every port except the one it arrived on — but from then on, it forwards directly to the one correct port. That's the entire job: which port is this MAC address behind?There is no routing, no subnet math, no IP addresses anywhere in this decision — a switch forwarding a frame has no idea what subnet the sender or receiver is even on, because it doesn't need to know. It only works within one broadcast domain, because MAC addresses are only meaningful on the local physical/logical segment — they don't survive being forwarded onto a different network.

A router builds a routing table instead — populated from directly connected networks, static routes an engineer typed in, and/or a dynamic routing protocol like OSPF or BGP that exchanges reachability information with other routers. The question a router answers is different in kind, not just in address format: which network does this destination IP belong to, and what's the best next hop toward it?Once it picks a next hop, the router has one more job a switch never has to do at all — it must re-encapsulate the packet in a brand-new Layer 2 frame, addressed to the MAC address of that next hop, because the original frame's MAC addressing was only ever valid for the segment it just came from. That re-write happens at every single router hop along the path, all the way to the destination.

Switching: forward by MAC address, inside one VLAN

Layer 2 — MAC lookup
VLAN 10 — 192.168.10.0/24 — one broadcast domainL2 SWITCHPort 1AA:11Port 2BB:22Port 3CC:33Port 4DD:44frame in, dst MAC = BB:22forwarded directly to Port 2 — onlyMAC ADDRESS TABLE (learned by observing source MACs)MAC ADDRESSPORTAA:BB:CC:11Port 1AA:BB:CC:22 (dest)Port 2AA:BB:CC:33Port 3no IP addresses anywhere in this table

Layer 2 — forwards by MAC address, within one broadcast domain. The switch never looks at, stores, or reasons about an IP address or a subnet — its entire world is "which port is this MAC behind."

The Stakes

Crossing a subnet boundary always requires a Layer 3 decision, no matter how many switches the traffic passes through

This is the part that trips people up: a workstation on VLAN 10 reaching a server on VLAN 20 — or reaching the internet — has to cross a subnet boundary at some point, and switching alone has absolutely no mechanism for doing that. It doesn't matter if there are ten switches in between; every one of them is still only asking "which port is this MAC behind," and none of them can forward traffic into a different broadcast domain. Something has to look at the destination IP address, recognize it belongs to a different network, and make a routing decision — that something is a router, or a Layer-3-capable switch performing what's usually called inter-VLAN routing. This is exactly why VLANs, which exist specifically to create separate broadcast domains at Layer 2, are useless for actual communication between each other unless a Layer 3 device sits between them — even when every device involved is physically plugged into the very same piece of switch hardware.

Routing: forward by IP address, between two networks

Layer 3 — routing table + re-encapsulation
SUBNET A — VLAN 10 — 10.10.10.0/24Workstation10.10.10.50SUBNET B — VLAN 20 — 10.10.20.0/24Server10.10.20.75ROUTERdst IP 10.10.20.75, dst MAC = router's A-side MACdst IP unchanged, dst MAC = NEW (server's MAC)ROUTING TABLE (static routes and/or OSPF/BGP)DESTINATION NETWORKNEXT HOPEXIT INTERFACE10.10.10.0/24directly connectedVLAN 10 (Subnet A)10.10.20.0/24 (dest)directly connectedVLAN 20 (Subnet B)0.0.0.0/0 (default)203.0.113.1WAN uplinkAt the router, the packet is re-encapsulated in a brand-new Layer 2 frame for Subnet B:Source IP 10.10.10.50 → Dest IP 10.10.20.75 — unchanged, carried the whole wayDest MAC: router's Subnet-A interface → rewritten to the server's actual MAC on Subnet Bthis MAC re-write happens at every router hop along the path, one Layer 2 segment at a time

Layer 3 — forwards by IP address, between different networks, and re-writes the Layer 2 header at each hop. The IP addresses stay constant end-to-end; the MAC addresses are only ever valid for one segment at a time and get replaced at every router.

Why this works

IP addresses are the constant across the whole journey. MAC addresses are only ever valid for one segment at a time.

A packet's source and destination IP addresses describe where it ultimately came from and where it's ultimately going — they don't change as the packet crosses the network. The MAC addresses in the frame wrapped around that packet describe something completely different: who's on the other end of the wire right now, on this one segment. That's exactly why a router has to swap the destination MAC address at every hop — the old one belonged to a device on the segment it just left, and it means nothing on the segment it's entering. Switching only ever has to deal with the second, local kind of addressing, which is why it can be fast and stateless within one broadcast domain. Routing exists specifically to bridge the gap between segments, which is why it has to understand both address types, hold a table of entire networks rather than individual devices, and do the extra work of re-wrapping the packet before sending it on.

Common misconception
"Switching and routing are basically the same forwarding process, just using different address types — you could route based on MAC addresses too if you wanted."

False, and swapping in a different address type wouldn't get you there — switching and routing are fundamentally different functions tied to different OSI layers, solving different problems. A switch has no concept of subnets or networks at all; it simply learns which port a given MAC address is reachable through, within one broadcast domain, and forwards accordingly. A router specifically exists to move traffic between different networks: it examines the destination IP address, determines which network it belongs to, picks a next hop toward that network from a routing table, and — critically — re-writes the Layer 2 frame header at every hop along the way so the frame is valid on the segment it's about to enter. This isn't an interchangeable choice of which address to key off of — it's two genuinely different jobs that both have to happen for cross-subnet communication to work at all.A device that only switches can move frames around its own broadcast domain quickly, but it has no way whatsoever to get a packet onto a different subnet — that capability doesn't exist at Layer 2, no matter what address you look up.

Related Concept Explainers
Unicast, Multicast & Broadcast — Three Genuinely Different Ways a Packet Reaches Its Audience
Read it →
MAC Address Table / Switch Learning Simulator
Open it →

Switching vs. Routing — Concept Explainer

Explains the fundamental difference between Layer 2 switching (forwarding frames within one broadcast domain by destination MAC address, using a learned MAC address table) and Layer 3 routing (forwarding packets between different subnets by destination IP address, using a routing table and a next-hop decision, with re-encapsulation into a new frame at every hop).

Switching — Layer 2, MAC Addresses, One Broadcast Domain

A switch builds a MAC address table by observing which port each source MAC address arrives on. When a frame arrives destined for an already-learned MAC address, the switch forwards it out that one specific port instead of flooding it everywhere; unknown destination MACs are flooded until they're learned. This entire process happens within a single broadcast domain — typically one VLAN or subnet — and never involves an IP address, a subnet mask, or any awareness of what network a device belongs to. Switching is fast precisely because it's a simple table lookup with no routing logic involved.

Routing — Layer 3, IP Addresses, Between Networks

A router builds a routing table from directly connected networks, static routes configured by an engineer, and/or a dynamic routing protocol such as OSPF or BGP that exchanges reachability information with neighboring routers. For each packet, the router examines the destination IP address, determines which network it belongs to, and looks up the best next hop toward that network. Unlike a switch, a router must also make a new Layer 2 forwarding decision for the next segment — re-encapsulating the packet in a new frame addressed to the next hop's MAC address — because MAC addressing is only ever valid for one physical/logical segment at a time.

Why Both Functions Exist Separately

Switching operates entirely within one subnet: a device that only switches can move frames around quickly inside that broadcast domain but has no mechanism at all to deliver a packet to a different subnet — MAC-based forwarding simply doesn't extend across a subnet boundary. Routing is specifically the function that recognizes a destination IP belongs to a different network and forwards toward it via an appropriate next hop. Any traffic that crosses from one subnet to another — a workstation on one VLAN reaching a server on another VLAN, or reaching the internet — requires a routing decision at some point, no matter how many switches the traffic passes through along the way.

Why VLANs Need a Layer 3 Device to Talk to Each Other

VLANs exist to segment a network into separate broadcast domains at Layer 2 — that's their whole purpose. But that segmentation also means devices in different VLANs cannot reach each other through switching alone, even if they're physically connected to the exact same switch chassis. Communication between VLANs requires a Layer 3 device: either a dedicated router connected to the switch, or a Layer-3-capable switch performing inter-VLAN routing (routing between VLAN interfaces on the same physical device). Either way, it's still a genuinely separate Layer 3 function being performed — not an extension of switching.

Frequently asked questions

Can a switch ever forward traffic between two different subnets?

No — not by switching alone. A standard Layer 2 switch has no concept of IP addresses or subnets and forwards purely by MAC address within one broadcast domain. Getting traffic from one subnet to another always requires a Layer 3 (routing) decision, whether that comes from a separate router or from inter-VLAN routing performed by a Layer-3-capable switch.

What is a Layer 3 switch, and does it change this distinction?

A Layer 3 switch is a single physical device that performs both functions — Layer 2 switching within VLANs and Layer 3 routing between VLAN interfaces — but the two functions remain logically separate operations happening inside the same box. It still builds and uses a MAC address table for intra-VLAN forwarding and a separate routing table for inter-VLAN forwarding; it isn't a hybrid address type or a shortcut around the distinction.

Why can't you just route using MAC addresses and skip IP addressing entirely?

Because MAC addresses aren't hierarchical or aggregatable the way IP addresses are — there's no way to summarize "all MACs starting with X" into a compact routing table entry the way a routing table summarizes an entire IP subnet as one route. IP addressing was specifically designed with a network portion and a host portion so that routers only need to track routes to networks, not to every individual device on the internet.

Why does the destination MAC address change at every router hop but the destination IP address does not?

The IP addresses describe the ultimate source and destination of the packet and are meant to stay constant for the entire trip. The MAC addresses only describe who is on the other end of the current physical/logical segment, so they have to be rewritten by each router to match the next segment the frame is about to travel over — the previous segment's MAC addressing is meaningless on the new segment.

If two devices are on the same VLAN but different physical switches, is that still switching or does it involve routing?

Still purely switching, as long as both devices are in the same broadcast domain/subnet. Frames can traverse multiple switches — over trunk links carrying VLAN tags, for example — using nothing but MAC address table lookups at each switch. Routing only enters the picture the moment traffic needs to leave that VLAN/subnet for a different one.

🎓

Try our Enterprise IT Networks Studio

More calculators, simulators, and guides for this discipline.

Related tools & guides

MAC Address Table / Switch Learning SimulatorVLAN Planning & Subnet SizerRouting Protocol Fundamentals: OSPF and BGP ExplainedSubnet & VLAN Segmentation Visualizer