A switch can move a frame anywhere inside its own subnet in microseconds. It cannot get that frame one hop past the subnet boundary — that job belongs to something else entirely.
"Switching" and "routing" get used almost interchangeably in casual conversation — both move traffic, both live in a network closet, both show up as boxes with a lot of blinking lights. But they are not two flavors of the same job. A switch operates at Layer 2 (the Data Link layer) and forwards frames using nothing but destination MAC addresses, entirely within a single broadcast domain. A router operates at Layer 3 (the Network layer) and forwards packets using destination IP addresses, specifically to get traffic from one subnet into a different one. Neither device can do the other's job. A switch has no concept of a subnet at all — it doesn't know what an IP address is. A router's entire reason for existing is to recognize that a destination lives outside the current subnet and forward it toward the right next hop.
A switch builds a MAC address table (sometimes called a CAM table) simply by watching traffic go by. Every time a frame arrives on a port, the switch notes the source MAC address and remembers "this MAC lives out this port." The first time it sees a frame addressed to a MAC it hasn't learned yet, it floods that frame out every port except the one it arrived on — but from then on, it forwards directly to the one correct port. That's the entire job: which port is this MAC address behind?There is no routing, no subnet math, no IP addresses anywhere in this decision — a switch forwarding a frame has no idea what subnet the sender or receiver is even on, because it doesn't need to know. It only works within one broadcast domain, because MAC addresses are only meaningful on the local physical/logical segment — they don't survive being forwarded onto a different network.
A router builds a routing table instead — populated from directly connected networks, static routes an engineer typed in, and/or a dynamic routing protocol like OSPF or BGP that exchanges reachability information with other routers. The question a router answers is different in kind, not just in address format: which network does this destination IP belong to, and what's the best next hop toward it?Once it picks a next hop, the router has one more job a switch never has to do at all — it must re-encapsulate the packet in a brand-new Layer 2 frame, addressed to the MAC address of that next hop, because the original frame's MAC addressing was only ever valid for the segment it just came from. That re-write happens at every single router hop along the path, all the way to the destination.
This is the part that trips people up: a workstation on VLAN 10 reaching a server on VLAN 20 — or reaching the internet — has to cross a subnet boundary at some point, and switching alone has absolutely no mechanism for doing that. It doesn't matter if there are ten switches in between; every one of them is still only asking "which port is this MAC behind," and none of them can forward traffic into a different broadcast domain. Something has to look at the destination IP address, recognize it belongs to a different network, and make a routing decision — that something is a router, or a Layer-3-capable switch performing what's usually called inter-VLAN routing. This is exactly why VLANs, which exist specifically to create separate broadcast domains at Layer 2, are useless for actual communication between each other unless a Layer 3 device sits between them — even when every device involved is physically plugged into the very same piece of switch hardware.
A packet's source and destination IP addresses describe where it ultimately came from and where it's ultimately going — they don't change as the packet crosses the network. The MAC addresses in the frame wrapped around that packet describe something completely different: who's on the other end of the wire right now, on this one segment. That's exactly why a router has to swap the destination MAC address at every hop — the old one belonged to a device on the segment it just left, and it means nothing on the segment it's entering. Switching only ever has to deal with the second, local kind of addressing, which is why it can be fast and stateless within one broadcast domain. Routing exists specifically to bridge the gap between segments, which is why it has to understand both address types, hold a table of entire networks rather than individual devices, and do the extra work of re-wrapping the packet before sending it on.
False, and swapping in a different address type wouldn't get you there — switching and routing are fundamentally different functions tied to different OSI layers, solving different problems. A switch has no concept of subnets or networks at all; it simply learns which port a given MAC address is reachable through, within one broadcast domain, and forwards accordingly. A router specifically exists to move traffic between different networks: it examines the destination IP address, determines which network it belongs to, picks a next hop toward that network from a routing table, and — critically — re-writes the Layer 2 frame header at every hop along the way so the frame is valid on the segment it's about to enter. This isn't an interchangeable choice of which address to key off of — it's two genuinely different jobs that both have to happen for cross-subnet communication to work at all.A device that only switches can move frames around its own broadcast domain quickly, but it has no way whatsoever to get a packet onto a different subnet — that capability doesn't exist at Layer 2, no matter what address you look up.
Explains the fundamental difference between Layer 2 switching (forwarding frames within one broadcast domain by destination MAC address, using a learned MAC address table) and Layer 3 routing (forwarding packets between different subnets by destination IP address, using a routing table and a next-hop decision, with re-encapsulation into a new frame at every hop).
A switch builds a MAC address table by observing which port each source MAC address arrives on. When a frame arrives destined for an already-learned MAC address, the switch forwards it out that one specific port instead of flooding it everywhere; unknown destination MACs are flooded until they're learned. This entire process happens within a single broadcast domain — typically one VLAN or subnet — and never involves an IP address, a subnet mask, or any awareness of what network a device belongs to. Switching is fast precisely because it's a simple table lookup with no routing logic involved.
A router builds a routing table from directly connected networks, static routes configured by an engineer, and/or a dynamic routing protocol such as OSPF or BGP that exchanges reachability information with neighboring routers. For each packet, the router examines the destination IP address, determines which network it belongs to, and looks up the best next hop toward that network. Unlike a switch, a router must also make a new Layer 2 forwarding decision for the next segment — re-encapsulating the packet in a new frame addressed to the next hop's MAC address — because MAC addressing is only ever valid for one physical/logical segment at a time.
Switching operates entirely within one subnet: a device that only switches can move frames around quickly inside that broadcast domain but has no mechanism at all to deliver a packet to a different subnet — MAC-based forwarding simply doesn't extend across a subnet boundary. Routing is specifically the function that recognizes a destination IP belongs to a different network and forwards toward it via an appropriate next hop. Any traffic that crosses from one subnet to another — a workstation on one VLAN reaching a server on another VLAN, or reaching the internet — requires a routing decision at some point, no matter how many switches the traffic passes through along the way.
VLANs exist to segment a network into separate broadcast domains at Layer 2 — that's their whole purpose. But that segmentation also means devices in different VLANs cannot reach each other through switching alone, even if they're physically connected to the exact same switch chassis. Communication between VLANs requires a Layer 3 device: either a dedicated router connected to the switch, or a Layer-3-capable switch performing inter-VLAN routing (routing between VLAN interfaces on the same physical device). Either way, it's still a genuinely separate Layer 3 function being performed — not an extension of switching.
No — not by switching alone. A standard Layer 2 switch has no concept of IP addresses or subnets and forwards purely by MAC address within one broadcast domain. Getting traffic from one subnet to another always requires a Layer 3 (routing) decision, whether that comes from a separate router or from inter-VLAN routing performed by a Layer-3-capable switch.
A Layer 3 switch is a single physical device that performs both functions — Layer 2 switching within VLANs and Layer 3 routing between VLAN interfaces — but the two functions remain logically separate operations happening inside the same box. It still builds and uses a MAC address table for intra-VLAN forwarding and a separate routing table for inter-VLAN forwarding; it isn't a hybrid address type or a shortcut around the distinction.
Because MAC addresses aren't hierarchical or aggregatable the way IP addresses are — there's no way to summarize "all MACs starting with X" into a compact routing table entry the way a routing table summarizes an entire IP subnet as one route. IP addressing was specifically designed with a network portion and a host portion so that routers only need to track routes to networks, not to every individual device on the internet.
The IP addresses describe the ultimate source and destination of the packet and are meant to stay constant for the entire trip. The MAC addresses only describe who is on the other end of the current physical/logical segment, so they have to be rewritten by each router to match the next segment the frame is about to travel over — the previous segment's MAC addressing is meaningless on the new segment.
Still purely switching, as long as both devices are in the same broadcast domain/subnet. Frames can traverse multiple switches — over trunk links carrying VLAN tags, for example — using nothing but MAC address table lookups at each switch. Routing only enters the picture the moment traffic needs to leave that VLAN/subnet for a different one.
Try our Enterprise IT Networks Studio
More calculators, simulators, and guides for this discipline.