At home, the network gear is “the Wi-Fi router.” At the office, there is a different box under the desk or up on a shelf ── one with a whole row of LAN ports. That box is usually a switch, and it is not the same thing as a router ── so what exactly is the difference? If any of these sound familiar, keep reading.
- You would rather not be asked to explain the difference between a router and a switch
- You have no idea what that box with a row of LAN ports under the office desk actually is
- You have thought, “I’m out of LAN ports. Should I just buy another router?“
- You want to tell apart the two kinds of icons that show up in every network diagram
If you only want a one-line answer, an earlier article in this series already gave it: a switch moves traffic within one network; a router connects networks to each other. But that one line leaves the real questions open. Where does “one network” end? What is the difference between “moving” and “connecting”? And why are there two kinds of boxes in the first place?
This article stays away from model recommendations, cabling, and setup steps entirely, and walks through:
- The one-line answer ── the town’s sorting clerk and the town exit (§1)
- The two-story address ── nameplate (MAC) and mailing address (IP) (§2)
- What a switch does ── a sorting clerk who memorizes nameplates (§3)
- What a router does ── reading mailing addresses at the town exit (§4)
- What your home “Wi-Fi router” really is ── an all-in-one combo box (§5)
── nothing but the logic of who does which job, in the shortest possible path. By the end, you will be able to answer “which box do I buy when I run out of ports?” from first principles.
| Question | Section |
|---|---|
| So what is actually different between a switch and a router? | §1 / §4 |
| How are MAC addresses and IP addresses divided up? | §2 |
| What is the difference between a hub and a switch? | §3 |
| Why do NAT and DHCP both live inside the router? | §4 |
| I’m out of ports. Which one do I buy? | §5 |
This is the fourth deep-dive in our “How PCs Work” series (IP addresses, DNS, firewalls, why office networks get slow, VPN, NAT, DHCP). So far the series has been about addresses ── assigning them, translating them, looking them up by name. This article is about the boxes that carry those addresses around, and how they split the work.
1. The One-Line Answer ── The Town’s Sorting Clerk and the Town Exit
1-1. Two boxes on the town map
Let’s place the two boxes on the town map this series keeps coming back to. Read “the same town” as “the same network.”
The town map ── where the sorting clerk and the exit sit
┌─────────────── inside the town (one network) ──────────┐
│ │
│ PC A PC B printer NAS │
│ │ │ │ │ │
│ └────┬────┴────┬────┴─────┬─────┘ │
│ │ switch (sorting clerk)│ │
│ └─────────┬──────────┘ │
│ │ │
│ router (town exit) │
└───────────────────┼─────────────────────────────────────┘
│
the internet (outside the town)
The switch is the sorting clerk standing in the middle of town. PC to printer, PC to NAS ── packages (data) traveling between devices in the same town get handed only to the device they are addressed to. The packages never leave town.
The router stands at the town exit. Packages addressed outside the town ── that is, anything bound for the internet ── get sent out of town, and packages arriving from outside get passed along to the right place inside.
So the one-line answer can be drawn like this: deliveries within the town are the switch’s job; deliveries that cross town lines are the router’s.
1-2. Where exactly is the “same town” line drawn?
Then where does “the same town” start and end? That boundary line has already appeared in this series, too. Remember the subnet mask from the four-item kit in the DHCP article? That was exactly this: the official definition of “everything from here to here counts as one town.”
Whenever a device is about to send something, it first compares the destination against that boundary. If the destination is in town, hand it over directly via the sorting clerk (the switch). If it’s out of town, entrust it to the town exit (the router) ── this decision is the first fork in the road for every single transmission.
Another item in that same four-item kit was the default gateway ── and its value is literally “the address of the town exit,” i.e., the router. Any package the device judges to be out-of-town mail goes straight to that address. What DHCP was handing out, in other words, was a note saying “when in doubt, drop it off here.”
2. The Two-Story Address ── Nameplate (MAC) and Mailing Address (IP)
2-1. Every device has two addresses
The key to truly understanding the switch/router split is one fact: every device carries two addresses.
The first is the MAC address ── an identifier burned into the hardware at the factory. It is allocated so that no two devices in the world share one: think of it as the nameplate on an apartment door. It is fixed at birth and never changes, no matter where the device moves.
The second is the IP address ── the address assigned for communication (→ the IP address article). This one is the mailing address, usable for deliveries that cross town lines. But as the DHCP article showed, it is a lease ── a fixed-term loan ── so it can change every time the device moves in somewhere new.
The two-story address every device carries ┌── your laptop ────────────────────────────────┐ │ │ │ Floor 2: IP address 192.168.1.23 │ │ (mailing address ── works across │ │ town lines. Borrowed from DHCP, │ │ so it can change) │ │ │ │ Floor 1: MAC address A4:5E:60:xx:xx:xx │ │ (door nameplate ── burned in at the │ │ factory. Globally unique, never │ │ changes for life) │ └───────────────────────────────────────────────┘
2-2. Why two? ── and how the two boxes split the work
“If the nameplate is globally unique, why not just deliver everything by nameplate?” ── because a nameplate, unique as it is, says nothing about location. No postal system on earth could memorize which town, which street, which room “A4:5E:60…” lives in ── for every device in the world. The mailing address (IP) is the opposite: it pins down the location, but since it’s borrowed, it doesn’t identify the machine itself.
So delivery becomes a division of labor: find the place by mailing address (IP), make the final handoff by nameplate (MAC). And that division of labor maps exactly onto the two boxes.
Switches run on nameplates (MAC); routers run on mailing addresses (IP) ── that is the spine of this article. Sections §3 and §4 simply unfold this one line, one box at a time.
3. What a Switch Does ── A Sorting Clerk Who Memorizes Nameplates
3-1. Memorize, then hand to the right door only
A switch has exactly two jobs: memorize and sort.
Every time a package flows in through a port, the switch looks at the sender’s nameplate (MAC address) and jots down a note: “the device with this nameplate lives behind this port” (this is called learning). Then, if a package’s destination nameplate is in the notebook, the switch sends it out through that port only. Nothing reaches the devices it doesn’t concern.
3-2. Hubs vs switches ── there was an era of spraying everyone
The classic question “what’s the difference between a hub and a switch?” is answered by that learning step. The old-school hub (a repeater hub) memorized nothing. Whatever came in went out to every port, destination be damned. Each device just threw away whatever wasn’t addressed to it ── simple, but as device counts grew, everyone’s packages flowed down everyone’s wire: a recipe for congestion and eavesdropping.
Hub vs switch ── how each one delivers
Hub (then): ignores the address Switch (now): memorizes nameplates
package for PC A arrives package for PC A arrives
│ │
┌──┴──┐ sprays every port ┌──┴───┐ checks its notes:
│ hub │──→ PC A ○ accepted │switch│ "A's nameplate = port 3"
│ │──→ PC B × (discards) │ │──→ port 3 → PC A ○
└─────┘──→ PC C × (discards) └──────┘ (B and C see nothing)
Almost every box sold as a “hub” today is, on the inside, a switch. That box under the office desk ── whatever your coworkers call it ── is almost certainly a switch too.
3-3. The packages that still go to everyone ── town announcements
That said, some packages leave even a switch no choice but to spray. Packages whose destination nameplate isn’t in the notebook yet ── and packages that are addressed to everyone from the start: the broadcast, the town-wide announcement we met in §3 of the slow-network article. The “can someone lend me an address!” shout from the DHCP article was one of these announcements, too.
A town announcement reaches every device in town. Which means the bigger the town, the more each announcement costs. That is exactly the congestion mechanism the slow-network article walked through.
Adding switches to plug in more devices only makes the town bigger ── it never splits the town. A switch is a sorting clerk, not a town-boundary maker. Town announcements sail right across switches and keep reaching everyone. The only thing that can split a town is the resident of the next section ── the router.
4. What a Router Does ── Reading Mailing Addresses at the Town Exit
4-1. Read the address, send it toward the next town
A router’s core business is reading the mailing address (IP address) on packages at the town exit. When a package not addressed to its own town arrives, the router judges “for this destination, the quickest move is to hand it to that town over there” and sends it off (this is route selection, or routing). The internet is a chain of towns, and your package gets relayed from router to router until it reaches the town it was addressed to.
4-2. A router is where one town ends and another begins
And here is the decisive difference from a switch: at a router, the town (the network) changes. The address scheme changes (the 192.168.1.x town versus the towns beyond it), and town announcements do not cross a router. If a switch is the box that makes a town bigger, a router is the box that draws the boundary between towns.
4-3. Why NAT, DHCP, and the checkpoint all live in the router
If you’ve been following the series, you have already met this box several times. The translation desk (the NAT article), the address-lending building manager (the DHCP article), the checkpoint (the firewall article) ── at home, every one of them lived inside the router.
Why do they all crowd into the exit? The logic is simple: it’s the one place every package entering or leaving town must pass through. The translation desk rewrites addresses on packages crossing the boundary; the checkpoint inspects what crosses it ── neither job can be done anywhere except the chokepoint everyone funnels through. The building manager (DHCP) doesn’t strictly need to be at the exit, but since a town only needs one of him, bundling him into the one box every town is guaranteed to have ── the router ── became the standard practice.
| Switch | Router | |
|---|---|---|
| Address it reads | Nameplate (MAC address) | Mailing address (IP address) |
| Job | Hand packages only to the in-town recipient (learning & sorting) | Send out-of-town mail toward the next town (routing) |
| Network boundary | Doesn’t create one ── makes the town bigger | Creates one ── the town changes here |
| Town announcements (broadcasts) | Lets them through | Stops them |
| Roommates it tends to house | ─ | NAT, DHCP, firewall |
| Earlier in the series | slow-network §3 | NAT / DHCP / FW |
5. What Your Home “Wi-Fi Router” Really Is ── An All-in-One Combo Box
5-1. Every character in the series, in one box
“Hold on. I don’t own a switch, and my PC and printer connect just fine” ── good catch. Here’s the reveal: a home “Wi-Fi router” is not a single-purpose router. It is a combo box.
| Role inside the box | Name in our metaphor | Job |
|---|---|---|
| Router section | Town exit | Reads mailing addresses (IP) and picks routes |
| Switch section | Sorting clerk | The row of LAN ports on the back; sorts in-town packages |
| Wireless AP section | Wireless wall jack | Connects devices into the town over Wi-Fi radio |
| DHCP | Building manager | Lends in-town devices an address on a fixed-term lease |
| NAT | Translation desk | Lets the whole town share one global IP |
| Firewall | Checkpoint | Inspects packages crossing the boundary |
Those LAN ports on the back? They are a small built-in switch. So you do own a switch ── it just shares a case with the router, which is why you never saw it. The building manager, the translation desk, the checkpoint from earlier articles: all of them are tenants of this one box.
5-2. The practical takeaway ── out of ports? Buy a switch
Everything so far answers the question from the introduction. “I’m out of LAN ports ── should I just buy another router?” ── No. What you should add is a switch.
Adding a switch means adding another sorting clerk: the town stays one town, and only the number of wall jacks grows. The address scheme stays put, and your devices keep seeing each other exactly as before.
5-3. What happens if you chain two routers ── double NAT
Do the opposite ── buy a router for its ports and daisy-chain it ── and the logic of §4 bites back, hard. A router is a box that draws town boundaries, so now there are two towns inside your house. Worse, the translation desk (NAT) is on duty at each router, so addresses get rewritten twice on the way out: a condition known as double NAT.
The classic double-NAT symptoms are “the printer or NAS ended up in the other town and can’t be found” and “I set up port forwarding like in NAT article §4, but it doesn’t work” (you only wrote it into the ledger of the nearer town). Nothing is broken ── your house just has two town maps where you meant to have one. It is a structural problem, so rebooting fixes nothing.
Most home routers have a mode toggle called bridge mode (or AP mode). What it actually does: put the router section, NAT, and DHCP to sleep, and work as a plain switch + wireless AP. So if you already bought that second router, bridge mode turns it into a “box that doesn’t split the town.” Once you know who does what inside the box, that setting’s name suddenly reads like plain English.
Summary ── The Four-Line Essence
- Device addresses are a two-story affair ── the nameplate (MAC address: yours for life) and the mailing address (IP address: borrowed). The place is found by mailing address; the final handoff happens by nameplate
- A switch is the in-town sorting clerk, running on nameplates. It memorizes senders’ nameplates and hands each package only to its recipient (that learning step is the difference from a hub). But town announcements still reach everyone, and the town never splits
- A router is the town exit, running on mailing addresses. It sends out-of-town mail toward the next town, and the town changes at its doorstep. Being the chokepoint, it houses NAT, DHCP, and the checkpoint
- A home Wi-Fi router is a router + switch + wireless AP + all those roommates, in one box. Out of ports? Add a switch ── daisy-chain a second router and the double-NAT trap is waiting
Two lines of answer-key before we close. What this article called “running on nameplates (MAC)” is known in the trade as L2 (layer 2); “running on mailing addresses (IP)” is L3 (layer 3). The next time you meet “L2 switch” or “L3 routing,” read them as the sorting clerk and the town exit.
The addresses themselves are covered in What is an IP address?, the lending of addresses in What is DHCP?, the rewriting at the exit in What is NAT?, and the congestion that town announcements cause in Why does the office network get slow?. The life of an address (assignment, translation, name lookup) now connects to the boxes that carry it (switch and router) ── and the series map is, for now, complete.
FAQ
Q1. What is the difference between a hub and a switch?
A. Whether it memorizes (§3). A hub is the old device that sprayed every package out of every port without looking at the destination; a switch is the modern one that memorizes senders’ nameplates (MAC addresses) and delivers only to the right port. Almost everything sold under the name “hub” today is internally a switch ── the old name just stuck around.
Q2. I’m out of LAN ports. Should I buy a switch or a router?
A. A switch (§5-2). A switch just adds another sorting clerk: the town (network) stays one town, you get more jacks, and your existing devices keep seeing each other as before. Adding a router adds a town boundary instead ── the recipe for double NAT (§5-3). Remember it as: “want more room, buy a switch; want a separate town, that’s the only time you buy a router.”
Q3. What concretely goes wrong if I chain two routers?
A. Your house ends up with two towns, and addresses get rewritten twice (double NAT, §5-3). Classic symptoms: the printer or NAS in the other town becomes unreachable, and port forwarding stops working. Nothing is broken, so rebooting won’t fix it ── it’s structural. The structurally correct fix is switching the second router into bridge mode (AP mode), which turns it into a box that doesn’t split the town.
Q4. Does a switch have an IP address?
A. Not for forwarding ── a switch sorts entirely by nameplate (MAC address) (§3). That said, some models do carry an IP address as a “management address” so an administrator can reach the settings screen (simpler models carry none at all). Keep them separate in your head: “forwarding runs on MAC; management runs on IP.”
Q5. Any tricks for telling switches and routers apart in a network diagram?
A. Look for who is drawing a town boundary (§4). The box fanning out to lots of devices ── growing the town ── is a switch; the box standing at the seam between networks (another floor, another site, the internet) is a router. Icon styles vary by vendor and team, but the position of the boundary never moves. And if you want practice reading “where the congestion will be” from how the boxes are arranged, Why does the office network get slow? is the field-exercise companion.
Leave a Reply