Switch vs router
“What is the difference between a switch and a router? What does each one look at, and what does each one change in the packet?”
What this tests
- Layer 2 vs layer 3 forwarding
- How each device learns where to send things
- What a broadcast domain is and where it ends
Answers by level
Read the beginner answer first and notice what is missing.
A switch forwards Ethernet frames by destination MAC address within one network segment. It learns by watching: every frame’s source MAC is recorded against the port it arrived on, building a MAC table. A frame to a known MAC goes out one port; to an unknown MAC, or to the broadcast address, it is flooded out every port. The switch never modifies the frame and does not look at IP. Everything connected to the same switch (or VLAN) is one broadcast domain: an ARP request reaches all of it.
A router forwards IP packets between networks by destination IP address, using a routing table and longest-prefix match to choose a next hop and an outgoing interface. It strips the incoming Ethernet header, decrements the TTL/hop limit, and writes a new Ethernet header addressed to the next hop’s MAC (resolved by ARP or Neighbor Discovery). Broadcasts stop at the router — that is what makes it a boundary between networks.
The practical consequence: hosts on the same subnet talk directly through switches (fast, no IP-level device involved); hosts on different subnets must go through a router, which is why the default gateway matters and why "same subnet but unreachable" points at layer 2 (ARP, VLANs, MAC tables) while "different subnet unreachable" points at routes and firewalls.
Green flags · Red flags
- Says MAC vs IP, learning vs routing table, flood vs drop for unknown destinations
- Explains that the router rewrites the Ethernet header and decrements TTL
- Uses "broadcast domain" correctly and says broadcasts stop at routers
- Connects it to diagnosis: same subnet → L2 problem, different subnet → routing/firewall
- Says "a router is a smarter switch" with no layer distinction
- Thinks a switch reads IP addresses, or a router reads only MACs
- Cannot explain how a switch knows which port to use
- Believes MAC addresses are used across the internet
Follow-up questions
Scenario
ping to the gateway works from both. Which device’s tables do you check first, and with what command?