Hub, Switch, Router and ISP

By the end of this lesson you will be able to

• Name what a hub, a switch, a router, an access point and a modem/ONT each do, and which network layer each one works at.
• Explain step by step how a switch learns MAC addresses into its CAM table, and when it floods, forwards or filters a frame.
• Tell broadcast from unicast, and collision domains from broadcast domains, and say how VLANs and STP fit in.
• Follow a packet from your laptop through the default gateway, the routing table and each hop, and explain what changes and what does not.
• Recognise the many devices inside a home “router” box, and diagnose “connected, no internet”.
• Explain how Wi-Fi stations share one channel with CSMA/CA (backoff, ACKs, the hidden-node problem and RTS/CTS), and why it differs from CSMA/CD.
• Describe how an ISP connects you to the world: tiers, internet exchanges like BDIX, international gateways and submarine cables.
• Explain how a data centre is wired (north–south vs east–west traffic, leaf–spine with ECMP, oversubscription) and use same-zone, cross-zone and cross-region latency and transfer cost as design inputs.

#From your laptop to the internet

Building a local network (a LAN) and connecting it to the global network (the WAN, the internet) takes a few kinds of hardware and a service provider, each doing one job:

  [Device A] ──┐
               ├──► [Switch] ──► [Router] ──► [ISP network] ──► [Global internet]
  [Device B] ──┘

• The switch connects devices inside one network.
• The router connects that network to other networks.
• The ISP connects your router to the rest of the internet.

Each device is defined by how much of a message it understands. That maps neatly onto the network layers you met earlier:

#Hub: the “dumb” repeater (Layer 1)

A hub is the simplest networking device. When a signal arrives on one port, the hub cannot check who it is for. It has no idea what an address is. It simply regenerates the signal and sends it blindly out of every other port.

That causes three problems:

• Unnecessary traffic. Every device receives every frame and has to look at it, even though only one was meant to. All devices share the hub’s bandwidth (for example 100 Mbps for everyone together).
• Collisions. All devices share one medium, so only one can transmit at a time (half duplex). If two transmit together, the signals collide and both are lost. Old Ethernet handled this with CSMA/CD: listen first, detect the collision, wait a random time, retry. The more devices, the more collisions.
• Security risk. Any device can capture everyone else’s traffic simply by keeping the frames that reach it.

Hubs are obsolete: you will not find them in a modern network. They are worth knowing because they explain why switches exist, and because Wi-Fi radio behaves a lot like a hub: everyone near an access point shares the same channel and takes turns.

#Switch: the device that learns (Layer 2)

A switch is a smart device. It reads the MAC address in every frame, learns which device is connected to which port, and sends each frame only towards its destination (unicast).

#MAC addresses

A MAC (Media Access Control) address is the unique physical address of a network interface, burned into its network card (NIC): 48 bits written as six pairs of hex digits, like 3c:22:fb:1a:9e:07. The first half identifies the manufacturer. MAC addresses matter only on the local link; they never travel across the internet. (Modern phones show a random MAC to each Wi-Fi network for privacy.)

Textbooks split the data link layer into two sub-layers. The upper one, LLC (Logical Link Control), tells the receiver which network-layer protocol the payload belongs to (IPv4, IPv6, ARP…). The lower one, MAC (Media Access Control), handles addressing and decides when a device may put a frame on the medium. That second job is what CSMA/CD and CSMA/CA, later in this lesson, are about.

#How the switch learns

The switch keeps a table of MAC address → port, called the CAM table (Content Addressable Memory, the fast hardware that stores it) or MAC address table. For every frame that arrives, it does two things:

1. Learn from the source. “The sender’s MAC lives on the port this frame came in on.” Add or refresh that entry.
2. Forward by the destination.
   • Destination in the table → send it out of that one port (forward). If that is the port it came from, drop it (filter).
   • Destination unknown → send it out of every port except the incoming one (flood, “unknown unicast flooding”).
   • Destination is the broadcast address ff:ff:ff:ff:ff:ff → always flood.

Play the scenarios and watch the table fill up:

A few details that matter in practice:

• Broadcast vs unicast. Unicast is for one device; broadcast (ff:ff:ff:ff:ff:ff) is for every device on the LAN. ARP (“who has 192.168.1.30?”) and DHCP discovery use broadcasts. A switch does not stop broadcasts; it forwards them everywhere.
• Aging. Entries expire if a device stays silent for a while (300 seconds by default on many switches), and entries on a port are deleted the moment its cable is unplugged. This keeps the table correct when devices move.
• Full duplex, no collisions. Each switch port is a private link that sends and receives at the same time. Many pairs of devices can talk at full speed simultaneously.
• Unmanaged vs managed. A cheap home switch just works. A managed switch adds VLANs, port security, traffic statistics and STP settings.
• Limits. The CAM table has a fixed size. An attacker who floods it with fake MACs makes the switch flood everything like a hub. Port security limits how many MACs each port may use.

#Loops and the Spanning Tree Protocol

Engineers add spare cables between switches so that one broken cable does not cut anyone off. But two paths between switches form a loop, and Ethernet frames have no TTL: a broadcast would circle forever, multiplying at every switch, until the whole network freezes. This is a broadcast storm.

The Spanning Tree Protocol (STP) prevents it. Switches elect a root bridge, compute a loop-free tree, and block the redundant ports. If an active link fails, a blocked port is unblocked to take over.

#Collision domains, broadcast domains and VLANs

Two terms that come up in every networking interview:

• A collision domain is a set of devices whose transmissions can collide. A hub puts all its ports in one collision domain; every switch port and router port is a separate one.
• A broadcast domain is a set of devices that receive each other’s broadcasts. A switch keeps all its ports in one broadcast domain; a router ends a broadcast domain at each of its interfaces.

A VLAN (Virtual LAN) splits one physical switch into several logical ones, each its own broadcast domain. An office might put Accounts on VLAN 10, HR on VLAN 20 and IT on VLAN 30, or staff, guests and security cameras on separate VLANs, all on the same switches. A switch floods unknown and broadcast frames only within the frame’s own VLAN. Traffic between VLANs must go through a router (or a layer-3 switch), where rules can allow or block it.

#When layer 2 goes wrong

Most layer-2 faults show up as “slow” or “some devices cannot see each other”, not as a clean error. The usual suspects:

Tools: ipconfig /all and getmac (Windows) or ip link (Linux) for your own MAC and link state, arp -a for neighbours, the switch’s MAC address table and VLAN commands, and Wireshark to see the actual frames.

#Router: connecting different networks (Layer 3)

A router’s main job is to connect two or more completely different networks, such as your home LAN and your ISP’s network. It works with IP addresses and its own routing table to decide where each packet should go next.

#What a router does with every packet

1. Receive the frame on one interface and strip off the Ethernet header.
2. Read the destination IP and look it up in the routing table. If several entries match, the most specific one (longest prefix) wins; 0.0.0.0/0, the default route, matches everything else.
3. Decrease the TTL by one; if it reaches zero, drop the packet and send back an ICMP “time exceeded”. This is what stops routing loops from lasting forever.
4. Build a new frame for the next link, with new source and destination MAC addresses, and send it out of the chosen interface.

The IP addresses stay the same from end to end (except where NAT rewrites them on a home router); the MAC addresses change at every hop.

From your laptop’s side, the rule is simple: if the destination is in my own network, deliver it directly (through the switch); otherwise, send it to my default gateway, which is the router.

Routers come in very different sizes: a home router knows two routes (the LAN and “everything else via the ISP”); an ISP’s core routers hold the full internet routing table, close to a million routes, learned from neighbouring networks with BGP. Inside companies, routers also connect internal networks and VLANs. A layer-3 switch is a switch that can also route between VLANs in hardware at full speed; data centres use them everywhere.

#Access points, modems and ONTs

Three more boxes complete the picture:

• Wireless access point: a Layer 2 bridge between radio and Ethernet. (A bridge is the switch’s ancestor: a device that joins two LAN segments and forwards frames between them by MAC address.) It connects Wi-Fi devices to the wired LAN as if they were plugged into a switch. All devices on one Wi-Fi channel share the air and take turns, so Wi-Fi is effectively half duplex. Large buildings use many access points with the same network name (SSID) so you can roam between them.
• Modem: converts your router’s digital signal into whatever the ISP’s line carries (a telephone line, a cable-television line, or a 4G radio signal) and back. The name comes from modulator–demodulator.
• ONT (Optical Network Terminal): the modem of a fibre connection. It turns electrical signals into light on the fibre to the ISP. Most home broadband in Bangladesh cities is now fibre to the home, so the small box with a fibre cable going into it is an ONT.

#How Wi-Fi shares the air: CSMA/CA

Every device on one Wi-Fi channel shares the same air, just as every device on a hub shared one wire. Old Ethernet solved this with CSMA/CD (detect the collision, then retry). Wi-Fi cannot, for two reasons:

• A radio cannot listen while it transmits. Its own signal is millions of times stronger than anything arriving at its antenna, so it would never hear a collision.
• Not every station hears every other. Two laptops can both reach the access point but not each other.

So Wi-Fi uses CSMA/CA (Collision Avoidance): try hard not to collide, and treat a missing acknowledgement as “it probably collided”.

1. Listen first (carrier sense). If the channel is busy, wait until it is quiet, then wait a fixed gap called DIFS.
2. Random backoff. Count down a random number of short slots (9 µs each), picked from the contention window, at first 0–15. If someone else starts sending meanwhile, freeze the counter and continue later. This spreads out stations that were all waiting for the same quiet moment.
3. Send when the counter reaches zero.
4. Get an ACK. The receiver checks the frame and replies with an ACK after a shorter gap, SIFS, so nobody can squeeze in between.
5. No ACK? Back off harder. Assume a collision, double the contention window (0–31, 0–63… up to a limit) and retry. After about 7 tries, give up and let the higher layers (TCP) deal with the loss.

The hidden-node problem breaks step 1: if laptop A and phone C are on opposite sides of the access point with a wall between them, each hears silence while the other is transmitting, and their frames keep colliding at the access point. The fix is RTS/CTS: before a large frame, A sends a tiny Request to Send with the time it needs; the access point answers Clear to Send, which every station in its range hears, C included. C sets its NAV timer (a “virtual carrier sense”) and stays quiet for that time. Because RTS/CTS adds two frames to every exchange, it is used only for large frames or when collisions are frequent.

This explains everyday Wi-Fi behaviour. The speed your phone shows is the radio rate; real throughput is often only about half of it after gaps, backoff and ACKs. Every extra busy device on the channel costs everyone airtime, and one slow, far-away device uses a lot of airtime for little data. That is why busy offices use many access points on different channels, and why the 5 GHz and 6 GHz bands, with more channels, feel faster. Wi-Fi 6 (802.11ax) also lets the access point schedule several stations at once instead of letting them all contend.

#The home “router” is many devices in one box

The box most people call “the router” is actually several devices in one plastic case:

• a router (LAN ↔ WAN, the default gateway),
• a small switch (the 4 yellow LAN ports),
• a Wi-Fi access point (the antennas),
• a DHCP server (hands out 192.168.x.x addresses),
• NAT (shares one public IP among all your devices),
• a stateful firewall (blocks connections nobody inside asked for),
• often a DNS forwarder, and sometimes the modem or ONT too.

#ISP: your connection to the world

An ISP (Internet Service Provider) is the company or organisation, such as Grameenphone, Link3 or AmberIT, that connects you to the global internet through a large infrastructure of optical fibre and, further out, submarine cables. It gives your router an IP address, routes your traffic and connects its network to other networks.

#How the internet is stitched together

No single company owns the internet. It is tens of thousands of networks (each called an autonomous system) that agree to carry each other’s traffic:

• Tier 1 networks are the largest global carriers. They reach every destination by peering with each other, without paying for transit.
• Tier 2 networks buy transit from Tier 1s and also peer with others.
• Access ISPs (Tier 3), like your home provider, buy transit and sell connections to customers.
• An IXP (Internet Exchange Point) is a place where many networks connect to swap local traffic directly and cheaply. In Bangladesh, BDIX in Dhaka keeps domestic traffic inside the country; that is why “BDIX sites” are fast on most local ISPs.
• In Bangladesh, traffic to and from other countries must pass through a licensed IIG (International Internet Gateway), regulated by BTRC. From there it leaves over submarine cables: SEA-ME-WE 4 (landing at Cox’s Bazar) and SEA-ME-WE 5 (landing at Kuakata), with SEA-ME-WE 6 being added, plus land cables through India.
• Big content companies place cache servers inside ISPs (Google Global Cache, Facebook’s caches), so popular videos never cross the sea at all.

#Hub vs switch vs router at a glance

#Inside a data centre and between regions

Your home network has one switch and one router. A data centre has tens of thousands of servers, and the way they are wired decides how fast your services can talk to each other.

#North–south and east–west traffic

• North–south traffic flows between users (the internet) and the data centre: a request comes in, a response goes out.
• East–west traffic flows between servers inside the data centre: the web server calling the database, a service calling five other services, caches, replication, backups, analytics jobs. One user request often triggers dozens of internal calls, so in a modern data centre east–west traffic is the large majority.

Older data centres used a three-tier tree (access, aggregation and core switches) built for north–south traffic. Server-to-server traffic had to climb up the tree and down again, STP blocked the redundant links, and the core became a bottleneck.

#Leaf–spine (a Clos fabric)

Modern data centres use leaf–spine, a design based on Charles Clos’s 1950s telephone-switch networks:

• Every rack has a top-of-rack (ToR) switch, called a leaf. The rack’s servers connect to it.
• Every leaf connects to every spine switch. Spines connect only to leaves, never to each other or to servers.
• A border leaf connects the fabric to the internet routers, firewalls and other sites: that is where north–south traffic enters.

So any server reaches a server in another rack the same way: leaf → spine → leaf. The hop count is identical for every pair, which keeps latency low and predictable (tens of microseconds inside the fabric). The links are routed (layer 3, often with BGP), not switched with STP, and ECMP (equal-cost multipath) uses all of them at once: the leaf hashes each flow’s addresses and ports to pick one of the equal spines, so a flow stays on one path (no reordering) while thousands of flows spread across all spines. Need more bandwidth? Add spines. More racks? Add leaves. If a spine fails, the leaves drop it from the ECMP set within about a second; capacity falls by that spine’s share, but nobody is cut off.

Oversubscription is the ratio of a leaf’s server-facing bandwidth to its uplink bandwidth. With 48 servers × 25 Gbps = 1,200 Gbps down and 4 × 100 Gbps = 400 Gbps up, the ratio is 3 : 1. That is a normal, cost-saving choice, because servers rarely all send off-rack at full speed at once. When they do (a big batch job, rebuilding a failed storage node), the uplinks congest, queues fill and packets drop, and every small request in that rack slows down. Storage, AI-training and HPC clusters are often built 1 : 1 (non-blocking) for this reason.

#Zones and regions: distance is latency, and latency has a price

Cloud providers group data centres into availability zones (AZs): separate buildings with their own power and network, a few to tens of kilometres apart, linked by fast private fibre. Several zones make a region (for example Singapore or Mumbai); regions are hundreds or thousands of kilometres apart. Each boundary you cross costs more:

Prices change and differ between providers and regions, so treat these as orders of magnitude and check the current price list.

These numbers are design inputs:

• Spread for availability, keep hot paths close. Run copies of each service in two or three zones so a building failure is survivable, but let each copy talk to the cache and replicas in its own zone when it can.
• Count round trips, not just milliseconds. A request that makes 40 sequential calls across zones pays 40 × 1.5 ms = 60 ms; across regions it pays seconds. Batch calls and avoid chatty designs across boundaries.
• Synchronous copies only nearby. Waiting for a standby in another zone costs ~1–2 ms per write and is common; waiting for another region costs tens of milliseconds, so cross-region replication is usually asynchronous (and can lose the last seconds of writes in a disaster).
• Gigabytes are money. 50 TB a month between zones is about $1,000 a month; serving 50 TB to the internet costs several thousand. Compress, cache, serve static files from a CDN, and keep bulk data flows inside one zone where you can.

#Where these devices show up in system design

• Data centres are built from switches arranged as a leaf–spine fabric (above): top-of-rack leaves, spines that connect every rack to every other with equal, short paths, and routing with ECMP instead of STP so every redundant link carries traffic.
• Load balancers, firewalls and proxies are devices (or software) that work higher up, at Layers 4–7, which later lessons cover.
• In the cloud, you never touch a switch, but the same ideas appear as software: a VPC is your private network, subnets are like VLANs, and each subnet has a routing table with a default route to an internet gateway or a NAT gateway.
• Failure thinking is the same at every scale: a single switch, router, ISP link or cable is a single point of failure. Production networks use two of everything: dual switches, two routers, two ISPs, and cables that take different physical paths.

#Try it yourself

# Your IP, MAC ("Physical Address"), default gateway and DNS server
ipconfig /all          # Windows
ip addr; ip route      # Linux
ifconfig; netstat -rn  # macOS

# Your own MAC addresses and link state
getmac /v              # Windows
ip link                # Linux

# Your Wi-Fi link: signal, channel, radio rate
netsh wlan show interfaces   # Windows
iw dev wlan0 link            # Linux (interface name may differ)

# The ARP cache: IP → MAC of devices you talked to on your LAN
arp -a                 # Windows / macOS
ip neigh               # Linux

# Your routing table: look for the 0.0.0.0 (default) route
route print            # Windows
ip route               # Linux

# Walk outwards when the internet is broken
ping 192.168.1.1       # the router (use your gateway address)
ping 1.1.1.1           # beyond the ISP, no DNS needed
tracert google.com     # Windows (traceroute on macOS / Linux): every router hop

Run arp -a before and after pinging another device on your LAN: a new entry appears, learned by an ARP broadcast. In tracert, the first hop is your home router and the next few belong to your ISP. Compare the Wi-Fi “receive rate” from netsh wlan show interfaces with a real speed test: the gap is the price of sharing the air.

#Summary

Key takeaways

• A hub (Layer 1) repeats every signal to every port: wasted bandwidth, collisions, no privacy. It is obsolete.
• A switch (Layer 2) learns MAC → port from source addresses into its CAM table, and forwards by destination: unicast if known, flood if unknown or broadcast. Entries age out; each port is full duplex and its own collision domain.
• Loops between switches cause broadcast storms because frames have no TTL; STP blocks redundant ports and unblocks them on failure. VLANs split a switch into separate broadcast domains.
• A router (Layer 3) connects different networks using its routing table (most specific match, default route), lowers the TTL, and rewrites MAC addresses at every hop while IP addresses stay the same (except NAT).
• A home “router” is a router + switch + access point + DHCP + NAT + firewall (+ DNS forwarder, + modem/ONT) in one box.
• Wi-Fi shares one channel with CSMA/CA: listen, wait a gap and a random backoff, send, expect an ACK; no ACK means double the window and retry. RTS/CTS solves the hidden-node problem. CSMA/CD only mattered on hubs.
• An ISP connects you to the internet. Networks interconnect through transit, peering and IXPs like BDIX; Bangladesh’s international traffic leaves via IIGs and submarine cables (SEA-ME-WE 4/5) with land backups.
• Data centres carry mostly east–west traffic over a leaf–spine fabric: every rack is leaf → spine → leaf from every other, ECMP uses all links, a spine failure only costs capacity, and oversubscription (often 3 : 1) congests under bulk traffic.
• Latency grows from ~0.1–0.5 ms in a zone to ~1–2 ms across zones to tens–hundreds of ms across regions, and cross-zone, cross-region and internet transfer is billed per GB: both are design inputs.

Self-check: network devices, Wi-Fi and data-centre networks31 questions