How a network is built: hosts, switches, routers and the layers between them

Two laptops on a desk, joined by one cable, are already a network. Everything after that — the switch in the cupboard, the router with the blinking lights, the fibre running under a road, the layer models drawn on every whiteboard — exists to answer one question at larger and larger scale: given these bytes and a name for where they should end up, which wire do I push them down next? This article builds the answer from one cable up, and hands over the words the other fifteen articles use without stopping to explain.

The map

Read this first when short on time. Every branch is a section below.

The smallest network: two hosts and a wire

A network is a set of hosts joined by links, plus enough agreement about naming and forwarding that any host can reach any other. Start with two.

Each host has a network interface: a chip with a socket on the back of the machine. Plug a cable between two of them and you have a link. The interface has two identities, and confusing them is the single most common beginner mistake in networking.

• A MAC address — 48 bits, written as six hex pairs like a4:2b:8c:11:22:33 — burned into the interface by its manufacturer. It identifies the interface on this link. Nobody outside the local network ever sees it or cares.
• An IP address — 192.168.1.10 — assigned by configuration or by DHCP. It identifies the host everywhere, and it is the only one of the two that travels across the internet unchanged.

The useful mental model: the MAC address is the name shouted across a room; the IP address is the postal address on an envelope. Shouting works only in the room you are standing in. The envelope works anywhere, but somebody in each room has to shout the last few metres.

One more identity sits above both. A host runs many programs at once, so the arriving bytes need a third label to say which one wants them: a port number. Web servers listen on 80 and 443, SSH on 22, DNS on 53. An IP address plus a port plus a protocol is a socket, and that triple is what a conversation is actually addressed to.

Host

Any device with an IP address that sends or receives its own traffic: laptop, phone, server, printer, camera. Routers and switches are hosts too when you manage them.

Interface

One network attachment point on a host or device. A laptop typically has two (Wi-Fi and Ethernet); a switch has 24 or 48.

MAC address

A 48-bit link-layer address. The first 24 bits are the manufacturer's OUI, so 00:1b:44 tells you who made the card.

Socket

The combination of protocol, IP address and port that one end of a conversation is bound to.

Layers: why nobody designed this as one program

A layer model splits "move these bytes to that machine" into jobs that can be solved independently, so that changing one of them does not force a rewrite of the rest. That is the whole idea, and it is worth holding on to, because both models below are taught as lists to memorise when they are really a design argument.

The argument goes like this. Moving electricity down a copper pair is a completely different problem from finding a path across the planet, which is a completely different problem from recovering a lost chunk of a file. Solve each one separately, define what each hands to the next, and you can swap Wi-Fi in for copper without touching the web browser, or swap HTTP for SSH without touching the router.

The two models

OSI has seven layers and is the vocabulary everyone speaks. TCP/IP has four and is what the software actually implements. They are not rivals; OSI is the ruler, TCP/IP is the thing being measured.

Two habits make the models useful rather than decorative. First, when something breaks, name the layer before naming the fix — "the link is up but the IP does not answer" is layer 1 and 2 fine, layer 3 suspect, and that alone cuts the search in half. Second, remember that devices are named by the highest layer they read: a layer 2 switch, a layer 3 switch, a layer 7 load balancer.

Encapsulation: the envelopes

Layering shows up on the wire as nesting. Each layer takes what it was handed, prepends its own header, and passes the result down as opaque payload. The receiving host unwraps in the opposite order.

PDU

Protocol data unit: the name for a layer's unit of data. Frame at layer 2, packet at layer 3, segment at layer 4. Exam questions lean on these names.

Encapsulation

Adding a header (and sometimes a trailer) as data moves down the stack. De-encapsulation is stripping them on the way up.

MTU

Maximum transmission unit: the largest payload one link will carry, 1500 bytes on standard Ethernet. Anything larger must be fragmented or rejected.

What each box actually reads

Every network device does the same thing — take a frame in one port, decide, send it out another — and they differ only in how deep they read before deciding. That one sentence explains almost every difference between them.

flowchart LR
  F["Frame arrives"] --> H{"Device?"}
  H -->|Hub| A["Reads nothing<br/>copies bits to<br/>every other port"]
  H -->|Switch| B["Reads destination MAC<br/>sends out the one port<br/>that owns it"]
  H -->|Router| C["Reads destination IP<br/>picks a next hop,<br/>rebuilds the frame"]
  H -->|Firewall| D["Reads IP and ports<br/>permits or drops,<br/>then forwards"]

Hub: history worth knowing

A hub is an electrical repeater. Bits in on one port, bits out on all others, no memory and no decisions. Every host therefore hears every frame, and if two hosts transmit at once the signals collide and both must back off and retry. All ports form one collision domain. Hubs have not been sold for twenty years, but the term collision domain survives, and half-duplex behaviour still shows up when autonegotiation goes wrong.

Switch: the workhorse

A switch reads the destination MAC address of each frame and forwards it out exactly one port, using a table it builds by watching source addresses. Because each port is its own collision domain and each link is full duplex, two hosts can transmit simultaneously without interfering. A switch does not stop broadcasts: a frame addressed to ff:ff:ff:ff:ff:ff goes out every port, so a switched network is one broadcast domain — until you cut it up with VLANs. Article 5 takes the switch apart properly.

Router: where networks meet

A router reads the destination IP address, looks it up in a routing table, and sends the packet to the next hop — building a brand new layer 2 frame for the outgoing link, with new source and destination MAC addresses. The IP addresses stay the same end to end; the MAC addresses change at every hop. Routers do not forward broadcasts, so every router interface is a boundary between broadcast domains. That single property is why routers exist as much as pathfinding is.

Collision domain

The set of interfaces whose transmissions can collide with each other. One per switch port on a modern network, so collisions should be zero.

Broadcast domain

The set of interfaces that receive a broadcast sent by any of them. Bounded by routers, and cut up by VLANs.

Flooding

A switch sending a frame out every port except the one it arrived on, because it does not yet know where the destination lives.

Cables, ports and the speeds printed on them

The physical layer is the least glamorous part of networking and the source of a surprising share of real faults, because it is the only layer where a human being with a pair of pliers is in the loop.

Copper: twisted pair

An Ethernet copper cable holds four pairs of wires, each pair twisted along its length. The twist is not decoration: two wires carrying opposite copies of the same signal pick up identical interference, and the receiver subtracts one from the other, cancelling the noise. Tighter twists cancel better, which is the physical difference between the categories.

The 100 metre limit is not a suggestion. It is the distance within which the electrical signal is still distinguishable from noise and within which collision detection could work in the original design. Beyond it, links come up and then behave erratically, which is far more annoying than a link that simply stays down.

Fibre: light instead of electricity

Fibre carries pulses of light down a glass core, so it does not care about electrical noise, cannot conduct a lightning strike between buildings, and goes much further. Two kinds matter:

• Multimode — a thicker core, cheap transceivers, light bouncing along several paths. Good to a few hundred metres. Orange or aqua jackets. Used inside buildings and between racks.
• Single mode — a hair-thin core, one straight path, more expensive optics. Kilometres to tens of kilometres. Yellow jacket. Used between buildings, to the ISP, and across cities.

On a switch, fibre plugs into an SFP slot rather than a fixed socket: a small removable transceiver that turns electrical signals into light. Buying the right SFP for the right fibre and the right distance is its own small art, and mismatches are common enough that show interfaces status is worth running before blaming anything else.

Straight-through, crossover, and why nobody asks any more

Ethernet over copper transmits on one pair and receives on another. A PC and a switch use opposite pairs, so a plain straight-through cable works. Two devices of the same kind — switch to switch, PC to PC — would both transmit on the same pair, so they historically needed a crossover cable with the pairs swapped. Then auto-MDIX arrived: interfaces detect the mismatch and swap internally. On any switch made this century, either cable works, and the topic survives mainly because exams still ask.

Duplex and speed: the mismatch that hides

Two interfaces on a link must agree on speed and duplex. Autonegotiation does this by exchanging capabilities and picking the best both support. Trouble starts when one side is hardcoded and the other is not: the automatic side cannot hear a negotiation, falls back to half duplex, and you get a link that is up, passes small packets, and collapses under load with late collisions and rising error counters. The symptom looks like a bad application; the cause is one line of configuration. Either hardcode both ends or neither.

Autonegotiation

The exchange in which two interfaces advertise their supported speeds and duplex modes and settle on the best shared option.

Late collision

A collision detected after the first 64 bytes of a frame have been sent. On a correctly built link this cannot happen, so it is a reliable fingerprint of a duplex mismatch or an over-long cable.

SFP

Small form-factor pluggable: a hot-swappable transceiver module that lets one switch port take copper, multimode fibre or single mode fibre depending on what you plug into it.

Topologies and the words people draw with

A topology is the shape of the links, and the shapes have names because each one trades cost against resilience differently.

Star is what every office actually is: every host has one cable to a central switch. Cheap, easy to reason about, and the switch is a single point of failure. Mesh gives every device a link to every other — resilient, and impossibly expensive past a handful of nodes, so it appears only between core devices as a partial mesh. Ring passes traffic around a loop and survives one break; it lost the office but survives in metro fibre. Bus, one shared cable with every host tapped onto it, is dead and worth knowing only because it is where collision domains came from.

The campus layers

Scale a star up and it becomes a hierarchy with three named tiers, each with one job.

flowchart TD
  C1["Core<br/>fast, dumb, always up"] --- D1["Distribution<br/>routing, policy, ACLs"]
  C1 --- D2["Distribution<br/>second building"]
  D1 --- A1["Access<br/>desks, phones, APs"]
  D1 --- A2["Access<br/>floor 2"]
  D2 --- A3["Access<br/>floor 3"]

In a small site the distribution and core tiers are the same pair of switches, which is called a collapsed core. In a data centre the hierarchy is replaced by spine and leaf: every leaf switch connects to every spine switch and to nothing else, so any server is exactly two hops from any other. That design exists because data centre traffic mostly runs sideways between servers, whereas campus traffic mostly runs up towards the internet.

Scope words

The distinction that matters in practice is ownership, not distance: on a LAN you control both ends of every cable and bandwidth is effectively free, while on a WAN you rent capacity, pay per megabit, and design around the assumption that it will be slower and less reliable than you would like.

One small office, end to end

Put every piece together in the smallest network that has all of them: two laptops, a printer, one switch, one router, one ISP link.

1. The laptop is configured (by DHCP) with address 192.168.1.10, mask 255.255.255.0, gateway 192.168.1.1, and a DNS server. The mask tells it that 192.168.1.0 to 192.168.1.255 is local and everything else is not.
2. A browser asks for example.com. DNS returns 93.184.216.34. Not local, so the packet must go to the gateway.
3. The laptop knows the gateway's IP but not its MAC, so it broadcasts an ARP request: "who has 192.168.1.1?" The switch floods it, the router answers, and the laptop caches the reply.
4. The laptop builds a frame: destination MAC = the router, destination IP = the server. It hands it to the switch, which reads the MAC, finds the router's port in its table, and forwards it out that one port.
5. The router strips the frame, reads the destination IP, finds no specific match and uses its default route pointing at the ISP. It rewrites the source address to the office's single public address (NAT), builds a new frame for the ISP link, decrements the TTL and sends it.
6. Somewhere between 10 and 20 routers later, the packet reaches the server. The reply comes back, the router reverses the NAT translation, the switch delivers the frame, and the browser's socket on port 51288 receives the bytes.

Nothing in that walkthrough is specific to this office. Change the numbers and it describes every request you have ever made. The rest of this series takes each step and asks how it works when there are hundreds of hosts, several buildings, dozens of subnets and someone actively trying to break in.

Recap