Subject: What is the differents between Switch and Router?

From: huangjianbo <[email-masked]>
Date: Thu, 15 Mar 2001 09:03:27 +0800

Dear All,

I am working on a paper on router, but one problem blocked my process.  That
is what's the differents between a switch and a router for the view of
theoritical.

As to the 3 Layer switch and router, both of them work as a distributor
based on the IP address.  Just some small differents usage and implemention.

Of coourse, we disscuss this problem on the switch and router on the same
layer.

Thank you for your help!

Rgds,

Truly yours,
Huang Jianbo
[email-masked]

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 16 Mar 2001 16:27:08 +0100

>Of coourse, we disscuss this problem on the switch and router on the same

A router decrements the IP TTL field.

--
Harald Tveit Alvestrand, [email-masked]
+47 41 44 29 94
Personal email: [email-masked]

---

From: Joe Touch <[email-masked]>
Date: Fri, 16 Mar 2001 21:50:52 -0800

> A router decrements the IP TTL field.

It should also not propagate broadcast IP packets (subnet or all 1's).
(Any other hard requirements?)

Joe

---

From: Bora Akyol <[email-masked]>
Date: Fri, 16 Mar 2001 22:09:57 -0800 (PST)

Layer 3 switch = Router (IMHO) esp in today's world. All layer 3 switches
that are routing packets using layer 3 addresses must follow RFC1812 etc.

Layer 2 switch != Router. They commonly do Ethernet stuff.

Bora

---

From: Grenville Armitage <[email-masked]>
Date: Fri, 16 Mar 2001 22:59:55 -0800

[..]
>based on the IP address.  Just some small differents usage and implemention.

Layer 3 "switch" is marketing drivel for "really fast" (typically
hardware) router. If it sinks like a duck....

cheers,
gja
____________________________________________________________________
Grenville Armitage                http://members.home.net/garmitage/

---

From: Randy Bush <[email-masked]>
Date: Sat, 17 Mar 2001 06:55:22 -0800

> It should also not propagate broadcast IP packets (subnet or all 1's).

for a non-attached subnet, what is a broadcast packet?

---

From: Bora Akyol <[email-masked]>
Date: Sat, 17 Mar 2001 07:24:10 -0800 (PST)

Maybe he meant directed broadcast as in 10.10.255.255 ?

Bora

---

From: Randy Bush <[email-masked]>
Date: Sat, 17 Mar 2001 08:26:47 -0800

> Maybe he meant directed broadcast as in 10.10.255.255 ?

i guess i was too suble.  from here, i do not know that 10.10.255.255 is not
a host in subnet 10.0.0.0/10.

randy

---

From: Joe Touch <[email-masked]>
Date: Sat, 17 Mar 2001 09:28:11 -0800

> a host in subnet 10.0.0.0/10.

I meant "subnet directed broadcasts", the rule I was referring to was RFC2644.

I was insufficiently specific:

	1. MUST NOT propagate IP packets whose destination is 
	   broadcast (all 1's). (as in RFC1812) 

	2. MAY NOT propagate IP packets whose destination is 
	   subnet broadcast for one if its attached nets (as in RFC2644)
		MUST be configured NOT to propagate as a default.
		MUST require explicit user intervention to override the default.

	2. MUST NOT propagate packets whose source address is the 
	   subnet broadcast for one of its attached nets. (as in RFC2644)

We're all talking about the same "broadcast filter" rule (set).

Other than refining that rule, are there any other observable differences
between routers and switches?

Joe

---

From: Harald Alvestrand <[email-masked]>
Date: Sat, 17 Mar 2001 22:03:53 +0100

>between routers and switches?

trying to expand on my koan-sized definition.....

In an ideal world, routers would obey all the restrictions and caveats of 
RFC 1812 and RFC 2644.

In the real world, not only is every single rule of the RFCs bent, broken 
or render irrelevant by some device or another, but the breaking is usually 
sold as a feature by some company's sales force.

That's my reason to use the TTL decrement; if someone shows me a device 
where a packet comes in on one interface with a certain TTL, and it comes 
out on another interface with a lower TTL but no other significant changes, 
I call it a router.

If it is incapable of not doing other significant damage, I call it an 
application layer gateway, a NAT box, or something else, but not a router.

If it doesn't decrement the TTL, and doesn't do anything else either to the 
IP portion, I call it a layer 2 switch (or a bridge, if I am feeling 
old-fashioned).

But that is my definition. Your mileage may vary.

---

From: "Shivendra Kumar" <[email-masked]>
Date: Mon, 19 Mar 2001 09:59:41 +0530

Hi all,

  This is how I would look at the difference:

   A switch is a connection-oriented router; and, a router is a connection-less
switch.
   : -) hope it doesn't sound too complicated!

rgds,
shivendra

---

From: Garrett Wollman <[email-masked]>
Date: Mon, 19 Mar 2001 12:12:06 -0500 (EST)

> out on another interface with a lower TTL but no other significant changes, 

Except that I can now show you a ``stealth router'' -- a device which
acts in all respects like a router, except that it does not decrement
the TTL field or generate ICMP Time Exceeded messages.  (Typically
this is done to interpose a packet-filtering router without making it
visible to remote attackers.)

-GAWollman

---

From: [email-masked] (Michael Richardson)
Date: Mon, 19 Mar 2001 13:15:40 -0500

>>>>> "Garrett" == Garrett Wollman <[email-masked]> writes:

    Garrett> Except that I can now show you a ``stealth router'' -- a device which
    Garrett> acts in all respects like a router, except that it does not decrement

  I would describe that as a "layer-3 and 4 aware layer-2 switch".

  In my terminology, anything that is a "layer 3 switch" == router, if it
decrements the TTL. If it doesn't touch the TTL, then it isn't a router. 

] Train travel features AC outlets with no take-off restrictions|gigabit is no[
]   Michael Richardson, Solidum Systems   Oh where, oh where has|problem  with[
]     [email-masked]   www.solidum.com   the little fishy gone?|PAX.port 1100[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [

---

From: Harald Alvestrand <[email-masked]>
Date: Mon, 19 Mar 2001 20:04:45 +0100

>visible to remote attackers.)

then I don't call it a router, but a filtering bridge....I know I'm 
simple-minded :-)
(it would be interesting to hang 2 of these between 2 ethernets, 
misconfigure them to think that the external gateway is on the other net, 
and see how many packets they can forward per second....department of 
perverse joys :-)