Routers vs Switches vs Hubs - What Each One Actually Does

They all move data. They do it very differently. Here’s what matters.

Walk into any server room, and you’ll see racks of blinking boxes. Some are routers, some are switches, and if it’s old enough, maybe a hub. They all move data, but in completely different ways. And in 2026, these same concepts live in the cloud, virtual switches, software-defined routers, and SD-WAN. The fundamentals haven’t changed.

Hubs - the dumbest device

A hub blasts data to every port. Every device receives everything. Wastes bandwidth, and from a security perspective, anyone can passively capture all traffic. Obsolete in modern networks but still on certification exams.

Switches - the smart version

A switch tracks which device is on which port via a MAC address table and sends data only to the correct destination. Layer 2, with Layer 3 switches, also routes by IP. Managed switches add VLANs, port security, and monitoring. Virtual switches (vSwitch, Open vSwitch) handle the same job in cloud and data center environments.

Better than hubs, but not bulletproof. MAC flooding, ARP spoofing, and VLAN hopping are real attack vectors.

Routers - the traffic directors

Routers connect different networks using IP addresses and routing tables. They sit at network boundaries and are critical for security; often, the first device traffic passes through them, with firewall functionality, ACLs, and traffic filtering. SD-WAN is the modern evolution: software-defined routing across multiple connection types, centralized policy enforcement, zero-trust access, and encrypted tunnels.

How they work together

Switches connect devices within a network. Routers connect networks. In cloud environments, the same architecture exists in software: virtual switches, route tables, security groups, and internet gateways. Understanding where each sits answers critical security questions: where to monitor, where attackers pivot, and where segmentation boundaries should be.

Bottom line

Hub: all ports, no intelligence, obsolete. Switch: correct port only, MAC addresses, Layer 2, standard everywhere. Router: connects networks, IP addresses, routing tables, and network boundaries. These form the backbone of physical and virtual infrastructure. Next up: firewalls.