Routers vs. Switches vs. Hubs — What Each One Actually Does

Walk into any office server room, and you'll see a rack full of blinking boxes with cables running everywhere. Some of those boxes are routers, some are switches, and if the office is old enough, maybe a hub or two gathering dust. They all move data, but they do so in very different ways. Understanding the difference between them is something you'll need to have locked down early.

Hubs — the dumbest device on the network

I'm not being mean. A hub is genuinely unintelligent. It's a box with multiple Ethernet ports. When a device sends data to the hub, the hub broadcasts it to every port. Every device connected to it receives the data, whether it was meant for them or not.

Imagine you're in a room full of people and you want to tell Sarah something. Instead of walking over to Sarah and whispering it to her, you shout it to the entire room. Everyone hears it. Sarah gets the message, but so does everyone else. That's a hub.

This creates two problems. First, it wastes bandwidth. Every device has to process traffic that isn't meant for it. Second, and more importantly from a security perspective, anyone on the network can see everyone else's traffic. An attacker connected to a hub can passively capture everything flowing through it without doing anything clever.

You won't find hubs in modern networks. Switches have almost entirely replaced them. But they still appear on certification exams, and understanding why they were replaced helps you know why switches matter.

Switches — the smart version

A switch looks similar to a hub — a box with a bunch of Ethernet ports. But it operates entirely differently. A switch keeps track of which device is connected to which port using something called a MAC address table. When data destined for a specific device arrives, the switch sends it only to the port where that device is connected. Nobody else sees it.

Back to our room analogy: a switch is like walking directly to Sarah and handing her a note. Nobody else in the room knows what it says.

Switches operate at Layer 2 of the OSI model (we'll cover that in a future post), which means they use MAC addresses to make forwarding decisions. Some more advanced switches, called Layer 3 switches, can also route traffic using IP addresses, blurring the line between switches and routers.

From a security perspective, switches are better than hubs because traffic isolation makes casual eavesdropping harder. But they're not bulletproof. Attacks like MAC flooding can overwhelm a switch's address table and force it to behave like a hub — sending traffic everywhere. ARP spoofing is another technique attackers use to intercept traffic on a switched network. So "better than a hub" doesn't mean "secure."

Routers — the traffic directors

A router connects different networks. Your home router connects your local home network to your ISP's network, which connects to the broader internet. In a business, routers connect the internal company network to outside networks and can also connect separate internal network segments.

Routers make decisions based on IP addresses. When a packet of data arrives, the router examines the destination IP address and decides where to forward it next. It uses a routing table — basically a map of known networks and the best path to reach each one.

If a switch is like a mail clerk who sorts letters within an office building, a router is like the postal service that figures out how to get a letter from your city to another city entirely.

Routers are critical for security because they sit at the boundary between networks. They're often the first (or last) device traffic passes through when entering or leaving a network. Many routers include basic firewall functionality, access control lists (ACLs), and the ability to filter traffic based on rules you define. If someone's attacking your network from the outside, the router is likely where you'll see it first.

How they work together

In a typical network setup, you'll have switches connecting devices within the same network (like all the computers on one floor of an office) and a router connecting that network to other networks (like the internet or another office location).

A simplified home setup looks like this: your devices (laptop, phone, smart TV) connect to a switch or directly to your router's built-in switch ports. Your router connects to your ISP's modem, which connects to the internet. Most home routers actually combine a router, a switch, a wireless access point, and a basic firewall into one box, which is why people sometimes use the terms interchangeably. In enterprise networks, these are separate, dedicated devices.

Quick comparison

Hub: sends data to all ports. No intelligence. No security benefit. Basically obsolete.

Switch: sends data only to the correct port. Uses MAC addresses. Standard in modern networks.

Router: connects different networks. Uses IP addresses. Makes forwarding decisions based on routing tables.

Bottom line

These three devices form the backbone of network infrastructure. Knowing what each one does and where it sits in a network will come up constantly — in job interviews, certification exams, and actual security work. When you're looking at a network diagram and trying to figure out where an attacker might pivot or where to place a monitoring tool, you need to know what you're looking at.

Next, we'll talk about firewalls — the device that decides what traffic gets in and what gets blocked.