Routing vs Forwarding vs Switching – Differences Explained

layer2layer3osiroutingswitching

I feel like the three terms are often used as synonyms but actually all mean something different. I did look at Wikipedia sites but I'm still unsure about the definitions of the three.

From my understanding, routing is concerned about finding a path or paths to a destination and deciding where to send a (unknown) packet to/which path to use based on its destination or prefix and not just based on a simple lookup in a table. This is what happens at IP routers (shortest prefix routing).

These simple lookups are what I understand as forwarding: The header/label (cf. MPLS)/etc are matched against entries in a flow table (or multiple tables). An exact match tells the switch at which port to output the packet without further computation or decisions to be made. If no match is found, a default action is performed or a seperate controller is asked (as in SDN). This cna be done faster than routing because of less computation and specialized hardware, correct?

Switching seems to be fairly similar to forwarding but with an emphasis on what happens on hardware in the switching fabric after the lookup in a table. This on OSI level 2 (data link) while routing and forwarding are actions on level 3 (network)?

What's correct/wrong about these intuitions? Did I miss something of importance? Are there differences between IP routing/forwarding (Google returns the same Wikipedia article)? What about the MAC layer?

Best Answer

In general, forwarding refers to a device sending a datagram to the next device in the path to the destination, switching refers to moving a datagram from one interface to another within a device, and routing refers to the process a layer-3 device uses to decide on what to do with a layer-3 packet.

A host sending data to another host through an ethernet interface will place a frame on the wire. If the next device is a bridge (a switch is a bridge), the bridge will inspect the frame for the source and destination MAC addresses. The bridge will use the source MAC address in its MAC address table so that it knows the host with that MAC address is connected to the interface where the frame entered the bridge. It will also try to look up the destination MAC address in its MAC address table to see to which interface it should switch the frame. If it finds the MAC address in its MAC address table, it will switch the frame to the interface indicated in its MAC address table, otherwise it will flood the frame to all other interfaces, forwarding the frame to the device(s) on the other end(s) of the interface(s) link(s).

A router receiving a frame on an interface will strip the frame from the packet. The router will then try to look up the destination IP address in its routing table. If it doesn't find a match, even a default route, it will drop the packet. If it finds one or more matches, it will switch the packet to the interface of the longest match in the routing table. The router will then prepare a new frame for the packet on the new interface (the link on new interface may or may not use MAC addresses), and the router will forward the new frame containing the original packet over the next hop interface toward its destination. The whole process a router uses is called routing, but within the router, it switches packets before forwarding them to the next hop device.

Related Solutions

Routing – BGP remote-triggered blackhole (RTBH) filter for Juniper

There is no reason to limit customer to blackhole only /32, allow them to blackhole anything from them.

Something like this:

policy-statement AS42-IN {
    term blackhole {
        from {
            community BLACKHOLE;
            prefix-list-filter AS42 orlonger;
        }
        then {
            community add NO-EXPORT;
            next-hop 192.0.2.1;
            accept;
        }
    }
    term advertise {
        from {
            prefix-list AS42;
        }
        then {
            community add ADVERTISE;
            next-hop peer-address;
            accept;
        }
    }
    term reject {
        then reject;
    }
}

Remember to set 'accept-remote-nexthop' under BGP settings, so that the next-hop can be changed to something else than link address.

I also strongly support that providers start to support different blackhole communities than just 'full blackhole'. Especially if you operate in more than one country usually attack is from transit and often customer actually mostly wants to access domestic peerings, so it's useful to implement several levels of blackhhole:

Full
Outside local country (local IXP, whole own AS + customers seen)
Outside local area (if applicable, like for me it could be 'Nordics')
Include/Exclude specific peering router in blackhole

I'm happy to give example how to implement something like this with JNPR DCU/SCU, provided your peering routers are JNPR, but it's possible with just communities, just bit more awkward.

If you absolutely want to limit your customer's options you can add this:

policy-statement /32 {
    term /32 {
        from {
            route-filter 0.0.0.0/0 prefix-length-range /32-/32;
        }
        then accept;
    }
    term reject {
        then reject;
    }
}

policy-statement AS42-IN {
    term blackhole {
        from {
            community BLACKHOLE;
            policy /32;
            prefix-list-filter AS42 orlonger;
        }
..
}

This way it should be logical AND. But I really don't see the value in creating complexity to reduce expressiveness of configuration.

Wireless – What OSI layer do Access Points operate on

Strictly speaking, access points are a L2 device. Their primary function is to bridge 802.11 WLAN traffic to 802.3 Ethernet traffic.

However, in the real world, enterprise wireless vendors often push more functionality to either the AP itself and/or tie them into a controller, with the end result that they often incorporate functionality from higher layers as well.

I don't entirely follow #1, but neither the connection to a switch or router nor the use of CSMA-CA has anything to do with their function as a L2 device. It is a L2 device because that is the layer of the network where it is designed to function. It doesn't care nor need L3 or above to operate and allow devices to communicate (again strictly speaking).

As for #2, yes, an AP (or any bridge) needs to keep track of which interface any individual device is connected. In general (and simply), they work on the principle of frames destined to an associated station gets forwarded out the wireless interface and any other frames get forwarded out the wired interface (or sent to the controller).

Best Answer

Related Solutions

Routing – BGP remote-triggered blackhole (RTBH) filter for Juniper

Wireless – What OSI layer do Access Points operate on

Related Topic