In order to Telnet to a switch (Layer 2) we create an SVI, thus a layer 3 point of contact is made. The switch inspects each packet sent from the remote client and responds to it so that it gets configured. In that case is it true that the switch becomes a L4 device as it got the capability to inspect the packets?

  • 1
    It's a layer-2/3 switch and a layer-7 telnet server. – user253751 Jul 3 '18 at 23:30
  • 3
    This is a perfect example of the distinction between the control/management plane (the "I'm a computer you can talk to over telnet" hat) and the data plane (the "I retransmit packets" hat). – chrylis -cautiouslyoptimistic- Jul 4 '18 at 0:23
  • 1
    If a switchman answers a phone call from his boss, does he become a receptionist? – AndreKR Jul 4 '18 at 10:32
  • Think about it as an internal port to the switch that you have no physical access to but it can be enabled/disabled by software. Then imagine just some little internal computer being connected there. – PlasmaHH Jul 4 '18 at 14:15
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer. – Ron Maupin Jan 4 at 18:08

If you SSH or telnet into a switch (or any other device) you actually utilize all OSI layers up to the application layer 7.

However, a switch is usually categorized by its forwarding functions residing in the data plane rather than by anything that goes on in the management plane.

So, even if a switch features a network console it stays a layer-2, layer-3, or layer-x device, depending on its forwarding features.


It's important to separate in your mind the data plane functions (forwarding frames) from the management plane functions (telnet, snmp, etc).

A switch (as a switch) operates at layer 2, forwarding frames based on layer 2 (MAC) information.

Managed switches have a management features that act like any other IP host. So it utilizes the full TCP/IP stack of functions.


In order to Telnet a switch (Layer 2) we create an SVI, thus a layer 3 point of contact is made.

I'm going to modify your statement a little. You are configuring a Layer3 SVI in the switch's management software, which runs on a CPU.

Let's pretend that the switch configuration software runs on an Ubuntu Linux distributionNote 1; Ubuntu runs on the switch's CPU. When you telnet to the switch, you're talking to the telnetd running on the Linux kernel to configure itNote 2.

In order to function correctly, the switch must have:

  1. Specialized switching hardware (made from ASICs) in the system so it can move packets extremely quickly; it must be able to do this lookup millions of times a second.
  2. Specialized configuration software running on the Linux kernel to offer a "switch configuration language". Parts of the configuration are used to rewrite data in the ASIC so it can know how to pass data through the switch quickly. This data is also used to control how the switch behaves in the network (such as configuration of routing protocols, or spanning-tree).

In that case is it true that, the switch becomes a L4 devices as it got the capability to inspect the packets?

No, this is a misunderstanding. Let's make a distinction for traffic to the switch (control plane), and traffic through the switch (data plane).

  1. Control plane traffic *to the switch* is sent to the configuration software running on the Linux kernel mentioned in point two, above. This is what we call the "control plane"Note 3. Control plane traffic includes telnet, which is intercepted by the telnetd running on the CPU; the CPU can only handle packets / keystrokes a few thousand times a second. It's an order of magnitude (or more) slower than the ASICs can handle.
  2. Data plane traffic *through the switch* is only touched by the ASICs (with a few exceptions). This could happen millions of times per second. Note, cheap switches you buy from Walmart cannot inspect the IP header to make a Layer3 SVI.

In summary, you're confusing traffic through the switch, and traffic to the switch in this question. Just because the switch is running a telnetd for traffic to the switch doesn't mean it can inspect Layer4 traffic through the switch.

Things that can inspect traffic at Layer4 are called:

  1. Firewalls
  2. Load balancers

The difference between a Layer3 switch and a load balancer / firewall is outside the scope of this question.

End Notes

Note 1: I'm not merely pretending; there really are switch vendors who build switches on top of Linux, but it's a very customized version of Linux.
Note 2: Most people should prefer ssh instead of telnet, but let's not cloud the discussion.
Note 3: The control plane is also called the "management plane".

  • 2
    Best answer yet IMHO, wish I could vote for it multiple times to balance it with the other answers. For completeness, in today's "market speak" load balancers = application delivery controllers. After all, they do so much more now than just balance load..... – YLearn Jul 3 '18 at 18:26
  • Just a nit: telnet, would be management plane, not control plane. – Ron Trunk Jul 3 '18 at 18:40
  • 1
    @RonTrunk, speaking as someone who worked for Cisco's engineering product management, I think you're making a distinction without a difference. – Mike Pennington Jul 3 '18 at 19:51

Consider also other network devices: Wireless Access Points, Routers, Firewalls etc.

All of these will likely contain services for management such as HTTP, SSH servers, as well as likely clients for DNS, DHCP, NTP etc. so as a whole device will be using the whole TCP/IP stack up to layer 7.

However layer 2/3/4 is just a descriptive term is typically referring to its primary purpose doing whatever it does on the data plane.

So in the case of a network switch its primary functions / capabilities of packet switching only looks at the header/trailer of the layer 2 frame but does not need to look at the contents of the payload itself. After all the contents do not even have to be IP packets, they could be a different layer 3 protocol. Hence why an ordinary non managed switch can function and does indeed only operate at level 2 entirely.


I think a simple way (and no so far from reality) is to consider the management plane as a device 'connected' to the switch. So the switch can stick to layer 2, and will forward management trafic (based on it's management MAC address)... Then the management cpu can go up to level 7... This is a little more complex with a SVI but it's the same principle.

By the way, you can have a layer 2 switch (i.e. not making layer 3 routing) but inspecting all packets on upper layers (for examples using ACL).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.