8

I know that different IP-based networks can be connected to the same layer-2 switch. and I know each network's nodes can communicate just fine, however, no normal traffic can occur between two nodes on two different networks.

My understanding is that a layer-2 switch depends on the physical addresses, hence it maintains the MAC Address Table.

So, how does a Layer-2 switch prevent normal traffic between say two different networks that were configured using IP addresses and subnet masks which are layer3 I assume?

Should not all nodes can communicate with each other based on the fact that they all exist in a MAC-based world.

6 Answers 6

9

The switch doesn't even "see" what is going on above MAC layer. However, hosts are usually configured to send packets to another IP subnet via a default-gateway IP address. So the hosts themselves enforce this behavior.

If you forged a packet (with some packet generator tool) with a destination IP not from your subnet and with the host's correct MAC address(assuming the host is connected to the same switch) the switch wouldn't care and it would forward this frame to the host.

12
  • 2
    So any request to a node on a different network won't even leave the source node as long as there is no configured default gateway. But what if I configured the default gateway to be the L2 switch. OK L2 switch does not have an IP in the first place. Am I making sense?
    – Shadi
    May 4 at 23:04
  • Yep, a host can also have a more specific route (not just a default gateway). Hosts usually have routing functionality.
    – manish ma
    May 5 at 4:31
  • 2
    Suppose you have hosts A = 192.168.1.10 and B = 192.168.2.20 with their standard class C masks and with default gateway 192.168.1.1 for A and 192.168.2.1 for B. If you can make A believe (by manipulatng their arp table) that the MAC of 192.168.1.1 is the MAC of B, then A would send data destined to B as "hello, I think you are my gateway, please forward this to 192.168.2.20" and B would be all like "Waddayamean, gateway? That packet is for me, thank you" ... For two-way communication, you'd also manipulate the arp table of B. --- Please, don't. Just don't May 5 at 15:53
  • 1
    @manishma: Routes do not need to have a next-hop address – they can just specify an interface, indicating that the destination is local on that interface. Shadi's example is almost correct, with only the IF <ifindex> parameter missing (e.g. route add 192.168.1.0/24 if 16 to designate it as local on interface #16). Though in some other operating systems, the same is achieved by specifying your own IP address as next-hop. But static ARP is the completely wrong thing to use here; the OS wouldn't even get to the point of caring about ARP if you did not have a local route for the destination.
    – user1686
    May 6 at 4:43
  • 1
    @Shadi One interface can have two IP addresses (on most operating systems). If you give the computer an IP address 192.168.1.1 and also 192.168.2.1 then it will be able to access both the 192.168.1.0/24 and 192.168.2.0/24 subnets.
    – user253751
    May 6 at 11:59
16

A (layer-2) switch doesn't care at all about the IP networks you run through it.

however, no normal traffic can occur between two nodes on two different networks.

That is correct. Different IP networks require a router/gateway in between, even if they actually run in the same layer-2 segment.

how does a Layer-2 switch prevent normal traffic between say two different networks that were configured using IP addresses and subnet masks which are layer3 I assume?

Actually, it doesn't. A layer-2 switch forwards frames based on their destination MAC address. At the same time, it learns which nodes are located on each switch port by examining each frame's source MAC address (self-learning bridge). That switch does nothing to stop any connected nodes from communicating with each other (unless it's a managed switch with ACLs, MAC address filtering, various snooping options etc.).

IP nodes from different IP subnets cannot communicate with each other without using a gateway. They don't even try. (There are various methods to trick the nodes into believing they are sending packets to a gateway when they actually don't, but I won't dive into that here. By the book, a gateway is required. In fact, you could even define additional subnets as being on-link = local - just talk out of interface x - so each host would be its own gateway. But obviously you'd need to do that on all hosts.)

Of course, there's nothing stopping a node from adding an IP address from the other subnet to its interface and start communicating with those nodes. That's why multiple IP subnets within the same L2 segment/VLAN are very rarely used. It's usually a pain to manage and there's no actual security gain. If you'd like to add security you need to use separate switches or separate VLANs.

IP nodes need to route packets - all nodes do, not just gateways. The destination IP address is matched to the entries in the local routing table and the entry best matching the destination (longest prefix match) determines the local interface and the next-hop gateway. In the simplest case, there's only a single local interface and a single default route/gateway, matching all destinations.

When the destination matches a locally attached subnet, the packet is sent directly to the destination (after determining the MAC address via ARP for IPv4). However, when there's no default route and no specific route to the destination either, the packet in question has nowhere to be sent and it is dropped.

Should not all nodes can communicate with each other based on the fact that they all exist in a MAC-based world.

Nodes connected to a simple switch (or a VLAN for that matter) can communicate on the data link layer (L2).

IP nodes can only communicate directly if they are connected to the same L2 segment and share an IP subnet. Everything else requires a gateway.

3
  • 1
    Using multiple IP blocks on the same L2 domain/VLAN is useful if you're limited in IP(v4) addresses (and can't usefully make a hard division). It's not about security there, and not that hard to configure for a small number of blocks. Even 2 helps, since it allows using e.g. 256+128 instead of 512, save ~25 %.
    – ilkkachu
    May 5 at 8:25
  • @ilkkachu Yes, it may be useful, but rarely so. "Pain to manage" referred to the problems caused by using DHCP (with either split DHCP and snooping or reservations). With static addresses that isn't a problem, but large amounts of static addresses may be a problem by themselves. Also, you'll need multiple gateway IPs, and so on.
    – Zac67
    May 5 at 9:01
  • 1
    I believe I tried something like this once on my (off-topic) home network in order to route all network traffic through an additional inspection gateway, without any wiring changes. Certainly not the best way to do that, but it worked as a hack.
    – user253751
    May 5 at 11:53
5

Enterprise-grade switches (what is on-topic here) use VLANs to separate traffic. Basically, VLAN partition a layer-2 switch into separate, unconnected, virtual switches, one for each VLAN on the switch. You get multiple MAC address tables, one for each VLAN.

Communication between VLANs requires a router. VLAN configured switches use trunks, where frames are tagged with the VLAN to which they belong so that the receiving switch can separate the traffic back to the proper VLAN.

A complete description of how that works is too broad for this site. There are many questions with answers here about VLANs; just search.

2
  • I was mistaken the first time I read the question. But what he is trying to ask is how L2 switches prevent traffic between different IP networks (L3), not how a smart switch separates traffic between VLANs (L2).
    – Livy
    May 6 at 17:46
  • @Livy, the question is, "So, how does a Layer-2 switch prevent normal traffic between say two different networks that were configured using IP addresses and subnet masks which are layer3 I assume?" I answered based on what is on-topic here. Consumer-grade devices are off-topic. Enterprise-grade switches, which are what is on-topic here, use VLANs to do that.
    – Ron Maupin
    May 6 at 18:55
4

Commercial grade switches can be partitioned into Virtual LANS, or VLANs. Each VLAN is a logical switch - ports belonging to one VLAN cannot communicate with ports in another VLAN.

If you connect two layer 3 networks to the same VLAN (or a switch without VLANs), then they still can't communicate (under normal circumstances) because layer 3 addressing requires a router to route traffic between networks. Devices on one network have no ability to reach devices on another network without a router.

Note that while devices can't communicate, the switch does not prevent them from doing so.

2

Should not all nodes can communicate with each other based on the fact that they all exist in a MAC-based world.

The MAC layer of both Ethernet (802.3) and Wi-Fi (802.11) both use 48-bit addresses, whose first 24-bit is Organizationally Unique Identifier (OUI), leaving only the last 24-bit for use as ID of the network card. It corresponds to 16,777,216 network addresses for a single manufacturer. It is not enough for billions of devices in the world.

Even if you increase the number of bits to provide enough addresses, they are still not useful for routing. Within your home or your enterprise, using a single big layer 2 network (the data link layer) could suffice for device-to-device communication. But to communicate with other layer 2 networks of other companies and various resources on the Internet, a mechanism for network-to-network communication is needed, and that's where the layer 3 -- the network layer -- is used to route packets across different networks.

You cannot expect all devices in the world to join a single gigantic L2 network. It will cause serious performance and security issues.

So, how does a Layer-2 switch prevent normal traffic between say two different networks that were configured using IP addresses and subnet masks which are layer3 I assume?

The switch doesn't know and doesn't prevent anything. Its job is to forward L2 data packet and that's it.

If the network layer is IPv4, source devices use Address Resolution Protocol (ARP) to find out the MAC address of the destination devices before creating and sending the Ethernet packets. If the network layer is IPv6, Neighbor Discovery Protocol (NDP) is used for the same purpose. The L2 switch receives and forwards the packets to the destination MAC addresses, without knowing which layer 3 network they belong to. The source devices try to send the packets to the correct destination devices which belong to the same L3 network -- it is not the switch who tries to separate the traffic between L3 networks.

For the sanity, most of the time we only run a single L3 network (IPv4) on a L2 network (Ethernet or Wi-Fi). Although theoretically possible, running multiple IPv4 networks on a single L2 network makes no sense. IPv6 on the other hand, purposely creates multiple L3 networks on a single L2 network, but most of the time you only concern with one, just like with IPv4.

-1

L2 switches work behaviour is checking the source and destination mac address and maintaining the mac address table. as per the mac table, it travels its frame source to destination.

4
  • 2
    While that is true, it doesn't answer the question.
    – Zac67
    May 6 at 5:03
  • Ya..but its depend on your l2 switch.then creat vlan as per subnet and use iprouting command
    – user83740
    May 7 at 7:52
  • If the switch is able to route it's a layer-3 switch... Have you read the original question? The actual question was how an L2 switch handles different IP networks. It doesn't.
    – Zac67
    May 7 at 8:51
  • Have you read my first answer. It means L2 switch does not handle IP base L3 packet.
    – user83740
    May 7 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.