How Does A Layer 2 Switch Differentiate Between Different Networks?

Question

I know that different IP-based networks can be connected to the same layer-2 switch. and I know each network's nodes can communicate just fine, however, no normal traffic can occur between two nodes on two different networks.

My understanding is that a layer-2 switch depends on the physical addresses, hence it maintains the MAC Address Table.

So, how does a Layer-2 switch prevent normal traffic between say two different networks that were configured using IP addresses and subnet masks which are layer3 I assume?

Should not all nodes can communicate with each other based on the fact that they all exist in a MAC-based world.

Answer 1

The switch doesn't even "see" what is going on above MAC layer. However, hosts are usually configured to send packets to another IP subnet via a default-gateway IP address. So the hosts themselves enforce this behavior.

If you forged a packet (with some packet generator tool) with a destination IP not from your subnet and with the host's correct MAC address(assuming the host is connected to the same switch) the switch wouldn't care and it would forward this frame to the host.

Answer 2

A (layer-2) switch doesn't care at all about the IP networks you run through it.

however, no normal traffic can occur between two nodes on two different networks.

That is correct. Different IP networks require a router/gateway in between, even if they actually run in the same layer-2 segment.

how does a Layer-2 switch prevent normal traffic between say two different networks that were configured using IP addresses and subnet masks which are layer3 I assume?

Actually, it doesn't. A layer-2 switch forwards frames based on their destination MAC address. At the same time, it learns which nodes are located on each switch port by examining each frame's source MAC address (self-learning bridge). That switch does nothing to stop any connected nodes from communicating with each other (unless it's a managed switch with ACLs, MAC address filtering, various snooping options etc.).

IP nodes from different IP subnets cannot communicate with each other without using a gateway. They don't even try. (There are various methods to trick the nodes into believing they are sending packets to a gateway when they actually don't, but I won't dive into that here. By the book, a gateway is required. In fact, you could even define additional subnets as being on-link = local - just talk out of interface x - so each host would be its own gateway. But obviously you'd need to do that on all hosts.)

Of course, there's nothing stopping a node from adding an IP address from the other subnet to its interface and start communicating with those nodes. That's why multiple IP subnets within the same L2 segment/VLAN are very rarely used. It's usually a pain to manage and there's no actual security gain. If you'd like to add security you need to use separate switches or separate VLANs.

IP nodes need to route packets - all nodes do, not just gateways. The destination IP address is matched to the entries in the local routing table and the entry best matching the destination (longest prefix match) determines the local interface and the next-hop gateway. In the simplest case, there's only a single local interface and a single default route/gateway, matching all destinations.

When the destination matches a locally attached subnet, the packet is sent directly to the destination (after determining the MAC address via ARP for IPv4). However, when there's no default route and no specific route to the destination either, the packet in question has nowhere to be sent and it is dropped.

Should not all nodes can communicate with each other based on the fact that they all exist in a MAC-based world.

Nodes connected to a simple switch (or a VLAN for that matter) can communicate on the data link layer (L2).

IP nodes can only communicate directly if they are connected to the same L2 segment and share an IP subnet. Everything else requires a gateway.

Answer 3

Enterprise-grade switches (what is on-topic here) use VLANs to separate traffic. Basically, VLAN partition a layer-2 switch into separate, unconnected, virtual switches, one for each VLAN on the switch. You get multiple MAC address tables, one for each VLAN.

Communication between VLANs requires a router. VLAN configured switches use trunks, where frames are tagged with the VLAN to which they belong so that the receiving switch can separate the traffic back to the proper VLAN.

A complete description of how that works is too broad for this site. There are many questions with answers here about VLANs; just search.

Answer 4

Commercial grade switches can be partitioned into Virtual LANS, or VLANs. Each VLAN is a logical switch - ports belonging to one VLAN cannot communicate with ports in another VLAN.

If you connect two layer 3 networks to the same VLAN (or a switch without VLANs), then they still can't communicate (under normal circumstances) because layer 3 addressing requires a router to route traffic between networks. Devices on one network have no ability to reach devices on another network without a router.

Note that while devices can't communicate, the switch does not prevent them from doing so.

Answer 5

Should not all nodes can communicate with each other based on the fact that they all exist in a MAC-based world.

The MAC layer of both Ethernet (802.3) and Wi-Fi (802.11) both use 48-bit addresses, whose first 24-bit is Organizationally Unique Identifier (OUI), leaving only the last 24-bit for use as ID of the network card. It corresponds to 16,777,216 network addresses for a single manufacturer. It is not enough for billions of devices in the world.

Even if you increase the number of bits to provide enough addresses, they are still not useful for routing. Within your home or your enterprise, using a single big layer 2 network (the data link layer) could suffice for device-to-device communication. But to communicate with other layer 2 networks of other companies and various resources on the Internet, a mechanism for network-to-network communication is needed, and that's where the layer 3 -- the network layer -- is used to route packets across different networks.

You cannot expect all devices in the world to join a single gigantic L2 network. It will cause serious performance and security issues.

So, how does a Layer-2 switch prevent normal traffic between say two different networks that were configured using IP addresses and subnet masks which are layer3 I assume?

The switch doesn't know and doesn't prevent anything. Its job is to forward L2 data packet and that's it.

If the network layer is IPv4, source devices use Address Resolution Protocol (ARP) to find out the MAC address of the destination devices before creating and sending the Ethernet packets. If the network layer is IPv6, Neighbor Discovery Protocol (NDP) is used for the same purpose. The L2 switch receives and forwards the packets to the destination MAC addresses, without knowing which layer 3 network they belong to. The source devices try to send the packets to the correct destination devices which belong to the same L3 network -- it is not the switch who tries to separate the traffic between L3 networks.

For the sanity, most of the time we only run a single L3 network (IPv4) on a L2 network (Ethernet or Wi-Fi). Although theoretically possible, running multiple IPv4 networks on a single L2 network makes no sense. IPv6 on the other hand, purposely creates multiple L3 networks on a single L2 network, but most of the time you only concern with one, just like with IPv4.

Answer 6

L2 switches work behaviour is checking the source and destination mac address and maintaining the mac address table. as per the mac table, it travels its frame source to destination.