Thiết bị mạngNetwork Devices

Part of the Network Engineer Roadmap knowledge base.

Overview

A network is only as good as the boxes that move packets between hosts. Every device on a network exists to solve a specific problem: extend a signal, isolate traffic, forward frames, route between networks, translate signaling, secure a perimeter, or distribute load. Understanding what problem each device solves — and at which layer of the OSI model it operates — is the single most useful mental model a network engineer can carry, because it lets you reason about behavior (collision domains, broadcast domains, latency, failure modes) without memorizing product datasheets.

This note walks the device taxonomy from the physical layer upward. We start with the “dumb” signal-repeating devices (repeater, hub), move to Layer 2 frame-switching devices (bridge, switch), then to Layer 3 routing devices (router, multilayer switch), and finally to the “smart” appliances that live at the edge of the network and above (modem, gateway, access point, firewall, load balancer, proxy, IDS/IPS, storage). We close with the modern shift toward virtual and cloud appliances (NFV) and a practical decision model for choosing the right device.

Deeper treatments of individual subjects live in sibling files, cross-linked throughout:

• OSI / TCP-IP layering: ./03-network-models-and-layers.md
• Switching (VLANs, STP, MAC learning): ./08-switching.md
• Routing (static, dynamic, protocols): ./07-routing.md
• Redundancy, HA, load balancing: ./09-redundancy-and-high-availability.md
• Network security, firewalls, IDS/IPS: ./11-network-security.md
• Wireless networking: ./10-wireless-networking.md

Fundamentals

Two ideas you need first: collision domains and broadcast domains

Almost every property of a Layer 1/Layer 2 device comes down to how it affects two “domains”:

• Collision domain — a set of devices whose frames can collide on a shared medium (relevant to half-duplex Ethernet using CSMA/CD). If two stations transmit at once, both frames are corrupted and must be retransmitted. Larger collision domains = more collisions = worse performance.
• Broadcast domain — a set of devices that will all receive a broadcast frame (destination MAC FF:FF:FF:FF:FF:FF) or other Layer 2 flooded traffic (ARP, DHCP discover, unknown-unicast flooding). Larger broadcast domains = more broadcast noise and a larger fault/security blast radius.

A quick rule of thumb for the classic devices:

• A hub is one big collision domain and one big broadcast domain.
• A switch puts each port in its own collision domain (so collisions essentially disappear with full-duplex), but by default all ports remain in one broadcast domain (unless split by VLANs).
• A router terminates broadcast domains: each router interface is a boundary between broadcast domains. Routers do not forward broadcasts by default.

Hold onto that: switches break up collision domains; routers break up broadcast domains.

The OSI layer a device “operates at”

We say a device “operates at” the highest layer at which it makes forwarding decisions:

• Layer 1 (Physical) devices only regenerate/repeat electrical or optical signals. They have no concept of a frame or address.
• Layer 2 (Data Link) devices make decisions based on MAC addresses (Ethernet frames).
• Layer 3 (Network) devices make decisions based on IP addresses (packets).
• Layer 4–7 devices inspect TCP/UDP ports (L4) or full application content — HTTP headers, TLS SNI, URLs (L7).

The higher the layer, the more context the device has, the smarter its decisions can be, and (historically) the more it costs per unit of throughput.

Duplex, and why hubs died

• Half-duplex: a station can send or receive, not both at once. Shared media (hubs, old coax) are half-duplex, requiring CSMA/CD collision handling.
• Full-duplex: a station can send and receive simultaneously over a dedicated point-to-point link. A switched port to a single host is full-duplex, which eliminates collisions on that segment entirely.

Because switches give every host a private, full-duplex collision domain — and cost the same or less than hubs did — hubs are obsolete. You will not deploy a hub today; they survive only as a teaching tool and, occasionally, as a crude way to tap traffic for monitoring (a real hub copies every frame to every port).

Key Concepts

Master comparison table: device → OSI layer → function

The rest of this section explains each family.

Layer 1 — Repeater and hub

A repeater takes a weakened, noisy signal and regenerates a clean copy, letting you exceed the maximum cable length of a medium (e.g., 100 m for copper Ethernet, or long fiber runs). It understands nothing about the data — it just cleans and forwards the signal.

A hub is a multiport repeater. A frame arriving on one port is blindly copied out of every other port. Consequences:

• All ports share one collision domain (half-duplex, CSMA/CD needed).
• All ports share one broadcast domain.
• No traffic isolation: every host sees every other host’s frames — a security and performance problem.
• Bandwidth is shared: a “100 Mbps hub” gives aggregate 100 Mbps split among active talkers.

This is why hubs were entirely replaced by switches. See ./08-switching.md for how switches improved on this.

Layer 2 — Bridge and switch

A bridge connects two (or a few) network segments and makes forwarding decisions using MAC addresses. It learns which MACs live on which segment by observing source addresses, then forwards a frame across the bridge only if the destination is on the other segment (filtering local traffic). Classic bridges were often two-port, software-based, and slow.

A switch is essentially a high-density, hardware-accelerated multiport bridge — the workhorse of the modern LAN. Core behaviors:

• MAC learning: the switch builds a MAC address table (CAM table) mapping MAC → port by inspecting source MACs of incoming frames.
• Forwarding / filtering: a unicast frame whose destination MAC is known is sent only to that one port. This is microsegmentation — each port is its own collision domain.
• Flooding: broadcasts, multicasts, and unknown unicasts are flooded to all ports in the VLAN.
• Full-duplex: each host-to-switch link runs full-duplex, so collisions vanish.
• VLANs: a switch can subdivide its ports into multiple broadcast domains (VLANs). Each VLAN is a separate broadcast domain, and routing is required to move traffic between them.
• Loop prevention: Spanning Tree Protocol (STP/RSTP) blocks redundant paths to prevent Layer 2 loops and broadcast storms.

Switch forwarding modes: store-and-forward (receive whole frame, check FCS, then forward — safest) vs cut-through (start forwarding after reading the destination MAC — lowest latency).

Deep dive: VLANs, trunking (802.1Q), STP, EtherChannel, and MAC tables in ./08-switching.md.

Layer 3 — Router and multilayer switch

A router connects different IP networks and forwards packets based on the destination IP address using a routing table and longest-prefix match. Key properties:

• Each interface sits in a different subnet and is a broadcast-domain boundary — routers do not forward broadcasts, which contains broadcast noise and shrinks fault/security blast radius.
• Routers perform functions switches don’t: NAT, DHCP relay, ACL-based filtering, QoS, and running dynamic routing protocols (OSPF, BGP, EIGRP).
• They connect LANs to WANs and to the internet; the router is typically what provides your default gateway (see below).
• Routing decisions are more CPU-intensive than switching, though modern routers offload to hardware.

A multilayer switch (Layer 3 switch) combines a switch’s wire-speed hardware forwarding with a router’s Layer 3 capability. It switches frames within a VLAN and routes packets between VLANs (inter-VLAN routing) at hardware speed. In a modern campus/data-center design, L3 switches usually handle east-west routing internally, while a dedicated router or firewall handles the edge/WAN. Rough distinction: a router shines with WAN interface diversity, rich routing features, and NAT; an L3 switch shines with dense high-throughput LAN routing between VLANs.

Deep dive on routing tables, static vs dynamic routing, and protocols: ./07-routing.md.

Default gateway

The default gateway is the IP address a host sends packets to when the destination is not on its own subnet. The host compares the destination IP against its own subnet mask; if the destination is local, it ARPs and sends directly; if it’s remote, it forwards the packet to the default gateway’s MAC and lets that device route onward.

• The default gateway is almost always an interface on a router (or an L3 switch, or a firewall) that sits on the host’s subnet.
• On home networks, the “router”/home gateway (e.g., 192.168.1.1) is the default gateway.
• For high availability, the gateway IP is often a virtual address shared by two routers via a First Hop Redundancy Protocol (HSRP/VRRP/GLBP), so failure of one router doesn’t strand the subnet — see ./09-redundancy-and-high-availability.md.

Modem and CPE / home gateway

A modem (modulator–demodulator) translates between the digital signals of your equipment and the analog/line-coded signal used by the carrier’s access medium — coax (DOCSIS cable), telephone copper (DSL), or fiber (an ONT for GPON, technically an optical network terminal but the same role). Modulation encodes bits onto the carrier for transmission; demodulation recovers bits on receipt. A pure modem operates mostly at Layer 1 (with some L2 for framing) and does not route or assign IPs by itself.

CPE (Customer Premises Equipment) is the umbrella term for the gear at the customer site provided or approved by the ISP: the modem/ONT, and often a combined home gateway (a.k.a. residential gateway or “wireless router”). A typical home gateway is a converged device that bundles several functions into one box:

• Modem or an interface to the ISP handoff
• Router (does NAT/PAT so many private hosts share one public IP)
• Multiport Ethernet switch
• Wireless access point
• DHCP server, DNS forwarder, basic firewall (stateful, plus port forwarding)

Understanding it as five devices in one enclosure explains its behavior and how to troubleshoot it. In business settings these functions are usually separate, purpose-built devices for performance, scale, and manageability.

Wireless access point (AP) and WLAN controller

A wireless access point bridges 802.11 (Wi-Fi) clients onto the wired LAN. It operates at Layer 2 — a frame from a Wi-Fi client is bridged into a wired VLAN. All clients on one radio share the RF medium (a form of shared/half-duplex medium with its own contention, CSMA/CA), which is why AP density and channel planning matter. An AP is not a router; in enterprise deployments the AP does only radio + bridging, while routing, DHCP, and policy live elsewhere.

A WLAN controller (WLC) centrally manages many APs — configuration, RF optimization (channel/power), roaming, security policy, and firmware — turning dozens or thousands of “thin/lightweight” APs into one coordinated system. Small deployments may instead use “autonomous” APs or cloud-managed APs (controller in the cloud).

Brief here by design — full treatment (standards, channels, security, roaming) in ./10-wireless-networking.md.

Firewall (as a device)

A firewall enforces a security policy between network zones (e.g., internet ↔ DMZ ↔ internal). Types, in increasing sophistication:

• Packet filter (stateless) — allow/deny by IP, protocol, and port; no memory of connections.
• Stateful firewall — tracks connection state (the TCP handshake, established flows), allowing return traffic automatically. The standard baseline.
• Next-generation firewall (NGFW) — adds application awareness (identify apps regardless of port), user identity, TLS inspection, and integrated IPS.

A firewall can be a dedicated hardware appliance, a feature on a router, or a virtual/cloud instance. It typically sits at zone boundaries and often is the default gateway for protected segments. Full treatment — zones, rule design, NAT, NGFW, deep packet inspection — in ./11-network-security.md.

Load balancer (L4 vs L7)

A load balancer distributes incoming traffic across a pool of backend servers to improve capacity, availability, and scalability. Two operating layers:

• Layer 4 load balancer — decisions based on IP address and TCP/UDP port. It forwards connections without understanding application content: fast, protocol-agnostic, lower overhead. Good for raw TCP/UDP throughput.
• Layer 7 load balancer — decisions based on application content: HTTP host/path, cookies, headers. Enables content-based routing (e.g., /api → one pool, /images → another), TLS termination, session persistence, and health checks by URL. More CPU, more capability.

Load balancers also do health checking (pull dead servers out of rotation) and are a cornerstone of high availability. Deep dive — algorithms (round-robin, least-connections), session persistence, HA pairing, and DSR — in ./09-redundancy-and-high-availability.md.

Reverse proxy and forward proxy

Both are intermediaries that terminate a connection and open a new one on the other side, but they face opposite directions:

• Forward proxy sits in front of clients going out. Clients send requests through it to reach the internet. Uses: content filtering, access control, caching, anonymizing/hiding internal client IPs, corporate egress control.
• Reverse proxy sits in front of servers. External clients think they’re talking to the server, but the proxy fronts one or many backends. Uses: TLS termination, caching, compression, request routing, hiding backend topology, and it frequently doubles as an L7 load balancer and WAF. Examples: NGINX, HAProxy, Envoy; a CDN edge is a globally distributed reverse-proxy/cache.

Mnemonic: a forward proxy protects/serves the clients; a reverse proxy protects/serves the servers.

Other appliances

• IDS / IPS sensors — an IDS (Intrusion Detection System) monitors traffic and alerts on suspicious activity; it is typically out-of-band, fed by a SPAN/mirror port or a network TAP, so it sees a copy of traffic. An IPS (Intrusion Prevention System) sits inline and can drop malicious traffic in real time. Detection uses signatures and/or anomaly/behavioral analysis. Often folded into an NGFW today. See ./11-network-security.md.
• NAS (Network Attached Storage) — a file-level storage appliance sharing folders over the LAN via NFS/SMB. Simple, uses the existing IP network, ideal for shared documents and backups.
• SAN (Storage Area Network) — a block-level storage fabric (Fibre Channel or iSCSI over IP) presenting raw disks (LUNs) to servers as if locally attached. High performance and low latency; used for databases and virtualization. Distinction: NAS = files, SAN = blocks.
• Controllers — in modern SDN and campus fabrics, a central controller manages the control plane (policy, topology, forwarding rules) while devices handle the data plane. WLCs (above) and SDN controllers are examples; this decouples “what the network should do” from the boxes that do it.

Virtual, cloud, and software appliances (NFV)

Historically each function above was a dedicated hardware box. Network Functions Virtualization (NFV) decouples network functions from proprietary hardware and runs them as software (virtual machines or containers) on standard x86 servers. So a “device” today is often a virtual appliance:

• Virtual routers, virtual firewalls, virtual load balancers, virtual switches (vSwitch), virtual APs.
• In the cloud, these appear as managed services: cloud load balancers (AWS ELB/ALB/NLB, GCP Cloud Load Balancing), cloud NAT gateways, virtual private gateways, security groups/network ACLs as distributed firewalls, and transit/virtual routers.
• Benefits: elastic scaling, faster provisioning, lower capex, easier automation (infrastructure-as-code), and placement flexibility.
• Trade-offs: performance depends on the host and drivers (though DPDK/SR-IOV help), and you must manage software lifecycle and licensing.

Related: SDN separates control and data planes; VNF/CNF are the virtualized/containerized network functions; service chaining stitches several VNFs into a traffic path. The mental model — device = OSI layer + function — still holds; the function is just software now.

Best Practices

A device-selection mental model

Match the problem to the layer, then to the device:

Design and operational guidance

• Prefer switches over hubs, always. There is no modern reason to introduce a shared collision domain.
• Push routing down where it helps. Use L3 switches for inter-VLAN routing at the access/distribution layer; reserve routers for WAN, NAT, and rich routing features.
• Right-size the layer. Don’t buy L7 inspection where an L4 forward is enough (cost/latency), and don’t try to solve an application problem at Layer 3.
• Minimize broadcast domain size. Large VLANs mean large broadcast domains and larger failure/security blast radius; segment with VLANs and route between them.
• Design for redundancy. Default gateways behind HSRP/VRRP, load balancers in HA pairs, dual uplinks with STP/EtherChannel — see ./09-redundancy-and-high-availability.md.
• Separate control and data planes where possible (SDN/controllers) for consistent, automatable policy.
• Beware converged home gateways in business use. Splitting router/switch/AP/firewall into purpose-built devices scales better and troubleshoots more cleanly.
• Place security devices at boundaries. Firewalls and IPS belong at zone edges; IDS taps belong where they can see the traffic that matters.
• Consider virtual/cloud appliances first for new builds — they automate and scale better, but validate throughput against your performance needs.
• Document layer and role for every device. Knowing what layer each box operates at makes every future troubleshooting session faster.

References

• Cisco — What Is a Network Switch vs. a Router?
• Cisco — What Is a Router?
• Cisco — What Is a WLAN Controller?
• Cloudflare — What is a load balancer? (L4 vs L7)
• Cloudflare — Forward proxy vs. reverse proxy
• Cloudflare — What is a firewall?
• Cloudflare — IDS vs. IPS
• Cisco — What Is Network Functions Virtualization (NFV)?