什么是网络交换机?| 交换机与路由器对比

网络交换机在设备之间转发数据包。交换机将数据包直接发送到设备,而不是像路由器那样将其发送到网络。

学习目标

阅读本文后,您将能够:

  • 网络交换机的定义
  • 了解交换机与路由器之间的区别
  • 了解以太网交换机、非托管和托管交换机以及其他信息

复制文章链接

什么是网络交换机?

A network switch connects devices within a network (often a local area network, or LAN*) and forwards data packets to and from those devices. Unlike a router, a switch only sends data to the single device it is intended for (which may be another switch, a router, or a user's computer), not to networks of multiple devices.

网络流量从 Internet 到路由器、到网络交换机、再到计算机

*局域网(LAN)是一组物理距离很近的连接的设备。家庭 WiFi 网络是 LAN 的常见示例之一。

交换机和路由器有什么区别?

Routers select paths for data packets to cross networks and reach their destinations. Routers do this by connecting with different networks and forwarding data from network to network — including LANs, wide area networks (WANs), or autonomous systems, which are the large networks that make up the Internet.

In practice, what this means is that routers are necessary for an Internet connection, while switches are only used for interconnecting devices. Homes and small offices need routers for Internet access, but most do not need a network switch, unless they require a large amount of Ethernet* ports. However, large offices, networks, and data centers with dozens or hundreds of computers usually do require switches.

*Ethernet is a layer 2 protocol for sending data between devices. Unlike WiFi, Ethernet requires a physical connection via an Ethernet cable.

什么是第 2 层交换机?什么是第 3 层交换机?

网络交换机可以在 OSI 第 2 层(数据链路层)或第 3 层网络层 )上运行。第 2 层交换机根据目标 MAC 地址转发数据(有关定义,请参见下文),而第 3 层交换机则根据目标 IP 地址转发数据。某些交换机可以同时执行这两种操作。

Most switches, however, are layer 2 switches. Layer 2 switches most often connect to the devices in their networks using Ethernet cables. Ethernet cables are physical cables that plug into devices via Ethernet ports.

什么是非托管交换机?什么是托管交换机?

非托管交换机只是在 LAN 上创建更多的以太网端口,以便更多的本地设备可以访问 Internet。非托管交换机根据设备 MAC 地址来回传递数据。

托管交换机可以为更大的网络实现相同的功能,并为网络管理员提供更多控制流量优先级的方法。它们还使管理员能够设置虚拟 LAN(VLAN),以将本地网络进一步细分为较小的块。

MAC 地址与 IP 地址有什么区别?

Network switches refer to MAC addresses in order to send Internet traffic to the right devices, not IP addresses.

每个连接到 Internet 的设备都有一个 IP 地址。IP 地址是一系列字母数字字符,例如 192.0.2.255 或 2001:0db8:85a3:0000:0000:8a2e:0370:7334。IP 地址的作用就像一个邮件地址,使指向该地址的 Internet 通信能够到达该设备。IP 地址经常更改:由于 IPv4 地址数量有限,因此当用户设备与网络建立新连接时,通常会为其分配新的地址。

IP 地址用于第 3 层,这意味着 Internet 上的所有计算机和设备都使用 IP 地址发送和接收数据,无论它们连接到哪个网络。所有 IP 数据包的标头中都包含其源 IP 地址和目标 IP 地址,就像一封邮件具有目标地址和返回地址一样。

In contrast, a MAC address is a permanent identifier for each piece of hardware, somewhat like a serial number. Unlike IP addresses, MAC addresses do not change. MAC addresses are used at layer 2, not layer 3 — which means they are not included in IP packet headers. In other words, MAC addresses are not part of Internet traffic. They are only used inside a given network.

How do network switches know the MAC addresses of the devices in their network?

Layer 2 network switches maintain a table in memory that matches MAC addresses to the switch's Ethernet ports. This table is called a Content Addressable Memory (CAM) table.

Suppose Computer A is connected to an Ethernet cable that plugs into the switch's Port 1, Computer B is connected to Port 2, and Computer C to Port 3. When data arrives for Computer A, the switch consults its CAM table, sees where Computer A is connected, and knows to forward Computer A-bound traffic at Port 1, not Ports 2 or 3.

The switch's CAM table would look something like this:

MAC address  Port 
Computer A's MAC address 1
Computer B's MAC address 2
Computer C's MAC address 3

The switch's CAM table is stored in memory. If the switch is turned off, the table will disappear and the switch has to relearn the table when it is rebooted.

Now, suppose the switch was just turned on and has not yet created its CAM table. It does not know which ports Computers A, B, and C are connected to. It also does not know their MAC addresses.

 MAC address   Port 
? ?
? ?
? ?

Suppose Computer A sends a message to Computer B. The switch takes the following steps to get the message to Computer B and start filling out its CAM table:

  • It records Computer A's MAC address and the port its message came in on
  • It forwards Computer A's message to all other computers on the network (except Computer A); this is known as "flooding"
  • When Computer B replies, it records Computer B's MAC address and port as well
MAC address  Port 
Computer A's MAC address 1
Computer B's MAC address 2
? ?

Now, the switch's CAM table knows where Computer A and Computer B are. It also knows their MAC addresses.

Cloudflare 如何保护网络交换机?

Cloudflare Magic Transit 保护诸如交换机和路由器之类的网络基础设施设备免受 DDoS 攻击流量的攻击(这些攻击流量可能会使它们脱机或受损)。Magic Transit 可保护本地、混合网络。了解有关 Magic Transit第 3 层攻击的更多信息。