Identify a network device by the forwarding decision it makes
Network devices are easiest to understand when you stop memorizing box names and instead ask what decision happens at that point in the packet path. A switch decides where an Ethernet frame should go inside a Layer 2 domain. A router decides where an IP packet should go between networks. An access point controls wireless association and bridges wireless traffic into the LAN. A firewall evaluates policy. A modem or provider edge handles the access medium toward the service provider.
After identifying a device, check whether you can distinguish its role from the evidence it provides. The AP Networking Network Components and Media Practice Test has 75 questions on endpoint interfaces, gateway functions, copper/fiber choices, power budgets, and link limits; its harder items ask which controlled comparison would isolate a failure.
One physical box can contain several logical device roles
Switch
MAC-based Layer 2 forwarding.
Router
IP-prefix-based Layer 3 forwarding.
Access Point
Wireless association and LAN bridging.
Firewall
Traffic-policy decisions.
NIC
Host network attachment.
Modem/Edge
Provider-access termination.
A consumer gateway may combine all of these functions. Exam questions often ask which function explains the behavior, not which plastic box contains it.
A switch learns from source MAC addresses and forwards by destination MAC address
When a frame enters a switch, the switch records the source MAC address on the ingress port and VLAN. That learning builds the MAC address table. When the destination MAC is known, the switch can forward the frame selectively toward the learned port rather than sending it everywhere.
Unknown destinations are flooded only inside the relevant Layer 2 boundary
If a switch has not learned the destination MAC yet, it typically floods the frame out eligible ports in the same VLAN. Broadcast traffic is also flooded within that VLAN. This is why VLAN membership matters so much: flooding scope is not the entire switch by default; it is the logical Layer 2 domain.
A router makes decisions from destination IP prefixes, not destination MAC addresses
A router receives a frame addressed to its local interface, removes the Layer 2 framing, inspects the destination IP address, and looks for the most specific matching route. The selected route identifies an outgoing interface or next hop.
The router then builds new Layer 2 framing appropriate for the next link.
Routers separate ordinary Layer 2 broadcast domains
ARP requests, unknown unicast flooding, and ordinary Ethernet broadcasts remain local to the Layer 2 domain. Routers do not simply copy those frames into every other IP subnet. That separation is one reason routers and Layer 3 switches are central to segmentation.
An access point handles the wireless edge, not the entire Internet path
An AP provides the radio cell, manages association, and bridges client traffic into the wired LAN design. A client can have excellent RSSI and a stable association yet still have the wrong VLAN, no DHCP lease, a broken gateway, bad DNS, or no upstream route.
Wireless state should be matched to the failure layer
If a client drops during movement, association and roaming evidence matter. If the client stays associated but receives the wrong subnet, inspect SSID-to-VLAN mapping and DHCP path. If wireless and wired clients both fail to reach the same server, the AP is no longer the strongest shared boundary.
The NIC is the host's point of attachment to the network
A network interface card or adapter provides link-layer access for Ethernet, Wi-Fi, or another medium. It has link or association state and typically a MAC address. The operating system binds IP configuration and routes to the interface.
Provider access and local routing are different functions
A modem or provider termination device handles the physical or data-link technology used to reach the service provider. The router decides how local IP traffic is forwarded toward that provider path. A LAN can be completely healthy while the provider access link is down.
A Layer 3 switch combines switching and routing, but the concepts remain separate
A multilayer switch can switch frames within VLANs and route packets between VLAN interfaces. The hardware may perform both functions at high speed, but same-VLAN and inter-VLAN traffic still follow different logical rules.
A hub repeats signals; it does not build a MAC forwarding table
A hub is a simple Layer 1 repeater. Traffic arriving on one port is repeated out the others. There is no learned MAC table and no selective frame forwarding. Hubs are uncommon in modern production networks, but the comparison clarifies what intelligence a switch adds.
| Device | Primary layer | Decision basis |
|---|---|---|
| Hub | Layer 1 | No per-frame forwarding decision |
| Switch | Layer 2 | Destination MAC |
| Router | Layer 3 | Destination IP prefix |
Swipe horizontally to see the comparison.
A firewall adds policy to the path
A firewall may also route, NAT, terminate VPNs, or inspect applications, but its defining troubleshooting value is policy. It decides whether traffic matching a set of conditions is permitted, denied, logged, translated, or otherwise processed.
A route existing does not prove the firewall allows the flow. These are different dependencies.
One consumer router can logically contain six different functions
Router
Moves IP packets between LAN and WAN.
Switch
Handles local Ethernet ports.
AP
Connects Wi-Fi clients.
DHCP server
Provides client configuration.
NAT
Translates private source addresses.
Firewall
Applies policy at the edge.
This is why saying “the router is broken” can be too vague. Which function failed?
Choose an artifact that belongs to the device's role
| Question | Best evidence | Device role |
|---|---|---|
| Where was this MAC learned? | MAC address table | Switch |
| Which next hop wins? | Routing table | Router/L3 switch |
| Is the station associated? | Client/AP association state | AP |
| Did policy deny the flow? | Rule counter/log | Firewall |
| Is the provider access up? | WAN/modem/edge status | Provider edge |
| Which adapter owns the route? | Host interface/route state | NIC/OS |
Swipe horizontally to see the device-evidence matrix.
Two hosts in the same VLAN cannot communicate
A routing-table change is a weak first move because the expected path is local Layer 2 delivery.
Two hosts in different subnets require Layer 3 forwarding
The switch may successfully deliver Host A's frame to the gateway while the routed path still fails later.
If other VLANs cross the same trunk, the physical uplink is a built-in control
This is a classic case where understanding device roles prevents unnecessary cable replacement.
Strong Wi-Fi signal with no address is not a router proof
The AP radio function is working enough for association. The failure is later in the logical attachment/configuration path.
Local LAN service can remain healthy during an upstream outage
Every device artifact proves only part of the path
| Artifact | What it proves | What it does not prove |
|---|---|---|
| MAC table | Layer 2 learning | Routing or app success |
| Route table | Path selection | Firewall or server listener |
| AP association | Wireless attachment | DHCP or Internet |
| Firewall allow log | Policy accepted flow | Destination service healthy |
| Modem sync | Provider physical/access state | LAN client configuration |
Swipe horizontally to see the evidence boundaries.
Trace which device role acts at each step
If the destination is local, steps 3–6 may not be involved at all. Device-role reasoning tells you which evidence is relevant.
Answer with the function, not just the product label
If a question says a wireless router learned a MAC on one of its LAN ports, the relevant function is switching. If it selected a route to another subnet, the relevant function is routing. If it associated a Wi-Fi station, the relevant function is the access point. One physical appliance can satisfy all three descriptions.
Match the problem to the control point that can actually solve it
Need more Ethernet ports
Switching capacity.
Need wireless coverage
Access point placement/capacity.
Need subnet-to-subnet forwarding
Router or Layer 3 switch.
Need traffic restrictions
Firewall/ACL policy.
Need provider access
Modem/provider edge.
Need host attachment
NIC/adapter.
One office has Wi-Fi, Ethernet, local printing, and no Internet
This is the value of device-role reasoning: every successful function removes a device role from the first-failure position.
Use shared dependencies to decide which device role deserves attention first
If one endpoint fails while other devices on the same switch, VLAN, gateway, firewall, and WAN path continue working, the shared infrastructure is already serving as a control. That makes the endpoint NIC, local cable, port configuration, client VLAN assignment, or host software more plausible than a provider outage. If every endpoint behind one switch fails at the same instant while users elsewhere remain healthy, the switch uplink or that switch's local path becomes much stronger.
This is device-role reasoning applied to scope: the failed population tells you which shared device function sits closest to the first failed dependency.
Prove the device function is failing before treating the chassis as the cause
A switch can be healthy while one VLAN is misconfigured. A router can be healthy while the firewall policy denies one source network. An access point can have excellent radio operation while DHCP fails upstream. A modem can show provider sync while the router has no usable default route. Replacing hardware is a weak response when the evidence points to configuration, policy, or an adjacent dependency.
24 Network Device Roles digital flashcards
Practice switch learning, router forwarding, access points, NICs, modems, Layer 3 switches, hubs, firewalls, home gateways, artifact interpretation, and troubleshooting by device role.