Hub vs Switch vs Router: Network Devices Explained

Hubs, switches and routers all move data around a network, and they are constantly confused with each other. They are not interchangeable. Each one operates at a different level, makes a different decision about where data goes, and belongs in a different place in your network.

This guide explains what each device actually does, adds the three that always come up in the same conversation (the modem, the wireless access point and the firewall), and then shows how they fit together in a real office. If you are specifying equipment for a business rather than reading for interest, the sizing and selection sections toward the end are the ones to skip to.

The short answer

A hub connects devices on a local network and copies every incoming data packet to every other port. It makes no decisions and cannot tell devices apart. Hubs are obsolete and have not been used in new installations for roughly two decades.

A switch connects devices on a local network and sends each data packet only to the port where the destination device is connected. It learns the MAC address of every device attached to it. The switch is the workhorse of any business network.

A router connects two or more separate networks and forwards data between them based on IP address. It is the gateway between your local network and the internet, and it decides which path traffic takes.

A modem converts the signal from your internet provider into Ethernet your network can use. It does not create a network and it does not share a connection. That is the router’s job.

A wireless access point adds Wi-Fi to an existing wired network. It does not route traffic and it does not connect to the internet by itself. It plugs into a switch.

A firewall inspects traffic passing between networks and blocks what policy does not allow. In small networks it is a function inside the router. In business networks it is usually a separate device.

Quick comparison

Device	OSI layer	Uses which address	Sends data to	Connects	Still used?
Hub	Layer 1 (physical)	None	Every port	Devices on one network	No. Obsolete.
Switch	Layer 2 (data link)	MAC address	One specific port	Devices on one network	Yes. Everywhere.
Layer 3 switch	Layer 2 and 3	MAC and IP	One port, across VLANs	Multiple internal networks	Yes. Larger sites.
Router	Layer 3 (network)	IP address	The best path to another network	Separate networks	Yes. Always needed.
Modem	Layer 1	None	One upstream link	Your site to your ISP	Yes, where the ISP requires it.
Access point	Layer 2	MAC address	Wireless clients	Wi-Fi devices to the wired network	Yes.
Firewall	Layers 3 to 7	IP, port, application	Only what policy permits	Sits between networks	Yes. Essential.

What is a hub?

A network hub is a device that connects multiple Ethernet devices and repeats every signal it receives out of every other port. It operates at Layer 1 of the OSI model, has no memory of which device is on which port, and cannot distinguish one device from another.

When a packet arrives, the hub copies it to every port. Only the intended recipient keeps it. Every other device receives it, inspects it, and discards it.

Why hubs disappeared

• Wasted bandwidth. Every packet went everywhere. On a busy network most traffic was noise.
• Collisions. All ports shared one collision domain, so two devices transmitting at once corrupted both transmissions and both had to retry. Performance fell off a cliff as devices were added.
• Half duplex. Devices could send or receive, not both at once.
• No security. Any device on the hub could see all traffic passing through it, which made passive eavesdropping trivial.

Switches solved all four problems and became cheap enough to replace hubs entirely. If you find a hub in a working network today it is either a piece of test equipment used deliberately for traffic capture, or something that should have been removed years ago. In practice, when someone says “hub” in an office they almost always mean an unmanaged switch.

What is a network switch?

A network switch connects devices within a local network and forwards each data packet only to the port where its destination device sits. It learns and stores the MAC address of every connected device in a table, then uses that table to direct traffic. It operates at Layer 2 of the OSI model.

The learning process is simple. When a device sends its first frame, the switch records the source MAC address against the port it arrived on. Over a few seconds it builds a complete map. After that, traffic between two devices stays on the two ports involved and does not touch anything else.

The result is that every port gets its own dedicated bandwidth and its own collision domain, and devices can send and receive simultaneously. A 24 port gigabit switch gives all 24 devices a gigabit each rather than making them share one.

The four types of switch

 

Type	What it does	Suits
Unmanaged	Plug in and it works. No configuration, no visibility, no VLANs.	A handful of devices in a back room. Not appropriate as the core of a business network.
Smart (lightly managed)	Basic VLANs, QoS and port settings through a simple web interface.	Small offices that need traffic separation without a network engineer.
Managed	Full control: VLANs, QoS, link aggregation, port security, SNMP monitoring, spanning tree, remote management.	Any business network you need to segment, monitor or troubleshoot. The correct default for commercial installations.
Layer 3 (multilayer)	Everything a managed switch does, plus routing between VLANs in hardware.	Larger sites with several VLANs where traffic between them would otherwise bottleneck at the router.

A separate distinction that cuts across all four: whether the switch supplies Power over Ethernet. A PoE switch delivers power and data down the same cable, which is how wireless access points, IP cameras, VoIP phones and door controllers are powered without an electrician running a circuit to each one. Our guide to PoE, PoE+ and PoE++ covers the wattage classes.

For a walk through the specific product families, see our small business Cisco switches guide.

What is a router?

A router is a device that connects two or more separate networks and forwards data between them based on IP address. It examines each packet’s destination IP, consults its routing table, and sends the packet along the best available path. It operates at Layer 3 of the OSI model.

 

A switch moves traffic within one network. A router moves traffic between networks. That is the whole distinction, and everything else follows from it.

In practice a business router does several jobs at once:

• Routing. Choosing the path packets take to reach another network.
• NAT. Translating many private internal addresses into one or a few public addresses, which is how an entire office shares a single internet connection.
• DHCP. Handing out IP addresses to devices as they connect.
• Firewalling. Blocking unsolicited inbound traffic. Adequate in small networks, not a substitute for a proper firewall in larger ones.
• VPN termination. Providing encrypted remote access for staff and site-to-site links between offices.
• WAN handoff. Terminating whatever your provider delivers, whether fibre, coax or a bonded circuit.

Router capability scales enormously, from a small unit handling one internet connection to service provider hardware carrying vast volumes of traffic. What does not change is the function: deciding where a packet goes when its destination is not on the local network.

Modem vs router: what is the difference?

 

A modem converts the signal from your internet provider into Ethernet that your equipment can use. A router creates and manages your local network and shares one internet connection among many devices. The modem gives you a connection. The router gives you a network.

The confusion exists because most providers now supply a single box that does both, plus Wi-Fi, plus switching. Bell, Rogers and the others call these gateways or all-in-one units. They are four devices in one enclosure, which is why the terms blur.

	Modem	Router
Connects to	Your ISP	Your modem and your local devices
Provides	One internet connection	A network, shared internet, addressing, basic security
Devices supported	One	Many
Assigns IP addresses	No	Yes
Provides Wi-Fi	No	Only if it also contains an access point
Needed?	Depends on the service type. Fibre handoffs often use an ONT rather than a modem.	Always

Why businesses usually replace the ISP box

Provider-supplied gateways are built for households. In a commercial setting they run out of capability quickly: limited or no VLAN support, weak firewall policy, no useful logging, a small NAT table that struggles with many concurrent devices, and no way to hand off management to your IT provider. The common approach is to put the ISP unit into bridge or pass-through mode and run a proper router and firewall behind it.

Access point vs router: what is the difference?

 

A wireless access point adds Wi-Fi coverage to an existing wired network. It connects to a switch by Ethernet cable and converts wired traffic into wireless signal. It does not route between networks, does not assign IP addresses, and cannot connect to the internet on its own.

A home router with built-in Wi-Fi contains an access point, which is why the two get conflated. In a commercial building they are almost always separate, for a straightforward reason: one radio cannot cover a floor plate. Coverage comes from placing multiple access points at calculated positions, each cabled back to a PoE switch, all managed centrally.

Two practical points for business Wi-Fi. Access points are powered over the Ethernet cable, so the switch’s PoE budget has to account for them, and current generation units draw considerably more than older ones. And coverage is a design exercise, not a purchase: our guide to access point density and coverage planning covers how many a building actually needs.

On standards, Wi-Fi 7 (802.11be) was formally published in 2025 and now accounts for a large share of enterprise access point shipments. Wi-Fi 8 (802.11bn) is still in development with standard approval targeted for 2028, so it is not a reason to delay a deployment today. The more immediate consideration is that modern access points can saturate a 1 Gbps uplink, which is why multi-gigabit switch ports have become relevant. Our guide to 2.5GbE and 5GbE covers where that matters.

Where the firewall fits

A firewall inspects traffic crossing between networks and permits or blocks it according to policy. A basic firewall filters on IP address and port. A next generation firewall also identifies applications, inspects encrypted traffic, and applies intrusion prevention and content filtering.

 

Every router has some firewall capability. The question is whether it is enough. In a small office with a handful of staff and no regulatory obligations, the router’s built-in filtering may be adequate. Once you are handling health, legal, financial or cardholder data, or once you have staff connecting remotely, a dedicated firewall becomes the sensible boundary.

Physically it usually sits between the internet handoff and the core switch, so all traffic in and out passes through it. In many small and mid sized deployments the router and firewall are a single appliance, which is fine as long as it is a commercial unit rather than a consumer one.

Router vs switch: the direct comparison

The question comes up constantly, so here it is plainly.

	Switch	Router
Job	Connect devices inside one network	Connect separate networks to each other
Decides using	MAC address	IP address
OSI layer	2 (or 2 and 3 on a Layer 3 switch)	3
Typical port count	8 to 48 and up	Few, often 2 to 8
Speed of forwarding	Very high, handled in hardware	Lower, more processing per packet
Provides NAT, DHCP, VPN	No	Yes
Provides PoE	Commonly	Rarely
Can you skip it?	Only if you have very few wired devices	No. Something must route to the internet.

The clean way to remember it: a switch asks “which port is this device on?” A router asks “which network is this packet going to?”

Layer 3 switch vs router

A Layer 3 switch routes traffic between internal VLANs in hardware at very high speed. A router connects your network to the outside world and handles the functions that come with that boundary. They overlap in the ability to route, and differ in almost everything else.

Layer 3 switches forward packets through purpose-built silicon, which gives them consistently low latency and very high throughput on local traffic. What they generally do not do is NAT, VPN termination, deep security inspection or WAN interface handling. Routers handle those, at lower raw forwarding speed.

In a well-designed multi-VLAN site you use both. The Layer 3 switch routes between internal VLANs so that traffic between departments never leaves the switching core. The router handles the internet edge, NAT, VPN and WAN circuits. Sending all inter-VLAN traffic up to the router and back, sometimes called router-on-a-stick, works at small scale and becomes a bottleneck as the site grows.

What a real office network looks like

Working from the outside in, this is the order almost every commercial network follows.

1. The provider handoff. Fibre terminating on an ONT, or coax on a modem, delivered into your main network closet.
2. Router and firewall. The boundary. Handles NAT, policy, VPN and, where you have two providers, failover between them.
3. Core switch. The centre of the network. Everything else connects here. In larger sites this is a Layer 3 switch handling inter-VLAN routing.
4. Access switches. Distributed to each floor or zone, connected back to the core by fibre or high-speed copper, providing the ports that user devices plug into.
5. Structured cabling. The permanent link from each access switch to each outlet. This is the layer with the longest life. Equipment is replaced every five to seven years, cabling every fifteen to twenty.
6. Endpoints. Workstations, wireless access points, VoIP phones, IP cameras, door controllers, printers.

Two things about this layout are worth stating plainly, because they are where most small business networks go wrong.

First, the network closet layout is a design decision, not a storage decision. Where the main distribution frame sits and how many intermediate frames you need is determined by cable distance limits and floor geometry. Our MDF and IDF guide covers this.

Second, the cabling outlives everything above it. Specifying Cat6A instead of Cat5e costs modestly more at install and determines what your network can do for the next fifteen years. Retrofitting cable into an occupied building costs far more than getting it right during fit-out.

How to size a switch for your office

The most common specification mistake is counting desks and buying that many ports. Work through these five instead.

1. Count every device, not every person

A 30 person office is rarely 30 ports. Count workstations, VoIP phones that are not daisy-chained through a PC, printers, wireless access points, IP cameras, door controllers, the alarm panel, the AV equipment in each meeting room, and anything else with an RJ45 socket. Thirty people frequently means sixty to seventy live ports.

2. Add 30 percent headroom

Networks only grow. Filling a switch to capacity on day one means buying another one within two years and running out of closet space.

3. Calculate the PoE budget separately from the port count

A switch has two limits: how many ports it has, and how many total watts it can deliver. These are not the same, and people plan against the first. Add up the actual draw of every powered device, then confirm the switch’s total PoE budget covers it with room to spare. Access points and cameras consume far more than phones do.

4. Plan the uplinks

An access switch connecting 48 devices back to the core over a single 1 Gbps link is a bottleneck by design. Use fibre or multi-gigabit uplinks, and use two of them aggregated where the traffic justifies it.

5. Put it on a UPS

When the switch loses power, the phones, the cameras, the door controllers and the Wi-Fi all go down together, because they are all powered by it. Sizing that UPS is covered in our UPS wattage guide.

Managed or unmanaged?

For any commercial network, managed. The reasons are practical rather than theoretical. You cannot separate guest Wi-Fi, security cameras and payment systems from your business traffic without VLANs. You cannot prioritise voice without QoS, so calls degrade whenever someone uploads a large file. And when something breaks, an unmanaged switch gives you no visibility at all, which turns a ten minute fix into a day of guessing.

The cost difference is real but small against the cost of one afternoon of downtime. Unmanaged switches have a legitimate place for a few devices in a remote corner. They do not belong at the centre of a network a business depends on.

Mistakes that come up repeatedly

Daisy-chaining unmanaged switches. Someone needs two more ports, so a five port switch goes under a desk. Then another. Eventually there are four hops between a workstation and the core, nobody has documented any of it, and intermittent faults become impossible to trace.

Relying on the ISP gateway as the whole network. It is a consumer device with a small NAT table and no meaningful segmentation. It will work until it does not, usually as headcount grows.

Buying port count without checking the PoE budget. The symptom is devices rebooting at random, and it surfaces weeks later when an extra access point is added.

Putting cameras and door controllers on the same flat network as everything else. Security devices are frequently the weakest link and should be on their own VLAN.

Specifying Cat5e to save a small amount at fit-out. The cabling has to last through three generations of equipment. This is the wrong place to economise.

Leaving the network closet unventilated. A closed cupboard with a switch, a UPS and a patch panel gets hot, and heat shortens equipment life considerably.

Frequently asked questions

What is the difference between a hub, a switch and a router?

A hub copies every data packet to every connected port and makes no decisions. A switch sends each packet only to the port where the destination device is, using MAC addresses. A router forwards data between separate networks using IP addresses. Hubs are obsolete. Switches connect devices within a network. Routers connect networks to each other.

Do I still need a hub?

No. Hubs have been obsolete for around twenty years. They waste bandwidth, cause collisions, run at half duplex and let any connected device see all traffic. An unmanaged switch does the same job better and costs about the same. The only remaining use is deliberate traffic capture for diagnostics.

Is a router the same as a modem?

No. A modem converts your provider’s signal into Ethernet and gives you one connection. A router creates your local network and shares that connection among many devices. Most providers now supply a combined unit containing a modem, router, switch and access point, which is why the terms get confused.

Can I use a switch instead of a router?

Only for local traffic. A switch lets devices on the same network communicate, but it cannot reach the internet or any other network because it does not read IP addresses or perform NAT. Every network that reaches the internet needs a router somewhere.

Can a router work without a switch?

Yes, for a small number of devices, since most routers include a few switch ports. Once you exceed those ports you add a switch. In any office of meaningful size the router handles the internet edge and a separate switch provides the ports.

What is a Layer 3 switch and do I need one?

A Layer 3 switch routes traffic between internal VLANs in hardware at very high speed. You need one when you have several VLANs and enough traffic between them that sending it all through the router creates a bottleneck. Smaller sites with two or three VLANs generally do not need one.

What is the difference between a managed and an unmanaged switch?

An unmanaged switch works out of the box with no configuration and no visibility. A managed switch lets you create VLANs, prioritise traffic with QoS, aggregate links, apply port security and monitor what is happening. For any business network, managed is the correct choice, mainly because you cannot segment or troubleshoot without it.

Is an access point the same as a router?

No. An access point adds Wi-Fi to an existing wired network and plugs into a switch. It does not route traffic, assign IP addresses or connect to the internet by itself. A home Wi-Fi router contains an access point alongside a router and a small switch, which is where the confusion starts.

How many ports does my office switch need?

Count devices rather than people. Workstations, VoIP phones, printers, access points, cameras, door controllers and meeting room equipment all need ports. A 30 person office commonly needs 60 to 70. Then add roughly 30 percent headroom, because networks only grow.

Do switches need power over Ethernet?

Only if they are powering devices. PoE lets a switch deliver power and data down one cable, which is how access points, IP cameras, VoIP phones and door controllers are powered without running electrical circuits to each one. If you have any of those, a PoE switch saves significant electrical work. Check the total wattage budget, not just the port count.

What order do the devices go in?

Internet handoff, then router and firewall, then core switch, then access switches, then endpoints. Wireless access points connect to a switch, not to the router directly. Structured cabling links the switches to the wall outlets and outlasts everything plugged into it.

Which layer of the OSI model does each device work at?

A hub operates at Layer 1, the physical layer. A switch operates at Layer 2, the data link layer, using MAC addresses. A router operates at Layer 3, the network layer, using IP addresses. A Layer 3 switch spans layers 2 and 3. Firewalls operate from Layer 3 up to Layer 7 depending on their capability.

Getting a business network built properly in Toronto and the GTA

Understanding what each device does is the first half. The second half is a network that is actually designed: correct closet placement, cabling specified for the next fifteen years rather than the next two, switches sized against real device counts and real PoE budgets, and segmentation that keeps cameras and guest Wi-Fi away from your business systems.

Cablify designs and installs commercial networks across Toronto, Mississauga, Brampton, Vaughan, Markham, Oakville, Burlington, Hamilton, Kitchener and the wider GTA. That covers structured network cabling, data cabling, fibre backbone, rack and patch panel build, switch and access point installation, and Fluke DSX certification on every run with the results documented.

If you are choosing equipment, our guide to Cisco switches and routers covers the product families in detail.

Site surveys are free and the quote is based on what we find onsite. Call 1-647-846-1925 or 1-877-450-2134, or email info@cablify.ca. Most replies come back inside one business day, weekdays through 8pm.

Book a free site survey

Related guides

• Types of Cisco switches and routers
• Small business Cisco switches: PoE, features and models
• PoE, PoE+ and PoE++ explained
• What is an MDF and IDF? A guide to network closets
• How many access points does a building need?
• 2.5GbE, 5GbE and multi-gigabit ethernet explained
• Cat6A cabling installation

========================================================================
SECTION D. STRUCTURED DATA (JSON-LD)
Article + FAQPage. The FAQPage block is the one that matters most here,
because it is what feeds AI Overviews and People Also Ask.
========================================================================