What are network devices?

A network device is a physical device or specialized system that helps establish, manage, forward, monitor, or secure network communications. Examples include routers, switches, wireless access points, firewalls, and network interface cards.

Different devices perform different jobs. A switch connects devices within a local area network (LAN), while a router forwards packets between IP networks. A firewall applies traffic security policies, and a wireless access point allows Wi-Fi devices to connect to a network.

Some functions can be combined in a single physical product. For example, a home router often includes a router, an Ethernet switch, a wireless access point, firewall features, and a DHCP server.

Types of network devices

The following table summarizes common network devices and their primary purposes.

1. Router

A router connects different IP networks and forwards packets toward their destinations. It examines network-layer information, particularly destination IP addresses, and uses its routing table to choose an appropriate next hop or outgoing interface.

How does a router work?

1. A device sends an IP packet toward a destination.
2. The router receives the packet on an interface.
3. It examines the destination IP address.
4. It checks its routing table and selects an appropriate route.
5. It forwards the packet through the selected interface, subject to applicable policies and processing.

Types of routers

• Home router: Connects household devices to a local network and internet connection.
• Enterprise router: Connects larger networks, offices, or sites.
• Core router: Forwards traffic within the backbone of a large network.
• Virtual router: Provides routing functionality through software.

Routers may also support Network Address Translation (NAT), DHCP, VPN connections, and firewall functions. These features depend on the product and configuration.

For example, when a laptop on a home network opens a website, its traffic usually passes through the local router toward the internet. The router does not necessarily inspect the contents of every application message.

2. Network switch

A network switch connects devices within a local area network. A typical Ethernet switch learns which MAC addresses are reachable through its ports and uses that information to forward Ethernet frames.

How does a switch work?

1. A device sends an Ethernet frame into a switch port.
2. The switch learns the source MAC address and the port where it was observed.
3. It checks the destination MAC address against its forwarding table.
4. If the destination is known, it forwards the frame through the appropriate port, subject to VLAN and other rules.
5. If the destination is unknown, the switch may flood the frame within the relevant VLAN, excluding the incoming port.

Types of switches

• Unmanaged switch: Offers basic connectivity with limited configuration.
• Managed switch: Supports configuration and monitoring features such as VLANs, port controls, and traffic statistics.
• Layer 2 switch: Primarily forwards Ethernet frames using MAC addresses.
• Layer 3 switch: Can also route IP traffic between networks or VLANs.
• PoE switch: Can provide electrical power to compatible devices through Ethernet.

Managed switches are particularly useful in business networks because they can support network segmentation, access controls, and monitoring. A switch alone does not automatically prevent every attack occurring on the connected network.

3. Hub, bridge and repeater

Hub

A hub is a basic Ethernet device that repeats incoming signals to its other ports. It does not learn MAC addresses or selectively forward frames to individual destinations.

Traditional Ethernet hubs create a shared collision domain and are largely obsolete in modern switched networks. A hub should not be confused with an Ethernet switch.

Bridge

A network bridge connects LAN segments and forwards or filters frames using MAC address information. A bridge can reduce unnecessary traffic between segments, depending on its configuration and forwarding behavior.

Ethernet switches are commonly understood as multiport bridges. Modern switching networks use bridging concepts to forward traffic within a LAN.

Repeater

A repeater regenerates or repeats signals to help extend a connection. It operates primarily at the physical layer and does not make forwarding decisions based on IP addresses.

Wireless repeaters and extenders can help extend Wi-Fi coverage. However, actual performance depends on placement, signal quality, interference, and the technology used.

4. Gateway and modem

Gateway

A gateway connects systems or networks and may translate between different protocols, data formats, or communication interfaces. The term has several meanings depending on the networking context.

In everyday home networking, the default gateway is usually the router address a device uses to reach destinations outside its local IP network. In other systems, a gateway may perform application or protocol translation.

Modem

A modem is a device that performs modulation and demodulation, or related signal conversion functions required by an access technology. The exact implementation depends on the connection type.

Cable and DSL connections commonly use modems. Fiber internet installations may use an optical network terminal (ONT), which performs a different role in the optical access network.

A modem or ONT is not necessarily a router. Some products combine access equipment, routing, Wi-Fi, and switching in one device.

5. Wireless access point

A wireless access point (AP) allows wireless clients to connect to a network using Wi-Fi. It usually bridges wireless traffic into a wired LAN.

Access points are used in homes, offices, schools, hospitals, warehouses, and public venues. Multiple access points can work together to provide coverage across a larger building.

Access point vs wireless router

A standalone access point primarily provides wireless network access. A wireless router commonly combines Wi-Fi, routing, Ethernet switching, and other functions.

A wireless access point is not the same as a wireless repeater. An access point typically connects clients to a LAN, often over Ethernet. A repeater or extender retransmits wireless traffic to extend coverage, depending on its design.

Wireless security

• Use WPA3 where supported, or an appropriate secure alternative.
• Use strong, unique Wi-Fi credentials.
• Keep access point firmware updated.
• Disable unnecessary management services.
• Use separate guest networks where appropriate.
• Review connected clients and wireless configuration.

6. Network security devices

Network security devices help organizations enforce access policies, inspect communications, detect threats, and reduce exposure to attacks. Their effectiveness depends on deployment, configuration, updates, and monitoring.

Firewall

A firewall applies rules to network traffic. Depending on its capabilities, it may filter traffic by addresses, ports, connection state, applications, or other characteristics.

Firewalls can be implemented in dedicated appliances, routers, operating systems, cloud environments, and other platforms. They may protect network boundaries or individual hosts.

Intrusion detection system (IDS)

An IDS monitors activity for signs of suspicious or malicious behavior. It may analyze network traffic, host events, or logs and generate alerts for investigation.

An IDS is generally designed to detect and report activity rather than automatically block every suspected threat.

Intrusion prevention system (IPS)

An IPS can inspect traffic and actively block or prevent activity that matches configured detection and prevention rules. Depending on the deployment, it may operate inline with network traffic.

Incorrect rules can block legitimate traffic, so prevention policies should be tested and monitored.

Web application firewall (WAF)

A WAF focuses on HTTP and HTTPS traffic to web applications. It can help detect and block certain application-layer attacks, such as requests matching known malicious patterns.

A WAF does not replace secure application development, software updates, authentication controls, or server hardening.

VPN gateway

A VPN gateway terminates or manages virtual private network connections. It can provide encrypted connections between remote users, offices, or networks, depending on the VPN technology.

VPN access should use strong authentication, current protocols, appropriate authorization, and regular security reviews.

7. Other important network devices

Network interface card (NIC)

A network interface card provides a device with a network connection. It may be an Ethernet adapter, a Wi-Fi adapter, or another supported network interface.

A NIC implements physical and data-link functions needed for its network technology. The operating system uses drivers and network configuration to communicate through it.

Load balancer

A load balancer distributes incoming connections or application requests across multiple servers. It can improve scalability and availability when correctly configured.

Layer 4 load balancers make decisions using transport-layer information, while Layer 7 load balancers can use application information such as HTTP request details.

Proxy server

A proxy handles requests on behalf of another system. A forward proxy commonly acts for clients, while a reverse proxy receives requests on behalf of servers.

Depending on configuration, proxies can support access control, logging, caching, traffic routing, or application protection. A proxy does not automatically make every connection private or secure.

Network monitoring appliance

Network monitoring systems collect and analyze information such as traffic flows, device status, interface utilization, errors, and logs. They help administrators identify outages, performance problems, and unusual activity.

Monitoring may use protocols and technologies such as SNMP, NetFlow or IPFIX, packet capture, system logs, and telemetry. What is available depends on the network equipment and monitoring platform.

Power over Ethernet (PoE) equipment

PoE-capable switches and injectors can supply electrical power over Ethernet cables to compatible devices, such as access points, IP cameras, and VoIP phones. The equipment must support suitable power standards and requirements.

Router vs switch vs hub vs bridge

These devices are often confused because they can all participate in connecting network equipment. Their forwarding behavior is different.

The OSI layer descriptions are useful learning guides, but real products can combine functions from multiple layers.

Example: devices in a home network

A typical home network might contain a router, an internet access device, Wi-Fi clients, and wired Ethernet devices.

In this example, the modem or ONT provides the access connection, while the router directs traffic between the home network and other IP networks. The router's Wi-Fi function allows wireless devices to connect.

Some internet providers supply a combined gateway device, so a separate modem, router, and access point may not be necessary.

Example: devices in a business network

A business network may use several types of equipment to connect employees, servers, wireless devices, and external services.

• Edge router: Connects the organization to an external network or internet provider.
• Firewall: Enforces security policies between selected network zones.
• Managed switches: Connect computers and servers and can separate traffic using VLANs.
• Wireless access points: Provide Wi-Fi access for authorized staff and guests.
• Load balancer: Distributes requests across application servers when needed.
• IDS or IPS: Detects suspicious traffic or blocks activity covered by prevention rules.
• Monitoring system: Helps administrators observe availability, performance, and security events.

The actual design depends on the organization's size, services, availability requirements, budget, and security needs. Not every network requires every device.

Network device security practices

Network devices are important security boundaries and can also become targets if their management interfaces, software, or configurations are exposed. Securing them is an important part of defending a network.

1. Change default credentials

Replace default administrative passwords with strong, unique credentials. Use multi-factor authentication where supported, particularly for remote management.

2. Update firmware and software

Apply vendor security updates according to a maintenance plan. Unsupported devices should be reviewed for replacement or isolation because they may no longer receive security fixes.

3. Restrict management access

Allow administration only from approved devices or management networks. Disable unnecessary services and avoid exposing management interfaces directly to the internet.

4. Segment the network

Use VLANs, routing policies, and firewalls to separate systems with different security needs. For example, guest Wi-Fi should generally be separated from internal administrative systems.

5. Monitor network activity

Review device logs, interface errors, unusual traffic, unexpected configuration changes, and authentication events. Centralized monitoring can make suspicious activity easier to investigate.

6. Secure wireless access

Use appropriate wireless encryption, remove unauthorized access, keep access point software updated, and review guest network settings.

7. Back up configurations

Maintain protected backups of important router, firewall, and switch configurations. Test recovery procedures so that a device failure or configuration mistake does not create prolonged downtime.

Frequently asked questions