Switch

What is a switch?

A switch is a network component that connects devices within a local area network (LAN) and forwards each Ethernet frame only to the port where the destination device is located, based on its MAC address. As a result, every connected device gets its own collision-free link and the rest of the network is not burdened with traffic that is not meant for it. In OT environments, switches form the backbone of Industrial Ethernet: they connect PLCs, HMIs, Drives, IO modules and SCADA servers, and they largely determine how reliably, quickly and securely a plant communicates.

Switches form the heart of both IT and OT networks. On the factory floor, a failed or misconfigured switch is often the direct cause of a stopped production line.

🧠 How does a switch work?

A switch operates at layer 2 of the OSI model (the data link layer) and follows a fixed pattern:

1. Learning - for every incoming frame, the switch records the source MAC address and the port in its MAC address table (also called the CAM table).
2. Lookup - the switch reads the destination MAC address and looks up the matching port.
3. Forwarding - if the address is known, the frame goes to that single port only (unicast).
4. Flooding - broadcasts, unknown unicast and (without IGMP snooping) multicast are sent to all ports in the same VLAN.
5. Ageing - unused table entries expire after the ageing time, 300 seconds by default, so a device that has moved is learned again.

Each port is its own collision domain and almost always runs full duplex, so the old CSMA/CD mechanism of shared Ethernet no longer plays a role. Switches usually work in store-and-forward mode (receive the whole frame and check its checksum first) or cut-through mode (forward as soon as the destination address has arrived, with lower latency). Layer 3 switches can also route between VLANs, a task that otherwise belongs to a router or firewall.

The Ethernet switch emerged around 1990: Kalpana’s EtherSwitch is regarded as one of the first multiport switches, and Cisco acquired Kalpana in 1994. This gradually pushed the hub, which repeated every frame to all ports, out of corporate networks.

🔄 What is the difference between a hub, a switch and a router?

🔧 What types of switches are there?

• Unmanaged switch - plug and play, no configuration, no VLANs or monitoring. Suitable for a small, isolated machine.
• Smart or web-managed switch - limited settings such as VLANs and port priority, often through a web interface.
• Managed switch - fully configurable via web, CLI or SNMP, with VLANs, QoS, redundancy protocols, logging and security features.
• Layer 3 switch - a managed switch that also routes between subnets and supports ACLs at IP level.
• Industrial switch - built for DIN rail or 19-inch rack mounting, with a typical operating range of -40 to +75 or +85 °C, redundant 24 V DC power inputs and resistance to vibration, dust and EMC interference.
• PoE switch - powers cameras, access points and sensors over the network cable: 15.4 W per port (IEEE 802.3af), 30 W (802.3at) or 60 to 90 W (802.3bt).

Substations add further requirements: IEC 61850-3 and IEEE 1613 describe the environmental and EMC requirements for network equipment installed alongside protection relays, in line with IEC 61850.

🏭 How are switches used in industrial networks?

• Connecting control and field - PLCs, HMIs, O and sensors via PROFINET, IP or Modbus TCP.
• Prioritising real-time traffic - with QoS, time-critical frames get precedence; PROFINET RT uses EtherType 0x8892 and VLAN priority 6. For deterministic traffic with guaranteed latency there is TSN.
• Redundancy - ring redundancy via MRP or DLR, meshed networks via RSTP, or seamless redundancy via PRP (two parallel networks) and HSR (ring).
• Segmentation - VLANs for network segmentation in line with the Purdue Model and the zones and conduits model.
• Monitoring - SNMP statistics and traps, logging to Syslog or a SIEM, and a SPAN port that copies traffic to an IDS for passive monitoring.
• Time synchronisation - switches with PTP support (IEEE 1588) acting as transparent or boundary clocks.

🔐 How do you secure a switch in an OT network?

A switch is both an attack target and a security tool. Hardening starts with the device itself:

• Lock down management - only SSH, HTTPS and SNMPv3; disable Telnet, HTTP and SNMPv1/v2c; manage the switch through a dedicated management VLAN.
• Replace default passwords and control access with RBAC and central authentication.
• Disable unused ports and assign them to an empty VLAN, or seal them physically.
• Port Security and MAC Filtering - limit which and how many MAC addresses are allowed per port; bear in mind that MAC addresses can be spoofed, so this is hygiene rather than strong authentication.
• 802.1X - real port authentication, where the end devices support it.
• DHCP Snooping, Dynamic ARP Inspection and IP Source Guard against ARP spoofing and rogue DHCP servers.
• ACLs on layer 3 switches to filter traffic between VLANs, as a complement to an industrial firewall.
• Keep firmware up to date through patch management, and back up configurations under change management.
• Logging to Syslog or a SIEM, with time from NTP, so you can spot changes and unknown devices.

For components, IEC 62443-4-2 sets out the technical requirements per security level; several vendors have their industrial switches certified against it. Together these measures give you access control and security at the very first hop of the network.

🧭 How do you choose and configure a switch for OT?

1. Take inventory - which devices, protocols and bandwidth are needed, and where does the switch sit in the Purdue Model? Record this in your asset inventory.
2. Choose the type - a managed industrial switch for anything related to production; unmanaged only inside an isolated machine.
3. Choose redundancy - MRP for PROFINET, DLR for EtherNet/IP, PRP/HSR where no interruption at all is acceptable.
4. Design VLANs and QoS - separate production, engineering, management and cameras; give real-time traffic priority.
5. Harden the switch - follow the list above and document the baseline.
6. Monitor and maintain - SNMP/Syslog, a SPAN port for the IDS, and periodic configuration reviews.

Dutch and European context. Under the Dutch Cyberbeveiligingswet, the national implementation of NIS2, essential and important entities must take appropriate measures for their network and information systems, and securely configured switches are part of that. The Cyber Resilience Act classifies switches as important products of class I: from 11 September 2026 manufacturers must report actively exploited vulnerabilities, and from 11 December 2027 they must meet all essential requirements, such as a secure default configuration and secure updates.

❓ Frequently asked questions

What is the difference between a switch and a hub?

A hub repeats every incoming signal to all ports, so all connected devices share a single collision domain. A switch learns which MAC addresses sit behind which port and sends a frame only to the correct port. A switch is therefore faster, more efficient and harder to eavesdrop on than a hub.

At which OSI layer does a switch operate?

A standard switch operates at layer 2 of the OSI model and forwards traffic based on MAC addresses. A layer 3 switch can also route between subnets and VLANs based on IP addresses. For secured traffic between OT zones, a firewall is still the appropriate place.

When do you need a managed switch?

You need a managed switch as soon as you want to use VLANs, QoS, redundancy protocols, monitoring or port security. In OT networks that are connected to SCADA or the corporate network, a managed switch is therefore the norm. An unmanaged switch only fits small, fully isolated machine networks.

What is an industrial switch?

An industrial switch is a switch built for harsh conditions, such as temperatures from -40 to +75 °C or higher, vibration, dust and electromagnetic interference. It is usually mounted on a DIN rail, has redundant 24 V power inputs and supports industrial redundancy protocols such as MRP. For substations, IEC 61850-3 and IEEE 1613 apply in addition.

How quickly does a switched network recover from a cable break?

The recovery time of a switched network depends on the redundancy protocol. Classic STP needs 30 to 50 seconds, RSTP usually less than a second, MRP a guaranteed 200 ms in its most widely used profile and DLR about 3 ms. PRP and HSR send every frame twice and therefore have no recovery time at all.

Can a switch be hacked?

A switch can be hacked if its management interfaces are exposed, default passwords have not been changed or its firmware contains vulnerabilities. An attacker with management access can redirect traffic, change VLANs or bring down a production network. Hardening, current firmware and logging to a SIEM greatly reduce that risk.

📌 In summary

A switch connects devices on a local network and sends each Ethernet frame only to the destination’s port, based on the MAC address. In industrial environments, managed, rugged switches are indispensable for reliability, segmentation and security: with VLANs, QoS, redundancy protocols such as MRP and PRP, and a properly hardened configuration, they form the foundation of a secure OT network.