/

Switch vendors keep layering on the hype

At NetWorld+Interop 97 in Atlanta, several vendors - including Cabletron and start-up YAGO Systems, Inc. - chatted up the concept of Layer 4 switches. I can understand vendors' need to differentiate their offerings in this noisy market, but labeling what are essentially routers as Layer 4 switches goes too far.

Today, it seems every new piece of network gear must have the word switch in its name or risk losing some mysterious cachet. Bridges have long since morphed into switches, while routers have devolved into something called Layer 3 switches. Even router king Cisco has dubbed its latest router offering the 12000 Gigabit Switch Router. We go through this semantic silliness from time to time anyone remember "brouters"?

Routers are being redeemed to some extent. Out of this soupy category known as Layer 3 switches have emerged routing switches and switching routers. In essence, these devices have the brains of routers and the body (guts may be more accurate) of switches. But before we've even had a chance to sort out all the devices lumped under the category of Layer 3 switches, along comes this craze called Layer 4 switching.

Does anybody remember what's defined at Layer 4 of the Open Systems Interconnection model? What about Layers 5, 6 and 7? Dare we contemplate devices called Layer 5 switches? What about Layer 6 and Layer 7 switches? I hope not.

Clearly, the networking industry is evolving rapidly. Switching technology has revolutionized the way we build network equipment, providing a much faster means of moving packets than older, bus-based backplane designs. Some functions that were performed in software are now performed in hardware. But in the rush to label everything a switch, we have failed to develop a common vocabulary that lets us discuss the various devices from a functional perspective.

I think we can all agree that a Layer 2 switch is a device that forwards a packet across a network based on its Layer 2, or media access control (MAC), address. Similarly, at a minimum, we can say a Layer 3 switch is a device that can forward a packet based on its Layer 3, or network layer, address.

What about so-called Layer 4 switches? Do they forward a packet based on its Layer 4, or transport layer, information?

No. Vendors such as YAGO admit they're not forwarding packets across the network based on Layer 4 information. Rather, like many routers, a Layer 4 switch is a device that can look deep enough into a packet to see transport layer information. In the TCP/IP protocol suite, TCP and User Datagram Protocol (UDP) make up the transport layer.

TCP specifies how two computers format data and acknowledgements to achieve reliable data transfer. A key function TCP performs is distinguishing among multiple destination programs or processes on a single host computer. These destinations are defined by IP addresses of the communicating hosts, along with port numbers. Likewise, UDP uses port numbers to distinguish among multiple programs.

Some applications, such as Lotus' cc:Mail and Notes and Microsoft's SQL Server, have been assigned port numbers by the Internet Assigned Numbers Authority. However, many assigned ports, as documented in RFC 1700, relate to protocols such as telnet, Simple Mail Transfer Protocol, Network News Transfer Protocol and things like the NETBIOS Name Service, rather than applications in the literal sense. Instead of having preassigned numbers, many actual applications are assigned port numbers on a dynamic basis.

Promoters of Layer 4 switching say it's their use of transport-layer information, such as port numbers, that distinguishes their products from Layer 3 switches. However, full-featured routers have had this capability to peer far into packets for years. And firewall products do it all the time. In addition, several vendors, including Ipsilon with its IP Switching and Cisco with its NetFlow switching, already exploit TCP and UDP information as part of their switching schemes. Both Ipsilon and Cisco use source and destination IP address, protocol type and port numbers to identify flows - that is, a certain type of traffic passing from a sender to a receiver. It's what these vendors - and makers of so-called Layer 4 switches - do with these flows that's interesting.

All of these vendors have built devices that can peer deep enough into a packet to identify traffic types, such as SMTP. They also are working on ways to apply policies to a specific traffic flow so it gets a certain amount of bandwidth, a predefined priority or other quality of service and a particular security handling. Likewise, these vendors are defining ways to keep track of the packet traffic for accounting purposes.

These are all valuable capabilities and are at the heart of policy-based management. Many vendors are pursuing ways to deliver these capabilities; they are not unique to so-called Layer 4 switches. With the marketing hype in overdrive, IT managers need to focus on what a device can do, not what it's called.

Petrosky is a senior analyst at The Burton Group, an information services firm that provides in-depth technology analysis. She can be reached at (415) 572-0560 or petrosky@tbg.com.