Latest / Logosofia no Dia a Dia / Managed vs Unmanaged Switches: What You Actually Need

Transcript

Managed vs Unmanaged Switches: What You Actually Need · Logosofia no Dia a Dia

• [Prompt] custom: Let's talk about managed versus unmanaged Ethernet switches. I have, I think, 4 Ethernet switches in | Hosts: corn, herman [Response] Corn: Daniel sent us this one — and I have to say, it's the most honest networking prompt we've ever gotten. He owns four Ethernet switches and has no idea what managed actually means. He buys based on port count, speed, PoE, maybe an SFP slot if he's feeling fancy. And he assumes managed just means there's a web UI somewhere. That's it. That's the entire decision framework. Herman: Which is exactly how most people buy switches. They treat them like power strips. You need more outlets, you buy another one, you plug it in, you hope nothing catches fire. The fact that one power strip has a CPU inside running a Linux kernel and the other is just copper and plastic — who cares, right? They both deliver electricity. Corn: That's the thing. Daniel's confusion isn't confusion at all. It's the rational response to an industry that markets managed switches like they're sacred objects while most home users experience exactly zero difference between a twenty dollar unmanaged switch and a three hundred dollar managed one. So the real questions are: what does managed actually add, why do manufacturers push it so hard, and does any of it matter if you're not running a data center? Herman: The answer to that first question is surprisingly concrete. A managed switch adds a CPU and a software stack. That's it. That's the entire distinction. An unmanaged switch is a purpose-built ASIC that reads MAC addresses and forwards frames — a hardware appliance with no brain. A managed switch has a brain. It runs an operating system, usually some flavor of Linux or VxWorks, and that brain lets you tell it what to do instead of just letting it do its one hardwired job. Corn: It's the difference between a toaster and a toaster that runs Linux and has an API. Herman: I mean, yes, but also no, because the toaster that runs Linux can now decide which slice of bread gets toasted first based on priority rules you configure, and it can isolate the rye bread from the sourdough so they don't contaminate each other, and it can send you a notification when the heating element starts failing. The brain opens up an entire category of capabilities that the dumb toaster simply cannot do. Corn: Yet most people just want toast. Herman: Most people just want toast. And that's the tension we're going to dig into. Because the features that managed switches unlock — VLANs, Quality of Service, link aggregation, loop prevention, port monitoring, security authentication — these are genuinely powerful. But the gap between powerful and actually useful in a home with four switches and a bunch of IoT devices? That's where it gets interesting. Corn: Let's start with the basics. What actually changes when you plug into a managed switch versus an unmanaged one? Herman: The first thing to understand is that we're not actually dealing with a binary choice. Managed versus unmanaged sounds like two categories, but the reality is a spectrum. On one end you've got the twenty dollar dumb switch — pure hardware, no software, no interface of any kind. It reads the destination MAC address on each frame, looks it up in a table it built by watching where traffic comes from, and forwards it out the right port. That's it. Corn: On the other end? Herman: On the other end you've got a fully managed switch with a command-line interface, SNMP for monitoring, 802.1X port authentication, sFlow for traffic analysis — the kind of thing a network engineer at a university campus configures over SSH. But between those two poles there's this whole middle ground. Web-managed switches. Easy smart switches — which is actually what TP-Link calls their entry-level managed line, and I love that branding because it's honest about what they are. Corn: That's the networking equivalent of "I'm not a doctor but I stayed at a Holiday Inn Express. Herman: It kind of is. The TP-Link TL-SG108E is the poster child here. Forty dollars, eight gigabit ports, and it gives you a web interface where you can configure VLANs and basic QoS and port mirroring. It's not fully managed — no CLI, no SNMP, no 802.1X — but it crosses the line from pure hardware into configurable. Ubiquiti's UniFi switches sit a bit higher up the curve but are still aimed at prosumers and small offices. Corn: The industry has basically acknowledged that there's demand for something between "dumb metal" and "requires a certification to operate. Herman: And that's why manufacturers make such a big deal about managed switches in their marketing. It's not because they think every home user needs SNMP traps. It's because the managed features are what differentiate their products in a market where the basic job — forwarding Ethernet frames at wire speed — was commoditized twenty years ago. A forty dollar smart switch and a twenty dollar unmanaged switch both move packets at one gigabit per second with the same latency. The hardware ASICs are nearly identical. The only thing the extra twenty bucks buys you is the CPU and the software stack. So that's what they have to sell. Corn: Which explains why the feature lists on these product pages read like they're trying to justify their own existence. "Supports IEEE 802.3ad link aggregation with LACP!" And you're sitting there thinking — I just want my Xbox to have internet. Herman: And the honest truth is that for a lot of home users, the twenty dollar switch is the correct purchase. But the moment your network crosses a certain complexity threshold — and we'll define that threshold — the smart switch stops being a luxury and starts being the thing that prevents your cheap IP camera from having a chat with your laptop at three in the morning. Corn: The spectrum matters because the question isn't "should I buy managed." The question is "where on this continuum does my network actually live. Herman: The short answer is: a managed switch gives you a control plane. And the feature that control plane unlocks, the one that matters more than any other, is VLANs. This is the killer app of managed switching, and it works by doing something that sounds almost too simple to be useful — it lets you take one physical switch and slice it into multiple logical switches that can't see each other. Corn: Which is a weird thing to want, until you think about what's actually on your network. Herman: Daniel mentioned he's got four switches in his house. If they're all unmanaged, every single device plugged into any of them is in the same broadcast domain. Your laptop, your wife's phone, the smart thermostat, the cheap IP camera you bought on AliExpress that definitely phones home to a server in Shenzhen — they're all on the same logical wire. An unmanaged switch forwards frames based on MAC addresses, but broadcast traffic? That goes to every port, every time. Corn: Broadcast traffic is constant. ARP requests, DHCP discoveries, mDNS from every smart speaker announcing itself. It's not nothing. Herman: It's not nothing. In a home with thirty IoT devices, you're looking at hundreds of broadcast frames per minute. Now, that's not going to saturate a gigabit link — we're talking tiny packets — but the real issue is that there's no boundary. The IP camera on your porch and the laptop you do your banking on are in the same broadcast domain. A managed switch with VLANs changes that by inserting a four-byte tag into the Ethernet frame header. That tag contains a VLAN ID, a number between one and 4094. The switch uses that tag to decide which ports can talk to which. Ports on VLAN ten can't see traffic on VLAN twenty, even though they're on the same physical hardware. Corn: It's like putting up drywall inside a warehouse. Same building, different rooms, no line of sight between them. Herman: And the practical application is immediate. You create one VLAN for your trusted devices — laptops, phones, the NAS. Another VLAN for IoT — cameras, thermostats, smart plugs, anything that doesn't need to talk to your main devices. Maybe a third for guests. The IoT VLAN can reach the internet but can't initiate connections to your main LAN. If that cheap IP camera is compromised, the attacker gets a foothold on a network segment that contains nothing but other cheap IoT devices. Your laptop never shows up in their ARP table. Corn: This isn't theoretical. There are documented cases of cheap Android TV boxes and IP cameras shipping with malware that scans the local network. On a flat unmanaged network, it finds everything. On a VLAN-segmented network, it finds a room full of other compromised lightbulbs and nothing else. Herman: The tradeoff, of course, is complexity. VLANs require a router that understands 802.1Q tagging — you need something to route between VLANs when you do want them to talk, like letting your main LAN reach the printer that's on the IoT VLAN for security. That means configuring trunk ports, setting up inter-VLAN routing rules. It's not plug-and-play. But for a motivated home user with a web-managed switch and a couple of hours on a Saturday? Corn: The next feature on the list builds on the same tagging mechanism. Herman: Quality of Service. It uses three bits inside that same four-byte VLAN tag to assign a priority code — zero through seven — to each frame. Zero is best effort, the default. Seven is network control traffic, the highest. The switch maintains separate transmit queues per port, and when there's congestion — when more frames are trying to leave a port than the link can handle — it services the higher-priority queues first. Corn: This is the thing that prevents a YouTube video from destroying a phone call. Herman: On an unmanaged switch, every frame is equal. A VoIP packet carrying twenty milliseconds of your voice gets the same treatment as a TCP segment from a 4K video stream. If the video saturates the egress buffer, your voice packet sits in line behind it. Without QoS, a 4K YouTube stream can add two hundred to five hundred milliseconds of latency to a VoIP call. That's the difference between a natural conversation and two people constantly talking over each other. Corn: Five hundred milliseconds is an eternity in voice. You feel it immediately. Herman: You absolutely feel it. 1p marking, the switch identifies the VoIP traffic — usually by its DSCP value in the IP header, which maps to a specific dot one p priority — and puts it in queue five or six. The video traffic stays in queue zero. When congestion hits, the switch drains the voice queue first. The video buffers slightly, which nobody notices, and the call stays clear. Corn: For a small office with VoIP phones, this is essential. For a home where someone's on a Zoom call while someone else is downloading a game on Steam? Herman: It's another feature that even the forty dollar smart switches support. Basic dot one p queuing, usually with four hardware queues per port instead of the full eight, but that's plenty for a home. Voice and video in the high queues, everything else in the low queue. The complexity tradeoff is minimal — most devices already mark their traffic correctly, so the switch just needs to be told to respect the marks. Corn: Now link aggregation. This is where we start drifting into enthusiast territory. Herman: LACP, Link Aggregation Control Protocol. 3ad, now folded into 802.It lets you bundle multiple physical ports into a single logical link. Two gigabit ports become one two-gigabit link. Four become four gigabits. And there's redundancy built in — if one cable fails, traffic keeps flowing over the remaining links. Corn: Which sounds incredible until you do the math on what actually needs that much bandwidth in a home. Herman: A single gigabit link delivers about 125 megabytes per second at the application layer. Most hard drives — even SSDs over a network file protocol like SMB — can't sustain writes at that rate. A typical NAS with spinning disks might write at eighty to a hundred megabytes per second. So you're already bottlenecked by the storage, not the network. Where LACP actually helps is when you've got multiple clients hitting the same server simultaneously — a video editing team pulling files from a shared NAS. For a home user with one or two people? The single gigabit link is almost never the bottleneck. Corn: It's the feature that looks best on a spec sheet and matters least in practice. Herman: For homes, absolutely. It's also a configuration headache — both ends of the link need to support LACP and be configured to match. Get the hashing algorithm wrong and you can end up with all your traffic pinned to one physical link anyway. Corn: Then there's Spanning Tree, which is the one feature on this list that exists purely to prevent disaster. Herman: Spanning Tree Protocol. STP, or Rapid STP in modern implementations. This is the feature that saves you from yourself. Ethernet has a fundamental design constraint: it cannot tolerate loops. If you connect two switches together with two cables — either accidentally or because you thought it would add redundancy — you've created a loop. A broadcast frame enters one switch, gets forwarded out both cables to the second switch, which forwards it back to the first switch, which forwards it again, and within seconds you've got a broadcast storm. Every link is saturated. The network is down. Corn: Unmanaged switches have no defense against this. Herman: The switch ASIC just forwards frames. It doesn't know the network topology, doesn't detect loops, doesn't care. If you create a physical loop on an unmanaged network, you will find out about it when everything stops working and you have to physically trace cables to find the culprit. A managed switch running STP detects the loop by exchanging Bridge Protocol Data Units with neighboring switches, builds a map of the topology, and blocks the redundant path at the port level. The loop is still physically there, but the switch disables one end of it logically. If the active path fails, STP recalculates and unblocks the backup within seconds. Corn: It's a circuit breaker. You hope you never need it, but if you do, the alternative is a dead network and a very frustrating afternoon. Herman: In a home with four switches — Daniel's situation — it's not hard to accidentally create a loop. Someone plugs a cable into two ports on the same switch. Someone connects a switch to itself while reorganizing cables. A mesh Wi-Fi system with wired backhaul providing a redundant path — if that backhaul isn't running STP, congratulations, you've just built a broadcast storm generator. I've seen it happen. A friend called me in a panic because his entire home network went down after he plugged in a second switch "for more ports." He'd connected both switches to each other twice without realizing it. Corn: The network equivalent of crossing the streams. Total protonic reversal. Herman: That's actually not far off. And the fix was unplugging one cable. But diagnosing it took an hour of cable tracing. STP would have blocked that second link silently and he'd never have known there was a problem. Corn: Those are the features Daniel's actually likely to encounter — VLANs, QoS, link aggregation, loop prevention. But there's a whole other layer of managed switch capabilities that sit above this, in the monitoring and security space, and this is where the gap between enterprise and home gets really wide. Herman: Once you have that CPU and software stack, the switch can do more than just forward frames intelligently. It can report on what it's seeing. SNMP, the Simple Network Management Protocol, lets the switch expose port statistics — bytes in, bytes out, error counts, packet drops, link state changes. You point a monitoring tool at it and suddenly you've got graphs. You can see which port is saturated, which one is throwing CRC errors, which one has been flapping up and down at three in the morning. Corn: The value here is proactive. You know something's wrong before anyone complains. Herman: A managed switch can send an SNMP trap when a port's error rate exceeds one percent. That's a failing cable or a dodgy NIC announcing itself before it takes down the link entirely. sFlow and NetFlow go further: they sample actual traffic flows and let you see who's talking to whom, on which protocols, at what volume. In an enterprise, this is essential. You've got a hundred switches and two thousand users. You need to know where the problem is before you start walking around. Corn: You've got four switches and you're the only user who cares. If the network is slow, you unplug the thing you just plugged in. Herman: That's the reality check. SNMP monitoring in a home network is a hobby, not a necessity. It's fun to have Grafana dashboards showing your per-port traffic — I'm not going to pretend I don't enjoy that — but it's not solving a problem you actually have. You are the monitoring system. You notice when Netflix buffers. Corn: The security features, though — those feel different. Those feel like they might actually matter. Herman: Some of them do, but the most powerful ones are also the most enterprise-specific. 1X port-based authentication. A device has to authenticate before the switch even enables the port. The switch talks to a RADIUS server, the device presents credentials — usually a certificate — and if it's not authorized, the port stays dead. Plug in a random laptop? No link light. No network access at all. Corn: Which sounds amazing for preventing someone from walking into your office and plugging into an open Ethernet jack. Herman: It's perfect for that. It's also completely unusable in a home. Most home devices — smart TVs, game consoles, IoT sensors — don't support 802.1X supplicant software. They can't authenticate. You'd lock yourself out of your own network. And you'd need to run a RADIUS server, which is not a thing normal people do on a Saturday. Corn: 1X is the feature that sounds like a fortress and turns out to be a locked door you can't open from the inside. Herman: That's the perfect description. Now, DHCP snooping and Dynamic ARP Inspection — these are more practically interesting. DHCP snooping prevents someone from plugging in a rogue DHCP server and handing out malicious IP configurations. The switch watches DHCP traffic and only allows responses from ports you've designated as trusted. Dynamic ARP Inspection prevents ARP spoofing — the classic man-in-the-middle attack where someone claims to be the gateway's IP address. The switch validates ARP packets against the DHCP snooping database and drops the ones that don't match. Corn: These are relevant because? Herman: Because a compromised IoT device can absolutely do ARP spoofing. A cheap IP camera that gets owned by malware can start telling every device on the network that it's the router. Suddenly all your traffic flows through the camera before heading out to the internet. On an unmanaged switch, there's no defense against this. The switch just forwards the spoofed ARP replies like any other frame. With DAI enabled, the switch inspects the ARP payload and says — no, you are not the gateway, I'm dropping this. Corn: This is the VLAN story again, but at a different layer. The unmanaged switch trusts everything. The managed switch verifies. Herman: That's really the philosophical difference between the two categories. An unmanaged switch is fundamentally trusting. It assumes every frame is legitimate, every device is friendly, every cable is correctly placed. A managed switch gives you the tools to enforce boundaries and verify behavior. Whether you need those tools is a question of what's on your network and how much you trust it. Corn: Let's talk about PoE management, because Daniel specifically mentioned PoE as one of his buying criteria, and I think there's a misconception here worth clearing up. Herman: There absolutely is. PoE — Power over Ethernet — is not a managed feature. It's a power delivery standard. 3af gives you 15.4 watts per port. 3at, PoE plus, gives you thirty watts. 3bt, PoE double-plus, goes up to sixty or even a hundred watts. Plenty of unmanaged switches deliver PoE just fine. They inject power onto the cable pairs and the connected device draws what it needs. Corn: What does managed actually add to PoE? Herman: An unmanaged PoE switch is always-on power to every port. Plug in a device, it gets power, end of story. A managed PoE switch lets you set per-port power budgets and schedule power cycles. This is useful. If you've got an IP camera mounted on the outside of your house and it locks up — which they do, regularly — a managed PoE switch lets you log in from your couch and cycle the power on that specific port. The camera reboots. You never leave the sofa. Corn: Whereas with an unmanaged PoE switch, you're outside on a ladder. Herman: In the rain, probably, because cameras only fail when the weather is terrible. The managed switch also monitors per-port power draw in real time. You can see that port three is drawing eleven watts, which is normal for that camera model, and if it suddenly drops to zero or spikes to twenty-five, you know something's wrong. It's proactive again — the switch can alert you when a PoE device stops drawing power, which usually means it's dead. Corn: PoE management is actually one of the more practical managed features for a home user with a few cameras or access points. Herman: It really is. If you've got more than two PoE devices, the ability to remotely power-cycle them alone is worth the price difference between a managed and unmanaged PoE switch. It's not about security or performance — it's about never having to climb a ladder to reboot a camera. Corn: Which brings us to the question Daniel actually asked, underneath all the technical detail. Does any of this make sense in a home or small business, or is this all enterprise stuff that the industry pushes because the basic switching hardware got commoditized twenty years ago? Herman: Let's do the honest inventory. VLANs — useful in any home with IoT devices or a guest network. If you have more than ten connected things, VLANs are the single highest-impact security upgrade you can make to your network. QoS — useful if you do voice or video calls while other people are streaming or downloading. The forty dollar smart switches support it. LACP — overkill for almost every home. The storage is the bottleneck, not the link. STP — only matters if you create loops, but if you have four switches like Daniel, the odds are not zero. SNMP monitoring — fun for tinkerers, irrelevant for everyone else. 1X — enterprise-only, most home devices can't use it. DHCP snooping and DAI — good security features, but they require some configuration knowledge. PoE management — surprisingly practical if you have PoE cameras or access points. Corn: The Venn diagram of "features that exist" and "features that matter" has a surprisingly small overlap. And I think that's actually liberating. You don't need to understand all of it. You need to understand about three things. Herman: Let's cut through the marketing and give you a practical framework. Here's the decision tree. If your network is a single flat segment — fewer than fifteen devices, no IoT cameras or smart plugs you don't trust, no VoIP phones, nobody working from home on video calls while someone else streams 4K — buy the twenty dollar unmanaged switch. It will forward frames at wire speed and you will never think about it again. That's a win. Corn: If you cross that line? Herman: If you've got IoT devices, if you've got multiple people doing performance-sensitive things simultaneously, if you've got PoE cameras or access points — get a smart managed switch. Not a fully managed enterprise switch. A smart switch. The sweet spot is forty to eighty dollars for eight ports, maybe a hundred fifty for twenty-four ports. TP-Link's Omada line, Ubiquiti UniFi if you want the unified ecosystem. The TP-Link TL-SG108E at forty dollars is the canonical entry point. It does VLANs, it does QoS, it does port mirroring. That's everything you actually need. Corn: If a switch doesn't do 802.1Q VLANs, it's not an upgrade from unmanaged. That's the line. Herman: That's the line. VLAN support is the single highest-impact feature. Everything else — QoS, STP, PoE management — is gravy. Useful gravy, but gravy. If the switch can't segment your network into isolated broadcast domains, you haven't actually bought a managed switch. You've bought an unmanaged switch with a pretty status page. Corn: The misconception we flagged earlier — that managed means "has a web UI." Some unmanaged switches have a web UI that shows you port status and nothing else. You can look but you can't touch. That's not managed. That's a window. Herman: Then there's the overbuying trap. SFP plus ports for ten gigabit. Full Layer Three routing. These are important in a campus network with five thousand users. In a home? A sixty dollar smart switch with VLANs will outperform a three hundred dollar fully managed switch for ninety-five percent of home use cases, because the three hundred dollar switch's advantages are in features you will never configure and bandwidth you will never saturate. Corn: The buying checklist is: Gigabit Ethernet, PoE plus if you need it for cameras or access points, and 802.1Q VLAN support. Everything else is negotiable. Herman: Don't pay extra for features you can't name. If you don't know what SNMP is, you don't need SNMP. If you've never heard of LACP, your NAS doesn't need it. The industry will happily sell you a switch that could run a mid-size hospital's network. Your job is to buy the switch that runs your house. Corn: Where does this leave us? Daniel's original confusion — "I assume managed means a web UI" — turns out to be the industry's fault, not his. They've spent years marketing features instead of explaining outcomes. And the outcome that actually matters is surprisingly narrow: can your switch keep the untrusted things away from the trusted things, and can it keep the important traffic moving when the network gets busy? Herman: Here's what I keep coming back to. The line between "home network" and "small business network" is dissolving. Ten years ago, a home had a laptop, a phone, maybe a game console. Thirty-plus devices. Multiple people on video calls simultaneously. Smart appliances that are definitely phoning home to somewhere. The complexity curve is bending upward, and unmanaged switches were designed for a world where "home networking" meant sharing a printer. Corn: The question isn't really "do I need a managed switch today." It's "will I need one in three years, and should I just buy it now. Herman: I think the trajectory is clear. Wi-Fi 7 is pushing multi-gig to the access point level. 5 gigabit Ethernet is becoming the new baseline for anything that isn't a budget switch. And here's the interesting part: as the silicon gets cheaper, the managed features are riding along for free. That forty dollar smart switch with VLANs? Five years ago it was eighty. In five more years, it might be twenty-five, and at that price point there's no reason not to include the control plane. VLANs and basic QoS could become standard features, not premium add-ons. Corn: The feature gap is narrowing from both directions. Unmanaged switches are creeping up in capability, managed switches are creeping down in price. Eventually they meet in the middle and the distinction stops mattering. Herman: That's the future I'd bet on. The dumb switch doesn't go extinct — there's always a use case for "I need five more ports and I need them now for twelve dollars" — but for anyone running a smart home with more than a handful of devices, the smart managed switch becomes the default. Not because everyone becomes a network engineer, but because the software gets good enough that you don't have to be one. Corn: Which means Daniel's question ages well. He's not confused because he's missing something obvious. He's confused because he's standing at the inflection point where the technology is crossing over from enterprise to consumer, and the marketing hasn't caught up yet. Herman: Now: Hilbert's daily fun fact. Hilbert: In the 1720s, missionaries documenting Aboriginal languages in Australia's Western Desert region recorded kinship systems with over thirty distinct terms for relatives — where English has about twelve. A single term might encode gender, generation, moiety membership, and whether the relative is on the mother's or father's side, making the semantic density roughly two point five times that of modern English kinship vocabulary. Corn:...right. Corn: That's going to sit with me. Herman: This has been My Weird Prompts. Thanks to our producer Hilbert Flumingtop, and to Daniel for sending in the question that probably half our listeners were too embarrassed to ask. Corn: If you enjoyed this, do us a favor and leave a review wherever you listen. It helps more than you'd think. We'll be back with another one soon.