Layer 3 is the network layer of the OSI model, the layer responsible for logical addressing and routing of packets between different networks, most commonly with IPv4 and IPv6. In Ethernet switching and networking practice, the term also describes devices and features that make forwarding decisions based on IP addresses rather than MAC addresses, such as layer 3 switches and routed interfaces.
Where layer 2 delivers frames inside one broadcast domain, layer 3 connects separate subnets and VLANs. This boundary determines how far broadcasts travel, how traffic is segmented and where access policies can be enforced.
What happens at layer 3
At layer 3, a device reads the destination IP address in the packet header and looks it up in its routing table to find the next hop. It then decrements the TTL or hop limit, recalculates the IPv4 header checksum, and hands the packet to layer 2 for delivery on the outgoing link with a new frame and new MAC addresses.
The routing decision uses the longest prefix match: the most specific route that covers the destination wins. Routes come from directly connected subnets, static routes and dynamic routing protocols such as OSPF or BGP.
High-performance devices separate the control plane, which builds the routing table from protocols and configuration, from the data plane, which forwards packets using a compiled forwarding information base (FIB). This split is why a layer 3 switch can route millions of packets per second in hardware while its CPU handles only routing updates and management traffic.
The table summarizes the main fields a layer 3 device uses when forwarding an IPv4 packet.
| Field | Purpose | Change at each hop |
|---|---|---|
| Destination address | Route lookup key | Unchanged, except with NAT |
| Source address | Return path and filtering | Unchanged, except with NAT |
| TTL | Loop prevention, 0 to 255 | Decremented by one |
| Header checksum | Header integrity in IPv4 | Recalculated |
| DSCP | Quality of service marking | Kept or remarked by policy |
Layer 3 compared with layer 2
The difference between layer 2 and layer 3 is the difference between switching inside a network and routing between networks. Ethernet switches learn MAC addresses and flood unknown frames, while layer 3 devices forward only to destinations they have a route for.
| Property | Layer 2 | Layer 3 |
|---|---|---|
| Address used | MAC address, 48 bits | IP address, 32 or 128 bits |
| Forwarding table | MAC address table | Routing table and FIB |
| Scope | One broadcast domain or VLAN | Between subnets and VLANs |
| Unknown destination | Frame is flooded | Packet is dropped or sent to default route |
| Loop protection | Spanning Tree Protocol | TTL and routing protocol design |
| Broadcast handling | Forwarded to all ports in VLAN | Not forwarded between subnets |
Because broadcasts stop at a layer 3 boundary, routing between smaller subnets limits broadcast storms and failure domains. This is the main reason large campus and data center networks push layer 3 closer to the access edge.
Layer 3 switches and routed interfaces
A layer 3 switch is a managed switch that performs IP routing in hardware ASICs at wire speed, in addition to normal layer 2 switching. It typically routes between VLANs using switched virtual interfaces (SVIs), one per VLAN, which act as the default gateway for the hosts in that VLAN.
Switch ports can also be configured as routed ports, which behave like router interfaces with their own IP address and no VLAN membership. Routed uplinks between switches avoid spanning tree blocking and allow equal-cost multipath forwarding across several links.
| Device | Strength | Typical placement |
|---|---|---|
| Layer 3 switch | High port density, hardware inter-VLAN routing | Campus core and distribution |
| Router | WAN interfaces, rich routing and NAT features | Internet edge and branch sites |
| Firewall | Stateful inspection with routing | Security boundaries between zones |
| Router on a stick | One trunk link serving many VLANs | Small networks and labs |
The boundary between these devices has blurred. Many layer 3 switches run OSPF and BGP, while routers include switch modules, so the choice depends on throughput, interface types, table sizes and security functions rather than on the label.
Designing where layer 3 begins
Network design decides where the layer 2 domain ends and routing starts. In a traditional three-tier campus, VLANs span the access layer and routing starts at distribution; in routed access designs, every access switch routes and each VLAN stays local.
| Situation | Recommended boundary | Reason |
|---|---|---|
| Small office, one switch stack | Layer 3 on the core switch | Simple inter-VLAN routing |
| Large campus | Routed access or distribution | Smaller failure domains |
| Data center fabric | Layer 3 at every leaf | Equal-cost paths, no spanning tree |
| VLAN must span sites | Overlay such as VXLAN | Layer 2 service over layer 3 transport |
Common mistakes and pitfalls
Most layer 3 problems in switched networks come from addressing and gateway configuration rather than hardware faults.
- Wrong default gateway on hosts makes local traffic work while all remote traffic fails.
- Overlapping subnets create ambiguous routes and unpredictable reachability.
- Forgetting to enable IP routing on a layer 3 switch leaves SVIs reachable but not routing.
- Asymmetric routing through stateful firewalls causes dropped return traffic.
- MTU mismatches on routed links break large packets while small pings still succeed.
A reliable habit is to verify each layer 3 change with three checks: the host’s address and gateway, the routing table on the device, and a traceroute that confirms the actual path. Together they reveal most misconfigurations before users notice them.
The short version
Think of layer 2 as delivering mail inside one building using apartment numbers, and layer 3 as delivering mail between cities using postal addresses.
A layer 3 device is the sorting center that reads the full address and decides which road a packet takes next. It keeps separate networks apart while still letting them talk, which makes large networks safer and easier to manage.
Where it makes a difference
A manufacturing company has one flat network of about 900 devices, including office PCs, production machines and IP cameras. A faulty camera starts flooding broadcasts, and the entire plant network slows down because every device receives the traffic.
The network team replaces the core with a pair of layer 3 switches, creates separate VLANs for offices, production, cameras and guests, and configures an SVI with a gateway address for each one. Access control lists on the SVIs allow production machines to reach only their management servers.
When a similar fault occurs months later, the broadcast storm stays inside the camera VLAN, production lines keep running and the team isolates the device within minutes.