Network hardware is the equipment that moves data between devices and out to the internet. In most installations only a handful of device roles are involved, and confusion usually comes from a single box performing several of them at once.
01The device roles
Modem or terminal. Converts between the access provider's medium and standard Ethernet. On cable this is a modem, on fibre an optical network terminal. It has no opinion about the local network; it only translates.
Router. Joins two networks and decides where each packet goes next. In a typical installation it is also the boundary between private internal addresses and the single public address the provider issued, performing address translation so many devices share one address.
Switch. Connects devices within one network and forwards frames only to the port where the destination actually lives, rather than to every port. Switches are the reason a wired network scales without every device hearing all traffic.
Access point. Bridges wireless clients onto the wired network. It is a radio, not a router, though consumer equipment usually combines the two.
Firewall. Enforces policy about which traffic may cross a boundary. Simple stateful filtering is built into most routers; dedicated appliances add inspection, segmentation and logging.
Alongside these sit the services that make a network usable: address assignment (DHCP), name resolution (DNS), and time synchronisation. These are functions rather than boxes, and they often run on the router by default even when they would be better placed elsewhere.
02Concepts that determine how a network behaves
Segmentation. VLANs divide one physical switch into separate logical networks. Keeping guest devices, unmanaged smart devices and trusted workstations on separate segments limits what a compromise on any one of them can reach.
Power over Ethernet. Delivers power and data over the same cable, which is how access points and cameras are placed where no outlet exists. Both the switch's per-port and total power budget matter when planning.
Managed versus unmanaged. An unmanaged switch simply forwards. A managed switch adds configuration, segmentation, port statistics and remote diagnosis — the difference is most obvious when something breaks and there is no way to see which port is at fault.
Uplink capacity. An access layer is limited by the link back to the core. Multiple high-speed devices behind a single slower uplink will contend for it regardless of how fast each device's own port is.
03Building something that stays working
Wired backhaul beats wireless backhaul wherever cable can be run: a mesh node that relays over the air spends airtime doing so, and that airtime is subtracted from the clients it serves.
Structured cabling, labelled at both ends, with a documented map of what is plugged where, is the difference between a ten-minute fault and an afternoon of tracing. Firmware on network equipment should be treated as security-relevant software and kept current, since network devices are internet-facing by definition. Default administrative credentials and any remote management interface exposed to the public internet are the two most common ways a network is compromised without anyone touching a workstation.