a virtual switch
A physical network switch is a box with ports that learns which device sits behind each port and forwards frames accordingly, like a receptionist who learns where everyone sits and routes mail to the right desk. Now suppose one physical server is running twenty virtual machines, each pretending to be its own computer. They all share one real network card, yet each needs its own apparent network port. A virtual switch is the answer: a switch made of software, running inside the server, that connects all those virtual machines to each other and out to the physical network.
Concretely, a virtual switch runs in the hypervisor (or host operating system) of a server. Each virtual machine has a virtual network interface that plugs into a virtual port on this software switch; the switch's uplink is the server's real network card. It does the normal switch job — MAC learning, forwarding frames between local virtual machines without ever touching the wire, applying VLAN tags, enforcing access rules — but entirely in code. Crucially, it is also where the overlay is implemented: the virtual switch acts as the VXLAN tunnel endpoint, wrapping a departing virtual machine's frame in an outer header and unwrapping arriving ones, so the overlay's encapsulation work happens here, at the very edge, in the server itself rather than in the physical fabric.
Why it matters: the virtual switch is the real boundary of the cloud network — the point where tenant isolation, overlay encapsulation, security policy, and per-VM traffic shaping are enforced. Pushing this intelligence into software at the edge is what lets operators reconfigure networks instantly without touching any hardware, and it pairs naturally with SDN. The honest trade-off is cost: doing all this packet processing on the server's general-purpose CPU steals cycles from the customer's workloads and adds latency. That overhead is precisely why operators increasingly offload the virtual switch's work onto SmartNICs, moving the heavy lifting back into dedicated hardware at the edge.
Two virtual machines on the same physical server send packets to each other. Their frames never reach the real network card or any physical switch — the virtual switch in the hypervisor forwards them directly in memory, in microseconds, which is far faster than going out to a top-of-rack switch and back.
Same-host VM traffic is switched in software, never touching a wire.
A virtual switch is a real switch — it learns MAC addresses and forwards frames — but it runs on the server's CPU, so its packet processing competes with customer workloads for cycles. That cost is the main motivation for offloading it to a SmartNIC.