Switchers map mac addresses of all devices in network which then maps to the switch port, locate the physical location of MACs .It also consists of ARP table (Address Resolution Protocol). Switch also consists of unmanageable, manageable supports VLANs, Port mirroring and etc. Evidence that has been recorded by the switch can be volatile, non-volatile.

Type of routers:
1. Enterprise (Capabilities are Stateful packet filtering, Supports many routing protocols, Multiprotocol Label Switching)
2. Consumer
3. Custom Linux Boxes

Routers consists of configuration interfaces like Central Management. Evidence that can be recorded by routers are Configurable via Syslog, FTP, TFTP, SNMP, etc.

Firewalls consist of Packet Filters, Session-Layer Proxies and Application Proxies. Evidence that has been recorded by a firewall are volatile which is similar to routers, persistent and remote.