Network devices implement processes that can be broken down into three functional planes: the data plane, control plane, and management plane. Under normal network operating conditions, the network traffic consists mostly of data plane transit packets. Network devices are optimized to handle these packets efficiently. Typically, there are considerably fewer control and management plane packets.
網路裝置實作的處理程序可分為三個功能平面：資料平面、控制平面與管理平面。在正常網路運作條件下，網路流量大多是資料平面的過境封包。網路裝置經過最佳化，可有效處理這些封包。控制平面與管理平面的封包數量通常少得多。
The data plane: The primary purpose of routers and switches is to forward packets and frames through the device onward to final destinations. The data plane, also called the forwarding plane, is responsible for the high-speed forwarding of data through a network device. Its logic is kept simple so that it can be implemented by hardware to achieve fast packet forwarding. The forwarding engine processes the arrived packet and then forwards it out of the device. Data plane forwarding is very fast. It is performed in hardware. To achieve the efficient forwarding, routers and switches create and utilize data structures, usually called tables, which facilitate the forwarding process. The control plane dictates the creation of these data structures. Examples of data plane structures are Content Addressable Memory (CAM) table, Ternary CAM (TCAM) table, Forwarding Information Base (FIB) table, and Adjacency table.
資料平面：路由器與交換器的主要用途是將封包與框架轉送通過裝置，送往最終目的地。資料平面（又稱轉送平面）負責在網路裝置中高速轉送資料。其邏輯設計得很簡單，因此可以用硬體實作，達到快速轉送封包的效果。轉送引擎處理抵達的封包，然後將其轉送出裝置。資料平面的轉送速度非常快，是以硬體執行的。為達成高效轉送，路由器與交換器會建立並使用資料結構（通常稱為表）來輔助轉送流程。控制平面主導這些資料結構的建立。資料平面結構的例子有內容定址記憶體（CAM）表、三態 CAM（TCAM）表、轉送資訊庫（FIB）表，以及鄰接表。
Cisco routers and switches also offer many features to secure the data plane. Almost every network device has the ability to utilize ACLs, which are processed in hardware, to limit allowed traffic to only well-known and desirable traffic.
Cisco 路由器與交換器也提供許多功能來保護資料平面。幾乎每一台網路裝置都能利用以硬體處理的 ACL，將允許的流量限制為僅限已知且需要的流量。
The control planeconsists of protocols and processes that communicate between network devices to determine how data is to be forwarded. When packets that require control plane processing arrive at the device, the data plane forwards them to the device’s processor, where the control plane processes them.
控制平面由網路裝置之間用來溝通、決定資料如何轉送的協定與處理程序組成。當需要控制平面處理的封包抵達裝置時，資料平面會將其轉送給裝置的處理器，由控制平面進行處理。
In cases of Layer 3 devices, the control plane sets up the forwarding information based on the information from routing protocols. The control plane is responsible for building the routing table or Routing Information Base (RIB). The RIB in turn determines the content of the forwarding tables, such as the FIB and the adjacency table, used by the data plane. In Layer 2 devices, the control plane processes information from Layer 2 control protocols, such as STP and Cisco Discovery Protocol, and processes Layer 2 keepalives. It also processes information from incoming frames (such as the source MAC address to fill in the MAC address table).
就第 3 層裝置而言，控制平面根據路由協定提供的資訊來建立轉送資訊。控制平面負責建立路由表，也就是路由資訊庫（RIB）。RIB 進而決定資料平面所使用之轉送表（如 FIB 與鄰接表）的內容。在第 2 層裝置中，控制平面處理來自第 2 層控制協定（如 STP 與 Cisco Discovery Protocol）的資訊，並處理第 2 層存活訊號（keepalive）。它也會處理進入框架中的資訊（例如填入 MAC 位址表所需的來源 MAC 位址）。
When high packet rates overload the control or management plane (or both), device processor resources can be overwhelmed, reducing the availability of these resources for tasks that are critical to the operation and maintenance of the network. Cisco networking devices support features that facilitate control of traffic that is sent to the device processor to prevent the processor itself from being overwhelmed and affecting system performance.
當高封包速率使控制平面或管理平面（或兩者）過載時，裝置處理器資源可能不堪負荷，降低這些資源用於維護網路運作與維運等關鍵任務的可用性。Cisco 網路裝置支援可協助控管送往裝置處理器之流量的功能，以避免處理器本身過載而影響系統效能。
The control plane processes the traffic that is directly or indirectly destined to the device itself. Control plane packets are handled directly by the device processor, which is why control plane traffic is called process switched traffic.
控制平面處理直接或間接以裝置本身為目的地的流量。控制平面封包由裝置處理器直接處理，因此控制平面流量又稱為處理程序交換（process switched）流量。
There are generally two types of process switched traffic. The first type of traffic is directed, or addressed, to the device itself and must be handled directly by the device processor. An example would be a routing protocol data exchange. The second type of traffic that is handled by the CPU is data plane traffic with a destination beyond the device itself, but which requires special processing by the device processor. One example of such traffic is IPv4 packets that have a Time to Live (TTL) value, or IPv6 packets that have a Hop Limit value that is less than or equal to one. They require Internet Control Message Protocol (ICMP) Time Exceeded messages to be sent, which results in CPU processing.
處理程序交換流量一般分為兩種類型。第一種流量的目的地是裝置本身，必須由裝置處理器直接處理，例如路由協定的資料交換。CPU 處理的第二種流量，則是目的地超出裝置本身，但需要裝置處理器特別處理的資料平面流量。此類流量的一個例子是存活時間（TTL）值小於或等於 1 的 IPv4 封包，或躍點限制（Hop Limit）值小於或等於 1 的 IPv6 封包。這類封包需要傳送網際網路控制訊息協定（ICMP）逾時（Time Exceeded）訊息，因而需要 CPU 處理。
The management planeconsists of functions that achieve the management goals of the network, which include interactive configuration sessions, and statistics gathering and monitoring. The management plane performs management functions for a network and coordinates functions among all the planes (data, control, and management). In addition, the management plane is used to manage a device through its connection to the network.
管理平面由達成網路管理目標的功能組成，包括互動式設定作業階段，以及統計資料的蒐集與監控。管理平面為網路執行管理功能，並協調所有平面（資料、控制與管理）之間的功能。此外，管理平面也用來透過裝置與網路的連線來管理該裝置。
The management plane is associated with traffic related to the management of the network or the device. From the device point of view, management traffic can be destined to the device itself or intended for other devices. The management plane encompasses applications and protocols such as Secure Shell (SSH), Simple Network Management Protocol (SNMP), HTTP, HTTPS, Network Time Protocol (NTP), TFTP, FTP, and others that are used to manage the device and the network.
管理平面與網路或裝置管理相關的流量有關。就裝置的角度而言，管理流量的目的地可以是裝置本身，也可以是其他裝置。管理平面涵蓋用來管理裝置與網路的應用程式與協定，例如安全殼層（SSH）、簡易網路管理協定（SNMP）、HTTP、HTTPS、網路時間協定（NTP）、TFTP、FTP 等。
From the perspective of a network device, there are three general types of packets as related to the functional planes:
就網路裝置的角度而言，依功能平面可將封包分為三種一般類型：
- Transit packets and framesinclude packets and frames that are subjected to standard, destination IP, and MAC-based forwarding functions. In most networks and under normal operating conditions, transit packets are typically forwarded with minimal CPU involvement or within specialized high-speed forwarding hardware.過境封包與框架包括依標準、目的地 IP 及 MAC 進行轉送的封包與框架。在多數網路及正常運作條件下，過境封包通常僅需極少的 CPU 參與，或完全在專用高速轉送硬體中即可完成轉送。
- Receive or for-us packetsinclude control plane and management plane packets that are destined for the network device itself. Receive packets must be handled by the CPU within the device processor, because they are ultimately destined for and handled by applications running at the process level within the device operating system.接收（for-us）封包包括以網路裝置本身為目的地的控制平面與管理平面封包。接收封包必須由裝置處理器內的 CPU 處理，因為它們最終是要交由裝置作業系統中處理程序層級的應用程式來處理的。
- Exception IP and non-IP information include IP packets that differ from standard IP packets, such as IPv4 packets containing the Options field in the IPv4 header, IPv4 packets with a TTL that expires, and IPv4 packets with unreachable destinations. Examples of non-IP packets are Layer 2 keepalives, ARP frames, and Cisco Discovery Protocol frames. All packets and frames in this set must be handled by the device processor.例外 IP 與非 IP資訊包括與標準 IP 封包不同的 IP 封包，例如 IPv4 標頭中含有 Options 欄位的 IPv4 封包、TTL 過期的 IPv4 封包，以及目的地無法到達的 IPv4 封包。非 IP 封包的例子有第 2 層存活訊號、ARP 框架與 Cisco Discovery Protocol 框架。此類別中的所有封包與框架都必須由裝置處理器處理。
In traditional networking, the control and data planes exist within one device. With the introduction of software-defined networking (SDN), the management and control planes are abstracted into a control layer, typically a centralized solution, a specialized network controller, which implements a virtualized software orchestration to provide network management and control functions. Infrastructure layer devices, such as switches and routers, focus on forwarding data. The application layer consists of SDN applications, which communicate network requirements towards the controller.
在傳統網路中，控制平面與資料平面存在於同一台裝置內。隨著軟體定義網路（SDN）的出現，管理平面與控制平面被抽象化為一個控制層，通常是一套集中式解決方案，也就是專用的網路控制器，實作虛擬化軟體協調機制，以提供網路管理與控制功能。基礎架構層的裝置，例如交換器與路由器，則專注於轉送資料。應用層由 SDN 應用程式組成，這些應用程式會將網路需求傳達給控制器。